@desplega.ai/agent-swarm 1.117.0 → 1.118.0

package/dist/{cli-s5q026mr.js → cli-f5qm42kd.js}

@@ -26,7 +26,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-xcp5dmts.js";
+} from "./cli-nh866k5t.js";
 import {
   init_secret_scrubber,
   scrubSecrets
@@ -46,6 +46,81 @@ function parseProviderMeta(rawProvider, rawMeta) {
 }
 var init_provider_metadata = () => {};
 
+// src/assets/key.ts
+function normalizeAssetKey(input) {
+  if (typeof input !== "string")
+    throw new AssetKeyError("Asset key must be a string");
+  if (input.includes("\x00"))
+    throw new AssetKeyError("Asset key cannot contain NUL bytes");
+  if (input.includes("\\"))
+    throw new AssetKeyError("Asset key must use forward slashes");
+  const normalized = input.trim().normalize("NFKC").toLowerCase();
+  if (!normalized)
+    throw new AssetKeyError("Asset key cannot be empty");
+  if (normalized.startsWith("/"))
+    throw new AssetKeyError("Asset key must be relative");
+  const withTrailingSlash = normalized.endsWith("/") ? normalized : `${normalized}/`;
+  if (withTrailingSlash.length > ASSET_KEY_MAX_LENGTH) {
+    throw new AssetKeyError(`Asset key cannot exceed ${ASSET_KEY_MAX_LENGTH} characters`);
+  }
+  const segments = withTrailingSlash.slice(0, -1).split("/");
+  if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+    throw new AssetKeyError("Asset key contains an empty or traversal segment");
+  }
+  const root = segments[0];
+  if (root !== "shared" && root !== "personal") {
+    throw new AssetKeyError("Asset key root must be shared or personal");
+  }
+  if (root === "personal" && !segments[1]) {
+    throw new AssetKeyError("Personal asset keys require a canonical user ID");
+  }
+  return withTrailingSlash;
+}
+function defaultAssetKey(resource, id) {
+  if (!id.trim())
+    throw new AssetKeyError("Asset key resource ID cannot be empty");
+  return normalizeAssetKey(`shared/${resource}:${id}/`);
+}
+function parseAssetKey(input) {
+  const key = normalizeAssetKey(input);
+  const segments = key.slice(0, -1).split("/");
+  if (segments[0] === "personal") {
+    return {
+      root: "personal",
+      key,
+      segments,
+      userId: segments[1],
+      relativeSegments: segments.slice(2)
+    };
+  }
+  return {
+    root: "shared",
+    key,
+    segments,
+    relativeSegments: segments.slice(1)
+  };
+}
+function isCanonicalAssetKey(input) {
+  try {
+    return normalizeAssetKey(input) === input;
+  } catch {
+    return false;
+  }
+}
+function canWriteAssetKey(input, trustedUserId) {
+  const parsed = parseAssetKey(input);
+  return parsed.root === "shared" || !!trustedUserId && parsed.userId === trustedUserId;
+}
+var ASSET_KEY_MAX_LENGTH = 255, AssetKeyError;
+var init_key = __esm(() => {
+  AssetKeyError = class AssetKeyError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "AssetKeyError";
+    }
+  };
+});
+
 // src/utils/template.ts
 function interpolate(template, ctx) {
   const unresolved = [];
@@ -728,9 +803,49 @@ function resolveTaskModelSelection(opts) {
 function isTerminalTaskStatus(status) {
   return TERMINAL_TASK_STATUSES.includes(status);
 }
-var ModelTierSchema, MODEL_TIERS, ReasoningEffortSchema, LEGACY_MODEL_TO_TIER, DEFAULT_MODEL_TIER_MAP, AgentTaskStatusSchema, TERMINAL_TASK_STATUSES, InboxMessageStatusSchema, InboxMessageSchema, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, RoutingAffinitySchema, AgentTaskSchema, TaskAttachmentKindSchema, attachmentCommonFields, AttachmentInputSchema, TaskAttachmentSchema, UserSchema, IdentityEventTypeSchema, InboxItemTypeSchema, InboxItemStatusSchema, InboxItemStateSchema, FavoriteItemTypeSchema, UserFavoriteSchema, TaskTemplateKindSchema, TaskTemplateSchema, AgentStatusSchema, AgentSchema, AgentCredStatusLiveTestSchema, AgentLatestModelSchema, AgentBedrockStatusSchema, AgentCredStatusSchema, AgentWithTasksSchema, ChangeSourceSchema, VersionableFieldSchema, ContextVersionSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, AgentLogEventTypeSchema, ResumeReasonSchema, AgentLogSchema, SessionLogSchema, SessionCostSourceSchema, SessionCostSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, SwarmEventSchema, ScheduledTaskTargetTypeSchema, ScheduledTaskSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, ActiveSessionSchema, RetryPolicySchema, ExecutorMetaSchema, ValidationResultSchema, StepValidationConfigSchema, SwarmScriptNodeConfigSchema, WorkflowNodeSchema, WorkflowEdgeSchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, WebhookVerificationSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, WorkflowTemplateSchema, WorkflowSnapshotSchema, WorkflowSchema, WorkflowVersionSchema, PageContentTypeSchema, PageAuthModeSchema, PageSnapshotSchema, PageSchema, PageVersionSchema, MetricParamSchema, MetricVariableTypeSchema, MetricFormatSchema, MetricVisualizationSchema, MetricQuerySchema, MetricVariableSchema, MetricVizConfigSchema, MetricWidgetSchema, MetricDefinitionSchema, MetricSnapshotSchema, MetricSchema, MetricVersionSchema, WorkflowRunStatusSchema, WorkflowRunSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, ScriptRunKindSchema, ScriptRunSchema, ScriptRunListItemSchema, ScriptRunJournalEntrySchema, WorkflowRunStepStatusSchema, WorkflowRunStepSchema, WaitModeSchema, WaitStateStatusSchema, WaitStateRowSchema, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptRecordSchema, ScriptVersionRecordSchema, ScriptApiAuthModeSchema, ScriptApiRecordSchema, SkillTypeSchema, SkillScopeSchema, SkillSchema, AgentSkillSchema, SkillWithInstallInfoSchema, SkillFileSchema, McpServerTransportSchema, McpServerScopeSchema, McpAuthMethodSchema, McpServerSchema, AgentMcpServerSchema, McpServerWithInstallInfoSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, ContextSnapshotSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, BudgetRefusedTriggerSchema, KvValueTypeSchema, KV_NAME_REGEX, KvNamespaceSchema, KvKeySchema, KvEntrySchema;
+var AssetKeySchema, AssetEntityTypeSchema, AssetProviderRefSchema, AssetKeyMappingSchema, AssetSummarySchema, ModelTierSchema, MODEL_TIERS, ReasoningEffortSchema, LEGACY_MODEL_TO_TIER, DEFAULT_MODEL_TIER_MAP, AgentTaskStatusSchema, TERMINAL_TASK_STATUSES, InboxMessageStatusSchema, InboxMessageSchema, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, RoutingAffinitySchema, AgentTaskSchema, TaskAttachmentKindSchema, attachmentCommonFields, AttachmentInputSchema, TaskAttachmentSchema, UserSchema, IdentityEventTypeSchema, InboxItemTypeSchema, InboxItemStatusSchema, InboxItemStateSchema, FavoriteItemTypeSchema, UserFavoriteSchema, TaskTemplateKindSchema, TaskTemplateSchema, AgentStatusSchema, AgentSchema, AgentCredStatusLiveTestSchema, AgentLatestModelSchema, AgentBedrockStatusSchema, AgentCredStatusSchema, AgentWithTasksSchema, ChangeSourceSchema, VersionableFieldSchema, ContextVersionSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, AgentLogEventTypeSchema, ResumeReasonSchema, AgentLogSchema, SessionLogSchema, SessionCostSourceSchema, SessionCostSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, SwarmEventSchema, ScheduledTaskTargetTypeSchema, ScheduledTaskSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, ActiveSessionSchema, RetryPolicySchema, ExecutorMetaSchema, ValidationResultSchema, StepValidationConfigSchema, SwarmScriptNodeConfigSchema, WorkflowNodeSchema, WorkflowEdgeSchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, WebhookVerificationSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, WorkflowTemplateSchema, WorkflowSnapshotSchema, WorkflowSchema, WorkflowVersionSchema, PageContentTypeSchema, PageAuthModeSchema, PageSnapshotSchema, PageSchema, PageVersionSchema, MetricParamSchema, MetricVariableTypeSchema, MetricFormatSchema, MetricVisualizationSchema, MetricQuerySchema, MetricVariableSchema, MetricVizConfigSchema, MetricWidgetSchema, MetricDefinitionSchema, MetricSnapshotSchema, MetricSchema, MetricVersionSchema, WorkflowRunStatusSchema, WorkflowRunSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, ScriptRunKindSchema, ScriptRunSchema, ScriptRunListItemSchema, ScriptRunJournalEntrySchema, WorkflowRunStepStatusSchema, WorkflowRunStepSchema, WaitModeSchema, WaitStateStatusSchema, WaitStateRowSchema, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptRecordSchema, ScriptVersionRecordSchema, ScriptApiAuthModeSchema, ScriptApiRecordSchema, SkillTypeSchema, SkillScopeSchema, SkillSchema, AgentSkillSchema, SkillWithInstallInfoSchema, SkillFileSchema, McpServerTransportSchema, McpServerScopeSchema, McpAuthMethodSchema, McpServerSchema, AgentMcpServerSchema, McpServerWithInstallInfoSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, ContextSnapshotSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, BudgetRefusedTriggerSchema, KvValueTypeSchema, KV_NAME_REGEX, KvNamespaceSchema, KvKeySchema, KvEntrySchema;
