@desplega.ai/agent-swarm 1.119.5 → 1.120.0

package/dist/{actions-xqb0w6as.js → actions-rym7jyg2.js}

@@ -1,10 +1,10 @@
 import {
   resolveSlackUserId
-} from "./cli-zn7x1nkq.js";
-import"./cli-xv365pmn.js";
+} from "./cli-f6c6y7fw.js";
+import"./cli-d2eyq90a.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-wejdajv9.js";
+} from "./cli-th08nm8p.js";
 import {
   buildCancelledBlocks,
   getTaskLink
@@ -19,11 +19,11 @@ import {
   init_context_key,
   init_db,
   slackContextKey
-} from "./cli-rp04sjbc.js";
+} from "./cli-383wyw2f.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-5sexkty0.js";
+import"./cli-gq12jc1m.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{app-qv9sy539.js → app-ss3a0nfj.js}

@@ -3,17 +3,17 @@ import {
   initSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-ctdx3h19.js";
+} from "./cli-kyqs14qe.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
 import"./cli-ma04faw5.js";
 import"./cli-wspgs9bt.js";
 import"./cli-dh55d5fg.js";
-import"./cli-rp04sjbc.js";
+import"./cli-383wyw2f.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-5sexkty0.js";
+import"./cli-gq12jc1m.js";
 import"./cli-4j2mrzag.js";
 import"./cli-e15jhafb.js";
 import"./cli-7wmybrt5.js";

package/dist/{assistant-54jkns28.js → assistant-8sd2b21b.js}

@@ -1,23 +1,23 @@
 import {
   bufferThreadMessage,
   wasEventSeen
-} from "./cli-qh6dfg7b.js";
+} from "./cli-j59bj3vs.js";
 import {
   hasOtherUserMention
-} from "./cli-4ntm7f2r.js";
+} from "./cli-0kkggfr9.js";
 import {
   require_dist
-} from "./cli-ctdx3h19.js";
+} from "./cli-kyqs14qe.js";
 import"./cli-rkndnn90.js";
 import"./cli-b0p7rfnd.js";
 import {
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-zn7x1nkq.js";
-import"./cli-xv365pmn.js";
+} from "./cli-f6c6y7fw.js";
+import"./cli-d2eyq90a.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-wejdajv9.js";
+} from "./cli-th08nm8p.js";
 import"./cli-ma04faw5.js";
 import"./cli-wspgs9bt.js";
 import"./cli-dh55d5fg.js";
@@ -30,11 +30,11 @@ import {
   init_resolver,
   resolveTemplate,
   slackContextKey
-} from "./cli-rp04sjbc.js";
+} from "./cli-383wyw2f.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-5sexkty0.js";
+import"./cli-gq12jc1m.js";
 import"./cli-4j2mrzag.js";
 import"./cli-e15jhafb.js";
 import"./cli-7wmybrt5.js";

package/dist/{boot-reembed-m3cpwet0.js → boot-reembed-7bs0d0sj.js}

@@ -1,17 +1,17 @@
 import {
   embedScript,
   embeddingProvider
-} from "./cli-9rrpjvan.js";
-import"./cli-65anxt77.js";
+} from "./cli-4cb3p8pj.js";
+import"./cli-0ap79nha.js";
 import"./cli-q25ejbyn.js";
 import {
   getDb,
   init_db
-} from "./cli-rp04sjbc.js";
+} from "./cli-383wyw2f.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-5sexkty0.js";
+import"./cli-gq12jc1m.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{boot-reembed-s0mftrn2.js → boot-reembed-eh18r04f.js}

@@ -3,16 +3,16 @@ import {
   getEmbeddingProvider,
   getMemoryStore,
   init_constants
-} from "./cli-65anxt77.js";
+} from "./cli-0ap79nha.js";
 import"./cli-q25ejbyn.js";
 import {
   getDb,
   init_db
-} from "./cli-rp04sjbc.js";
+} from "./cli-383wyw2f.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-5sexkty0.js";
+import"./cli-gq12jc1m.js";
 import"./cli-4j2mrzag.js";
 import"./cli-p9swy5t3.js";
 

package/dist/{boot-scrub-logs-btj144vd.js → boot-scrub-logs-v8ch000n.js}

@@ -1,11 +1,11 @@
 import {
   getDb,
   init_db
-} from "./cli-rp04sjbc.js";
+} from "./cli-383wyw2f.js";
 import"./cli-z2zcxes1.js";
 import"./cli-bw80ck94.js";
 import"./cli-xz9aq0rf.js";
-import"./cli-5sexkty0.js";
+import"./cli-gq12jc1m.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-65anxt77.js → cli-0ap79nha.js}

