@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/dist/{cli-j6kpj9az.js → cli-ee9gtz70.js}

@@ -12,7 +12,7 @@ import {
   generateRandomCodeVerifier,
   generateRandomState,
   oauthAppRowToProviderConfig
-} from "./cli-388egyf6.js";
+} from "./cli-6razj6t4.js";
 import {
   CredentialBroker,
   DEFAULT_CREDENTIAL_BINDINGS,
@@ -36,6 +36,9 @@ import {
   init_oauth,
   init_quickjs_pool_config,
   init_secret_registry,
+  init_swarm_config_guard,
+  isApiOnlyConfigKey,
+  isInternalConfigKey,
   normalizeDateRequired,
   oauthSecretName,
   placeholderForConfigKey,
@@ -46,11 +49,11 @@ import {
   updateAuthorizationTokens,
   upsertAuthorization,
   upsertSwarmConfig
-} from "./cli-tgpfnm6r.js";
+} from "./cli-ef1hg1wv.js";
 import {
   defaultAssetKey,
   init_key
-} from "./cli-hsem16hb.js";
+} from "./cli-cgtksawx.js";
 import {
   init_zod
 } from "./cli-sd0mxa3c.js";
@@ -69,6 +72,14 @@ import {
   union,
   unknown
 } from "./cli-w5e1d1vv.js";
+import {
+  init_node_env,
+  isDevOrTestNodeEnv
+} from "./cli-p0sg24zp.js";
+import {
+  getMcpBaseUrl,
+  init_constants
+} from "./cli-gd4favx9.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
@@ -78,12 +89,13 @@ import {
   init_api_key
 } from "./cli-a1b9b32n.js";
 import {
+  createValueScrubber,
   init_secret_scrubber,
   refreshSecretScrubberCache,
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-d161g69q.js";
+} from "./cli-p1x85d2t.js";
 import {
   __commonJS,
   __require,
@@ -175184,6 +175196,7 @@ var require_dist = __commonJS(function(exports) {
 
 // src/scripts-runtime/loader.ts
 init_api_key();
+init_constants();
 init_secret_scrubber();
 
 // src/scripts-runtime/egress-secrets.ts
@@ -175780,7 +175793,7 @@ async function buildConfigPayload(input) {
       apiKey: { value: apiKey, isSecret: true },
       agentId: { value: input.agentId, isSecret: false },
       mcpBaseUrl: {
-        value: input.mcpBaseUrl ?? process.env.MCP_BASE_URL ?? "http://localhost:3013",
+        value: input.mcpBaseUrl ?? getMcpBaseUrl(),
         isSecret: false
       },
       ...input.runtimeInstanceId ? { runtimeInstanceId: { value: input.runtimeInstanceId, isSecret: false } } : {}
@@ -175804,12 +175817,13 @@ async function runScript(input) {
       error: "executor_error"
     };
   }
+  const runSecrets = createValueScrubber(Object.entries(input.userConfig ?? {}).filter(([, entry]) => entry.isSecret).map(([key, entry]) => ({ value: entry.value, name: `config:${key}` })));
   const imports = validateScriptImports(input.source);
   if (!imports.ok) {
     return {
       result: undefined,
       stdout: "",
-      stderr: imports.diagnostic,
+      stderr: scrubSecrets(runSecrets.text(imports.diagnostic)),
       truncated: { stdout: false, stderr: false },
       durationMs: 0,
       exitCode: 1,
@@ -175840,10 +175854,10 @@ async function runScript(input) {
   }
   return {
     ...output,
-    result: scrubObject(output.result),
-    stdout: scrubSecrets(output.stdout),
-    stderr: scrubSecrets(output.stderr),
-    ...output.runtimeError ? { runtimeError: scrubObject(output.runtimeError) } : {}
+    result: scrubObject(runSecrets.object(output.result)),
+    stdout: scrubSecrets(runSecrets.text(output.stdout)),
+    stderr: scrubSecrets(runSecrets.text(output.stderr)),
+    ...output.runtimeError ? { runtimeError: scrubObject(runSecrets.object(output.runtimeError)) } : {}
   };
 }
 
@@ -175854,6 +175868,7 @@ init_oauth();
 
 // src/oauth/mcp-wrapper.ts
 init_env_flag();
+init_node_env();
 init_secret_scrubber();
 var PRIVATE_IPV4_BLOCKS = [
   { prefix: "10.", mask: 8 },
@@ -175932,22 +175947,21 @@ function assertUrlSafe(rawUrl, opts = {}) {
   return parsed;
 }
 function publicEndpointSsrfOptions() {
-  const env = "development";
-  const dev = env === "development" || env === "test" || process.env.ALLOW_PRIVATE_NETWORK_URLS === "true";
+  const dev = isDevOrTestNodeEnv() || process.env.ALLOW_PRIVATE_NETWORK_URLS === "true";
   return {
     allowPrivateHosts: dev,
     allowInsecure: dev
   };
 }
-function defaultSsrfOptions() {
+function mcpOAuthSsrfOptions() {
   return {
     allowPrivateHosts: isEnvFlagEnabled("MCP_OAUTH_ALLOW_PRIVATE_HOSTS", false),
-    allowInsecure: true
+    allowInsecure: isDevOrTestNodeEnv()
   };
 }
 var DEFAULT_FETCH_TIMEOUT_MS = 15000;
 async function safeFetch(url, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
-  assertUrlSafe(url, defaultSsrfOptions());
+  assertUrlSafe(url, mcpOAuthSsrfOptions());
   return fetch(url, { ...init, signal: init?.signal ?? AbortSignal.timeout(timeoutMs) });
 }
 async function discoverProtectedResourceMetadata(resourceUrl) {
@@ -176801,6 +176815,82 @@ async function callMcpServerTool(serverId, tool, args, context = {}) {
   return client.callToolRaw(tool, args);
 }
 
+// src/be/sql-connections.ts
+init_db2();
+init_secret_scrubber();
+var SQL_MAX_ROWS = 1000;
+var SQL_MAX_BYTES = 5 * 1024 * 1024;
+var SQL_FETCH_BATCH = 100;
+function assertPostgresDsn(dsn) {
+  if (!URL.canParse(dsn) || !["postgres:", "postgresql:"].includes(new URL(dsn).protocol)) {
+    throw new Error("SQL connection DSN must be a postgres:// or postgresql:// URL.");
+  }
+}
+async function resolveSqlDsn(connection, agentId) {
+  const key = connection.authConfigKey;
+  if (!key)
+    throw new Error("SQL connection has no DSN config key.");
+  const repoId = connection.scope === "repo" ? connection.scopeId ?? undefined : undefined;
+  const dsn = (await getResolvedConfig(agentId, repoId)).find((c) => c.key === key)?.value;
+  if (!dsn)
+    throw new Error(`SQL connection DSN '${key}' is not set.`);
+  registerVolatileSecret(dsn, key);
+  if (URL.canParse(dsn))
+    registerVolatileSecret(decodeURIComponent(new URL(dsn).password), key);
+  assertPostgresDsn(dsn);
+  return dsn;
+}
+var asTemplate = (text) => Object.assign([text], { raw: [text] });
+var defaultExecutor = async (dsn, query, params, take) => {
+  const sql = new Bun.SQL({
+    adapter: "postgres",
+    url: dsn,
+    max: 1,
+    connectionTimeout: 10,
+    connection: { default_transaction_read_only: "on", statement_timeout: 30000 }
+  });
+  try {
+    await sql.begin("read only", async (tx) => {
+      const declare = `declare swarm_sql_cursor no scroll cursor for ${query}`;
+      await (params.length > 0 ? tx.unsafe(declare, params) : tx(asTemplate(declare)));
+      const fetchNext = asTemplate(`fetch ${SQL_FETCH_BATCH} from swarm_sql_cursor`);
+      for (;; ) {
+        const batch = [...await tx(fetchNext)];
+        if (!take(batch) || batch.length < SQL_FETCH_BATCH)
+          return;
+      }
+    });
+  } finally {
+    await sql.close();
+  }
+};
+var sqlExecutorForTesting = null;
+async function runReadOnlyQuery(dsn, query, params = []) {
+  const rows = [];
+  let bytes = 0;
+  let truncated = false;
+  const take = (batch) => {
+    for (const row of batch) {
+      const size = Buffer.byteLength(JSON.stringify(row, (_, v) => typeof v === "bigint" ? v.toString() : v));
+      if (rows.length >= SQL_MAX_ROWS || bytes + size > SQL_MAX_BYTES) {
+        truncated = true;
+        return false;
+      }
+      bytes += size;
+      rows.push(row);
+    }
+    return true;
+  };
+  try {
+    await (sqlExecutorForTesting ?? defaultExecutor)(dsn, query, params, take);
+    return { rows, rowCount: rows.length, truncated };
+  } catch (err) {
+    const code = err.errno;
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(scrubSecrets(typeof code === "string" ? `${message} (SQLSTATE ${code})` : message));
+  }
+}
+
 // src/be/vendored-openapi.ts
 import { readFileSync } from "node:fs";
 import path from "node:path";
@@ -176899,6 +176989,9 @@ var ConnectionAuthInputSchema = exports_external.discriminatedUnion("type", [
     hosts: authHostsSchema
   })
 ]);
+var SqlDsnInputSchema = exports_external.object({ secret: authSecretSchema, configKey: authConfigKeySchema }).refine((dsn) => dsn.secret === undefined !== (dsn.configKey === undefined), {
+  message: "Provide exactly one of `secret` or `configKey` for the SQL DSN."