 var init_types = __esm(() => {
   init_zod();
+  init_key();
+  AssetKeySchema = string().min(1).max(255).superRefine((value, ctx) => {
+    try {
+      normalizeAssetKey(value);
+    } catch (error) {
+      ctx.addIssue({
+        code: "custom",
+        message: error instanceof Error ? error.message : "Invalid asset namespace key"
+      });
+    }
+  }).describe("Non-unique asset directory namespace (for example shared/ or personal/<user-id>/drafts/). Runtime write boundaries normalize and validate the canonical form.");
+  AssetEntityTypeSchema = _enum(["task", "workflow", "schedule", "page", "file"]);
+  AssetProviderRefSchema = object({
+    providerId: string(),
+    orgId: string().optional(),
+    driveId: string().optional(),
+    providerKey: string()
+  });
+  AssetKeyMappingSchema = object({
+    id: string(),
+    providerId: string(),
+    providerOrgId: string().optional(),
+    providerDriveId: string().optional(),
+    providerKey: string(),
+    key: AssetKeySchema,
+    sourceEntityType: _enum(["task-attachment", "external"]).optional(),
+    sourceEntityId: string().optional(),
+    createdAt: exports_iso.datetime(),
+    updatedAt: exports_iso.datetime(),
+    createdBy: string().optional(),
+    updatedBy: string().optional()
+  });
+  AssetSummarySchema = object({
+    entityType: AssetEntityTypeSchema,
+    id: string(),
+    key: AssetKeySchema,
+    label: string(),
+    updatedAt: string(),
+    providerRef: AssetProviderRefSchema.optional()
+  });
   ModelTierSchema = _enum(["smol", "regular", "smart", "ultra"]);
   MODEL_TIERS = ModelTierSchema.options;
   ReasoningEffortSchema = _enum(["off", "low", "medium", "high", "xhigh", "max"]);
@@ -849,6 +964,7 @@ var init_types = __esm(() => {
   });
   AgentTaskSchema = object({
     id: uuid(),
+    key: AssetKeySchema,
     agentId: uuid().nullable(),
     creatorAgentId: uuid().optional(),
     task: string().min(1),
@@ -1029,7 +1145,7 @@ var init_types = __esm(() => {
   FavoriteItemTypeSchema = _enum(["page", "workflow", "schedule"]);
   UserFavoriteSchema = object({
     id: string(),
-    userId: string(),
+    userId: string().optional(),
     itemType: FavoriteItemTypeSchema,
     itemId: string(),
     createdAt: string(),
@@ -1300,6 +1416,7 @@ var init_types = __esm(() => {
   ScheduledTaskTargetTypeSchema = _enum(["agent-task", "workflow", "script"]);
   ScheduledTaskSchema = object({
     id: uuid(),
+    key: AssetKeySchema,
     name: string().min(1).max(100),
     description: string().optional(),
     cronExpression: string().optional(),
@@ -1568,6 +1685,7 @@ var init_types = __esm(() => {
   });
   WorkflowSchema = object({
     id: string().uuid(),
+    key: AssetKeySchema,
     name: string(),
     description: string().optional(),
     enabled: boolean(),
@@ -1606,6 +1724,7 @@ var init_types = __esm(() => {
   });
   PageSchema = object({
     id: string(),
+    key: AssetKeySchema,
     agentId: string(),
     slug: string(),
     title: string(),
@@ -2112,6 +2231,153 @@ var init_request_auth_context = __esm(() => {
   authStorage = new AsyncLocalStorage;
 });
 
+// src/be/asset-key-audit.ts
+function auditKeyRow(db, entityType, row) {
+  if (!row.key) {
+    return [
+      {
+        severity: "fatal",
+        code: "missing-key",
+        entityType,
+        entityId: row.id,
+        message: "Asset key is missing or empty."
+      }
+    ];
+  }
+  if (!isCanonicalAssetKey(row.key)) {
+    return [
+      {
+        severity: "fatal",
+        code: "noncanonical-key",
+        entityType,
+        entityId: row.id,
+        message: "Asset key is not in canonical v1 form."
+      }
+    ];
+  }
+  const parsed = parseAssetKey(row.key);
+  if (parsed.root === "personal") {
+    const user = db.prepare("SELECT EXISTS(SELECT 1 FROM users WHERE id = ?) AS present").get(parsed.userId);
+    if (!user?.present) {
+      return [
+        {
+          severity: "warning",
+          code: "unknown-personal-user",
+          entityType,
+          entityId: row.id,
+          message: "Personal namespace references a user that no longer exists."
+        }
+      ];
+    }
+  }
+  return [];
+}
+function auditAssetKeys(db) {
+  const issues = [];
+  let checked = 0;
+  for (const table of KEY_TABLES) {
+    const rows = db.prepare(table.sql).all();
+    checked += rows.length;
+    for (const row of rows)
+      issues.push(...auditKeyRow(db, table.entityType, row));
+  }
+  const attachmentMappings = db.prepare(`SELECT
+         a.id AS attachment_id,
+         t."key" AS task_key,
+         m.id AS mapping_id,
+         m."key" AS mapping_key
+       FROM task_attachments a
+       JOIN agent_tasks t ON t.id = a.task_id
+       LEFT JOIN asset_key_mappings m
+         ON m.provider_id = COALESCE(NULLIF(a.provider_id, ''), 'agent-fs')
+        AND m.provider_org_id = COALESCE(a.agent_fs_org_id, '')
+        AND m.provider_drive_id = COALESCE(a.agent_fs_drive_id, '')
+        AND m.provider_key = COALESCE(NULLIF(a.provider_key, ''), a.path)
+       WHERE a.kind = 'agent-fs'
+         AND COALESCE(NULLIF(a.provider_key, ''), a.path) IS NOT NULL`).all();
+  for (const row of attachmentMappings) {
+    if (!row.mapping_id) {
+      issues.push({
+        severity: "warning",
+        code: "missing-provider-mapping",
+        entityType: "file",
+        entityId: row.attachment_id,
+        message: "Agent-fs attachment has no logical namespace mapping."
+      });
+    } else if (row.mapping_key !== row.task_key) {
+      issues.push({
+        severity: "warning",
+        code: "provider-mapping-drift",
+        entityType: "file",
+        entityId: row.mapping_id,
+        message: "Provider mapping namespace differs from its parent task namespace."
+      });
+    }
+  }
+  const sourcedMappings = db.prepare(`SELECT
+         m.id AS mapping_id,
+         m.source_entity_id,
+         a.id AS attachment_id,
+         t."key" AS task_key,
+         m."key" AS mapping_key,
+         CASE WHEN a.id IS NOT NULL
+           AND m.provider_id = COALESCE(NULLIF(a.provider_id, ''), 'agent-fs')
+           AND m.provider_org_id = COALESCE(a.agent_fs_org_id, '')
+           AND m.provider_drive_id = COALESCE(a.agent_fs_drive_id, '')
+           AND m.provider_key = COALESCE(NULLIF(a.provider_key, ''), a.path)
+         THEN 1 ELSE 0 END AS tuple_matches
+       FROM asset_key_mappings m
+       LEFT JOIN task_attachments a ON a.id = m.source_entity_id
+       LEFT JOIN agent_tasks t ON t.id = a.task_id
+       WHERE m.source_entity_type = 'task-attachment'`).all();
+  for (const row of sourcedMappings) {
+    if (!row.attachment_id || row.tuple_matches !== 1 || row.task_key !== row.mapping_key) {
+      issues.push({
+        severity: "warning",
+        code: "provider-mapping-drift",
+        entityType: "file",
+        entityId: row.mapping_id,
+        message: "Provider mapping source or tuple has drifted from its attachment."