@@ -6,7 +6,7 @@ import {
   getDb,
   init_db,
   isSqliteVecAvailable
-} from "./cli-rp04sjbc.js";
+} from "./cli-383wyw2f.js";
 import {
   __esm,
   __export,

package/dist/{cli-4ntm7f2r.js → cli-0kkggfr9.js}

@@ -3,7 +3,7 @@ import {
   getAgentWorkingOnThread,
   getAllAgents,
   init_db
-} from "./cli-rp04sjbc.js";
+} from "./cli-383wyw2f.js";
 
 // src/slack/router.ts
 init_db();

package/dist/{cli-rp04sjbc.js → cli-383wyw2f.js}

@@ -26,7 +26,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-5sexkty0.js";
+} from "./cli-gq12jc1m.js";
 import {
   init_secret_scrubber,
   scrubSecrets
@@ -2378,6 +2378,220 @@ var init_asset_key_audit = __esm(() => {
   ];
 });
 
+// src/scripts-runtime/credential-broker/types.ts
+function placeholderForConfigKey(configKey) {
+  return `${REDACTED_PLACEHOLDER_PREFIX}${configKey}]`;
+}
+function normalizeCredentialBindingsDocument(input, resolveLegacyOAuthProvider, defaultScope) {
+  const document = Array.isArray(input) ? input : input && typeof input === "object" && Array.isArray(input.bindings) ? input.bindings : [];
+  return document.flatMap((raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+      return [];
+    const candidate = { ...raw };
+    if (defaultScope !== undefined && candidate.scope == null) {
+      candidate.scope = defaultScope;
+    }
+    if (candidate.authKind === "oauth" && typeof candidate.oauthAuthorizationId !== "string" && typeof candidate.oauthProvider === "string") {
+      const authorizationId = resolveLegacyOAuthProvider?.(candidate.oauthProvider);
+      if (!authorizationId)
+        return [];
+      candidate.oauthAuthorizationId = authorizationId;
+    }
+    const parsed = CredentialBindingSchema.safeParse(candidate);
+    return parsed.success ? [parsed.data] : [];
+  });
+}
+var CREDENTIAL_BINDINGS_CONFIG_KEY = "SCRIPT_CREDENTIAL_BINDINGS", REDACTED_PLACEHOLDER_PREFIX = "[REDACTED:", CredentialBindingScopeSchema, CredentialBindingAuthKindSchema, CredentialBindingSchema, CredentialBindingsDocumentSchema;
+var init_types2 = __esm(() => {
+  init_zod();
+  CredentialBindingScopeSchema = _enum(["global", "agent", "repo"]);
+  CredentialBindingAuthKindSchema = _enum(["config", "oauth"]);
+  CredentialBindingSchema = object({
+    configKey: string().min(1).max(255),
+    allowedHosts: array(string().min(1)).min(1),
+    headerTemplate: string().min(1).optional(),
+    queryTemplate: string().min(1).optional(),
+    scope: CredentialBindingScopeSchema.default("global"),
+    scopeId: string().nullable().optional(),
+    active: boolean().default(true),
+    authKind: CredentialBindingAuthKindSchema.default("config"),
+    oauthAuthorizationId: string().min(1).max(255).optional()
+  }).refine((binding) => binding.headerTemplate || binding.queryTemplate, {
+    message: "At least one of headerTemplate or queryTemplate is required."
+  }).refine((binding) => binding.authKind !== "oauth" || !!binding.oauthAuthorizationId, {
+    message: "oauthAuthorizationId is required when authKind is oauth.",
+    path: ["oauthAuthorizationId"]
+  });
+  CredentialBindingsDocumentSchema = union([
+    array(CredentialBindingSchema),
+    object({ bindings: array(CredentialBindingSchema) })
+  ]);
+});
+
+// src/scripts-runtime/credential-broker/broker.ts
+function bindingHasPlaceholder(binding) {
+  const placeholder = placeholderForConfigKey(binding.configKey);
+  return binding.headerTemplate?.includes(placeholder) === true || binding.queryTemplate?.includes(placeholder) === true;
+}
+function reasonFromError(err) {
+  const reason = err.reason;
+  return typeof reason === "string" && reason.length > 0 ? reason : "refresh_failed";
+}
+function labelFromError(err) {
+  const label = err.authorizationLabel;
+  return typeof label === "string" && label.length > 0 ? label : undefined;
+}
+
+class CredentialBroker {
+  store;
+  resolveConfigCredential;
+  defaults;
+  resolveOAuthCredential;
+  constructor(store, resolveConfigCredential, defaults = [], resolveOAuthCredential) {
+    this.store = store;
+    this.resolveConfigCredential = resolveConfigCredential;
+    this.defaults = defaults;
+    this.resolveOAuthCredential = resolveOAuthCredential;
+  }
+  async resolveBindingsWithFailures(context) {
+    const merged = [...this.defaults, ...this.store.listActiveBindings(context)];
+    const resolved = [];
+    const failed = [];
+    const seen = new Set;
+    const failedSeen = new Set;
+    for (const binding of merged) {
+      if (binding.active === false)
+        continue;
+      if (!bindingHasPlaceholder(binding))
+        continue;
+      let value;
+      if (binding.authKind === "oauth") {
+        if (!binding.oauthAuthorizationId)
+          continue;
+        try {
+          value = await this.resolveOAuthCredential?.(binding.oauthAuthorizationId);