+});
 function parseJsonArray(value) {
   try {
     const parsed = JSON.parse(value);
@@ -177620,7 +177713,9 @@ function assertConfigKeyNotReserved(auth) {
 function derivedInlineSecretKey(connection) {
   if (!connection)
     return null;
-  if (connection.authType === "none" || connection.authType === "oauth")
+  if (connection.authType === "oauth")
+    return null;
+  if (connection.authType === "none" && connection.kind !== "sql")
     return null;
   const key = connection.authConfigKey;
   return key && DERIVED_INLINE_SECRET_KEY.test(key) ? key : null;
@@ -177781,6 +177876,9 @@ async function upsertScriptConnection(data) {
   if (data.kind === "mcp" && data.auth && data.auth.type !== "none") {
     throw new Error("MCP connections resolve auth through their MCP server; `auth` is not supported.");
   }
+  if (data.kind === "sql" && data.auth && data.auth.type !== "none") {
+    throw new Error("SQL connections authenticate through their DSN; `auth` is not supported.");
+  }
   assertConfigKeyNotReserved(data.auth);
   if (data.kind === "openapi" && existingConnection?.openapiSpecJson && data.openapiSpecJson == null && data.openapiSpecUrl == null && data.openapiSpecSource == null) {
     openapiSpecJson = existingConnection.openapiSpecJson;
@@ -177790,7 +177888,7 @@ async function upsertScriptConnection(data) {
     openapiSpecFetchedAt = existingConnection.openapiSpecFetchedAt;
   }
   const explicitLegacyBinding = data.auth === undefined && data.credentialBindingId !== undefined;
-  const authIntent = data.kind === "mcp" || explicitLegacyBinding ? { type: "none" } : data.auth ?? reconstructAuthFromConnection(existingConnection);
+  const authIntent = data.kind === "mcp" || data.kind === "sql" || explicitLegacyBinding ? { type: "none" } : data.auth ?? reconstructAuthFromConnection(existingConnection);
   let derived = null;
   const explicitBinding = explicitLegacyBinding && data.credentialBindingId ? await getCredentialBindingById(data.credentialBindingId) : null;
   const explicitBindingCredential = explicitBinding ? {
@@ -177913,17 +178011,41 @@ async function upsertScriptConnection(data) {
     generatedRuntimeJson = artifacts.generatedRuntimeJson;
     generatedAt = now;
   }
+  let sqlDsnKey = null;
+  let sqlSecretWrite = null;
+  if (data.kind === "sql") {
+    if (data.sqlDsn?.secret !== undefined) {
+      assertPostgresDsn(data.sqlDsn.secret);
+      sqlDsnKey = `connection.${normalizedSlug}.secret`;
+      sqlSecretWrite = { scope, scopeId, key: sqlDsnKey, value: data.sqlDsn.secret };
+    } else if (data.sqlDsn?.configKey) {
+      assertConfigKeyNotReserved({ type: "bearer", configKey: data.sqlDsn.configKey });
+      sqlDsnKey = data.sqlDsn.configKey;
+    } else {
+      sqlDsnKey = existingConnection?.kind === "sql" ? existingConnection.authConfigKey : null;
+    }
+    if (!sqlDsnKey)
+      throw new Error("SQL connections require `dsn.secret` or `dsn.configKey`.");
+    generatedRuntimeJson = JSON.stringify({ slug: normalizedSlug, kind: "sql", connectionId });
+    generatedTypes = `export interface ${pascal(normalizedSlug)}Api {
+  /** One read-only statement; pass values via params ($1, $2, ...). */
+  query<T = Record<string, JsonValue>>(sql: string, params?: JsonValue[]): Promise<{ rows: T[]; rowCount: number; truncated: boolean }>;
+}`;
+    generatedAt = now;
+  }
   if (data.kind !== "graphql") {
     allowedHosts = data.allowedHosts ?? (effectiveBaseUrl ? [new URL(effectiveBaseUrl).hostname] : []);
   }
   const oldDerivedSecretKey = derivedInlineSecretKey(existingConnection);
-  const newReferencedConfigKey = derived?.configKey ?? explicitBinding?.configKey ?? null;
+  const newReferencedConfigKey = derived?.configKey ?? explicitBinding?.configKey ?? sqlDsnKey ?? null;
   let supersededSecretDeleted = false;
   const writeConnectionAndBinding = () => getDbClient().transaction(async (tx) => {
     await tx.run("PRAGMA defer_foreign_keys = ON");
     if (derived?.secretWrite) {
       await upsertSwarmConfig({ ...derived.secretWrite, isSecret: true });
     }
+    if (sqlSecretWrite)
+      await upsertSwarmConfig({ ...sqlSecretWrite, isSecret: true });
     if (oldDerivedSecretKey && oldDerivedSecretKey !== newReferencedConfigKey) {
       await deleteManagedConnectionSecret({
         scope: existingConnection?.scope ?? scope,
@@ -177964,6 +178086,8 @@ async function upsertScriptConnection(data) {
       credentialBindingId = existingConnection && existingManaged && existingConnection.credentialBindingId === existingManaged.id ? null : existingConnection?.credentialBindingId ?? null;
       authCols = NONE_AUTH_COLUMNS;
     }
+    if (sqlDsnKey)
+      authCols = { ...NONE_AUTH_COLUMNS, authConfigKey: sqlDsnKey };
     const params = [
       normalizedSlug,
       data.displayName ?? null,
@@ -178027,8 +178151,9 @@ async function upsertScriptConnection(data) {
     return row2;
   });
   const row = await writeConnectionAndBinding();
-  if (derived?.secretWrite || supersededSecretDeleted)
+  if (derived?.secretWrite || sqlSecretWrite || supersededSecretDeleted) {
     refreshSecretScrubberCache();
+  }
   return connectionFromRow(row);
 }
 async function refreshScriptConnection(id, userId, callerAgentId) {
@@ -178143,7 +178268,7 @@ async function deleteScriptConnection(id) {
   return deleted;
 }
 function getScriptApiConnectionDescriptors(context = {}) {
-  return listScriptConnections(context).filter((connection) => connection.kind === "openapi" || connection.kind === "graphql").map((connection) => {
+  return listScriptConnections(context).filter((connection) => ["openapi", "graphql", "sql"].includes(connection.kind)).map((connection) => {
     if (!connection.generatedRuntimeJson)
       return null;
     try {
@@ -178165,7 +178290,7 @@ function getScriptMcpConnectionDescriptors(context = {}) {
   }).filter((descriptor) => Boolean(descriptor));
 }
 function getScriptApiTypes(context = {}) {
-  const connections = listScriptConnections(context).filter((connection) => connection.kind === "openapi" || connection.kind === "graphql");
+  const connections = listScriptConnections(context).filter((connection) => ["openapi", "graphql", "sql"].includes(connection.kind));
   const blocks = connections.filter((connection) => connection.generatedTypes).map((connection) => connection.generatedTypes);
   if (blocks.length === 0)
     return `export interface ScriptApiRegistry {}
@@ -178246,13 +178371,25 @@ async function resolveOAuthBindingToken(oauthAuthorizationId) {
 }
 
 // src/be/script-credential-broker.ts
+init_swarm_config_guard();
+
 class RelationalCredentialBindingStore {
   listActiveBindings(context) {
     return listRelationalCredentialBindings(context);
   }
 }
+function toScriptUserConfig(configs) {
+  const exposed = configs.filter((config) => !isApiOnlyConfigKey(config.key) && !isInternalConfigKey(config.key));
+  for (const config of exposed) {
+    if (config.isSecret && config.value) {
+      registerVolatileSecret(config.value, `config:${config.key}`);
+    }
+  }
+  return Object.fromEntries(exposed.map((config) => [config.key, { value: config.value, isSecret: config.isSecret }]));
+}
 async function buildScriptCredentialBindingsWithFailures(input) {
   const resolvedConfigs = await getResolvedConfig(input.agentId, input.repoId);
+  const userConfig = toScriptUserConfig(resolvedConfigs);
   const configMap = new Map(resolvedConfigs.map((config) => [config.key, config.value]));
   const broker = new CredentialBroker(new RelationalCredentialBindingStore, (configKey) => configMap.get(configKey) ?? process.env[configKey], DEFAULT_CREDENTIAL_BINDINGS, (oauthAuthorizationId) => resolveOAuthBindingToken(oauthAuthorizationId));
   const { resolved, failed } = await broker.resolveBindingsWithFailures({
@@ -178262,10 +178399,11 @@ async function buildScriptCredentialBindingsWithFailures(input) {
   for (const binding of resolved) {
     registerVolatileSecret(binding.value, binding.configKey);
   }
-  return { egressSecrets: resolved, failedBindings: failed };
-}
-async function buildScriptCredentialBindings(input) {
-  return (await buildScriptCredentialBindingsWithFailures(input)).egressSecrets;
+  return {
+    egressSecrets: resolved,
+    failedBindings: failed,
+    userConfig
+  };
 }
 
 // src/be/scripts/run-saved.ts
@@ -178292,6 +178430,7 @@ async function runSavedScriptAsAgent(args, deps = {}) {
     agentId: args.agentId,
     egressSecrets: credentials.egressSecrets,
     failedBindings: credentials.failedBindings,
+    userConfig: credentials.userConfig,
     apiConnections: getScriptApiConnectionDescriptors({ agentId: args.agentId }),
     mcpConnections: getScriptMcpConnectionDescriptors({ agentId: args.agentId }),
     ...args.timeoutMs ? { timeoutMs: args.timeoutMs } : {},
@@ -178436,6 +178575,16 @@ var catalog_generated_default = {
     "Metric",
     "Alert",
     "Badge",
+    "Icon",
+    "Progress",
+    "EmptyState",
+    "CopyButton",
+    "Kbd",
+    "Skeleton",
+    "Spinner",
+    "AvatarStack",
+    "Section",
+    "Chips",
     "Table",
     "Form",
     "Drawer",
@@ -178449,6 +178598,7 @@ var catalog_generated_default = {
   actionTypes: [
     "swarm.sdk",
     "swarm.call",
+    "ui.toast",
     "app.mutate",
     "app.refresh",
     "app.action",
@@ -178456,7 +178606,7 @@ var catalog_generated_default = {
   ],
   components: {
     Stack: {
-      description: "THE primary layout primitive — a flex column (default) or row of its children. `gap`/`padding` use the shared spacing scale (none|xs|sm|md|lg|xl, default gap md); `align` is the cross axis, `justify` the main axis, `wrap` lets a row reflow. For rows, set `collapseBelow` (sm|md|lg) so the row stacks vertically on narrow viewports — filter bars should always set it. Use this as the page root and for every section; `Container` is the legacy 2-prop alias kept for older pages.",
+      description: "THE primary layout primitive — a flex column (default) or row of its children. `gap`/`padding` use the shared spacing scale (none|xs|sm|md|lg|xl, default gap md); `align` is the cross axis, `justify` the main axis, `wrap` lets a row reflow. For rows, set `collapseBelow` (sm|md|lg) so the row stacks vertically on narrow viewports — filter bars should always set it. `motion` (rise|fade|none, default rise) is the entrance of the direct children on first paint: a 200ms fade plus a 4px rise, staggered 30ms; it never replays on data polls, nested Stacks inherit the parent's entrance, and reduced-motion viewers get a short fade. Use this as the page root and for every section; `Container` is the legacy 2-prop alias kept for older pages.",
       slots: ["default"],
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
@@ -178488,6 +178638,10 @@ var catalog_generated_default = {
           collapseBelow: {
             type: "string",
             enum: ["sm", "md", "lg"]
+          },
+          motion: {
+            type: "string",
+            enum: ["rise", "fade", "none"]
           }
         },
         additionalProperties: false
@@ -178591,7 +178745,7 @@ var catalog_generated_default = {
       }
     },
     Tabs: {
-      description: 'Tabbed sections. POSITIONAL children: children[i] is the body of tabs[i], so declare exactly as many children as tabs, in the same order. Only the active tab is visible but every child stays mounted, so polled Tables in background tabs keep their data warm. The active key is mirrored into state at `/ui/<id>/tab`, so other components can bind `{ "$state": "/ui/<id>/tab" }`. `defaultTab` picks the initial key (defaults to the first tab).',