+      });
+    }
+  }
+  const fatalCount = issues.filter((issue) => issue.severity === "fatal").length;
+  const warningCount = issues.length - fatalCount;
+  return {
+    ok: issues.length === 0,
+    structuralValid: fatalCount === 0,
+    checked,
+    fatalCount,
+    warningCount,
+    issues
+  };
+}
+function enforceAssetKeyStartupAudit(db) {
+  const result = auditAssetKeys(db);
+  if (result.warningCount > 0) {
+    console.warn(`[asset-keys] Startup audit found ${result.warningCount} repairable warning(s)`);
+  }
+  if (result.structuralValid)
+    return result;
+  const message = `[asset-keys] Startup audit found ${result.fatalCount} structurally invalid row(s)`;
+  if (process.env.ASSET_KEY_AUDIT_DISABLE_STARTUP_HARD_FAIL === "true") {
+    console.warn(`${message}; hard-fail temporarily disabled`);
+    return result;
+  }
+  throw new Error(message);
+}
+var KEY_TABLES;
+var init_asset_key_audit = __esm(() => {
+  init_key();
+  KEY_TABLES = [
+    { entityType: "task", sql: 'SELECT id, "key" as key FROM agent_tasks' },
+    { entityType: "workflow", sql: 'SELECT id, "key" as key FROM workflows' },
+    { entityType: "schedule", sql: 'SELECT id, "key" as key FROM scheduled_tasks' },
+    { entityType: "page", sql: 'SELECT id, "key" as key FROM pages' },
+    { entityType: "file", sql: 'SELECT id, "key" as key FROM asset_key_mappings' }
+  ];
+});
+
 // src/be/crypto/secrets-cipher.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 function assertKey(key) {
@@ -3838,6 +4104,7 @@ __export(exports_db, {
   upsertInboxState: () => upsertInboxState,
   upsertChannelActivityCursor: () => upsertChannelActivityCursor,
   upsertBudget: () => upsertBudget,
+  upsertAssetKeyMapping: () => upsertAssetKeyMapping,
   updateWorkflowRunStep: () => updateWorkflowRunStep,
   updateWorkflowRun: () => updateWorkflowRun,
   updateWorkflow: () => updateWorkflow,
@@ -3874,6 +4141,7 @@ __export(exports_db, {
   shouldBlockPolling: () => shouldBlockPolling,
   setUserFavorite: () => setUserFavorite,
   setSlackMessageTracking: () => setSlackMessageTracking,
+  setFavorite: () => setFavorite,
   setBudgetRefusalFollowUpTaskId: () => setBudgetRefusalFollowUpTaskId,
   setApiKeyName: () => setApiKeyName,
   setAgentHarnessProvider: () => setAgentHarnessProvider,
@@ -3904,6 +4172,7 @@ __export(exports_db, {
   normalizeSkillFilePath: () => normalizeSkillFilePath,
   moveTaskToBacklog: () => moveTaskToBacklog,
   moveTaskFromBacklog: () => moveTaskFromBacklog,
+  moveAssetKey: () => moveAssetKey,
   maskSecrets: () => maskSecrets,
   markTasksNotified: () => markTasksNotified,
   markTaskSlackReplySent: () => markTaskSlackReplySent,
@@ -3926,6 +4195,8 @@ __export(exports_db, {
   listMcpServers: () => listMcpServers,
   listKv: () => listKv,
   listInboxState: () => listInboxState,
+  listFavorites: () => listFavorites,
+  listAssetSummaries: () => listAssetSummaries,
   listApprovalRequests: () => listApprovalRequests,
   listAllPages: () => listAllPages,
   listAllMetrics: () => listAllMetrics,
@@ -4093,6 +4364,8 @@ __export(exports_db, {
   getBudgetRefusalNotification: () => getBudgetRefusalNotification,
   getBudget: () => getBudget,
   getAvailableKeyIndices: () => getAvailableKeyIndices,
+  getAssetKeyMappingByProvider: () => getAssetKeyMappingByProvider,
+  getAssetKeyMapping: () => getAssetKeyMapping,
   getApprovalRequestByStepId: () => getApprovalRequestByStepId,
   getApprovalRequestById: () => getApprovalRequestById,
   getAllUsers: () => getAllUsers,
@@ -4219,6 +4492,10 @@ __export(exports_db, {
   KvTypeCollisionError: () => KvTypeCollisionError
 });
 import { Database } from "bun:sqlite";
+function assetKeyPrefixPattern(input) {
+  const canonical = normalizeAssetKey(input);
+  return `${canonical.replace(/[\\%_]/g, "\\$&")}%`;
+}
 function emitTaskLifecycleTelemetryAfterCommit(event, props, verify) {
   queueMicrotask(() => {
     if (verify && !verify(getTaskById(props.taskId)))
@@ -4269,6 +4546,7 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
     db.run("PRAGMA foreign_keys = ON;");
     loadSqliteVec(db);
     configureDbResolver(resolvePromptTemplate);
+    enforceAssetKeyStartupAudit(db);
     resolveEncryptionKey(dbPath);
     return db;
   }
@@ -4294,81 +4572,25 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
     if (needsStatusMigration) {
       console.log("[Migration] Removing restrictive CHECK constraint on agent_tasks.status");
       db.run("PRAGMA foreign_keys=off");
-      db.run(`
-        CREATE TABLE agent_tasks_new (
-          id TEXT PRIMARY KEY,
-          agentId TEXT,
-          creatorAgentId TEXT,
-          task TEXT NOT NULL,
-          status TEXT NOT NULL DEFAULT 'pending',
-          source TEXT NOT NULL DEFAULT 'mcp' CHECK(source IN ('mcp', 'slack', 'api', 'github', 'agentmail', 'system', 'schedule')),
-          taskType TEXT,
-          tags TEXT DEFAULT '[]',
-          priority INTEGER DEFAULT 50,
-          dependsOn TEXT DEFAULT '[]',
-          offeredTo TEXT,
-          offeredAt TEXT,
-          acceptedAt TEXT,
-          rejectionReason TEXT,
-          slackChannelId TEXT,
-          slackThreadTs TEXT,
-          slackUserId TEXT,
-          createdAt TEXT NOT NULL,
-          lastUpdatedAt TEXT NOT NULL,
-          finishedAt TEXT,
-          failureReason TEXT,
-          output TEXT,
-          progress TEXT,
-          notifiedAt TEXT,
-          mentionMessageId TEXT,
-          mentionChannelId TEXT,
-          githubRepo TEXT,
-          githubEventType TEXT,
-          githubNumber INTEGER,
-          githubCommentId INTEGER,
-          githubAuthor TEXT,
-          githubUrl TEXT,
-          parentTaskId TEXT,
-          claudeSessionId TEXT,
-          agentmailInboxId TEXT,
-          agentmailMessageId TEXT,
-          agentmailThreadId TEXT,
-          model TEXT,
-          scheduleId TEXT
-        )
-      `);
-      db.run(`
-        INSERT INTO agent_tasks_new (
-          id, agentId, creatorAgentId, task, status, source, taskType, tags,
-          priority, dependsOn, offeredTo, offeredAt, acceptedAt, rejectionReason,
-          slackChannelId, slackThreadTs, slackUserId, createdAt, lastUpdatedAt,
-          finishedAt, failureReason, output, progress, notifiedAt,
-          mentionMessageId, mentionChannelId, githubRepo, githubEventType,
-          githubNumber, githubCommentId, githubAuthor, githubUrl,
-          parentTaskId, claudeSessionId,
-          agentmailInboxId, agentmailMessageId, agentmailThreadId,
-          model, scheduleId
-        )
-        SELECT
-          id, agentId, creatorAgentId, task, status, source, taskType, tags,
-          priority, dependsOn, offeredTo, offeredAt, acceptedAt, rejectionReason,
-          slackChannelId, slackThreadTs, slackUserId, createdAt, lastUpdatedAt,
-          finishedAt, failureReason, output, progress, notifiedAt,
-          mentionMessageId, mentionChannelId, githubRepo, githubEventType,
-          githubNumber, githubCommentId, githubAuthor, githubUrl,
-          parentTaskId, claudeSessionId,
-          agentmailInboxId, agentmailMessageId, agentmailThreadId,
-          model, scheduleId
-        FROM agent_tasks
-      `);
-      db.run("DROP TABLE agent_tasks");
-      db.run("ALTER TABLE agent_tasks_new RENAME TO agent_tasks");
-      db.run("CREATE INDEX IF NOT EXISTS idx_agent_tasks_agentId ON agent_tasks(agentId)");
-      db.run("CREATE INDEX IF NOT EXISTS idx_agent_tasks_status ON agent_tasks(status)");