+        } catch (err) {
+          const placeholder = placeholderForConfigKey(binding.configKey);
+          const failKey = [placeholder, [...binding.allowedHosts].sort().join(",")].join("\x00");
+          if (!failedSeen.has(failKey)) {
+            failedSeen.add(failKey);
+            const label = labelFromError(err);
+            failed.push({
+              placeholder,
+              allowedHosts: binding.allowedHosts,
+              reason: reasonFromError(err),
+              ...label ? { authorizationLabel: label } : {}
+            });
+          }
+          continue;
+        }
+      } else {
+        value = this.resolveConfigCredential(binding.configKey);
+      }
+      if (!value)
+        continue;
+      const dedupeKey = [
+        binding.configKey,
+        [...binding.allowedHosts].sort().join(","),
+        binding.headerTemplate ?? "",
+        binding.queryTemplate ?? "",
+        binding.scope,
+        binding.scopeId ?? ""
+      ].join("\x00");
+      if (seen.has(dedupeKey))
+        continue;
+      seen.add(dedupeKey);
+      resolved.push({
+        ...binding,
+        placeholder: placeholderForConfigKey(binding.configKey),
+        value
+      });
+    }
+    return { resolved, failed };
+  }
+  async resolveBindings(context) {
+    return (await this.resolveBindingsWithFailures(context)).resolved;
+  }
+}
+var init_broker = __esm(() => {
+  init_types2();
+});
+
+// src/scripts-runtime/credential-broker/default-bindings.ts
+var DEFAULT_CREDENTIAL_BINDINGS;
+var init_default_bindings = __esm(() => {
+  DEFAULT_CREDENTIAL_BINDINGS = [
+    {
+      configKey: "GITHUB_TOKEN",
+      allowedHosts: ["api.github.com"],
+      headerTemplate: "Authorization: Bearer [REDACTED:GITHUB_TOKEN]",
+      scope: "global",
+      scopeId: null,
+      active: true,
+      authKind: "config"
+    }
+  ];
+});
+
+// src/scripts-runtime/credential-broker/fetch-patch.ts
+var init_fetch_patch = () => {};
+
+// src/scripts-runtime/credential-broker/index.ts
+var init_credential_broker = __esm(() => {
+  init_broker();
+  init_default_bindings();
+  init_fetch_patch();
+  init_types2();
+});
+
+// src/be/connection-bindings-blob-migration.ts
+function migrateLegacyCredentialBindingBlob(database) {
+  const rows = database.prepare("SELECT id, scope, scopeId, value FROM swarm_config WHERE key = ?").all(CREDENTIAL_BINDINGS_CONFIG_KEY);
+  if (rows.length === 0)
+    return 0;
+  const resolveLegacyOAuthProvider = (provider) => {
+    const row = database.prepare(`SELECT z.id
+         FROM oauth_authorizations z
+         JOIN oauth_apps a ON a.id = z.appId
+         WHERE a.provider = ? AND a.mcpServerId IS NULL AND z.label = 'default'
+         ORDER BY a.createdAt ASC, a.id ASC
+         LIMIT 1`).get(provider);
+    return row?.id;
+  };
+  const insert = database.prepare(`INSERT OR IGNORE INTO script_credential_bindings
+       (id, config_key, allowed_hosts_json, header_template, query_template, scope, scope_id,
+        active, auth_kind, oauth_authorization_id, source, managed_by_connection_id,
+        created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'migration', NULL,
+             datetime('now'), datetime('now'))`);
+  let imported = 0;
+  const tx = database.transaction(() => {
+    for (const config of rows) {
+      let bindings;
+      try {
+        bindings = normalizeCredentialBindingsDocument(JSON.parse(config.value), resolveLegacyOAuthProvider, config.scope);
+      } catch (err) {
+        console.warn(`[credential-bindings] Skipping unparseable SCRIPT_CREDENTIAL_BINDINGS entry (config id ${config.id}, scope ${config.scope}): ${scrubSecrets(err instanceof Error ? err.message : String(err))}`);
+        continue;
+      }
+      for (const binding of bindings) {
+        const scope = binding.scope ?? config.scope;
+        const scopeId = binding.scopeId ?? config.scopeId ?? null;
+        insert.run(crypto.randomUUID(), binding.configKey, JSON.stringify(binding.allowedHosts), binding.headerTemplate ?? null, binding.queryTemplate ?? null, scope, scope === "global" ? null : scopeId, binding.active === false ? 0 : 1, binding.authKind, binding.oauthAuthorizationId ?? null);
+        imported += 1;
+      }
+    }
+    database.prepare("DELETE FROM swarm_config WHERE key = ?").run(CREDENTIAL_BINDINGS_CONFIG_KEY);
+  });
+  tx();
+  console.log(`[credential-bindings] Migrated ${imported} legacy SCRIPT_CREDENTIAL_BINDINGS entr(ies) to relational rows and retired the blob key.`);
+  return imported;
+}
+var init_connection_bindings_blob_migration = __esm(() => {
+  init_credential_broker();
+  init_secret_scrubber();
+});
+
 // src/be/crypto/secrets-cipher.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 function assertKey(key) {
@@ -2692,6 +2906,45 @@ var init_runner = __esm(() => {
   ];
 });
 
+// src/be/oauth-encryption-backfill.ts
+function autoEncryptLegacyOAuthSecrets(database) {
+  const apps = database.prepare(`SELECT id, clientSecret
+       FROM oauth_apps
+       WHERE clientSecretEncrypted = 0 AND clientSecret IS NOT NULL`).all();
+  const authorizations = database.prepare(`SELECT id, accessToken, refreshToken
+       FROM oauth_authorizations
+       WHERE tokensEncrypted = 0`).all();
+  if (apps.length === 0 && authorizations.length === 0) {
+    console.log("[oauth-encryption] No plaintext OAuth secrets to migrate.");
+    return { appsEncrypted: 0, authorizationsEncrypted: 0 };
+  }
+  const key = getEncryptionKey();
+  const updateApp = database.prepare(`UPDATE oauth_apps
+     SET clientSecret = ?, clientSecretEncrypted = 1,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND clientSecretEncrypted = 0`);
+  const updateAuthorization = database.prepare(`UPDATE oauth_authorizations
+     SET accessToken = ?, refreshToken = ?, tokensEncrypted = 1,
+         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+     WHERE id = ? AND tokensEncrypted = 0`);
+  database.transaction(() => {
+    for (const app of apps) {
+      updateApp.run(encryptSecret(app.clientSecret, key), app.id);
+    }
+    for (const authorization of authorizations) {
+      updateAuthorization.run(encryptSecret(authorization.accessToken, key), authorization.refreshToken == null ? null : encryptSecret(authorization.refreshToken, key), authorization.id);
+    }
+  })();
+  console.log(`[oauth-encryption] Migrated ${apps.length} app secret(s) and ${authorizations.length} authorization token set(s).`);
+  return {
+    appsEncrypted: apps.length,
+    authorizationsEncrypted: authorizations.length
+  };
+}
+var init_oauth_encryption_backfill = __esm(() => {
+  init_crypto();
+});
+
 // src/prompts/session-templates.ts
 var init_session_templates = __esm(() => {
   init_registry();
@@ -4661,15 +4914,34 @@ function initDb(dbPath = "./agent-swarm-db.sqlite") {
   seedContextVersions();
   configureDbResolver(resolvePromptTemplate);
   seedDefaultTemplates();
-  const hasExistingEncryptedSecrets = (database.prepare("SELECT EXISTS(SELECT 1 FROM swarm_config WHERE isSecret = 1 AND encrypted = 1) as present").get()?.present ?? 0) === 1;
+  const hasExistingEncryptedSecrets = (database.prepare(`SELECT EXISTS(
+           SELECT 1 FROM swarm_config WHERE isSecret = 1 AND encrypted = 1
+           UNION ALL
+           SELECT 1 FROM oauth_apps
+             WHERE clientSecretEncrypted = 1 AND clientSecret IS NOT NULL
+           UNION ALL
+           SELECT 1 FROM oauth_authorizations WHERE tokensEncrypted = 1
+         ) AS present`).get()?.present ?? 0) === 1;
   const userProvidedKey = !!(process.env.SECRETS_ENCRYPTION_KEY?.length || process.env.SECRETS_ENCRYPTION_KEY_FILE?.length);
   resolveEncryptionKey(dbPath, { allowGenerate: !hasExistingEncryptedSecrets });
+  try {
+    autoEncryptLegacyOAuthSecrets(database);
+  } catch (err) {
+    console.error(`[oauth-encryption] FATAL: failed to auto-encrypt legacy OAuth secrets: ${err.message}`);
+    throw err;
+  }
   try {
     autoEncryptLegacyPlaintextSecrets(database, dbPath, { createBackup: !userProvidedKey });
   } catch (err) {
     console.error(`[secrets] FATAL: failed to auto-encrypt legacy secrets: ${err.message}`);
     throw err;
   }
+  try {
+    migrateLegacyCredentialBindingBlob(database);
+  } catch (err) {
+    console.error(`[credential-bindings] FATAL: failed to migrate legacy credential binding blob: ${err.message}`);
+    throw err;
+  }
   return db;
 }
 function getDb(path2) {
@@ -11143,9 +11415,11 @@ var init_db = __esm(() => {
   init_request_auth_context();
   init_secret_scrubber();
   init_asset_key_audit();
+  init_connection_bindings_blob_migration();
   init_crypto();
   init_date_utils();
   init_runner();
+  init_oauth_encryption_backfill();
   init_seed_prompt_templates();
   init_swarm_config_guard();
   init_task_lifecycle_events();
@@ -11243,4 +11517,4 @@ var init_db = __esm(() => {
   };
 });
 
-export { normalizeAssetKey, parseAssetKey, canWriteAssetKey, init_key, interpolate, deepInterpolate, init_template, registerTemplate, getTemplateDefinition, getAllTemplateDefinitions, init_registry, configureHttpResolver, resolveTemplate, resolveTemplateAsync, init_resolver, slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, initTelemetry, telemetry, init_telemetry, AssetKeySchema, AssetEntityTypeSchema, ModelTierSchema, ReasoningEffortSchema, splitLegacyModelAlias, resolveTaskModelSelection, AgentTaskStatusSchema, isTerminalTaskStatus, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, AttachmentInputSchema, TaskAttachmentSchema, InboxItemTypeSchema, InboxItemStatusSchema, FavoriteItemTypeSchema, TaskTemplateKindSchema, AgentSchema, AgentLatestModelSchema, AgentCredStatusSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, ResumeReasonSchema, AgentLogSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, ScheduledTaskTargetTypeSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, PageContentTypeSchema, PageAuthModeSchema, MetricDefinitionSchema, MetricVersionSchema, WorkflowRunStatusSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptApiAuthModeSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, KvValueTypeSchema, KvNamespaceSchema, KvKeySchema, KvEntrySchema, init_types, setRequestAuth, getRequestAuth, getCurrentRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, init_session_templates, init_templates, init_templates2 as init_templates1, isReservedConfigKey, reservedKeyError, validateConfigValue, init_swarm_config_guard, onTaskStarted, init_task_lifecycle_events, generateDefaultClaudeMd, generateDefaultSoulMd, generateDefaultIdentityMd, generateDefaultToolsMd, init_defaults, isSqliteVecAvailable, initDb, getDb, closeDb, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, agentQueries, updateAgentCredentialState, createAgent, getAgentById, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, taskQueries, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, getTaskById, markTaskSlackReplySent, setSlackMessageTracking, getChildTasks, hasNonTerminalResumeChild, hasNonTerminalRerouteDecisionChild, updateTaskClaudeSessionId, updateTaskVcs, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, completeTask, failTask, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, insertTaskAttachment, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, getAgentWithTasks, getAllAgentsWithTasks, logQueries, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, releaseStaleReviewingTasks, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, sessionLogQueries, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, getSessionCostSummary, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, upsertKv, deleteKv, KvTypeCollisionError, incrKv, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };
+export { normalizeAssetKey, parseAssetKey, canWriteAssetKey, init_key, interpolate, deepInterpolate, init_template, registerTemplate, getTemplateDefinition, getAllTemplateDefinitions, init_registry, configureHttpResolver, resolveTemplate, resolveTemplateAsync, init_resolver, slackContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, initTelemetry, telemetry, init_telemetry, AssetKeySchema, AssetEntityTypeSchema, ModelTierSchema, ReasoningEffortSchema, splitLegacyModelAlias, resolveTaskModelSelection, AgentTaskStatusSchema, isTerminalTaskStatus, AgentTaskSourceSchema, ProviderNameSchema, FollowUpConfigSchema, AgentTaskSchema, AttachmentInputSchema, TaskAttachmentSchema, InboxItemTypeSchema, InboxItemStatusSchema, FavoriteItemTypeSchema, TaskTemplateKindSchema, AgentSchema, AgentLatestModelSchema, AgentCredStatusSchema, ChannelTypeSchema, ChannelSchema, ChannelMessageSchema, ServiceStatusSchema, ServiceSchema, ResumeReasonSchema, AgentLogSchema, EventCategorySchema, EventStatusSchema, EventSourceSchema, EventNameSchema, ScheduledTaskTargetTypeSchema, SwarmConfigScopeSchema, SwarmConfigSchema, RepoGuidelinesSchema, RepoHooksSchema, SwarmRepoSchema, AgentMemoryScopeSchema, AgentMemorySourceSchema, AgentMemorySchema, WorkflowDefinitionSchema, WorkflowNodePatchSchema, WorkflowPatchSchema, TriggerConfigSchema, CooldownConfigSchema, InputValueSchema, PageContentTypeSchema, PageAuthModeSchema, MetricDefinitionSchema, MetricVersionSchema, WorkflowRunStatusSchema, ScriptRunStatusSchema, TERMINAL_SCRIPT_RUN_STATUSES, PromptTemplateScopeSchema, PromptTemplateStateSchema, PromptTemplateSchema, PromptTemplateHistorySchema, ScriptScopeSchema, ScriptFsModeSchema, ScriptApiAuthModeSchema, ContextSnapshotEventTypeSchema, ContextFormulaSchema, BudgetScopeSchema, BudgetSchema, PricingProviderSchema, PricingTokenClassSchema, PricingRowSchema, BudgetRefusalCauseSchema, BudgetRefusalNotificationSchema, KvValueTypeSchema, KvNamespaceSchema, KvKeySchema, KvEntrySchema, init_types, setRequestAuth, getRequestAuth, getCurrentRequestAuth, init_request_auth_context, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, normalizeDate, normalizeDateRequired, init_date_utils, init_session_templates, init_templates, init_templates2 as init_templates1, isReservedConfigKey, reservedKeyError, validateConfigValue, init_swarm_config_guard, onTaskStarted, init_task_lifecycle_events, generateDefaultClaudeMd, generateDefaultSoulMd, generateDefaultIdentityMd, generateDefaultToolsMd, init_defaults, isSqliteVecAvailable, initDb, getDb, closeDb, computeContentHash, createContextVersion, getLatestContextVersion, getContextVersion, getContextVersionHistory, agentQueries, updateAgentCredentialState, createAgent, getAgentById, getAllAgents, getLeadAgent, updateAgentStatus, updateAgentMaxTasks, updateAgentProvider, setAgentHarnessProvider, updateAgentCredStatus, listAgentsWithCredStatusByProvider, getAgentHarnessProviders, updateAgentActivity, MAX_EMPTY_POLLS, incrementEmptyPollCount, resetEmptyPollCount, shouldBlockPolling, deleteAgent, getActiveTaskCount, hasCapacity, getRemainingCapacity, updateAgentStatusFromCapacity, isPoolAffinityEnforcementEnabled, buildRoutingAffinityFromAgent, isAgentEligibleForTask, taskQueries, createTask, getPendingTaskForAgent, assignUnassignedTaskPending, startTask, getTaskById, markTaskSlackReplySent, setSlackMessageTracking, getChildTasks, hasNonTerminalResumeChild, hasNonTerminalRerouteDecisionChild, updateTaskClaudeSessionId, updateTaskVcs, getTasksByAgentId, getAgentCurrentTask, getTasksByStatus, findTaskByVcs, findTaskByGitHub, getAllTasks, getTasksCount, getTaskStats, getCompletedSlackTasks, getRecentlyFinishedWorkerTasks, markTasksNotified, resetTasksNotified, getInProgressSlackTasks, getInProgressTasksByContextKey, findExistingLinearTrackerContextWork, getLatestTaskByContextKey, getAgentWorkingOnThread, getLatestActiveTaskInThread, getMostRecentTaskInThread, findCompletedTaskInThread, findRecentCancelledTaskInThread, completeTask, failTask, cancelTask, supersedeTask, backfillSupersedeTaskResumeTaskId, pauseTask, resumeTask, getPausedTasksForAgent, getOrphanedInProgressTasksForAgent, resetOrphanedInProgressTasksForAgent, getRecentlyCancelledTasksForAgent, deleteTask, updateTaskProgress, insertTaskAttachment, getAssetKeyMappingByProvider, upsertAssetKeyMapping, getAssetKeyMapping, listAssetSummaries, moveAssetKey, deleteTaskAttachment, replaceTaskAttachment, getTaskAttachments, getAgentWithTasks, getAllAgentsWithTasks, logQueries, createLogEntry, getLogsByAgentId, getLogsByTaskId, getLogsByTaskIdChronological, getLogsByEventType, getAllLogs, findRecentSimilarTasks, createTaskExtended, claimTask, releaseTask, acceptTask, rejectTask, moveTaskToBacklog, moveTaskFromBacklog, releaseStaleReviewingTasks, getOfferedTasksForAgent, claimOfferedTask, getUnassignedTasksCount, getUnassignedTaskIds, getUnassignedTaskIdsForAgent, checkDependencies, getDependentTasks, cascadeFailDependents, updateAgentProfile, updateAgentName, createChannel, getMessageById, getChannelById, getChannelByName, getAllChannels, deleteChannel, postMessage, getChannelMessages, updateReadState, getLastReadAt, getUnreadMessages, getMentionsForAgent, getInboxSummary, claimMentions, releaseMentionProcessing, releaseStaleMentionProcessing, createService, getServiceById, getServiceByAgentAndName, getServicesByAgentId, getAllServices, updateServiceStatus, deleteService, upsertService, deleteServicesByAgentId, sessionLogQueries, createSessionLogs, getSessionLogsByTaskId, getSessionLogsBySession, createSessionCost, getSessionCostsByTaskId, getSessionCostsByAgentId, getAllSessionCosts, getSessionCostsFiltered, getSessionCostSummary, getDashboardCostSummary, createInboxMessage, getInboxMessageById, getUnreadInboxMessages, claimInboxMessages, markInboxMessageRead, markInboxMessageResponded, markInboxMessageDelegated, releaseStaleProcessingInbox, getConcurrentContext, getScheduledTasks, getScheduledTaskById, getScheduledTaskByName, createScheduledTask, updateScheduledTask, deleteScheduledTask, getDueScheduledTasks, autoEncryptLegacyPlaintextSecrets, maskSecrets, getSwarmConfigs, getInjectableGlobalConfigs, getSwarmConfigById, getSwarmConfigLookupById, upsertSwarmConfig, deleteSwarmConfig, deleteSwarmConfigByKey, getResolvedConfig, getSwarmRepos, getSwarmRepoById, getSwarmRepoByName, getSwarmRepoByUrl, createSwarmRepo, updateSwarmRepo, deleteSwarmRepo, getAgentMailInboxMapping, getAgentMailInboxMappingsByAgent, getAllAgentMailInboxMappings, createAgentMailInboxMapping, deleteAgentMailInboxMapping, findTaskByAgentMailThread, insertActiveSession, deleteActiveSession, deleteActiveSessionById, getActiveSessions, heartbeatActiveSession, cleanupStaleSessions, cleanupAgentSessions, updateActiveSessionProviderSessionId, getActiveSessionForTask, reassociateSessionLogs, getStalledInProgressTasks, getStalePinnedResumes, failPendingResumeIfUnclaimed, getIdleWorkersWithCapacity, getUnassignedPoolTasks, getStaleUnassignedAffinityTasks, getRecentFailedTasks, getRecentCompletedCount, getRecentFailedCount, createWorkflow, getWorkflow, listWorkflows, updateWorkflow, deleteWorkflow, getWorkflowsByScheduleId, createWorkflowRun, getWorkflowRun, updateWorkflowRun, listWorkflowRuns, createWorkflowRunStep, getWorkflowRunStep, updateWorkflowRunStep, getWorkflowRunStepsByRunId, getStuckWorkflowRuns, getLastSuccessfulRun, getLastRunStart, getRetryableSteps, getCompletedStepNodeIds, getTaskByWorkflowRunStepId, getStepByIdempotencyKey, getStepCountForNode, getLatestStepForNode, createWorkflowVersion, getWorkflowVersions, getWorkflowVersion, createPage, getPage, getPageBySlug, getLatestPageBySlug, listPagesByAgent, listAllPages, countAllPages, countPagesByAgent, updatePage, deletePage, incrementPageViewCount, createPageVersion, getPageVersions, getPageVersion, createMetric, getMetric, getMetricBySlug, listMetricsByAgent, listAllMetrics, countAllMetrics, countMetricsByAgent, updateMetric, deleteMetric, createMetricVersion, getMetricVersions, getMetricVersion, getPromptTemplates, getPromptTemplateById, upsertPromptTemplate, deletePromptTemplate, resetPromptTemplateToDefault, getPromptTemplateHistory, resolvePromptTemplate, checkoutPromptTemplate, getAllChannelActivityCursors, getChannelActivityCursor, upsertChannelActivityCursor, createApprovalRequest, getApprovalRequestById, resolveApprovalRequest, updateApprovalRequestNotifications, listApprovalRequests, getStuckApprovalRuns, getApprovalRequestByStepId, getExpiredPendingApprovals, createWaitState, getWaitStateById, getWaitStateByStepId, getDueWaitStates, getPendingEventWaitNames, getPendingWaitsByEvent, resolveWaitState, getStuckWaitRuns, SKILL_FILE_LIMITS, normalizeSkillFilePath, createSkill, updateSkill, listSkillFileManifest, getSkillFiles, getSkillFile, upsertSkillFile, upsertSkillFiles, deleteSkillFile, deleteSkill, getSkillById, getSkillByName, listSkills, searchSkills, installSkill, getSystemDefaultSkills, installSystemDefaultSkillsForAgent, uninstallSkill, getAgentSkills, toggleAgentSkill, createMcpServer, updateMcpServer, deleteMcpServer, getMcpServerById, getMcpServerByName, listMcpServers, installMcpServer, uninstallMcpServer, getAgentMcpServers, createContextSnapshot, getContextSnapshotsByTaskId, getContextSnapshotsBySessionId, getContextSummaryByTaskId, getAvailableKeyIndices, recordKeyUsage, markKeyRateLimited, recordKeyRateLimitWindows, setApiKeyName, clearKeyRateLimit, getKeyStatuses, getKeyCostSummary, getUserById, getAllUsers, createUser, updateUser, deleteUser, listInboxState, upsertInboxState, listFavorites, listUserFavorites, getFavoriteItemIdSet, setFavorite, setUserFavorite, withFavoriteFlags, listTaskTemplates, getRootTaskChain, listRecentSessions, countSessions, getBudget, getBudgets, upsertBudget, deleteBudget, getAllPricingRows, getPricingRows, getActivePricingRow, insertPricingRow, deletePricingRow, getDailySpendForAgent, getDailySpendGlobal, getDailySpendForUser, recordBudgetRefusalNotification, getBudgetRefusalNotification, getRecentBudgetRefusalNotifications, hasBudgetRefusalNotificationToday, setBudgetRefusalFollowUpTaskId, getLiveAgentCounts, getInstanceActivity, getSwarmMetrics, hasFirstCompletedTask, getKv, upsertKv, deleteKv, KvTypeCollisionError, incrKv, listKv, countKv, createScriptRun, recordInlineScriptRun, getScriptRun, getScriptRunByIdempotencyKey, listScriptRuns, countScriptRuns, countActiveScriptRuns, updateScriptRun, getRunningScriptRuns, getScriptRunJournalStep, upsertScriptRunJournalStep, listScriptRunJournalSteps, countScriptRunJournalSteps, countScriptRunJournalAgentTaskSteps, exports_db, init_db };

package/dist/{cli-9rrpjvan.js → cli-4cb3p8pj.js}

@@ -4,11 +4,11 @@ import {
   getEmbeddingProvider,
   init_embedding,
   serializeEmbedding
-} from "./cli-65anxt77.js";
+} from "./cli-0ap79nha.js";
 import {
   getDb,
   init_db
-} from "./cli-rp04sjbc.js";
+} from "./cli-383wyw2f.js";
 import {
   init_secret_scrubber,
   scrubSecrets