+      description: 'Tabbed sections. POSITIONAL children: children[i] is the body of tabs[i], so declare exactly as many children as tabs, in the same order. Only the active tab is visible but every child stays mounted, so polled Tables in background tabs keep their data warm. The active key is mirrored into state at `/ui/<id>/tab`, so other components can bind `{ "$state": "/ui/<id>/tab" }`. `defaultTab` picks the initial key (defaults to the first tab). Tab entries take an optional `icon` and `count` (a small count pill; a literal or a bound number). `variant: "segmented"` renders a compact segmented control instead of the tab strip (same state and warm panels).',
       slots: ["default"],
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
@@ -178611,6 +178765,54 @@ var catalog_generated_default = {
                 },
                 label: {
                   type: "string"
+                },
+                icon: {
+                  type: "string",
+                  enum: [
+                    "plus",
+                    "refresh-cw",
+                    "search",
+                    "filter",
+                    "download",
+                    "upload",
+                    "external-link",
+                    "copy",
+                    "check",
+                    "x",
+                    "trash-2",
+                    "pencil",
+                    "eye",
+                    "calendar",
+                    "clock",
+                    "user",
+                    "users",
+                    "bot",
+                    "git-pull-request",
+                    "git-branch",
+                    "github",
+                    "slack",
+                    "mail",
+                    "link",
+                    "file-text",
+                    "folder",
+                    "database",
+                    "zap",
+                    "sparkles",
+                    "flag",
+                    "star",
+                    "tag",
+                    "alert-triangle",
+                    "info",
+                    "circle-check",
+                    "trending-up",
+                    "trending-down",
+                    "dollar-sign",
+                    "activity",
+                    "rocket"
+                  ]
+                },
+                count: {
+                  type: "number"
                 }
               },
               required: ["key"],
@@ -178619,6 +178821,10 @@ var catalog_generated_default = {
           },
           defaultTab: {
             type: "string"
+          },
+          variant: {
+            type: "string",
+            enum: ["line", "segmented"]
           }
         },
         required: ["id", "tabs"],
@@ -178712,7 +178918,7 @@ var catalog_generated_default = {
       }
     },
     SearchInput: {
-      description: 'Free-text search box. Writes the debounced (~200ms) query into state at `/ui/<id>/value`; bind it into a Table with `"search": { "$state": "/ui/<id>/value" }`. Purely client-side — it filters rows the page already polled, it does not re-run the query.',
+      description: 'Free-text search box. Writes the debounced (~200ms) query into state at `/ui/<id>/value`; bind it into a Table with `"search": { "$state": "/ui/<id>/value" }`. Purely client-side — it filters rows the page already polled, it does not re-run the query. `shortcut` (usually `"/"`) shows a keycap hint and focuses the field when pressed outside a text field.',
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -178725,6 +178931,11 @@ var catalog_generated_default = {
           },
           label: {
             type: "string"
+          },
+          shortcut: {
+            type: "string",
+            minLength: 1,
+            maxLength: 12
           }
         },
         required: ["id"],
@@ -178732,7 +178943,7 @@ var catalog_generated_default = {
       }
     },
     Select: {
-      description: 'Dropdown filter/picker. `options` are plain strings or `{ value, label }` objects. Writes the chosen value into state at `/ui/<id>/value` (clearing writes `null`); bind it into a Table with `"filters": { "<column>": { "$state": "/ui/<id>/value" } }`. `clearable` (default true) shows a clear button.',
+      description: 'Dropdown filter/picker. `options` are plain strings or `{ value, label?, icon?, hint? }` objects. Writes the chosen value into state at `/ui/<id>/value` (clearing writes `null`); bind it into a Table with `"filters": { "<column>": { "$state": "/ui/<id>/value" } }`. `clearable` (default true) shows a clear button. `searchable` adds a type-to-filter field (on by default past 8 options; `searchPlaceholder` sets its hint). `multiple` picks several: the value is a string array (empty = nothing picked), which a Table filter reads as "cell is one of".',
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -178756,6 +178967,54 @@ var catalog_generated_default = {
                     },
                     label: {
                       type: "string"
+                    },
+                    icon: {
+                      type: "string",
+                      enum: [
+                        "plus",
+                        "refresh-cw",
+                        "search",
+                        "filter",
+                        "download",
+                        "upload",
+                        "external-link",
+                        "copy",
+                        "check",
+                        "x",
+                        "trash-2",
+                        "pencil",
+                        "eye",
+                        "calendar",
+                        "clock",
+                        "user",
+                        "users",
+                        "bot",
+                        "git-pull-request",
+                        "git-branch",
+                        "github",
+                        "slack",
+                        "mail",
+                        "link",
+                        "file-text",
+                        "folder",
+                        "database",
+                        "zap",
+                        "sparkles",
+                        "flag",
+                        "star",
+                        "tag",
+                        "alert-triangle",
+                        "info",
+                        "circle-check",
+                        "trending-up",
+                        "trending-down",
+                        "dollar-sign",
+                        "activity",
+                        "rocket"
+                      ]
+                    },
+                    hint: {
+                      type: "string"
                     }
                   },
                   required: ["value"],
@@ -178772,6 +179031,15 @@ var catalog_generated_default = {
           },
           clearable: {
             type: "boolean"
+          },
+          searchable: {
+            type: "boolean"
+          },
+          multiple: {
+            type: "boolean"
+          },
+          searchPlaceholder: {
+            type: "string"
           }
         },
         required: ["id", "options"],
@@ -178779,7 +179047,7 @@ var catalog_generated_default = {
       }
     },
     Button: {
-      description: 'Interactive button. Wire to actions via `on.press`. `variant: "destructive-outline"` is the canonical red-outlined destructive look (standalone deletes should use it, not solid red). `disabled` accepts a constant or a bound boolean; `busyWith: "<actionName>"` disables the button and shows a spinner while that custom action is running.',
+      description: 'Interactive button. Wire to actions via `on.press`. `variant: "destructive-outline"` is the canonical red-outlined destructive look (standalone deletes should use it, not solid red). `disabled` accepts a constant or a bound boolean; `busyWith: "<actionName>"` swaps the label for a spinner (presses ignored) while that custom action is running, then shows a check plus `successLabel` for ~1.5s when it finishes ok. `icon` + `iconPosition` (start|end) add an icon from the curated set; `size` sm|default|lg. `shortcut` (one key, e.g. `"n"`) shows a keycap inside the button and presses it from anywhere on the page (not while typing in a field, not with Ctrl/Cmd/Alt). `hint` is a hover tooltip.',
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -178803,6 +179071,70 @@ var catalog_generated_default = {
           },
           busyWith: {
             type: "string"
+          },
+          icon: {
+            type: "string",
+            enum: [
+              "plus",
+              "refresh-cw",
+              "search",
+              "filter",
+              "download",
+              "upload",
+              "external-link",
+              "copy",
+              "check",
+              "x",
+              "trash-2",
+              "pencil",
+              "eye",
+              "calendar",
+              "clock",
+              "user",
+              "users",
+              "bot",
+              "git-pull-request",
+              "git-branch",
+              "github",
+              "slack",
+              "mail",
+              "link",
+              "file-text",
+              "folder",
+              "database",
+              "zap",
+              "sparkles",
+              "flag",
+              "star",
+              "tag",
+              "alert-triangle",
+              "info",
+              "circle-check",
+              "trending-up",
+              "trending-down",
+              "dollar-sign",
+              "activity",
+              "rocket"
+            ]
+          },
+          iconPosition: {
+            type: "string",
+            enum: ["start", "end"]
+          },
+          successLabel: {
+            type: "string"
+          },
+          size: {
+            type: "string",
+            enum: ["sm", "default", "lg"]
+          },
+          shortcut: {
+            type: "string",
+            minLength: 1,
+            maxLength: 12
+          },
+          hint: {
+            type: "string"
           }
         },
         required: ["label"],
@@ -178810,7 +179142,7 @@ var catalog_generated_default = {
       }
     },
     Metric: {
-      description: 'Single label/value tile for status pages. Bind `loading` to the backing query (`{ "$state": "/queries/<name>/loading" }`) to show a skeleton instead of a blank value while it loads.',
+      description: 'Stat tile (the dashboard `StatPanel`): label, value, optional `detail` line and `trend: { direction: "up"|"down"|"flat", label }` (arrow plus success/error/muted text). `icon` adds a tile tinted by `tone` (neutral|success|active|error|info|pending|warning|paused); `info` is a one-sentence explanation in a tooltip next to the label. Bind `loading` to the backing query (`{ "$state": "/queries/<name>/loading" }`) to show a skeleton instead of a blank value while it loads; an empty value renders an em dash.',
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -178830,6 +179162,84 @@ var catalog_generated_default = {
           },
           loading: {
             type: "boolean"
+          },
+          icon: {
+            type: "string",
+            enum: [
+              "plus",
+              "refresh-cw",
+              "search",
+              "filter",