-      db.run("CREATE INDEX IF NOT EXISTS idx_agent_tasks_offeredTo ON agent_tasks(offeredTo)");
-      db.run("CREATE INDEX IF NOT EXISTS idx_agent_tasks_taskType ON agent_tasks(taskType)");
-      db.run("CREATE INDEX IF NOT EXISTS idx_agent_tasks_agentmailThreadId ON agent_tasks(agentmailThreadId)");
-      db.run("CREATE INDEX IF NOT EXISTS idx_agent_tasks_schedule_id ON agent_tasks(scheduleId)");
+      const rebuiltSchemaSql = schemaSql.replace(/^(CREATE TABLE\s+(?:IF NOT EXISTS\s+)?)(?:"agent_tasks"|agent_tasks)/i, "$1agent_tasks_new").replace(/\s+CHECK\s*\(\s*status\s+IN\s*\([^)]*\)\s*\)/i, "");
+      if (rebuiltSchemaSql === schemaSql || !/agent_tasks_new/i.test(rebuiltSchemaSql)) {
+        throw new Error("Could not derive agent_tasks schema without legacy status CHECK");
+      }
+      const columns = db.prepare('PRAGMA table_info("agent_tasks")').all().map((column) => `"${column.name.replaceAll('"', '""')}"`).join(", ");
+      const schemaObjects = db.prepare(`SELECT sql FROM sqlite_master
+           WHERE tbl_name = 'agent_tasks'
+             AND type IN ('index', 'trigger')
+             AND sql IS NOT NULL
+           ORDER BY type, name`).all().map((row) => row.sql);
+      database.transaction(() => {
+        database.run("DROP TABLE IF EXISTS agent_tasks_new");
+        database.run(rebuiltSchemaSql);
+        database.run(`INSERT INTO agent_tasks_new (${columns}) SELECT ${columns} FROM agent_tasks`);
+        database.run("DROP TABLE agent_tasks");
+        database.run("ALTER TABLE agent_tasks_new RENAME TO agent_tasks");
+        for (const sql of schemaObjects)
+          database.run(sql);
+      })();
       db.run("PRAGMA foreign_keys=on");
       console.log("[Migration] Successfully removed CHECK constraint on agent_tasks.status");
     }
@@ -4381,6 +4603,7 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
     }
     throw e;
   }
+  enforceAssetKeyStartupAudit(database);
   seedContextVersions();
   configureDbResolver(resolvePromptTemplate);
   seedDefaultTemplates();
@@ -4726,6 +4949,7 @@ function rowToAgentTask(row) {
   }
   return {
     id: row.id,
+    key: row.key,
     agentId: row.agentId,
     creatorAgentId: row.creatorAgentId ?? undefined,
     task: row.task,
@@ -4799,6 +5023,7 @@ function rowToAgentTaskSummary(row) {
   const t = rowToAgentTask(row);
   return {
     id: t.id,
+    key: t.key,
     agentId: t.agentId,
     creatorAgentId: t.creatorAgentId,
     task: previewText(t.task, TASK_PREVIEW_LENGTH),
@@ -4828,7 +5053,7 @@ function rowToAgentTaskSummary(row) {
 function createTask(agentId, task, options) {
   const id = crypto.randomUUID();
   const source2 = options?.source ?? "mcp";
-  const row = taskQueries.insert().get(id, agentId, task, "pending", source2, options?.slackChannelId ?? null, options?.slackThreadTs ?? null, options?.slackUserId ?? null, package_default.version);
+  const row = taskQueries.insert().get(id, defaultAssetKey("task", id), agentId, task, "pending", source2, options?.slackChannelId ?? null, options?.slackThreadTs ?? null, options?.slackUserId ?? null, package_default.version);
   if (!row)
     throw new Error("Failed to create task");
   try {
@@ -5057,6 +5282,13 @@ function getAllTasks(filters, opts) {
     conditions.push("scheduleId = ?");
     params.push(filters.scheduleId);
   }
+  if (filters?.key) {
+    conditions.push('"key" = ?');
+    params.push(normalizeAssetKey(filters.key));
+  } else if (filters?.keyPrefix) {
+    conditions.push(`"key" LIKE ? ESCAPE '\\'`);
+    params.push(assetKeyPrefixPattern(filters.keyPrefix));
+  }
   if (filters?.source && filters.source.length > 0) {
     const placeholders = filters.source.map(() => "?").join(", ");
     conditions.push(`source IN (${placeholders})`);
@@ -5152,6 +5384,13 @@ function getTasksCount(filters) {
     conditions.push("scheduleId = ?");
     params.push(filters.scheduleId);
   }
+  if (filters?.key) {
+    conditions.push('"key" = ?');
+    params.push(normalizeAssetKey(filters.key));
+  } else if (filters?.keyPrefix) {
+    conditions.push(`"key" LIKE ? ESCAPE '\\'`);
+    params.push(assetKeyPrefixPattern(filters.keyPrefix));
+  }
   if (filters?.source && filters.source.length > 0) {
     const placeholders = filters.source.map(() => "?").join(", ");
     conditions.push(`source IN (${placeholders})`);
@@ -5739,6 +5978,28 @@ function stringifyAttachmentCapabilities(value) {
   return value ? JSON.stringify(value) : null;
 }
 function insertTaskAttachment(input) {
+  return getDb().transaction(() => {
+    const attachment = insertTaskAttachmentRow(input);
+    if (attachment.kind === "agent-fs" && attachment.providerId && attachment.providerKey) {
+      const task = getTaskById(input.taskId);
+      if (!task)
+        throw new Error(`Task not found while mapping attachment: ${input.taskId}`);
+      upsertAssetKeyMapping({
+        providerId: attachment.providerId,
+        providerOrgId: attachment.orgId,
+        providerDriveId: attachment.driveId,
+        providerKey: attachment.providerKey,
+        key: task.key,
+        sourceEntityType: "task-attachment",
+        sourceEntityId: attachment.id,
+        createdBy: input.createdBy,
+        updatedBy: input.updatedBy
+      });
+    }
+    return attachment;
+  })();
+}
+function insertTaskAttachmentRow(input) {
   const db2 = getDb();
   if (input.sha256) {
     const existing = db2.prepare("SELECT * FROM task_attachments WHERE task_id = ? AND sha256 = ? LIMIT 1").get(input.taskId, input.sha256);
@@ -5784,6 +6045,249 @@ function defaultProviderKey(input) {
     return input.pageId ?? null;
   return null;
 }
+function rowToAssetKeyMapping(row) {
+  return {
+    id: row.id,
+    providerId: row.provider_id,
+    providerOrgId: row.provider_org_id || undefined,
+    providerDriveId: row.provider_drive_id || undefined,
+    providerKey: row.provider_key,
+    key: row.key,
+    sourceEntityType: row.source_entity_type ?? undefined,
+    sourceEntityId: row.source_entity_id ?? undefined,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    createdBy: row.created_by ?? undefined,
+    updatedBy: row.updated_by ?? undefined
+  };
+}
+function insertAssetKeyHistory(input) {
+  getDb().run(`INSERT INTO asset_key_history
+       (id, entity_type, entity_id, previous_key, new_key, changed_by)
+     VALUES (?, ?, ?, ?, ?, ?)`, [
+    crypto.randomUUID(),
+    input.entityType,
+    input.entityId,
+    input.previousKey ?? null,
+    input.newKey,
+    input.changedBy ?? null
+  ]);
+}
+function getAssetKeyMappingByProvider(input) {
+  const row = getDb().prepare(`SELECT * FROM asset_key_mappings
+       WHERE provider_id = ? AND provider_org_id = ?
+         AND provider_drive_id = ? AND provider_key = ?`).get(input.providerId, input.providerOrgId ?? "", input.providerDriveId ?? "", input.providerKey);
+  return row ? rowToAssetKeyMapping(row) : null;
+}
+function upsertAssetKeyMapping(input) {
+  if (!input.providerId.trim())
+    throw new Error("providerId is required");
+  if (!input.providerKey.trim())
+    throw new Error("providerKey is required");
+  const now = new Date().toISOString();
+  return getDb().transaction(() => {
+    const existing = getAssetKeyMappingByProvider(input);
+    if (existing) {
+      const key2 = normalizeAssetKey(input.key ?? existing.key);
+      const row2 = getDb().prepare(`UPDATE asset_key_mappings
+           SET "key" = ?, source_entity_type = ?, source_entity_id = ?,
+               updated_at = ?, updated_by = ?