+              "download",
+              "upload",
+              "external-link",
+              "copy",
+              "check",
+              "x",
+              "trash-2",
+              "pencil",
+              "eye",
+              "calendar",
+              "clock",
+              "user",
+              "users",
+              "bot",
+              "git-pull-request",
+              "git-branch",
+              "github",
+              "slack",
+              "mail",
+              "link",
+              "file-text",
+              "folder",
+              "database",
+              "zap",
+              "sparkles",
+              "flag",
+              "star",
+              "tag",
+              "alert-triangle",
+              "info",
+              "circle-check",
+              "trending-up",
+              "trending-down",
+              "dollar-sign",
+              "activity",
+              "rocket"
+            ]
+          },
+          tone: {
+            type: "string",
+            enum: [
+              "neutral",
+              "success",
+              "active",
+              "error",
+              "info",
+              "pending",
+              "warning",
+              "paused"
+            ]
+          },
+          detail: {
+            type: "string"
+          },
+          info: {
+            type: "string"
+          },
+          trend: {
+            type: "object",
+            properties: {
+              direction: {
+                type: "string",
+                enum: ["up", "down", "flat"]
+              },
+              label: {
+                type: "string"
+              }
+            },
+            required: ["direction", "label"],
+            additionalProperties: false
           }
         },
         required: ["label", "value"],
@@ -178837,7 +179247,7 @@ var catalog_generated_default = {
       }
     },
     Alert: {
-      description: "Status-toned inline alert.",
+      description: "Status-toned inline alert. `icon` overrides the tone's default icon. `actionLabel` adds a button inside the callout that emits the element's `press` event (wire it with `on.press`).",
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -178851,6 +179261,54 @@ var catalog_generated_default = {
           },
           title: {
             type: "string"
+          },
+          icon: {
+            type: "string",
+            enum: [
+              "plus",
+              "refresh-cw",
+              "search",
+              "filter",
+              "download",
+              "upload",
+              "external-link",
+              "copy",
+              "check",
+              "x",
+              "trash-2",
+              "pencil",
+              "eye",
+              "calendar",
+              "clock",
+              "user",
+              "users",
+              "bot",
+              "git-pull-request",
+              "git-branch",
+              "github",
+              "slack",
+              "mail",
+              "link",
+              "file-text",
+              "folder",
+              "database",
+              "zap",
+              "sparkles",
+              "flag",
+              "star",
+              "tag",
+              "alert-triangle",
+              "info",
+              "circle-check",
+              "trending-up",
+              "trending-down",
+              "dollar-sign",
+              "activity",
+              "rocket"
+            ]
+          },
+          actionLabel: {
+            type: "string"
           }
         },
         required: ["message"],
@@ -178858,7 +179316,7 @@ var catalog_generated_default = {
       }
     },
     Badge: {
-      description: "Status pill (uppercase tag chip) with a semantic tone.",
+      description: "Small chip. `variant`: `tag` (default, the uppercase status chip with a tone dot), `status` (11px sentence-case pill with a dot or icon), `count` (compact rounded numeric pill), `beta` (the BETA tag; `hint` is its tooltip). `tone` is neutral|success|active|error|info|pending|warning|paused; `icon` replaces the dot. `status` takes a lifecycle value (pending, in_progress, completed, failed, cancelled, paused, ...) and renders the dashboard status chip with its icon and label — any other value falls back to a toned pill showing `text`. `hint` adds a hover tooltip.",
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -178885,14 +179343,465 @@ var catalog_generated_default = {
               "warning",
               "paused"
             ]
+          },
+          icon: {
+            type: "string",
+            enum: [
+              "plus",
+              "refresh-cw",
+              "search",
+              "filter",
+              "download",
+              "upload",
+              "external-link",
+              "copy",
+              "check",
+              "x",
+              "trash-2",
+              "pencil",
+              "eye",
+              "calendar",
+              "clock",
+              "user",
+              "users",
+              "bot",
+              "git-pull-request",
+              "git-branch",
+              "github",
+              "slack",
+              "mail",
+              "link",
+              "file-text",
+              "folder",
+              "database",
+              "zap",
+              "sparkles",
+              "flag",
+              "star",
+              "tag",
+              "alert-triangle",
+              "info",
+              "circle-check",
+              "trending-up",
+              "trending-down",
+              "dollar-sign",
+              "activity",
+              "rocket"
+            ]
+          },
+          status: {
+            type: "string"
+          },
+          variant: {
+            type: "string",
+            enum: ["tag", "status", "count", "beta"]
+          },
+          hint: {
+            type: "string"
           }
         },
         required: ["text"],
         additionalProperties: false
       }
     },
+    Icon: {
+      description: "One icon from the curated lucide set (`plus`, `refresh-cw`, `search`, `filter`, `download`, `upload`, `external-link`, `copy`, `check`, `x`, `trash-2`, `pencil`, `eye`, `calendar`, `clock`, `user`, `users`, `bot`, `git-pull-request`, `git-branch`, `github`, `slack`, `mail`, `link`, `file-text`, `folder`, `database`, `zap`, `sparkles`, `flag`, `star`, `tag`, `alert-triangle`, `info`, `circle-check`, `trending-up`, `trending-down`, `dollar-sign`, `activity`, `rocket`). The same names work on every `icon` prop (Button, Badge, Metric, Alert, Tabs entries, Chips options, EmptyState, Table columns, row actions and Drawer actions). Decorative unless `label` is set. `size` sm|md|lg, `tone` default|muted|success|warning|error|info.",
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          name: {
+            type: "string",
+            enum: [
+              "plus",
+              "refresh-cw",
+              "search",
+              "filter",
+              "download",
+              "upload",
+              "external-link",
+              "copy",
+              "check",
+              "x",
+              "trash-2",
+              "pencil",
+              "eye",
+              "calendar",
+              "clock",
+              "user",
+              "users",
+              "bot",
+              "git-pull-request",
+              "git-branch",
+              "github",
+              "slack",
+              "mail",
+              "link",
+              "file-text",
+              "folder",
+              "database",
+              "zap",
+              "sparkles",
+              "flag",
+              "star",
+              "tag",
+              "alert-triangle",
+              "info",
+              "circle-check",
+              "trending-up",
+              "trending-down",
+              "dollar-sign",
+              "activity",
+              "rocket"
+            ]
+          },
+          size: {
+            type: "string",
+            enum: ["sm", "md", "lg"]
+          },
+          tone: {
+            type: "string",
+            enum: ["default", "muted", "success", "warning", "error", "info"]
+          },
+          label: {
+            type: "string"
+          }
+        },
+        required: ["name"],
+        additionalProperties: false
+      }
+    },
+    Progress: {
+      description: 'Progress readout. `value` against `max` (default 100), usually bound to state. `variant: "bar"` (default) is a toned bar (`tone` neutral|success|active|error|info|pending|warning|paused) with an optional `label` above it; `"ring"` is the dashboard progress ring (done arc). `showValue` (default true) prints the percent (bar) or `value / max` (ring).',
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          value: {
+            type: "number"
+          },
+          max: {
+            type: "number",
+            exclusiveMinimum: 0
+          },
+          tone: {
+            type: "string",
+            enum: [
+              "neutral",
+              "success",
+              "active",
+              "error",
+              "info",
+              "pending",
+              "warning",
+              "paused"
+            ]
+          },
+          label: {
+            type: "string"
+          },
+          variant: {
+            type: "string",
+            enum: ["bar", "ring"]
+          },
+          showValue: {
+            type: "boolean"
+          }
+        },
+        required: ["value"],
+        additionalProperties: false
+      }
+    },
+    EmptyState: {
+      description: "Centered empty state: `icon` (curated set, default inbox), `title`, optional `body`. `actionLabel` adds a button that emits the element's `press` event — wire it with `on.press` like a Button.",
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          icon: {
+            type: "string",
+            enum: [
+              "plus",
+              "refresh-cw",
+              "search",
+              "filter",
+              "download",
+              "upload",
+              "external-link",
+              "copy",
+              "check",
+              "x",
+              "trash-2",
+              "pencil",
+              "eye",
+              "calendar",
+              "clock",
+              "user",
+              "users",
+              "bot",
+              "git-pull-request",
+              "git-branch",
+              "github",
+              "slack",
+              "mail",
+              "link",
+              "file-text",
+              "folder",
+              "database",
+              "zap",
+              "sparkles",
+              "flag",
+              "star",
+              "tag",
+              "alert-triangle",
+              "info",
+              "circle-check",
+              "trending-up",
+              "trending-down",
+              "dollar-sign",
+              "activity",
+              "rocket"
+            ]
+          },
+          title: {
+            type: "string"
+          },
+          body: {
+            type: "string"
+          },
+          actionLabel: {
+            type: "string"
+          }
+        },
+        required: ["title"],
+        additionalProperties: false
+      }
+    },
+    CopyButton: {
+      description: "Copies `value` to the clipboard; the icon swaps to a check on copy. `label` is the visible text; without it the button is icon-only.",
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          value: {
+            anyOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "number"
+              }
+            ]
+          },
+          label: {
+            type: "string"
+          }
+        },
+        required: ["value"],
+        additionalProperties: false
+      }
+    },
+    Kbd: {
+      description: 'Keycaps for a keyboard shortcut, one per entry in `keys` (e.g. `["⌘", "K"]`). Display only.',
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          keys: {
+            minItems: 1,
+            type: "array",
+            items: {
+              type: "string"
+            }
+          }
+        },
+        required: ["keys"],
+        additionalProperties: false
+      }
+    },
+    Skeleton: {
+      description: "Loading placeholder. `shape`: `line` (text lines), `block` (one box, `height` in px, default 128), `rows` (table-like rows), `metric` (stat tiles), `card` (a card sketch). `count` repeats lines, rows or tiles. Pair with `visible` on a query's `loading` state.",
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          shape: {
+            type: "string",
+            enum: ["line", "block", "rows", "metric", "card"]
+          },
+          count: {
+            type: "integer",
+            minimum: 1,
+            maximum: 20
+          },
+          height: {
+            type: "integer",
+            minimum: 8,
+            maximum: 800
+          }
+        },
+        required: ["shape"],
+        additionalProperties: false
+      }
+    },
+    Spinner: {
+      description: 'Inline busy indicator with `role=status`. `variant` ring|ellipsis|bars (default: the dashboard spinner), `size` sm|md, `label` shown next to it (and its accessible name; defaults to an sr-only "Loading").',
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          variant: {
+            type: "string",
+            enum: ["ring", "ellipsis", "bars"]
+          },
+          size: {
+            type: "string",
+            enum: ["sm", "md"]
+          },
+          label: {
+            type: "string"
+          }
+        },
+        additionalProperties: false
+      }
+    },
+    AvatarStack: {
+      description: "Overlapping initials avatars for `users` (display names), up to `max` (default 4) then a `+N` count; hover lists every name.",
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          users: {
+            type: "array",
+            items: {
+              type: "string"
+            }
+          },
+          max: {
+            type: "integer",
+            minimum: 1,
+            maximum: 20
+          }
+        },
+        required: ["users"],
+        additionalProperties: false
+      }
+    },
+    Section: {
+      description: "Titled section around its children: `title`, optional `description`. `collapsible` folds the body under a toggle header (`defaultOpen`, default true).",
+      slots: ["default"],
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          title: {
+            type: "string"
+          },
+          description: {
+            type: "string"
+          },
+          collapsible: {
+            type: "boolean"
+          },
+          defaultOpen: {
+            type: "boolean"
+          }
+        },
+        required: ["title"],
+        additionalProperties: false
+      }
+    },
+    Chips: {
+      description: 'Toggle chips for quick filters. `options` are strings or `{ value, label?, icon? }`. Writes the selection to `/ui/<id>/value`: one string or `null` (pressing the selected chip clears it), or with `multiple` a string array (empty = nothing picked). Bind it into a Table with `"filters": { "<column>": { "$state": "/ui/<id>/value" } }` — an array filter matches rows whose cell is one of the values. `label` names the group for screen readers.',
+      props: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          id: {
+            type: "string"
+          },
+          options: {
+            minItems: 1,
+            type: "array",
+            items: {
+              anyOf: [
+                {
+                  type: "string"
+                },
+                {
+                  type: "object",
+                  properties: {
+                    value: {
+                      type: "string"
+                    },
+                    label: {
+                      type: "string"
+                    },
+                    icon: {
+                      type: "string",
+                      enum: [
+                        "plus",
+                        "refresh-cw",
+                        "search",
+                        "filter",
+                        "download",
+                        "upload",
+                        "external-link",
+                        "copy",
+                        "check",
+                        "x",
+                        "trash-2",
+                        "pencil",
+                        "eye",
+                        "calendar",
+                        "clock",
+                        "user",
+                        "users",
+                        "bot",
+                        "git-pull-request",
+                        "git-branch",
+                        "github",
+                        "slack",
+                        "mail",
+                        "link",
+                        "file-text",
+                        "folder",
+                        "database",
+                        "zap",
+                        "sparkles",
+                        "flag",
+                        "star",
+                        "tag",
+                        "alert-triangle",
+                        "info",
+                        "circle-check",
+                        "trending-up",
+                        "trending-down",
+                        "dollar-sign",
+                        "activity",
+                        "rocket"
+                      ]
+                    }
+                  },
+                  required: ["value"],
+                  additionalProperties: false
+                }
+              ]
+            }
+          },
+          multiple: {
+            type: "boolean"
+          },
+          label: {
+            type: "string"
+          }
+        },
+        required: ["id", "options"],
+        additionalProperties: false
+      }
+    },
     Table: {
-      description: 'Data table. Bind `data`/`loading`/`error` to a named query (`/queries/<name>/...`). `rowActions` chains receive `{ "$row": "<col>" }` (or `{ "$row": "" }` for the whole row) and `{ "$rowIndex": true }`. Destructive row actions always confirm via a dialog; override the copy with `confirm: { title, description, confirmLabel }`. `search` (case-insensitive substring across every listed column) and `filters` (per-column equality, `null`/`""` disables one) narrow the polled rows client-side — bind them to a `SearchInput` / `Select` via `/ui/<id>/value`, or pin a constant (e.g. `"filters": { "pinned": true }`). Columns take `pinned: "left"|"right"` to survive horizontal scroll; `pagination` pages large row sets (auto past 200 rows); `density: "compact"` tightens row height.',
+      description: 'Data table. Bind `data`/`loading`/`error` to a named query (`/queries/<name>/...`). `rowActions` chains receive `{ "$row": "<col>" }` (or `{ "$row": "" }` for the whole row) and `{ "$rowIndex": true }`. Destructive row actions always confirm via a dialog; override the copy with `confirm: { title, description, confirmLabel }`. `search` (case-insensitive substring across every listed column) and `filters` (per-column equality, `null`/`""` disables one; an array means "one of", which is what a multiple `Chips` writes, and an empty array disables it) narrow the polled rows client-side — bind them to a `SearchInput` / `Select` via `/ui/<id>/value`, or pin a constant (e.g. `"filters": { "pinned": true }`). Columns take `pinned: "left"|"right"` to survive horizontal scroll; `pagination` pages large row sets (auto past 200 rows); `density: "compact"` tightens row height. Column kinds: `status` (lifecycle values like pending/in_progress/completed/failed get the dashboard status icon, anything else a `tones` pill), `user` / `agent` (avatar + name), `relative` (smart time with the exact time on hover), `duration` (ms → 1m 23s), `progress` (bar, `max` default 100), `copy` (value + copy button), `switch` (runs the column\'s `onChange` chain with `$row` set to the new value; read-only without it), `link` (http(s) URL, opens in a new tab). Columns also take `align`, `truncate: "middle"` (ids, paths), a header `icon` and `tooltip` (a row field shown on hover). `onRowClick` runs a chain with `$row` when a row is clicked — pair it with `app.navigate` + a Drawer and bind `selectedId` to the drawer param to highlight the open row. `rowId` names the id field (default `id`). Below 768px the table renders as a phone list (`mobile: "list"`, fields picked by `mobileFields: { title, subtitle?, meta?, status? }`); `mobile: "scroll"` keeps the grid. `emptyState: { icon?, title, body? }` replaces the empty message. Row actions take `icon` and `placement: "menu"` (collected into a More menu).',
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -178920,7 +179829,24 @@ var catalog_generated_default = {
                 },
                 kind: {
                   type: "string",
-                  enum: ["text", "string", "number", "boolean", "date", "badge", "enum"]
+                  enum: [
+                    "text",
+                    "string",
+                    "number",
+                    "boolean",
+                    "date",
+                    "badge",
+                    "enum",
+                    "status",
+                    "user",
+                    "agent",
+                    "relative",
+                    "duration",
+                    "progress",
+                    "copy",
+                    "switch",
+                    "link"
+                  ]
                 },
                 tones: {
                   type: "object",
@@ -178947,6 +179873,86 @@ var catalog_generated_default = {
                 pinned: {
                   type: "string",
                   enum: ["left", "right"]
+                },
+                align: {
+                  type: "string",
+                  enum: ["start", "end"]
+                },
+                truncate: {
+                  type: "string",
+                  enum: ["end", "middle"]
+                },
+                icon: {
+                  type: "string",
+                  enum: [
+                    "plus",
+                    "refresh-cw",
+                    "search",
+                    "filter",
+                    "download",
+                    "upload",
+                    "external-link",
+                    "copy",
+                    "check",
+                    "x",
+                    "trash-2",
+                    "pencil",
+                    "eye",
+                    "calendar",
+                    "clock",
+                    "user",
+                    "users",
+                    "bot",
+                    "git-pull-request",
+                    "git-branch",
+                    "github",
+                    "slack",
+                    "mail",
+                    "link",
+                    "file-text",
+                    "folder",
+                    "database",
+                    "zap",
+                    "sparkles",
+                    "flag",
+                    "star",
+                    "tag",
+                    "alert-triangle",
+                    "info",
+                    "circle-check",
+                    "trending-up",
+                    "trending-down",
+                    "dollar-sign",
+                    "activity",
+                    "rocket"
+                  ]
+                },
+                tooltip: {
+                  type: "string"
+                },
+                max: {
+                  type: "number",
+                  exclusiveMinimum: 0
+                },
+                onChange: {
+                  type: "array",
+                  items: {
+                    type: "object",
+                    properties: {
+                      action: {
+                        type: "string"
+                      },
+                      params: {
+                        type: "object",
+                        propertyNames: {
+                          type: "string"
+                        },
+                        additionalProperties: {}
+                      }
+                    },
+                    required: ["action"],
+                    additionalProperties: false
+                  }
                 }
               },
               required: ["key"],
@@ -179016,6 +180022,55 @@ var catalog_generated_default = {
                     required: ["action"],
                     additionalProperties: false
                   }
+                },
+                icon: {
+                  type: "string",
+                  enum: [
+                    "plus",
+                    "refresh-cw",
+                    "search",
+                    "filter",
+                    "download",
+                    "upload",
+                    "external-link",
+                    "copy",
+                    "check",
+                    "x",
+                    "trash-2",
+                    "pencil",
+                    "eye",
+                    "calendar",
+                    "clock",
+                    "user",
+                    "users",
+                    "bot",
+                    "git-pull-request",
+                    "git-branch",
+                    "github",
+                    "slack",
+                    "mail",
+                    "link",
+                    "file-text",
+                    "folder",
+                    "database",
+                    "zap",
+                    "sparkles",
+                    "flag",
+                    "star",
+                    "tag",
+                    "alert-triangle",
+                    "info",
+                    "circle-check",
+                    "trending-up",
+                    "trending-down",
+                    "dollar-sign",
+                    "activity",
+                    "rocket"
+                  ]
+                },
+                placement: {
+                  type: "string",
+                  enum: ["inline", "menu"]
                 }
               },
               required: ["label", "actions"],
@@ -179058,6 +180113,22 @@ var catalog_generated_default = {
                     },
                     {
                       type: "boolean"
+                    },
+                    {
+                      type: "array",
+                      items: {
+                        anyOf: [
+                          {
+                            type: "string"
+                          },
+                          {
+                            type: "number"
+                          },
+                          {
+                            type: "boolean"
+                          }
+                        ]
+                      }
                     }
                   ]
                 },
@@ -179073,6 +180144,137 @@ var catalog_generated_default = {
           density: {
             type: "string",
             enum: ["comfortable", "compact"]
+          },
+          rowId: {
+            type: "string"
+          },
+          onRowClick: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                action: {
+                  type: "string"
+                },
+                params: {
+                  type: "object",
+                  propertyNames: {
+                    type: "string"
+                  },
+                  additionalProperties: {}
+                }
+              },
+              required: ["action"],
+              additionalProperties: false
+            }
+          },
+          selectedId: {
+            anyOf: [
+              {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "number"
+                  }
+                ]
+              },
+              {
+                type: "null"
+              }
+            ]
+          },
+          mobile: {
+            type: "string",
+            enum: ["list", "scroll"]
+          },
+          mobileFields: {
+            type: "object",
+            properties: {
+              title: {
+                type: "string"
+              },
+              subtitle: {
+                type: "string"
+              },
+              meta: {
+                anyOf: [
+                  {
+                    type: "string"
+                  },
+                  {
+                    type: "array",
+                    items: {
+                      type: "string"
+                    }
+                  }
+                ]
+              },
+              status: {
+                type: "string"
+              }
+            },
+            required: ["title"],
+            additionalProperties: false
+          },
+          emptyState: {
+            type: "object",
+            properties: {
+              icon: {
+                type: "string",
+                enum: [
+                  "plus",
+                  "refresh-cw",
+                  "search",
+                  "filter",
+                  "download",
+                  "upload",
+                  "external-link",
+                  "copy",
+                  "check",
+                  "x",
+                  "trash-2",
+                  "pencil",
+                  "eye",
+                  "calendar",
+                  "clock",
+                  "user",
+                  "users",
+                  "bot",
+                  "git-pull-request",
+                  "git-branch",
+                  "github",
+                  "slack",
+                  "mail",
+                  "link",
+                  "file-text",
+                  "folder",
+                  "database",
+                  "zap",
+                  "sparkles",
+                  "flag",
+                  "star",
+                  "tag",
+                  "alert-triangle",
+                  "info",
+                  "circle-check",
+                  "trending-up",
+                  "trending-down",
+                  "dollar-sign",
+                  "activity",
+                  "rocket"
+                ]
+              },
+              title: {
+                type: "string"
+              },
+              body: {
+                type: "string"
+              }
+            },
+            required: ["title"],
+            additionalProperties: false
           }
         },
         required: ["columns"],
@@ -179153,7 +180355,7 @@ var catalog_generated_default = {
       }
     },
     Drawer: {
-      description: 'Route-driven slide-in side panel (sheet). Open exactly when the route param named by `param` is set — open it with `app.navigate` (e.g. a rowAction setting `{ "panel": { "$row": "id" } }`), and the URL stays shareable: a deep link with the param renders the drawer open, and closing it clears the param. Children mount only while open (a Table inside does NOT stay warm when closed — unlike Tabs). `side` right (default) or left; `size` sm|md|lg|xl width.',
+      description: 'Route-driven slide-in side panel (sheet). Open exactly when the route param named by `param` is set — open it with `app.navigate` (e.g. a rowAction setting `{ "panel": { "$row": "id" } }`), and the URL stays shareable: a deep link with the param renders the drawer open, and closing it clears the param. Children mount only while open (a Table inside does NOT stay warm when closed — unlike Tabs). `side` right (default) or left; `size` sm|md|lg|xl width. `actions: [{ label, icon?, variant?, confirm?, actions }]` render in a sticky footer with the Table rowActions confirm rules (destructive variants confirm, an `app.mutate` delete always confirms); chains have no `$row`, so read the open record id with `{ "$state": "/route/params/<param>" }`.',
       slots: ["default"],
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
@@ -179175,6 +180377,120 @@ var catalog_generated_default = {
           size: {
             type: "string",
             enum: ["sm", "md", "lg", "xl"]
+          },
+          actions: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                label: {
+                  type: "string"
+                },
+                variant: {
+                  type: "string",
+                  enum: [
+                    "default",
+                    "secondary",
+                    "outline",
+                    "ghost",
+                    "destructive",
+                    "destructive-outline"
+                  ]
+                },
+                confirm: {
+                  anyOf: [
+                    {
+                      type: "boolean"
+                    },
+                    {
+                      type: "object",
+                      properties: {
+                        title: {
+                          type: "string"
+                        },
+                        description: {
+                          type: "string"
+                        },
+                        confirmLabel: {
+                          type: "string"
+                        }
+                      },
+                      additionalProperties: false
+                    },
+                    {
+                      type: "string"
+                    }
+                  ]
+                },
+                actions: {
+                  type: "array",
+                  items: {
+                    type: "object",
+                    properties: {
+                      action: {
+                        type: "string"
+                      },
+                      params: {
+                        type: "object",
+                        propertyNames: {
+                          type: "string"
+                        },
+                        additionalProperties: {}
+                      }
+                    },
+                    required: ["action"],
+                    additionalProperties: false
+                  }
+                },
+                icon: {
+                  type: "string",
+                  enum: [
+                    "plus",
+                    "refresh-cw",
+                    "search",
+                    "filter",
+                    "download",
+                    "upload",
+                    "external-link",
+                    "copy",
+                    "check",
+                    "x",
+                    "trash-2",
+                    "pencil",
+                    "eye",
+                    "calendar",
+                    "clock",
+                    "user",
+                    "users",
+                    "bot",
+                    "git-pull-request",
+                    "git-branch",
+                    "github",
+                    "slack",
+                    "mail",
+                    "link",
+                    "file-text",
+                    "folder",
+                    "database",
+                    "zap",
+                    "sparkles",
+                    "flag",
+                    "star",
+                    "tag",
+                    "alert-triangle",
+                    "info",
+                    "circle-check",
+                    "trending-up",
+                    "trending-down",
+                    "dollar-sign",
+                    "activity",
+                    "rocket"
+                  ]
+                }
+              },
+              required: ["label", "actions"],
+              additionalProperties: false
+            }
           }
         },
         required: ["param"],
@@ -179182,7 +180498,7 @@ var catalog_generated_default = {
       }
     },
     DetailList: {
-      description: 'Read-only label/value detail view for ONE record. Bind `data` to a single row — usually `{ "$state": "/queries/<name>/data/0" }` with a `$param`-filtered query. `fields` pick and format properties with the same kinds as Table columns (badge tones, relative dates) plus `code` for raw/JSON values. Bind `loading` to the query (`/queries/<name>/loading`) for skeleton fields while it loads; `emptyMessage` shows when the record is genuinely missing.',
+      description: 'Read-only label/value detail view for ONE record. Bind `data` to a single row — usually `{ "$state": "/queries/<name>/data/0" }` with a `$param`-filtered query. `fields` pick and format properties with the same kinds as Table columns (badge tones, relative dates) plus `status` (lifecycle chip), `user` (avatar + name), `relative` (smart time, exact on hover), `copy` (value + copy button), `code` (monospace block) and `json` (collapsible JSON tree). Bind `loading` to the query (`/queries/<name>/loading`) for skeleton fields while it loads; `emptyMessage` shows when the record is genuinely missing.',
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -179215,7 +180531,21 @@ var catalog_generated_default = {
                 },
                 kind: {
                   type: "string",
-                  enum: ["text", "string", "number", "boolean", "date", "badge", "enum", "code"]
+                  enum: [
+                    "text",
+                    "string",
+                    "number",
+                    "boolean",
+                    "date",
+                    "badge",
+                    "enum",
+                    "code",
+                    "status",
+                    "user",
+                    "relative",
+                    "copy",
+                    "json"
+                  ]
                 },
                 tones: {
                   type: "object",
@@ -179265,7 +180595,7 @@ var catalog_generated_default = {
       }
     },
     Kanban: {
-      description: 'Kanban board: one card per row, grouped into `columns` by the row\'s `columnField`. Bind `data`/`loading` to a named query. `titleField` is the card title; `cardFields` add label/value lines with Table column kinds (badge tones, relative dates). Dragging a card to another column runs `onMove` with `$row` = the moved row, `columnField` already set to the new column — typically `[{ "action": "app.mutate", "params": { "model": "<m>", "op": "update", "rowId": { "$row": "id" }, "values": { "<columnField>": { "$row": "<columnField>" } } } }]`. Without `onMove` the board is read-only. `onCardClick` runs with `$row` (e.g. an `app.navigate` that opens a Drawer).',
+      description: 'Kanban board: one card per row, grouped into `columns` by the row\'s `columnField`. Bind `data`/`loading` to a named query. `titleField` is the card title; `cardFields` add label/value lines with the DetailList field kinds (badge tones, status, user, relative, copy, ...). Dragging a card to another column runs `onMove` with `$row` = the moved row, `columnField` already set to the new column — typically `[{ "action": "app.mutate", "params": { "model": "<m>", "op": "update", "rowId": { "$row": "id" }, "values": { "<columnField>": { "$row": "<columnField>" } } } }]`. Without `onMove` the board is read-only. `onCardClick` runs with `$row` (e.g. an `app.navigate` that opens a Drawer).',
       props: {
         $schema: "http://json-schema.org/draft-07/schema#",
         type: "object",
@@ -179326,7 +180656,21 @@ var catalog_generated_default = {
                 },
                 kind: {
                   type: "string",
-                  enum: ["text", "string", "number", "boolean", "date", "badge", "enum", "code"]
+                  enum: [
+                    "text",
+                    "string",
+                    "number",
+                    "boolean",
+                    "date",
+                    "badge",
+                    "enum",
+                    "code",
+                    "status",
+                    "user",
+                    "relative",
+                    "copy",
+                    "json"
+                  ]
                 },
                 tones: {
                   type: "object",
@@ -179610,6 +180954,57 @@ var catalog_generated_default = {
         additionalProperties: false
       }
     },
+    "ui.toast": {
+      description: 'Show a toast: `message`, optional `description`, `tone` success|error|info|warning (default info). `undo: { label?, actions }` adds an Undo button (label defaults to "Undo") that runs `actions` as a chain — e.g. an `app.mutate` that restores the row a delete just removed.',
+      params: {
+        $schema: "http://json-schema.org/draft-07/schema#",
+        type: "object",
+        properties: {
+          message: {
+            type: "string"
+          },
+          description: {
+            type: "string"
+          },
+          tone: {
+            type: "string",
+            enum: ["success", "error", "info", "warning"]
+          },
+          undo: {
+            type: "object",
+            properties: {
+              label: {
+                type: "string"
+              },
+              actions: {
+                type: "array",
+                items: {
+                  type: "object",
+                  properties: {
+                    action: {
+                      type: "string"
+                    },
+                    params: {
+                      type: "object",
+                      propertyNames: {
+                        type: "string"
+                      },
+                      additionalProperties: {}
+                    }
+                  },
+                  required: ["action"],
+                  additionalProperties: false
+                }
+              }
+            },
+            required: ["actions"],
+            additionalProperties: false
+          }
+        },
+        required: ["message"],
+        additionalProperties: false
+      }
+    },
     "app.mutate": {
       description: "Create / update / delete a swarm-app row, then refetch every named query on the same model.",
       params: {
@@ -179721,12 +181116,37 @@ var ELEMENT_KEYS = new Set([
   "repeat",
   "watch"
 ]);
-var UI_STATE_COMPONENTS = new Set(["SearchInput", "Select", "Tabs"]);
+var UI_STATE_COMPONENTS = new Set(["SearchInput", "Select", "Tabs", "Chips"]);
 var PROP_ACTION_CHAINS = {
+  Table: ["onRowClick"],
   Form: ["onSubmit"],
   Kanban: ["onMove", "onCardClick"],
   Calendar: ["onSelect"]
 };
+var ITEM_ACTION_CHAINS = {
+  Table: [
+    ["rowActions", "actions"],
+    ["columns", "onChange"]
+  ],
+  Drawer: [["actions", "actions"]]
+};
+function itemActionChains(type, props, propsPath) {
+  const chains = [];
+  for (const [arrayProp, chainKey] of ITEM_ACTION_CHAINS[String(type)] ?? []) {
+    const items = props[arrayProp];
+    if (!Array.isArray(items))
+      continue;
+    for (const [index, item] of items.entries()) {
+      if (!isPlainObject(item) || !Object.hasOwn(item, chainKey))
+        continue;
+      chains.push({
+        path: `${propsPath}.${arrayProp}.${index}.${chainKey}`,
+        chain: item[chainKey]
+      });
+    }
+  }
+  return chains;
+}
 var DATA_FIELD_PROPS = {
   Kanban: ["columnField", "titleField", "idField"],
   Calendar: ["startField", "endField", "titleField", "idField"],
@@ -179965,9 +181385,9 @@ function actionParams(step, path2, definition, catalog, validateNavigation = fal
     }
     if (op === "update" || op === "delete") {
       const rowId = params.rowId;
-      const validRowId = typeof rowId === "string" || isPlainObject(rowId) && typeof rowId.$row === "string" && Object.keys(rowId).length === 1;
+      const validRowId = typeof rowId === "string" || isStateBinding(rowId) || isPlainObject(rowId) && typeof rowId.$row === "string" && Object.keys(rowId).length === 1;
       if (!validRowId) {
-        result.issues.push(issue(appendPath(paramsPath, "rowId"), "is required for update and delete and must be a string or $row binding"));
+        result.issues.push(issue(appendPath(paramsPath, "rowId"), "is required for update and delete and must be a string, $row, or $state binding"));
       }
     }
     if (isPlainObject(params.values) && !isActionSentinel(params.values) && !isStateBinding(params.values)) {
@@ -179986,6 +181406,13 @@ function actionParams(step, path2, definition, catalog, validateNavigation = fal
     if (typeof params.name !== "string" || !Object.hasOwn(definition.actions ?? {}, params.name)) {
       result.issues.push(issue(appendPath(paramsPath, "name"), `unknown app action "${String(params.name)}"`));
     }
+  } else if (step.action === "ui.toast") {
+    const undo = toastUndoChain(step);
+    if (Array.isArray(undo)) {
+      const undoResult = validateActionChain(undo, appendPath(appendPath(paramsPath, "undo"), "actions"), definition, catalog);
+      result.issues.push(...undoResult.issues);
+      result.stateRefs.push(...undoResult.stateRefs);
+    }
   }
   return result;
 }
@@ -180170,10 +181597,21 @@ function visitActionChain(chain, path2, visit, allowSingle) {
   if (!Array.isArray(normalized))
     return;
   for (const [index, step] of normalized.entries()) {
-    if (isPlainObject(step))
-      visit(step, appendPath(path2, index));
+    if (!isPlainObject(step))
+      continue;
+    const stepPath = appendPath(path2, index);
+    visit(step, stepPath);
+    const undo = toastUndoChain(step);
+    if (undo !== undefined)
+      visitActionChain(undo, `${stepPath}.params.undo.actions`, visit, false);
   }
 }
+function toastUndoChain(step) {
+  if (step.action !== "ui.toast" || !isPlainObject(step.params))
+    return;
+  const undo = step.params.undo;
+  return isPlainObject(undo) && Object.hasOwn(undo, "actions") ? undo.actions : undefined;
+}
 function visitPageActionSteps(page, pagePath, visit) {
   if (!isPlainObject(page.elements))
     return;
@@ -180191,12 +181629,8 @@ function visitPageActionSteps(page, pagePath, visit) {
     }
     if (!isPlainObject(rawElement.props))
       continue;
-    if (rawElement.type === "Table" && Array.isArray(rawElement.props.rowActions)) {
-      for (const [index, rowAction] of rawElement.props.rowActions.entries()) {
-        if (!isPlainObject(rowAction))
-          continue;
-        visitActionChain(rowAction.actions, `${elementPath}.props.rowActions.${index}.actions`, visit, false);
-      }
+    for (const { path: path2, chain } of itemActionChains(rawElement.type, rawElement.props, `${elementPath}.props`)) {
+      visitActionChain(chain, path2, visit, false);
     }
     for (const prop of PROP_ACTION_CHAINS[String(rawElement.type)] ?? []) {
       visitActionChain(rawElement.props[prop], `${elementPath}.props.${prop}`, visit, false);
@@ -180526,7 +181960,8 @@ function validatePage(definition, catalog, target) {
     }
     if (component) {
       const propsPath = appendPath(elementPath, "props");
-      const actionChainPath = (path2) => (PROP_ACTION_CHAINS[String(type)] ?? []).some((prop) => path2 === `${propsPath}.${prop}`) || type === "Table" && /^.+\.rowActions\.\d+\.actions$/.test(path2);
+      const itemChainPaths = new Set(isPlainObject(rawElement.props) ? itemActionChains(type, rawElement.props, propsPath).map(({ path: path2 }) => path2) : []);
+      const actionChainPath = (path2) => (PROP_ACTION_CHAINS[String(type)] ?? []).some((prop) => path2 === `${propsPath}.${prop}`) || itemChainPaths.has(path2);
       const propsResult = validateSchema(Object.hasOwn(rawElement, "props") ? rawElement.props : {}, component.props, propsPath, false, actionChainPath);
       issues.push(...propsResult.issues);
       stateRefs.push(...propsResult.stateRefs);
@@ -180563,6 +181998,9 @@ function validatePage(definition, catalog, target) {
             }
           }
           collectRowFieldIssues(rawElement.props.rowActions, `${elementPath}.props.rowActions`, queryModel.modelName, queryModel.model, issues);
+          for (const prop of ["onRowClick", "columns"]) {
+            collectRowFieldIssues(rawElement.props[prop], `${elementPath}.props.${prop}`, queryModel.modelName, queryModel.model, issues);
+          }
         }
       } else if (type === "DetailList") {
         const queryModel = queryModelFromDataBinding(definition, rawElement.props.data);
@@ -180659,16 +182097,12 @@ function validatePage(definition, catalog, target) {
         issues.push(...visibleConditionIssues(rawElement[key], bindingPath));
       }
     }
-    if (type === "Table" && isPlainObject(rawElement.props) && Array.isArray(rawElement.props.rowActions)) {
-      for (const [rowActionIndex, rowAction] of rawElement.props.rowActions.entries()) {
-        if (!isPlainObject(rowAction) || !Object.hasOwn(rowAction, "actions"))
-          continue;
-        const chainResult = validateActionChain(rowAction.actions, `${elementPath}.props.rowActions.${rowActionIndex}.actions`, definition, catalog);
+    if (isPlainObject(rawElement.props)) {
+      for (const { path: path2, chain } of itemActionChains(type, rawElement.props, `${elementPath}.props`)) {
+        const chainResult = validateActionChain(chain, path2, definition, catalog);
         issues.push(...chainResult.issues);
         stateRefs.push(...chainResult.stateRefs);
       }
-    }
-    if (isPlainObject(rawElement.props)) {
       for (const prop of PROP_ACTION_CHAINS[String(type)] ?? []) {
         if (!Object.hasOwn(rawElement.props, prop))
           continue;
@@ -182107,10 +183541,10 @@ export interface SwarmSdk {
   // --- slack ---
   slack_read(args?: { inboxMessageId?: string; taskId?: string; channelId?: string; threadTs?: string; limit?: number; includeFiles?: boolean }): Promise<unknown>;
   slack_listChannels(args?: { types?: Array<"public" | "private" | "dm" | "mpim">; limit?: number }): Promise<unknown>;
+  // --- chat sdk ---
+  chat_readThread(args: { threadId: string; limit?: number }): Promise<unknown>;
   // --- messaging ---
   message_read(args?: { channel?: string; limit?: number; since?: string; unreadOnly?: boolean; mentionsOnly?: boolean; markAsRead?: boolean }): Promise<unknown>;
-  // --- services ---
-  service_list(args?: { agentId?: string; name?: string; status?: "starting" | "healthy" | "unhealthy" | "stopped"; includeOwn?: boolean }): Promise<unknown>;
   // --- context / profiles ---
   context_history(args?: { agentId?: string; field?: "soulMd" | "identityMd" | "toolsMd" | "claudeMd" | "setupScript"; limit?: number }): Promise<unknown>;
   context_diff(args: { versionId: string; compareToVersionId?: string }): Promise<unknown>;
@@ -182153,7 +183587,7 @@ export interface SwarmSdk {
   task_action(args: Record<string, unknown>): Promise<unknown>;
 
   // --- write: config ---
-  config_set(args: { key: string; value: unknown; scope?: "global" | "agent" | "repo"; scopeId?: string; isSecret?: boolean }): Promise<unknown>;
+  config_set(args: { key: string; value: unknown; scope?: "global" | "agent" | "repo"; scopeId?: string; isSecret?: boolean; exportToEnv?: boolean }): Promise<unknown>;
   config_delete(args: { id: string }): Promise<unknown>;
 
   // --- write: model catalog ---
@@ -182183,17 +183617,19 @@ export interface SwarmSdk {
   slack_delete(args: { channelId: string; messageTs: string }): Promise<unknown>;
   slack_update(args: { channelId: string; messageTs: string; message: string }): Promise<unknown>;
 
+  // --- write: chat sdk ---
+  chat_reply(args: { text: string }): Promise<unknown>;
+  chat_post(args: { adapter: "telegram" | "slack" | "discord" | "teams"; threadId?: string; channelId?: string; text: string }): Promise<unknown>;
+  chat_openDm(args: { adapter: "telegram" | "slack" | "discord" | "teams"; userId: string }): Promise<unknown>;
+  chat_registerChannel(args: { adapter: "telegram" | "slack" | "discord" | "teams"; channelId: string; agentId?: string; workflowId?: string; name?: string }): Promise<unknown>;
+  chat_unregisterChannel(args: { adapter: "telegram" | "slack" | "discord" | "teams"; channelId: string }): Promise<unknown>;
+
   // --- write: messaging (internal) ---
   message_post(args: { channel?: string; content: string; to?: string }): Promise<unknown>;
 
   // --- write: profiles ---
   profile_update(args: Record<string, unknown>): Promise<unknown>;
 
-  // --- write: services ---
-  service_register(args: Record<string, unknown>): Promise<unknown>;
-  service_unregister(args: { name: string }): Promise<unknown>;
-  service_updateStatus(args: { name: string; status: "starting" | "healthy" | "unhealthy" | "stopped" }): Promise<unknown>;
-
   // --- write: schedules ---
   schedule_create(args: Record<string, unknown>): Promise<unknown>;
   schedule_update(args: Record<string, unknown>): Promise<unknown>;
@@ -182939,4 +184375,53 @@ void _scriptMain;
   });
 }
 
-export { require_dist, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, normalizeTokenEndpointAuthMethod, resolveAdvertisedTokenEndpointAuthMethod, authMethodForStoredClient, selectDcrTokenEndpointAuthMethod, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, listVendoredOpenapiEntries, ConnectionAuthInputSchema, connectionAuthSummary, listRelationalCredentialBindings, getCredentialBindingById, findCredentialBindingByIdentity, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, listScriptConnectionsAsync, getScriptConnectionById, ScriptConnectionConflictError, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, deleteScriptConnection, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, writeBareImportShim, MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, require_typescript, checkImportAllowlist, validateScriptImports, runScript, extractScriptSignature, extractArgsJsonSchema, getSavedScriptOwnerAgentId, runSavedScriptAsAgent, resolveSyncRunAs, AppNameSchema, ColumnKindSchema, isIso8601Date, SYSTEM_COLUMN_KINDS, SORTABLE_SYSTEM_DATE_COLUMNS, AppElementsSchema, AppDefinitionSchema, collectScriptReferences, parseAppDefinition, applyAppDefinitionPatch, upgradeAppDefinition, decodeAppDefinition, appDefinitionNeedsRepair, createApp, getApp, listApps, listAppRecords, updateApp, deleteApp, getScriptAppTypes, SCRIPT_SDK_TYPES, scriptSdkTypesWithGeneratedApis, SCRIPT_STDLIB_MODULE_TYPES, scriptStdlibTypesWithGeneratedApis, typecheckWithAmbient, typecheckScript };
+// src/be/skill-parser.ts
+function parseSkillContent(content) {
+  const trimmed = content.trim();
+  if (!trimmed.startsWith("---")) {
+    throw new Error("Skill content must start with YAML frontmatter (---). No frontmatter found.");
+  }
+  const secondDelimiter = trimmed.indexOf("---", 3);
+  if (secondDelimiter === -1) {
+    throw new Error("Skill content has unterminated frontmatter. Missing closing ---.");
+  }
+  const frontmatterRaw = trimmed.slice(3, secondDelimiter).trim();
+  const body = trimmed.slice(secondDelimiter + 3).trim();
+  const metadata = {};
+  for (const line of frontmatterRaw.split(`
+`)) {
+    const colonIdx = line.indexOf(":");
+    if (colonIdx === -1)
+      continue;
+    const key = line.slice(0, colonIdx).trim();
+    let value = line.slice(colonIdx + 1).trim();
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+      try {
+        value = JSON.parse(value);
+      } catch {}
+    }
+    if (key && value) {
+      metadata[key] = value;
+    }
+  }
+  if (!metadata.name) {
+    throw new Error('Skill frontmatter is missing required field: "name"');
+  }
+  if (!metadata.description) {
+    throw new Error('Skill frontmatter is missing required field: "description"');
+  }
+  return {
+    name: metadata.name,
+    description: metadata.description,
+    allowedTools: metadata["allowed-tools"] || undefined,
+    model: metadata.model || undefined,
+    effort: metadata.effort || undefined,
+    context: metadata.context || undefined,
+    agent: metadata.agent || undefined,
+    disableModelInvocation: metadata["disable-model-invocation"] === "true" ? true : undefined,
+    userInvocable: metadata["user-invocable"] !== undefined ? metadata["user-invocable"] !== "false" : undefined,
+    body
+  };
+}
+
+export { require_dist, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, mcpOAuthSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, normalizeTokenEndpointAuthMethod, resolveAdvertisedTokenEndpointAuthMethod, authMethodForStoredClient, selectDcrTokenEndpointAuthMethod, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, resolveSqlDsn, runReadOnlyQuery, listVendoredOpenapiEntries, ConnectionAuthInputSchema, SqlDsnInputSchema, connectionAuthSummary, listRelationalCredentialBindings, getCredentialBindingById, findCredentialBindingByIdentity, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, listScriptConnectionsAsync, getScriptConnectionById, ScriptConnectionConflictError, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, deleteScriptConnection, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, writeBareImportShim, MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, require_typescript, checkImportAllowlist, validateScriptImports, runScript, extractScriptSignature, extractArgsJsonSchema, getSavedScriptOwnerAgentId, runSavedScriptAsAgent, resolveSyncRunAs, AppNameSchema, ColumnKindSchema, isIso8601Date, SYSTEM_COLUMN_KINDS, SORTABLE_SYSTEM_DATE_COLUMNS, AppElementsSchema, AppDefinitionSchema, collectScriptReferences, parseAppDefinition, applyAppDefinitionPatch, upgradeAppDefinition, decodeAppDefinition, appDefinitionNeedsRepair, createApp, getApp, listApps, listAppRecords, updateApp, deleteApp, getScriptAppTypes, SCRIPT_SDK_TYPES, scriptSdkTypesWithGeneratedApis, SCRIPT_STDLIB_MODULE_TYPES, scriptStdlibTypesWithGeneratedApis, typecheckWithAmbient, typecheckScript, parseSkillContent };