+           WHERE id = ? RETURNING *`).get(key2, input.sourceEntityType ?? existing.sourceEntityType ?? null, input.sourceEntityId ?? existing.sourceEntityId ?? null, now, input.updatedBy ?? input.createdBy ?? existing.updatedBy ?? null, existing.id);
+      if (!row2)
+        throw new Error("Failed to update asset key mapping");
+      if (existing.key !== key2) {
+        insertAssetKeyHistory({
+          entityType: "file",
+          entityId: existing.id,
+          previousKey: existing.key,
+          newKey: key2,
+          changedBy: input.updatedBy ?? input.createdBy
+        });
+      }
+      return rowToAssetKeyMapping(row2);
+    }
+    const id = crypto.randomUUID();
+    const key = normalizeAssetKey(input.key ?? defaultAssetKey(`fs:${input.providerId.trim()}`, id));
+    const row = getDb().prepare(`INSERT INTO asset_key_mappings (
+           id, provider_id, provider_org_id, provider_drive_id, provider_key,
+           "key", source_entity_type, source_entity_id,
+           created_at, updated_at, created_by, updated_by
+         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(id, input.providerId.trim(), input.providerOrgId ?? "", input.providerDriveId ?? "", input.providerKey, key, input.sourceEntityType ?? "external", input.sourceEntityId ?? null, now, now, input.createdBy ?? null, input.updatedBy ?? input.createdBy ?? null);
+    if (!row)
+      throw new Error("Failed to create asset key mapping");
+    insertAssetKeyHistory({
+      entityType: "file",
+      entityId: id,
+      newKey: key,
+      changedBy: input.createdBy
+    });
+    return rowToAssetKeyMapping(row);
+  })();
+}
+function getAssetKeyMapping(id) {
+  const row = getDb().prepare("SELECT * FROM asset_key_mappings WHERE id = ?").get(id);
+  return row ? rowToAssetKeyMapping(row) : null;
+}
+function assetSummaryQueries(types) {
+  const queries = [];
+  if (types.has("task")) {
+    queries.push(`SELECT 'task' AS entityType, id, "key", 'Task ' || substr(id, 1, 8) AS label,
+              lastUpdatedAt AS updatedAt, NULL AS providerId, NULL AS providerOrgId,
+              NULL AS providerDriveId, NULL AS providerKey
+       FROM agent_tasks`);
+  }
+  if (types.has("workflow")) {
+    queries.push(`SELECT 'workflow' AS entityType, id, "key", name AS label,
+              lastUpdatedAt AS updatedAt, NULL AS providerId, NULL AS providerOrgId,
+              NULL AS providerDriveId, NULL AS providerKey
+       FROM workflows`);
+  }
+  if (types.has("schedule")) {
+    queries.push(`SELECT 'schedule' AS entityType, id, "key", name AS label,
+              lastUpdatedAt AS updatedAt, NULL AS providerId, NULL AS providerOrgId,
+              NULL AS providerDriveId, NULL AS providerKey
+       FROM scheduled_tasks`);
+  }
+  if (types.has("page")) {
+    queries.push(`SELECT 'page' AS entityType, id, "key", title AS label,
+              updatedAt, NULL AS providerId, NULL AS providerOrgId,
+              NULL AS providerDriveId, NULL AS providerKey
+       FROM pages`);
+  }
+  if (types.has("file")) {
+    queries.push(`SELECT 'file' AS entityType, id, "key", provider_key AS label,
+              updated_at AS updatedAt, provider_id AS providerId,
+              NULLIF(provider_org_id, '') AS providerOrgId,
+              NULLIF(provider_drive_id, '') AS providerDriveId,
+              provider_key AS providerKey
+       FROM asset_key_mappings`);
+  }
+  return queries;
+}
+function listAssetSummaries(filters) {
+  const requestedTypes = new Set(filters?.types?.length ? filters.types : ["task", "workflow", "schedule", "page", "file"]);
+  const queries = assetSummaryQueries(requestedTypes);
+  if (queries.length === 0)
+    return [];
+  const limit = Math.min(Math.max(filters?.limit ?? 500, 1), 1000);
+  const params = [];
+  let query = `SELECT * FROM (${queries.join(" UNION ALL ")})`;
+  if (filters?.keyPrefix) {
+    query += ` WHERE "key" LIKE ? ESCAPE '\\'`;
+    params.push(assetKeyPrefixPattern(filters.keyPrefix));
+  }
+  query += ' ORDER BY "key" ASC, updatedAt DESC LIMIT ?';
+  params.push(limit);
+  const rows = getDb().prepare(query).all(...params);
+  return rows.map((row) => ({
+    entityType: row.entityType,
+    id: row.id,
+    key: row.key,
+    label: row.label,
+    updatedAt: row.updatedAt,
+    providerRef: row.providerId && row.providerKey ? {
+      providerId: row.providerId,
+      orgId: row.providerOrgId ?? undefined,
+      driveId: row.providerDriveId ?? undefined,
+      providerKey: row.providerKey
+    } : undefined
+  }));
+}
+function currentAssetKey(entityType, id) {
+  switch (entityType) {
+    case "task":
+      return getDb().prepare('SELECT "key" AS key FROM agent_tasks WHERE id = ?').get(id)?.key ?? null;
+    case "workflow":
+      return getDb().prepare('SELECT "key" AS key FROM workflows WHERE id = ?').get(id)?.key ?? null;
+    case "schedule":
+      return getDb().prepare('SELECT "key" AS key FROM scheduled_tasks WHERE id = ?').get(id)?.key ?? null;
+    case "page":
+      return getDb().prepare('SELECT "key" AS key FROM pages WHERE id = ?').get(id)?.key ?? null;
+    case "file":
+      return getAssetKeyMapping(id)?.key ?? null;
+  }
+}
+function moveAssetKey(input) {
+  const key = normalizeAssetKey(input.key);
+  const audit = auditAssetKeys(getDb());
+  if (!audit.ok) {
+    throw new Error("Asset namespace moves are blocked until structural errors, unknown personal users, or provider mapping drift are repaired.");
+  }
+  const previousKey = currentAssetKey(input.entityType, input.id);
+  if (!previousKey)
+    return false;
+  if (previousKey === key)
+    return true;
+  if (input.entityType === "file") {
+    const mapping = getAssetKeyMapping(input.id);
+    if (mapping?.sourceEntityType === "task-attachment") {
+      throw new Error("Task attachment namespaces move with their parent task; move the task instead.");
+    }
+  }
+  const now = new Date().toISOString();
+  getDb().transaction(() => {
+    switch (input.entityType) {
+      case "task": {
+        const mappedFiles = getDb().prepare(`SELECT DISTINCT m.id, m."key" AS key
+             FROM asset_key_mappings m
+             JOIN task_attachments a
+               ON m.provider_id = COALESCE(NULLIF(a.provider_id, ''), 'agent-fs')
+              AND m.provider_org_id = COALESCE(a.agent_fs_org_id, '')
+              AND m.provider_drive_id = COALESCE(a.agent_fs_drive_id, '')
+              AND m.provider_key = COALESCE(NULLIF(a.provider_key, ''), a.path)
+             WHERE a.task_id = ?`).all(input.id);
+        getDb().run('UPDATE agent_tasks SET "key" = ?, lastUpdatedAt = ?, updated_by = ? WHERE id = ?', [key, now, input.changedBy ?? null, input.id]);
+        getDb().run(`UPDATE asset_key_mappings
+           SET "key" = ?, updated_at = ?, updated_by = ?
+           WHERE EXISTS (
+             SELECT 1 FROM task_attachments a
+             WHERE a.task_id = ?
+               AND asset_key_mappings.provider_id = COALESCE(NULLIF(a.provider_id, ''), 'agent-fs')
+               AND asset_key_mappings.provider_org_id = COALESCE(a.agent_fs_org_id, '')
+               AND asset_key_mappings.provider_drive_id = COALESCE(a.agent_fs_drive_id, '')
+               AND asset_key_mappings.provider_key = COALESCE(NULLIF(a.provider_key, ''), a.path)
+           )`, [key, now, input.changedBy ?? null, input.id]);
+        for (const mapping of mappedFiles) {
+          if (mapping.key === key)
+            continue;
+          insertAssetKeyHistory({
+            entityType: "file",
+            entityId: mapping.id,
+            previousKey: mapping.key,
+            newKey: key,
+            changedBy: input.changedBy
+          });
+        }
+        break;
+      }
+      case "workflow":
+        getDb().run('UPDATE workflows SET "key" = ?, lastUpdatedAt = ?, updated_by = ? WHERE id = ?', [key, now, input.changedBy ?? null, input.id]);
+        break;
+      case "schedule":
+        getDb().run('UPDATE scheduled_tasks SET "key" = ?, lastUpdatedAt = ?, updated_by = ? WHERE id = ?', [key, now, input.changedBy ?? null, input.id]);
+        break;
+      case "page":
+        getDb().run('UPDATE pages SET "key" = ?, updatedAt = ?, updated_by = ? WHERE id = ?', [
+          key,
+          now,
+          input.changedBy ?? null,
+          input.id
+        ]);
+        break;
+      case "file":
+        getDb().run('UPDATE asset_key_mappings SET "key" = ?, updated_at = ?, updated_by = ? WHERE id = ?', [key, now, input.changedBy ?? null, input.id]);
+        break;
+    }
+    insertAssetKeyHistory({
+      entityType: input.entityType,
+      entityId: input.id,
+      previousKey,
+      newKey: key,
+      changedBy: input.changedBy
+    });
+  })();
+  return true;
+}
 function deleteTaskAttachment(id) {
   const result = getDb().run("DELETE FROM task_attachments WHERE id = ?", [id]);
   return result.changes > 0;
@@ -5958,6 +6462,9 @@ function createTaskExtended(task, options) {
       if (parent.requestedByUserId && !options.requestedByUserId) {
         options.requestedByUserId = parent.requestedByUserId;
       }
+      if (parent.key && !options.key) {
+        options.key = parent.key;
+      }
       if (parent.contextKey && !options.contextKey) {
         options.contextKey = parent.contextKey;
       }
@@ -6014,8 +6521,9 @@ function createTaskExtended(task, options) {
     }
   }
   const auditUserId = getCurrentRequestUserId() ?? null;
+  const assetKey = normalizeAssetKey(options?.key ?? defaultAssetKey("task", id));
   const row = getDb().prepare(`INSERT INTO agent_tasks (
-        id, agentId, creatorAgentId, task, status, source,
+        id, "key", agentId, creatorAgentId, task, status, source,
         taskType, tags, priority, dependsOn, offeredTo, offeredAt,
         slackChannelId, slackThreadTs, slackUserId,
         vcsProvider, vcsRepo, vcsEventType, vcsNumber, vcsCommentId, vcsAuthor, vcsUrl,
@@ -6023,7 +6531,7 @@ function createTaskExtended(task, options) {
         agentmailInboxId, agentmailMessageId, agentmailThreadId,
         mentionMessageId, mentionChannelId, dir, parentTaskId, model, modelTier, effort, scheduleId,
         workflowRunId, workflowRunStepId, outputSchema, followUpConfig, requestedByUserId, contextKey, routingAffinity, swarmVersion, createdAt, lastUpdatedAt, created_by, updated_by
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(id, options?.agentId ?? null, options?.creatorAgentId ?? null, task, status, options?.source ?? "mcp", options?.taskType ?? null, JSON.stringify(options?.tags ?? []), options?.priority ?? 50, JSON.stringify(options?.dependsOn ?? []), options?.offeredTo ?? null, options?.offeredTo ? now : null, options?.slackChannelId ?? null, options?.slackThreadTs ?? null, options?.slackUserId ?? null, options?.vcsProvider ?? null, options?.vcsRepo ?? null, options?.vcsEventType ?? null, options?.vcsNumber ?? null, options?.vcsCommentId ?? null, options?.vcsAuthor ?? null, options?.vcsUrl ?? null, options?.vcsInstallationId ?? null, options?.vcsNodeId ?? null, options?.agentmailInboxId ?? null, options?.agentmailMessageId ?? null, options?.agentmailThreadId ?? null, options?.mentionMessageId ?? null, options?.mentionChannelId ?? null, options?.dir ?? null, options?.parentTaskId ?? null, options?.model ?? null, options?.modelTier ?? null, options?.effort ?? null, options?.scheduleId ?? null, options?.workflowRunId ?? null, options?.workflowRunStepId ?? null, options?.outputSchema ? JSON.stringify(options.outputSchema) : null, options?.followUpConfig ? JSON.stringify(options.followUpConfig) : null, options?.requestedByUserId ?? null, options?.contextKey ?? null, options?.routingAffinity ? JSON.stringify(options.routingAffinity) : null, package_default.version, now, now, auditUserId, auditUserId);
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(id, assetKey, options?.agentId ?? null, options?.creatorAgentId ?? null, task, status, options?.source ?? "mcp", options?.taskType ?? null, JSON.stringify(options?.tags ?? []), options?.priority ?? 50, JSON.stringify(options?.dependsOn ?? []), options?.offeredTo ?? null, options?.offeredTo ? now : null, options?.slackChannelId ?? null, options?.slackThreadTs ?? null, options?.slackUserId ?? null, options?.vcsProvider ?? null, options?.vcsRepo ?? null, options?.vcsEventType ?? null, options?.vcsNumber ?? null, options?.vcsCommentId ?? null, options?.vcsAuthor ?? null, options?.vcsUrl ?? null, options?.vcsInstallationId ?? null, options?.vcsNodeId ?? null, options?.agentmailInboxId ?? null, options?.agentmailMessageId ?? null, options?.agentmailThreadId ?? null, options?.mentionMessageId ?? null, options?.mentionChannelId ?? null, options?.dir ?? null, options?.parentTaskId ?? null, options?.model ?? null, options?.modelTier ?? null, options?.effort ?? null, options?.scheduleId ?? null, options?.workflowRunId ?? null, options?.workflowRunStepId ?? null, options?.outputSchema ? JSON.stringify(options.outputSchema) : null, options?.followUpConfig ? JSON.stringify(options.followUpConfig) : null, options?.requestedByUserId ?? null, options?.contextKey ?? null, options?.routingAffinity ? JSON.stringify(options.routingAffinity) : null, package_default.version, now, now, auditUserId, auditUserId);
   if (!row)
     throw new Error("Failed to create task");
   try {
@@ -7052,6 +7560,7 @@ function previewText(text, maxChars) {
 function rowToScheduledTask(row) {
   return {
     id: row.id,
+    key: row.key,
     name: row.name,
     description: row.description ?? undefined,
     cronExpression: row.cronExpression ?? undefined,
@@ -7116,6 +7625,13 @@ function getScheduledTasks(filters, opts) {
     query += " AND scriptName = ?";
     params.push(filters.scriptName);
   }
+  if (filters?.key) {
+    query += ' AND "key" = ?';
+    params.push(normalizeAssetKey(filters.key));
+  } else if (filters?.keyPrefix) {
+    query += ` AND "key" LIKE ? ESCAPE '\\'`;
+    params.push(assetKeyPrefixPattern(filters.keyPrefix));
+  }
   if (filters?.consecutiveErrorsMin !== undefined) {
     query += " AND consecutiveErrors >= ?";
     params.push(filters.consecutiveErrorsMin);
@@ -7144,12 +7660,12 @@ function createScheduledTask(data) {
   const id = crypto.randomUUID();
   const now = new Date().toISOString();
   const row = getDb().prepare(`INSERT INTO scheduled_tasks (
-        id, name, description, cronExpression, intervalMs, taskTemplate,
+        id, "key", name, description, cronExpression, intervalMs, taskTemplate,
         taskType, tags, priority, targetAgentId, enabled, nextRunAt,
         createdByAgentId, timezone, model, modelTier, scheduleType, targetType,
         workflowId, scriptName, scriptArgs, createdAt, lastUpdatedAt,
         created_by, updated_by
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(id, data.name, data.description ?? null, data.cronExpression ?? null, data.intervalMs ?? null, data.taskTemplate ?? null, data.taskType ?? null, JSON.stringify(data.tags ?? []), data.priority ?? 50, data.targetAgentId ?? null, data.enabled !== false ? 1 : 0, data.nextRunAt ?? null, data.createdByAgentId ?? null, data.timezone ?? "UTC", data.model ?? null, data.modelTier ?? null, data.scheduleType ?? "recurring", data.targetType ?? "agent-task", data.workflowId ?? null, data.scriptName ?? null, data.scriptArgs !== undefined ? JSON.stringify(data.scriptArgs) : "{}", now, now, data.createdBy ?? null, data.createdBy ?? null);
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(id, normalizeAssetKey(data.key ?? defaultAssetKey("schedule", id)), data.name, data.description ?? null, data.cronExpression ?? null, data.intervalMs ?? null, data.taskTemplate ?? null, data.taskType ?? null, JSON.stringify(data.tags ?? []), data.priority ?? 50, data.targetAgentId ?? null, data.enabled !== false ? 1 : 0, data.nextRunAt ?? null, data.createdByAgentId ?? null, data.timezone ?? "UTC", data.model ?? null, data.modelTier ?? null, data.scheduleType ?? "recurring", data.targetType ?? "agent-task", data.workflowId ?? null, data.scriptName ?? null, data.scriptArgs !== undefined ? JSON.stringify(data.scriptArgs) : "{}", now, now, data.createdBy ?? null, data.createdBy ?? null);
   if (!row)
     throw new Error("Failed to create scheduled task");
   return rowToScheduledTask(row);
@@ -7157,6 +7673,10 @@ function createScheduledTask(data) {
 function updateScheduledTask(id, data) {
   const updates = [];
   const params = [];
+  if (data.key !== undefined) {
+    updates.push('"key" = ?');
+    params.push(normalizeAssetKey(data.key));
+  }
   if (data.name !== undefined) {
     updates.push("name = ?");
     params.push(data.name);
@@ -7737,6 +8257,7 @@ function getRecentFailedCount(hours = 24) {
 function rowToWorkflow(row) {
   return {
     id: row.id,
+    key: row.key,
     name: row.name,
     description: row.description ?? undefined,
     enabled: row.enabled === 1,
@@ -7756,8 +8277,8 @@ function rowToWorkflow(row) {
 }
 function createWorkflow(data) {
   const id = crypto.randomUUID();
-  const row = getDb().prepare(`INSERT INTO workflows (id, name, description, definition, triggers, cooldown, input, triggerSchema, dir, vcs_repo, createdByAgentId, created_by, updated_by)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(id, data.name, data.description ?? null, JSON.stringify(data.definition), JSON.stringify(data.triggers ?? []), data.cooldown ? JSON.stringify(data.cooldown) : null, data.input ? JSON.stringify(data.input) : null, data.triggerSchema ? JSON.stringify(data.triggerSchema) : null, data.dir ?? null, data.vcsRepo ?? null, data.createdByAgentId ?? null, data.createdBy ?? null, data.createdBy ?? null);
+  const row = getDb().prepare(`INSERT INTO workflows (id, "key", name, description, definition, triggers, cooldown, input, triggerSchema, dir, vcs_repo, createdByAgentId, created_by, updated_by)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(id, normalizeAssetKey(data.key ?? defaultAssetKey("workflow", id)), data.name, data.description ?? null, JSON.stringify(data.definition), JSON.stringify(data.triggers ?? []), data.cooldown ? JSON.stringify(data.cooldown) : null, data.input ? JSON.stringify(data.input) : null, data.triggerSchema ? JSON.stringify(data.triggerSchema) : null, data.dir ?? null, data.vcsRepo ?? null, data.createdByAgentId ?? null, data.createdBy ?? null, data.createdBy ?? null);
   if (!row)
     throw new Error("Failed to create workflow");
   return rowToWorkflow(row);
@@ -7776,6 +8297,7 @@ function rowToWorkflowSummary(row) {
   }
   return {
     id: row.id,
+    key: row.key,
     name: row.name,
     description: row.description ?? undefined,
     enabled: row.enabled === 1,
@@ -7794,6 +8316,13 @@ function listWorkflows(filters, opts) {
     query += " AND enabled = ?";
     params.push(filters.enabled ? 1 : 0);
   }
+  if (filters?.key) {
+    query += ' AND "key" = ?';
+    params.push(normalizeAssetKey(filters.key));
+  } else if (filters?.keyPrefix) {
+    query += ` AND "key" LIKE ? ESCAPE '\\'`;
+    params.push(assetKeyPrefixPattern(filters.keyPrefix));
+  }
   if (filters?.lastRunStatus !== undefined) {
     query += " AND (SELECT status FROM workflow_runs WHERE workflowId = workflows.id ORDER BY startedAt DESC LIMIT 1) = ?";
     params.push(filters.lastRunStatus);
@@ -7821,6 +8350,10 @@ function listWorkflows(filters, opts) {
 function updateWorkflow(id, data) {
   const updates = [];
   const params = [];
+  if (data.key !== undefined) {
+    updates.push('"key" = ?');
+    params.push(normalizeAssetKey(data.key));
+  }
   if (data.name !== undefined) {
     updates.push("name = ?");
     params.push(data.name);
@@ -8131,6 +8664,7 @@ function getWorkflowVersion(workflowId, version) {
 function rowToPage(row) {
   return {
     id: row.id,
+    key: row.key,
     agentId: row.agentId,
     slug: row.slug,
     title: row.title,
@@ -8146,8 +8680,9 @@ function rowToPage(row) {
   };
 }
 function createPage(data) {
-  const row = getDb().prepare(`INSERT INTO pages (agentId, slug, title, description, contentType, authMode, passwordHash, body, needsCredentials)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(data.agentId, data.slug, data.title, data.description ?? null, data.contentType, data.authMode ?? "authed", data.passwordHash ?? null, data.body, data.needsCredentials ? JSON.stringify(data.needsCredentials) : null);
+  const id = crypto.randomUUID().replace(/-/g, "");
+  const row = getDb().prepare(`INSERT INTO pages (id, "key", agentId, slug, title, description, contentType, authMode, passwordHash, body, needsCredentials)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`).get(id, normalizeAssetKey(data.key ?? defaultAssetKey("page", id)), data.agentId, data.slug, data.title, data.description ?? null, data.contentType, data.authMode ?? "authed", data.passwordHash ?? null, data.body, data.needsCredentials ? JSON.stringify(data.needsCredentials) : null);
   if (!row)
     throw new Error("Failed to create page");
   return rowToPage(row);
@@ -8167,6 +8702,7 @@ function getLatestPageBySlug(slug) {
 function rowToPageSummary(row) {
   return {
     id: row.id,
+    key: row.key,
     agentId: row.agentId,
     slug: row.slug,
     title: row.title,
@@ -8180,24 +8716,68 @@ function rowToPageSummary(row) {
   };
 }
 function listPagesByAgent(agentId, limit = 100, offset = 0, opts) {
-  const rows = getDb().prepare("SELECT * FROM pages WHERE agentId = ? ORDER BY updatedAt DESC LIMIT ? OFFSET ?").all(agentId, limit, offset);
+  let query = "SELECT * FROM pages WHERE agentId = ?";
+  const params = [agentId];
+  if (opts?.key) {
+    query += ' AND "key" = ?';
+    params.push(normalizeAssetKey(opts.key));
+  } else if (opts?.keyPrefix) {
+    query += ` AND "key" LIKE ? ESCAPE '\\'`;
+    params.push(assetKeyPrefixPattern(opts.keyPrefix));
+  }
+  query += " ORDER BY updatedAt DESC LIMIT ? OFFSET ?";
+  params.push(limit, offset);
+  const rows = getDb().prepare(query).all(...params);
   return opts?.slim ? rows.map(rowToPageSummary) : rows.map(rowToPage);
 }
 function listAllPages(limit = 100, offset = 0, opts) {
-  const rows = getDb().prepare("SELECT * FROM pages ORDER BY updatedAt DESC LIMIT ? OFFSET ?").all(limit, offset);
+  let query = "SELECT * FROM pages WHERE 1=1";
+  const params = [];
+  if (opts?.key) {
+    query += ' AND "key" = ?';
+    params.push(normalizeAssetKey(opts.key));
+  } else if (opts?.keyPrefix) {
+    query += ` AND "key" LIKE ? ESCAPE '\\'`;
+    params.push(assetKeyPrefixPattern(opts.keyPrefix));
+  }
+  query += " ORDER BY updatedAt DESC LIMIT ? OFFSET ?";
+  params.push(limit, offset);
+  const rows = getDb().prepare(query).all(...params);
   return opts?.slim ? rows.map(rowToPageSummary) : rows.map(rowToPage);
 }
-function countAllPages() {
-  const row = getDb().prepare("SELECT COUNT(*) AS count FROM pages").get();
+function countAllPages(filters) {
+  let query = "SELECT COUNT(*) AS count FROM pages WHERE 1=1";
+  const params = [];
+  if (filters?.key) {
+    query += ' AND "key" = ?';
+    params.push(normalizeAssetKey(filters.key));
+  } else if (filters?.keyPrefix) {
+    query += ` AND "key" LIKE ? ESCAPE '\\'`;
+    params.push(assetKeyPrefixPattern(filters.keyPrefix));
+  }
+  const row = getDb().prepare(query).get(...params);
   return row?.count ?? 0;
 }
-function countPagesByAgent(agentId) {
-  const row = getDb().prepare("SELECT COUNT(*) AS count FROM pages WHERE agentId = ?").get(agentId);
+function countPagesByAgent(agentId, filters) {
+  let query = "SELECT COUNT(*) AS count FROM pages WHERE agentId = ?";
+  const params = [agentId];
+  if (filters?.key) {
+    query += ' AND "key" = ?';
+    params.push(normalizeAssetKey(filters.key));
+  } else if (filters?.keyPrefix) {
+    query += ` AND "key" LIKE ? ESCAPE '\\'`;
+    params.push(assetKeyPrefixPattern(filters.keyPrefix));
+  }
+  const row = getDb().prepare(query).get(...params);
   return row?.count ?? 0;
 }
 function updatePage(id, data) {
   const updates = [];
   const params = [];
+  if (data.key !== undefined) {
+    updates.push('"key" = ?');
+    params.push(normalizeAssetKey(data.key));
+  }
   if (data.title !== undefined) {
     updates.push("title = ?");
     params.push(data.title);
@@ -9725,7 +10305,7 @@ function upsertInboxState(opts) {
 function rowToUserFavorite(row) {
   return {
     id: row.id,
-    userId: row.userId,
+    userId: row.userId ?? undefined,
     itemType: row.itemType,
     itemId: row.itemId,
     createdAt: row.createdAt,
@@ -9734,9 +10314,9 @@ function rowToUserFavorite(row) {
     updatedBy: row.updated_by ?? undefined
   };
 }
-function listUserFavorites(opts) {
-  const conditions = ["userId = ?"];
-  const params = [opts.userId];
+function listFavorites(opts) {
+  const conditions = ["favoriteScope = ?"];
+  const params = [opts.favoriteScope];
   if (opts.itemType) {
     conditions.push("itemType = ?");
     params.push(opts.itemType);
@@ -9748,34 +10328,44 @@ function listUserFavorites(opts) {
   const rows = getDb().prepare(`SELECT * FROM user_favorites WHERE ${conditions.join(" AND ")} ORDER BY lastUpdatedAt DESC`).all(...params);
   return rows.map(rowToUserFavorite);
 }
+function listUserFavorites(opts) {
+  return listFavorites({ ...opts, favoriteScope: `user:${opts.userId}` });
+}
 function getFavoriteItemIdSet(opts) {
-  return new Set(listUserFavorites(opts).map((favorite) => favorite.itemId));
+  return new Set(listFavorites(opts).map((favorite) => favorite.itemId));
 }
-function setUserFavorite(opts) {
+function setFavorite(opts) {
   if (!opts.favorite) {
-    getDb().prepare("DELETE FROM user_favorites WHERE userId = ? AND itemType = ? AND itemId = ?").run(opts.userId, opts.itemType, opts.itemId);
+    getDb().prepare("DELETE FROM user_favorites WHERE favoriteScope = ? AND itemType = ? AND itemId = ?").run(opts.favoriteScope, opts.itemType, opts.itemId);
     return null;
   }
   const now = new Date().toISOString();
-  const actor = opts.actorUserId ?? opts.userId;
+  const actor = opts.actorId ?? opts.userId ?? opts.favoriteScope;
   const row = getDb().prepare(`INSERT INTO user_favorites (
-         userId, itemType, itemId, createdAt, lastUpdatedAt, created_by, updated_by
+         favoriteScope, userId, itemType, itemId, createdAt, lastUpdatedAt, created_by, updated_by
        )
-       VALUES (?, ?, ?, ?, ?, ?, ?)
-       ON CONFLICT(userId, itemType, itemId) DO UPDATE SET
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(favoriteScope, itemType, itemId) DO UPDATE SET
          lastUpdatedAt = excluded.lastUpdatedAt,
          updated_by = excluded.updated_by
-       RETURNING *`).get(opts.userId, opts.itemType, opts.itemId, now, now, actor, actor);
+       RETURNING *`).get(opts.favoriteScope, opts.userId ?? null, opts.itemType, opts.itemId, now, now, actor, actor);
   if (!row)
     throw new Error("Failed to set favorite");
   return rowToUserFavorite(row);
 }
+function setUserFavorite(opts) {
+  return setFavorite({
+    ...opts,
+    favoriteScope: `user:${opts.userId}`,
+    actorId: opts.actorUserId
+  });
+}
 function withFavoriteFlags(rows, opts) {
-  if (!opts.userId || rows.length === 0) {
+  if (!opts.favoriteScope || rows.length === 0) {
     return rows.map((row) => ({ ...row, favorite: false }));
   }
   const favoriteIds = getFavoriteItemIdSet({
-    userId: opts.userId,
+    favoriteScope: opts.favoriteScope,
     itemType: opts.itemType,
     itemIds: rows.map((row) => row.id)
   });
@@ -10490,6 +11080,7 @@ var db = null, sqliteVecAvailable = false, VERSIONABLE_FIELDS, agentQueries, MAX
 var init_db = __esm(() => {
   init_provider_metadata();
   init_package();
+  init_key();
   init_resolver();
   init_slack_routing();
   init_telemetry();
@@ -10497,6 +11088,7 @@ var init_db = __esm(() => {
   init_credentials();
   init_request_auth_context();
   init_secret_scrubber();
+  init_asset_key_audit();
   init_crypto();
   init_date_utils();
   init_runner();
@@ -10521,8 +11113,8 @@ var init_db = __esm(() => {
     delete: () => getDb().prepare("DELETE FROM agents WHERE id = ?")
   };
   taskQueries = {
-    insert: () => getDb().prepare(`INSERT INTO agent_tasks (id, agentId, task, status, source, slackChannelId, slackThreadTs, slackUserId, swarmVersion, createdAt, lastUpdatedAt)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')) RETURNING *`),
+    insert: () => getDb().prepare(`INSERT INTO agent_tasks (id, "key", agentId, task, status, source, slackChannelId, slackThreadTs, slackUserId, swarmVersion, createdAt, lastUpdatedAt)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), strftime('%Y-%m-%dT%H:%M:%fZ', 'now')) RETURNING *`),
     getById: () => getDb().prepare("SELECT * FROM agent_tasks WHERE id = ?"),
     getByAgentId: () => getDb().prepare("SELECT * FROM agent_tasks WHERE agentId = ? ORDER BY createdAt DESC"),
     getByStatus: () => getDb().prepare("SELECT * FROM agent_tasks WHERE status = ? ORDER BY createdAt DESC"),
@@ -10597,4 +11189,4 @@ var init_db = __esm(() => {
   };
 });
 
-export { interpolate, deepInterpolate, init_template, registerTemplate, getTemplateDefinition, getAllTemplateDefinitions, init_registry, configureHttpResolver, resolveTemplate, resolveTemplateAsync, init_resolver, slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, initTelemetry, telemetry, init_telemetry, ModelTierSchema, ReasoningEffortSchema, splitLegacyModelAlias, resolveTaskModelSelection, AgentTaskStatusSchema, isTerminalTaskStatus, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, AttachmentInputSchema, TaskAttachmentSchema, InboxItemTypeSchema, InboxItemStatusSchema, FavoriteItemTypeSchema, TaskTemplateKindSchema, AgentSchema, AgentLatestModelSchema, AgentCredStatusSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, ResumeReasonSchema, AgentLogSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, ScheduledTaskTargetTypeSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, PageContentTypeSchema, PageAuthModeSchema, MetricDefinitionSchema, MetricVersionSchema, WorkflowRunStatusSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptApiAuthModeSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, KvValueTypeSchema, KvNamespaceSchema, KvKeySchema, KvEntrySchema, init_types, setRequestAuth, getRequestAuth, getCurrentRequestAuth, init_request_auth_context, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, init_session_templates, init_templates, init_templates2 as init_templates1, isReservedConfigKey, reservedKeyError, validateConfigValue, init_swarm_config_guard, onTaskStarted, init_task_lifecycle_events, generateDefaultClaudeMd, generateDefaultSoulMd, generateDefaultIdentityMd, generateDefaultToolsMd, init_defaults, isSqliteVecAvailable, initDb, getDb, closeDb, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, agentQueries, updateAgentCredentialState, createAgent, getAgentById, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, taskQueries, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, getTaskById, markTaskSlackReplySent, setSlackMessageTracking, getChildTasks, hasNonTerminalResumeChild, hasNonTerminalRerouteDecisionChild, updateTaskClaudeSessionId, updateTaskVcs, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, completeTask, failTask, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, insertTaskAttachment, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, getAgentWithTasks, getAllAgentsWithTasks, logQueries, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, releaseStaleReviewingTasks, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, sessionLogQueries, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, getSessionCostSummary, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listUserFavorites, getFavoriteItemIdSet, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, upsertKv, deleteKv, KvTypeCollisionError, incrKv, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };
+export { normalizeAssetKey, parseAssetKey, canWriteAssetKey, init_key, interpolate, deepInterpolate, init_template, registerTemplate, getTemplateDefinition, getAllTemplateDefinitions, init_registry, configureHttpResolver, resolveTemplate, resolveTemplateAsync, init_resolver, slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, initTelemetry, telemetry, init_telemetry, AssetKeySchema, AssetEntityTypeSchema, ModelTierSchema, ReasoningEffortSchema, splitLegacyModelAlias, resolveTaskModelSelection, AgentTaskStatusSchema, isTerminalTaskStatus, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, AttachmentInputSchema, TaskAttachmentSchema, InboxItemTypeSchema, InboxItemStatusSchema, FavoriteItemTypeSchema, TaskTemplateKindSchema, AgentSchema, AgentLatestModelSchema, AgentCredStatusSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, ResumeReasonSchema, AgentLogSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, ScheduledTaskTargetTypeSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, PageContentTypeSchema, PageAuthModeSchema, MetricDefinitionSchema, MetricVersionSchema, WorkflowRunStatusSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptApiAuthModeSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, KvValueTypeSchema, KvNamespaceSchema, KvKeySchema, KvEntrySchema, init_types, setRequestAuth, getRequestAuth, getCurrentRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, init_session_templates, init_templates, init_templates2 as init_templates1, isReservedConfigKey, reservedKeyError, validateConfigValue, init_swarm_config_guard, onTaskStarted, init_task_lifecycle_events, generateDefaultClaudeMd, generateDefaultSoulMd, generateDefaultIdentityMd, generateDefaultToolsMd, init_defaults, isSqliteVecAvailable, initDb, getDb, closeDb, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, agentQueries, updateAgentCredentialState, createAgent, getAgentById, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, taskQueries, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, getTaskById, markTaskSlackReplySent, setSlackMessageTracking, getChildTasks, hasNonTerminalResumeChild, hasNonTerminalRerouteDecisionChild, updateTaskClaudeSessionId, updateTaskVcs, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, completeTask, failTask, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, insertTaskAttachment, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, getAgentWithTasks, getAllAgentsWithTasks, logQueries, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, releaseStaleReviewingTasks, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, sessionLogQueries, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, getSessionCostSummary, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, upsertKv, deleteKv, KvTypeCollisionError, incrKv, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };