@desplega.ai/agent-swarm 2.3.0 → 2.4.1

package/dist/{cli-8qsx817b.js → cli-kr2pmfqx.js}

@@ -72,6 +72,7 @@ import {
   hasNonTerminalRerouteDecisionChild2,
   getAgentCurrentTask2,
   findTaskByVcs2,
+  readableSessionCondition,
   getAllTasks2,
   getPendingChatRelayTasks2,
   giveUpStaleChatRelays2,
@@ -89,6 +90,7 @@ import {
   getLatestLeadTaskByContextKey2,
   findCompletedTaskInThread2,
   findRecentCancelledTaskInThread2,
+  init_read,
   listModelProfiles,
   getModelProfileByName,
   modelProfileRefError,
@@ -330,19 +332,19 @@ import {
   recordInlineScriptRun2,
   exports_db,
   init_db3
-} from "./cli-re4wkbzx.js";
+} from "./cli-rqqsfz30.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-6vcyw6v7.js";
+} from "./cli-nx462e4v.js";
 import {
   ensurePricingSeeded2,
   ensureRbacSeeded2,
   ensureModelProfilesSeeded2
-} from "./cli-xgn4rwyv.js";
+} from "./cli-s48yvzb8.js";
 import {
   loadModelsDevCache
-} from "./cli-qrwp40st.js";
+} from "./cli-3p8fqcnh.js";
 import {
   buildCatalogEntries,
   listModelCatalog,
@@ -352,12 +354,12 @@ import {
   loadModelsCatalog,
   requestModelCatalogRefresh2,
   startPricingRefreshLoop2
-} from "./cli-kqypty34.js";
+} from "./cli-k9z4zd4p.js";
 import {
   ampPinProviderError,
   ampPinCatalogError,
   ampModelError
-} from "./cli-fhvqt2fp.js";
+} from "./cli-sv5gb0yb.js";
 import {
   notifyAutomationPreflightFailure,
   isNeedsSetupFailure,
@@ -395,6 +397,7 @@ import {
   cancelWorkflowRunRows2,
   cancelWorkflowRun2,
   resumeWaitState2,
+  recoverResolvedWaitState2,
   resumeFromChildRun2,
   initWaitBusSubscriptions2,
   TriggerSchemaError,
@@ -408,7 +411,7 @@ import {
   buildNodeInterpolationCtx,
   interpolateNodeConfig,
   scriptBodyInterpolationError
-} from "./cli-jhmjwqcg.js";
+} from "./cli-kmqgmcnb.js";
 import {
   require_dist2,
   publicEndpointSsrfOptions,
@@ -465,14 +468,14 @@ import {
   deleteApp,
   typecheckScript,
   parseSkillContent
-} from "./cli-65q70v2v.js";
+} from "./cli-0bh477zn.js";
 import {
   buildAuthorizationUrl,
   onAuthorizationRefreshed,
   ensureAuthorizationTokenOrThrow,
   ensureToken,
   ensureTokenOrThrow
-} from "./cli-g6p7c2my.js";
+} from "./cli-sjyetj21.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -484,6 +487,7 @@ import {
   getTaskLink,
   getTaskUrl,
   markdownToSlack,
+  buildMrkdwnSectionBlocks,
   buildCaptionBlock,
   taskCitationIssues,
   stripInvalidTaskCitations,
@@ -501,14 +505,14 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-dxwh4j32.js";
+} from "./cli-vy0fay6k.js";
 import {
   slackCode,
   slackMissingScopeMessage,
   withAutoJoin,
   externalChannelToolError2,
   getChannelBlockReason2
-} from "./cli-9e9kjqsj.js";
+} from "./cli-mfe7f7b5.js";
 import {
   BaseExecutor,
   postApprovalCancellationUpdates,
@@ -525,11 +529,36 @@ import {
   definitionNodeIds,
   validateDefinition,
   applyDefinitionPatch
-} from "./cli-q1812jbw.js";
+} from "./cli-tbhwrxpt.js";
 import {
   workflowEventBus2,
   init_event_bus
-} from "./cli-ptkpaqfy.js";
+} from "./cli-wt645v7q.js";
+import {
+  duplicateGuardedQueryKey,
+  parseQueryParams,
+  getPathSegments,
+  agentWithCapacity,
+  BODY_TOO_LARGE,
+  enforceContentLengthCap,
+  json,
+  jsonError,
+  getSessionRoot,
+  sessionAccessForRoot,
+  resolveTaskAuditUserId,
+  resolveHttpFavoriteOwner,
+  resolveSessionActor2,
+  SESSION_READ_DENIED2,
+  canReadSession2,
+  readableByFor2,
+  pathSessionDenial2,
+  userAgentIdentityDenial2,
+  runtimeInstanceHeader,
+  routeRegistry,
+  isPublicRoute,
+  findRoute,
+  route
+} from "./cli-z071fb95.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-7a91w22y.js";
@@ -539,23 +568,9 @@ import {
   getFileStorageProvider2
 } from "./cli-qje9k2nh.js";
 import {
-  findUserById,
-  findUserByExternalId,
-  findUserByEmail,
-  findUsersByName,
-  getUserIdentities,
-  recordIdentityEvent,
-  findOrCreateUserByEmail,
-  linkIdentity,
-  unlinkIdentity,
-  resolveUserByToken,
-  revokeRuntimeTokensForRuntime,
-  resolveSessionToken,
-  fingerprintApiKey,
-  init_users,
   getRuntimePool2,
   init_db
-} from "./cli-hz64bcnj.js";
+} from "./cli-bn5kevnf.js";
 import {
   getMemoryRaterNames,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -566,7 +581,7 @@ import {
   COMPOSIO_HTTP_METHODS,
   executeComposioRequest,
   composioArgsFromParts
-} from "./cli-rdr166ht.js";
+} from "./cli-smvcw9z5.js";
 import {
   require_fast_deep_equal
 } from "./cli-bhp11egn.js";
@@ -580,7 +595,23 @@ import {
 import {
   canProvisionKind,
   init_runtime_providers
-} from "./cli-wk8ccrz6.js";
+} from "./cli-pw7v69vp.js";
+import {
+  findUserById,
+  findUserByExternalId,
+  findUserByEmail,
+  findUsersByName,
+  getUserIdentities,
+  recordIdentityEvent,
+  findOrCreateUserByEmail,
+  linkIdentity,
+  unlinkIdentity,
+  resolveUserByToken,
+  revokeRuntimeTokensForRuntime,
+  resolveSessionToken,
+  fingerprintApiKey,
+  init_users
+} from "./cli-fz9kewbh.js";
 import {
   isRbacEnabled,
   decideAdmission,
@@ -589,7 +620,7 @@ import {
   init_elevated_agents,
   can,
   init_rbac
-} from "./cli-zj4d6afs.js";
+} from "./cli-1pa3rz69.js";
 import {
   normalizeAssetKey,
   parseAssetKey,
@@ -649,7 +680,7 @@ import {
   KvNamespaceSchema,
   KvKeySchema,
   init_types
-} from "./cli-yv0vgscc.js";
+} from "./cli-fpmsqq59.js";
 import {
   generateDefaultClaudeMd2,
   generateDefaultSoulMd2,
@@ -658,7 +689,7 @@ import {
   taskAttachmentFetchCommand,
   taskAttachmentDisplayUrl,
   init_task_attachment_links
-} from "./cli-cby329ny.js";
+} from "./cli-x5mq1fyq.js";
 import {
   getSlackConfiguration,
   init_config
@@ -677,7 +708,7 @@ import {
   init_registry,
   resolveTemplate,
   init_resolver
-} from "./cli-w7z94e6c.js";
+} from "./cli-tx00c0h6.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -689,7 +720,6 @@ import {
   init_json_schema_processors,
   init_core,
   datetime,
-  ZodError,
   string2,
   uuid,
   number2,
@@ -721,7 +751,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-5d1m1qca.js";
+} from "./cli-ash6xxk7.js";
 import {
   realtimeBus,
   init_bus
@@ -754,7 +784,7 @@ import {
   registerVolatileSecret,
   registerSensitiveKeyName,
   init_secret_scrubber
-} from "./cli-4mkvwgzr.js";
+} from "./cli-xf234ws8.js";
 import {
   isAlias,
   parseAlias,
@@ -768,7 +798,7 @@ import {
   openAICompatibleProviderIds,
   claudeCatalogModelId,
   init_src2
-} from "./cli-x3en6ct3.js";
+} from "./cli-nwyw3zhg.js";
 import {
   __toESM,
   __commonJS,
@@ -20223,17 +20253,12 @@ async function recoverWaitStates(registry) {
   let recovered = 0;
   for (const stuck of stuckRuns) {
     try {
-      let resumeStatus;
-      let payload;
-      if (stuck.waitStatus === "fired") {
-        resumeStatus = "fired";
-        payload = stuck.firedPayload != null ? safeJsonParse(stuck.firedPayload) : undefined;
-      } else if (stuck.waitStatus === "timeout") {
-        resumeStatus = "timeout";
+      if (stuck.waitStatus === "pending") {
+        const status = stuck.waitMode === "time" ? "fired" : "timeout";
+        await resumeWaitState2(stuck.waitId, status, undefined, registry);
       } else {
-        resumeStatus = stuck.waitMode === "time" ? "fired" : "timeout";
+        await recoverResolvedWaitState2(stuck.waitId, registry);
       }
-      await resumeWaitState2(stuck.waitId, resumeStatus, payload, registry);
       recovered++;
     } catch (err) {
       if (await failRunOnUnreadableReplay(stuck.runId, err))
@@ -20243,13 +20268,6 @@ async function recoverWaitStates(registry) {
   }
   return recovered;
 }
-function safeJsonParse(s) {
-  try {
-    return JSON.parse(s);
-  } catch {
-    return s;
-  }
-}
 async function getRunIdsByStatus(status) {
   const rows = await getDbClient2().query("SELECT id FROM workflow_runs WHERE status = ?", [status]);
   return rows.map((r) => r.id);
@@ -21125,7 +21143,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp } = await import("./app-4e1s4675.js");
+        const { getSlackApp } = await import("./app-kreq1gwg.js");
         const app = getSlackApp();
         if (!app) {
           return {
@@ -23676,6 +23694,13 @@ var SDK_TOOL_NAME_MAP = {
   app_list: "app-list",
   app_patch: "app-patch",
   app_query: "app-query",
+  app_rows_list: "app-rows-list",
+  app_row_get: "app-row-get",
+  app_row_create: "app-row-create",
+  app_rows_create: "app-rows-create",
+  app_row_patch: "app-row-patch",
+  app_row_delete: "app-row-delete",
+  app_rows_delete: "app-rows-delete",
   app_rollback: "app-rollback",
   app_sync: "app-sync",
   app_upsert: "app-upsert",
@@ -24132,7 +24157,7 @@ var NUDGES = {
     const definition = r.data?.app?.definition;
     const hasQueries = Object.keys(definition?.queries ?? {}).length > 0;
     const hasActions = Object.keys(definition?.actions ?? {}).length > 0;
-    return hasQueries || hasActions ? "This app's callable surface is `definition.queries` (run with `app-query`, passing any `$param` values) and `definition.actions` (invoke with `POST /api/apps/<id>/actions/<name>`; `sync` actions refresh sources)." : undefined;
+    return hasQueries || hasActions ? "Run `definition.queries` with `app-query` and supply each `$param` value. Invoke `definition.actions` with `app-action-run` through MCP or `POST /api/apps/<id>/actions/<name>` through REST. Sync actions refresh sources." : undefined;
   },
   "kv-get": (r) => {
     if (!r.ok)
@@ -24480,7 +24505,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-6pdjtkr1.js");
+  const dispatcher = await import("./dispatcher-0s0mckqr.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -24575,469 +24600,6 @@ var createToolRegistrar = (server) => {
   };
 };
 
-// src/http/route-def.ts
-init_zod();
-init_node_env();
-init_secret_scrubber();
-
-// src/http/utils.ts
-init_db3();
-init_env_flag();
-init_node_env();
-init_secret_scrubber();
-function duplicateGuardedQueryKey(query) {
-  return ["agentId", "repoId", "includeSecrets", "resolveSecrets"].find((key) => query.getAll(key).length > 1);
-}
-var DEFAULT_ALLOWED_ORIGINS = [
-  "https://*.agent-swarm.dev",
-  "https://*.agent-swarm.cloud",
-  "http://localhost:5274",
-  "http://127.0.0.1:5274",
-  "http://[::1]:5274",
-  "https://ui.swarm.localhost:1355"
-];
-var warnedAboutAllowAnyOrigin = false;
-function warnIfCorsAllowsAnyOrigin() {
-  if (isEnvFlagEnabled("CORS_ALLOW_ANY_ORIGIN", false) && !warnedAboutAllowAnyOrigin) {
-    warnedAboutAllowAnyOrigin = true;
-    console.warn("[CORS] CORS_ALLOW_ANY_ORIGIN=true: any request origin can receive non-credentialed responses; cookie-authenticated responses still require CORS_ALLOWED_ORIGINS. Set CORS_ALLOWED_ORIGINS and disable CORS_ALLOW_ANY_ORIGIN to restrict access.");
-  }
-}
-function getAllowedOrigins() {
-  const raw = process.env.CORS_ALLOWED_ORIGINS;
-  if (!raw || !raw.trim())
-    return DEFAULT_ALLOWED_ORIGINS;
-  return raw.split(",").map((entry) => entry.trim()).filter(Boolean);
-}
-function isDevLoopbackOrigin(origin) {
-  if (getNodeEnv() !== "development")
-    return false;
-  return /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d{1,5})?$/.test(origin);
-}
-function originAllowedForCredentials(origin) {
-  if (isDevLoopbackOrigin(origin))
-    return true;
-  return getAllowedOrigins().some((entry) => {
-    if (!entry.includes("*"))
-      return entry === origin;
-    const pattern = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/\*\.([a-zA-Z0-9.-]+)(:\d+)?$/.exec(entry);
-    const candidate = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([a-zA-Z0-9.-]+)(:\d+)?$/.exec(origin);
-    if (!pattern || !candidate)
-      return false;
-    if (pattern[1] !== candidate[1] || pattern[3] !== candidate[3])
-      return false;
-    const suffix = pattern[2].toLowerCase();
-    const hostname = candidate[2].toLowerCase();
-    const validLabel = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-    if (![...suffix.split("."), ...hostname.split(".")].every((label) => validLabel.test(label))) {
-      return false;
-    }
-    return hostname.endsWith(`.${suffix}`);
-  });
-}
-function isOriginAllowedForCredentials(origin) {
-  const allowed = originAllowedForCredentials(origin);
-  if (!allowed) {
-    console.warn(`[CORS] Denied credentialed origin ${scrubSecrets(JSON.stringify(origin.slice(0, 512)))}; add the trusted SPA origin to CORS_ALLOWED_ORIGINS (custom values replace hosted/dev defaults).`);
-  }
-  return allowed;
-}
-function allowedCredentialRedirect(raw) {
-  if (!raw)
-    return;
-  try {
-    const redirect = new URL(raw);
-    if (redirect.protocol !== "http:" && redirect.protocol !== "https:")
-      return;
-    return originAllowedForCredentials(redirect.origin) ? redirect.toString() : undefined;
-  } catch {
-    return;
-  }
-}
-function setCorsHeaders(req, res) {
-  const rawOrigin = req.headers.origin;
-  const origin = Array.isArray(rawOrigin) ? rawOrigin[0] : rawOrigin;
-  const allowCredentials = origin ? isOriginAllowedForCredentials(origin) : false;
-  const allowAnyOrigin = isEnvFlagEnabled("CORS_ALLOW_ANY_ORIGIN", false);
-  if (allowAnyOrigin)
-    warnIfCorsAllowsAnyOrigin();
-  if (origin && !allowCredentials && !allowAnyOrigin) {
-    res.setHeader("Vary", "Origin");
-    return;
-  }
-  if (origin) {
-    res.setHeader("Access-Control-Allow-Origin", origin);
-    res.setHeader("Vary", "Origin");
-    if (allowCredentials)
-      res.setHeader("Access-Control-Allow-Credentials", "true");
-    const reqHeaders = req.headers["access-control-request-headers"];
-    const askedHeaders = Array.isArray(reqHeaders) ? reqHeaders.join(", ") : reqHeaders;
-    res.setHeader("Access-Control-Allow-Headers", askedHeaders ?? "Authorization, Content-Type, X-Agent-ID, X-Requested-With, X-Swarm-User-Id");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
-    res.setHeader("Access-Control-Expose-Headers", "Content-Type, Content-Length, ETag, Location");
-  } else {
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "*");
-    res.setHeader("Access-Control-Expose-Headers", "*");
-  }
-}
-function parseQueryParams(url) {
-  const queryIndex = url.indexOf("?");
-  if (queryIndex === -1)
-    return new URLSearchParams;
-  return new URLSearchParams(url.slice(queryIndex + 1));
-}
-function getPathSegments(url) {
-  const pathEnd = url.indexOf("?");
-  const path = pathEnd === -1 ? url : url.slice(0, pathEnd);
-  return path.split("/").filter(Boolean);
-}
-function abortedStatusCodeAttribute(headersSent, statusCode) {
-  return headersSent ? statusCode : undefined;
-}
-function wireHttpSpanLifecycle(res, span, getStatusCode, startTime) {
-  let spanEnded = false;
-  res.on("finish", () => {
-    if (spanEnded)
-      return;
-    spanEnded = true;
-    const statusCode = getStatusCode();
-    span.setAttributes({
-      "http.response.status_code": statusCode,
-      "agentswarm.http.duration_ms": Math.round((performance.now() - startTime) * 10) / 10
-    });
-    if (statusCode >= 500) {
-      span.setStatus({ code: 2, message: `HTTP ${statusCode}` });
-    }
-    span.end();
-  });
-  res.on("error", (err) => {
-    if (spanEnded)
-      return;
-    spanEnded = true;
-    if (err)
-      span.recordException(err);
-    span.setStatus({ code: 2, message: err?.message });
-    span.end();
-  });
-  res.on("close", () => {
-    if (spanEnded)
-      return;
-    spanEnded = true;
-    span.setAttributes({
-      "http.response.status_code": abortedStatusCodeAttribute(res.headersSent, getStatusCode()),
-      "agentswarm.http.duration_ms": Math.round((performance.now() - startTime) * 10) / 10,
-      "agentswarm.http.aborted": true
-    });
-    span.end();
-  });
-}
-function safeRequestUrlForLog(rawUrl) {
-  if (!rawUrl)
-    return "";
-  try {
-    const url = new URL(rawUrl, "http://localhost");
-    const params = Array.from(url.searchParams.keys());
-    if (params.length === 0)
-      return url.pathname;
-    const redactedQuery = params.map((key) => `${key}=[REDACTED]`).join("&");
-    return `${url.pathname}?${redactedQuery}`;
-  } catch {
-    const pathOnly = rawUrl.split("?")[0] || rawUrl;
-    return scrubSecrets(pathOnly);
-  }
-}
-async function agentWithCapacity(agent) {
-  const activeCount = await getActiveTaskCount2(agent.id);
-  const max = agent.maxTasks ?? 1;
-  return {
-    ...agent,
-    capacity: {
-      current: activeCount,
-      max,
-      available: Math.max(0, max - activeCount)
-    }
-  };
-}
-
-class RequestBodyTooLargeError extends Error {
-  maxBytes;
-  constructor(maxBytes) {
-    super(`Payload too large (max ${maxBytes} bytes)`);
-    this.name = "RequestBodyTooLargeError";
-    this.maxBytes = maxBytes;
-  }
-}
-function requestContentLength(req) {
-  const raw = req.headers["content-length"];
-  const value = Array.isArray(raw) ? raw[0] : raw;
-  if (!value)
-    return;
-  const parsed = Number(value);
-  return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;
-}
-async function parseBody(req, maxBytes = Number.POSITIVE_INFINITY) {
-  const contentLength = requestContentLength(req);
-  if (contentLength !== undefined && contentLength > maxBytes) {
-    req.resume();
-    throw new RequestBodyTooLargeError(maxBytes);
-  }
-  return await new Promise((resolve, reject) => {
-    const chunks = [];
-    let totalBytes = 0;
-    let settled = false;
-    const cleanup = () => {
-      req.off("data", onData);
-      req.off("end", onEnd);
-      req.off("error", onError);
-      req.off("aborted", onAborted);
-      req.off("close", onClose);
-    };
-    const rejectTooLarge = () => {
-      if (settled)
-        return;
-      settled = true;
-      reject(new RequestBodyTooLargeError(maxBytes));
-      req.resume();
-    };
-    const onData = (chunk) => {
-      if (settled)
-        return;
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      totalBytes += buffer.byteLength;
-      if (totalBytes > maxBytes) {
-        rejectTooLarge();
-        return;
-      }
-      chunks.push(buffer);
-    };
-    const onEnd = () => {
-      if (settled) {
-        cleanup();
-        return;
-      }
-      settled = true;
-      cleanup();
-      const raw = Buffer.concat(chunks).toString();
-      if (raw.trim() === "") {
-        resolve({});
-        return;
-      }
-      try {
-        resolve(JSON.parse(raw));
-      } catch (error) {
-        reject(error);
-      }
-    };
-    const onError = (error) => {
-      cleanup();
-      if (!settled) {
-        settled = true;
-        reject(error);
-      }
-    };
-    const onAborted = () => onError(new Error("Request body was aborted"));
-    const onClose = () => {
-      if (!req.readableEnded)
-        onError(new Error("Request body closed before completion"));
-    };
-    req.on("data", onData);
-    req.on("end", onEnd);
-    req.on("error", onError);
-    req.on("aborted", onAborted);
-    req.on("close", onClose);
-    req.resume();
-  });
-}
-var BODY_TOO_LARGE = Symbol("body-too-large");
-function enforceContentLengthCap(req, res, maxBytes) {
-  const raw = req.headers["content-length"];
-  const val = Array.isArray(raw) ? raw[0] : raw;
-  if (!val)
-    return null;
-  const n = Number(val);
-  if (!Number.isFinite(n) || n < 0)
-    return null;
-  if (n > maxBytes) {
-    res.writeHead(413, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: `Payload too large (max ${maxBytes} bytes)` }));
-    return BODY_TOO_LARGE;
-  }
-  return null;
-}
-function json(res, data, status = 200) {
-  res.writeHead(status, { "Content-Type": "application/json" });
-  res.end(JSON.stringify(data));
-}
-function jsonError(res, error, status = 400) {
-  res.writeHead(status, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ error: scrubSecrets(error) }));
-}
-function writeUnhandledError(res, err, req) {
-  const message = err instanceof Error ? err.message : String(err);
-  console.error(`[HTTP] ❌ ${req?.method ?? ""} ${safeRequestUrlForLog(req?.url)} → ${scrubSecrets(message)}`);
-  if (!res.headersSent) {
-    jsonError(res, message, 500);
-  } else if (!res.writableEnded) {
-    res.end();
-  }
-}
-function triggerSchemaErrorResponse(res, message, details) {
-  res.writeHead(400, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ error: "TriggerSchemaError", message, details }));
-}
-function deriveApiBaseUrl(req) {
-  const publicBase = process.env.PUBLIC_MCP_BASE_URL?.trim();
-  if (publicBase)
-    return publicBase.replace(/\/+$/, "");
-  const envBase = process.env.MCP_BASE_URL?.trim();
-  if (envBase)
-    return envBase.replace(/\/+$/, "");
-  const fwdProtoRaw = req.headers["x-forwarded-proto"];
-  const fwdHostRaw = req.headers["x-forwarded-host"];
-  const fwdProto = Array.isArray(fwdProtoRaw) ? fwdProtoRaw[0] : fwdProtoRaw;
-  const fwdHost = Array.isArray(fwdHostRaw) ? fwdHostRaw[0] : fwdHostRaw;
-  const proto = fwdProto?.split(",")[0]?.trim() || "http";
-  const host = fwdHost?.split(",")[0]?.trim() || req.headers.host;
-  if (host)
-    return `${proto}://${host}`;
-  return `http://localhost:${process.env.PORT || "3013"}`;
-}
-function httpServerSemconvAttributes(req) {
-  const headerValue = (v) => Array.isArray(v) ? v[0] : v;
-  const firstHop = (v) => headerValue(v)?.split(",")[0]?.trim() || undefined;
-  const fwdProto = firstHop(req.headers["x-forwarded-proto"]);
-  const host = firstHop(req.headers["x-forwarded-host"]) ?? headerValue(req.headers.host)?.trim();
-  return {
-    "server.address": host ? host.replace(/:\d+$/, "") || undefined : undefined,
-    "url.scheme": fwdProto ?? "http",
-    "network.protocol.version": req.httpVersion || undefined,
-    "user_agent.original": headerValue(req.headers["user-agent"])
-  };
-}
-function matchRoute(method, pathSegments, expectedMethod, pattern, exact = false) {
-  if (method !== expectedMethod)
-    return false;
-  for (let i = 0;i < pattern.length; i++) {
-    const seg = pattern[i];
-    if (seg === null) {
-      if (!pathSegments[i])
-        return false;
-    } else {
-      if (pathSegments[i] !== seg)
-        return false;
-    }
-  }
-  if (exact && pathSegments[pattern.length])
-    return false;
-  return true;
-}
-
-// src/http/route-def.ts
-var runtimeInstanceHeader = (operation) => object2({
-  "X-Runtime-Instance-ID": string2().optional().describe("Identifies the concrete runtime instance (worker process) making the call, " + `as generated at its boot. Required to ${operation} when multi-runtime mode ` + "(MULTI_RUNTIME_ENABLED) is on; ignored otherwise.")
-});
-var routeRegistry = [];
-function isPublicRoute(method, pathSegments) {
-  for (const def of routeRegistry) {
-    if (def.auth?.apiKey === false) {
-      if (matchRoute(method, pathSegments, def.method.toUpperCase(), def.pattern, def.exact ?? true)) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-function findRoute(method, pathSegments) {
-  for (const def of routeRegistry) {
-    if (matchRoute(method, pathSegments, def.method.toUpperCase(), def.pattern, def.exact ?? true)) {
-      return def;
-    }
-  }
-  return;
-}
-var CORE_ROUTE_TEMPLATES = {
-  health: { path: "/health" },
-  "openapi.json": { path: "/openapi.json" },
-  docs: { path: "/docs", toleratesTrailingSlash: true },
-  me: { path: "/me", methods: ["GET"], toleratesQueryString: true },
-  "cancelled-tasks": {
-    path: "/cancelled-tasks",
-    methods: ["GET"],
-    toleratesQueryString: true
-  },
-  "internal/reload-config": { path: "/internal/reload-config", methods: ["POST"] },
-  mcp: { path: "/mcp", methods: ["GET", "POST", "DELETE"] },
-  "mcp-user": { path: "/mcp-user", methods: ["GET", "POST", "DELETE"] }
-};
-function describeRequestRoute(method, pathSegments, hasQueryString = false, hasTrailingSlash = false) {
-  const m = (method ?? "").toUpperCase() || "UNKNOWN";
-  const matched = findRoute(method, pathSegments);
-  if (matched)
-    return { spanName: `${m} ${matched.path}`, httpRoute: matched.path };
-  const coreTemplate = CORE_ROUTE_TEMPLATES[pathSegments.join("/")];
-  if (coreTemplate && (!coreTemplate.methods || coreTemplate.methods.includes(m)) && (!hasQueryString || coreTemplate.toleratesQueryString) && (!hasTrailingSlash || coreTemplate.toleratesTrailingSlash)) {
-    return { spanName: `${m} ${coreTemplate.path}`, httpRoute: coreTemplate.path };
-  }
-  const first = pathSegments[0];
-  return { spanName: first ? `${m} /${first}` : m };
-}
-var VALIDATE_RESPONSES = getNodeEnv() === "test" || getNodeEnv() === "development" || process.env.VALIDATE_HTTP_RESPONSES === "true";
-function route(def) {
-  routeRegistry.push(def);
-  return {
-    def,
-    respond(res, code, data) {
-      if (VALIDATE_RESPONSES) {
-        const schema = def.responses[code]?.schema;
-        if (schema) {
-          const result = schema.safeParse(data);
-          if (!result.success) {
-            const detail = `Response schema violation: ${def.method.toUpperCase()} ${def.path} ${code} — ` + result.error.issues.map((i) => `${i.path.join(".") || "<root>"}: ${i.message}`).join("; ");
-            if (getNodeEnv() === "test") {
-              throw new Error(detail);
-            }
-            console.error(`[route-def] ${scrubSecrets(detail)}`);
-          }
-        }
-      }
-      res.writeHead(code, { "Content-Type": "application/json" });
-      res.end(JSON.stringify(data));
-    },
-    match(method, pathSegments) {
-      return matchRoute(method, pathSegments, def.method.toUpperCase(), def.pattern, def.exact ?? true);
-    },
-    async parse(req, res, pathSegments, queryParams) {
-      try {
-        const rawParams = {};
-        if (def.params) {
-          const paramNames = def.path.match(/\{(\w+)\}/g)?.map((p) => p.slice(1, -1)) ?? [];
-          for (let i = 0;i < def.pattern.length; i++) {
-            if (def.pattern[i] === null && paramNames.length > 0) {
-              rawParams[paramNames.shift()] = pathSegments[i] ?? "";
-            }
-          }
-        }
-        const params = def.params ? def.params.parse(rawParams) : undefined;
-        const query = def.query ? def.query.parse(Object.fromEntries(queryParams)) : undefined;
-        const body = def.body ? def.body.parse(await parseBody(req, def.maxBodyBytes)) : undefined;
-        return { params, query, body };
-      } catch (err) {
-        if (err instanceof ZodError) {
-          jsonError(res, `Validation error: ${err.issues.map((e) => `${e.path.join(".")}: ${e.message}`).join(", ")}`, 400);
-          return null;
-        }
-        if (err instanceof RequestBodyTooLargeError) {
-          jsonError(res, err.message, 413);
-          return null;
-        }
-        throw err;
-      }
-    }
-  };
-}
-
 // src/http/mcp-bridge.ts
 var _bridgeServer = null;
 async function getBridgeServer() {
@@ -31701,7 +31263,7 @@ async function loadAdapter(name, config, logger) {
       return createTelegramAdapter({ ...base, allowUnverifiedWebhooks: false });
     }
     case "slack": {
-      const { createSlackAdapter } = await import("./index-g909y089.js");
+      const { createSlackAdapter } = await import("./index-zgvqzjsw.js");
       return createSlackAdapter({
         ...base,
         signingSecret: config.signingSecret ?? "",
@@ -31720,7 +31282,7 @@ async function loadAdapter(name, config, logger) {
       });
     }
     case "teams": {
-      const { createTeamsAdapter } = await import("./index-x0q2a4f9.js");
+      const { createTeamsAdapter } = await import("./index-ysd45kgc.js");
       const { teamsWebhookVerifier, teamsToken } = getChatSdkTestHooks();
       return createTeamsAdapter({
         ...base,
@@ -34256,7 +33818,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-4e1s4675.js");
+    const { getSlackApp } = await import("./app-kreq1gwg.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -34327,7 +33889,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient } = await import("./db-hy80219q.js");
+  const { getDbClient } = await import("./db-w505dwa8.js");
   await getDbClient().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -107677,7 +107239,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-epr2gnbw.js");
+  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-x5aktmp8.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await syncTelemetryEnabled("settings").catch((err) => {
@@ -107693,10 +107255,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-p666cw5n.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-e53x6b9v.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-w6pm64j4.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-f6z923ny.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -107854,6 +107416,12 @@ async function handleCore(req, res, myAgentId, apiKey) {
     }
     setRequestAuth(req, auth);
   }
+  const routeDef = findRoute(req.method, pathSegments);
+  const agentIdentityDenial = await userAgentIdentityDenial2(req, routeDef, pathSegments);
+  if (agentIdentityDenial) {
+    jsonError(res, agentIdentityDenial, 403);
+    return true;
+  }
   if (auth?.kind === "agent") {
     const query = parseQueryParams(req.url || "");
     const duplicate = duplicateGuardedQueryKey(query);
@@ -107905,7 +107473,7 @@ async function handleCore(req, res, myAgentId, apiKey) {
   if (auth?.kind === "user" && isRbacEnabled()) {
     const grant = await getUserGrant2(auth.userId);
     if (!grant.grantsAll) {
-      const def = findRoute(req.method, pathSegments);
+      const def = routeDef;
       const decision = decideAdmission({
         method: req.method ?? "",
         rbac: def?.rbac,
@@ -107924,6 +107492,13 @@ async function handleCore(req, res, myAgentId, apiKey) {
       }
     }
   }
+  if (routeDef?.session) {
+    const sessionDenial = await pathSessionDenial2(req, myAgentId, routeDef, pathSegments);
+    if (sessionDenial) {
+      jsonError(res, sessionDenial, 403);
+      return true;
+    }
+  }
   if (req.method === "POST" && req.url === "/internal/reload-config") {
     try {
       const result = await reloadGlobalConfigsAndIntegrations();
@@ -107979,7 +107554,13 @@ async function handleCore(req, res, myAgentId, apiKey) {
     }
     const queryParams = parseQueryParams(req.url || "");
     const taskId = queryParams.get("taskId");
+    const sessionActor = await resolveSessionActor2(req, myAgentId);
     if (taskId) {
+      if (!await canReadSession2(req, myAgentId, taskId)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: SESSION_READ_DENIED2 }));
+        return true;
+      }
       const task = await getTaskById2(taskId);
       if (task && task.status === "cancelled") {
         res.writeHead(200, { "Content-Type": "application/json" });
@@ -107998,7 +107579,7 @@ async function handleCore(req, res, myAgentId, apiKey) {
       res.end(JSON.stringify({ cancelled: [] }));
       return true;
     }
-    const cancelledTasks = await getRecentlyCancelledTasksForAgent2(myAgentId);
+    const cancelledTasks = await getRecentlyCancelledTasksForAgent2(myAgentId, readableByFor2(sessionActor));
     res.writeHead(200, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ cancelled: cancelledTasks }));
     return true;
@@ -108212,15 +107793,21 @@ var registerAcceptSteerTool = (server) => {
   }, async (args, info, _meta) => acceptSteerHandler(ownerCtx(info), args));
 };
 
-// src/tools/app-diff.ts
+// src/tools/app-action-run.ts
 init_zod();
 
-// src/apps/version.ts
+// src/apps/action-runner.ts
+init_key();
 init_db3();
+init_db2();
+init_resolver();
+init_secret_scrubber();
 
-// src/apps/schema-migrate.ts
+// src/apps/sync.ts
 init_zod();
 init_db3();
+init_db2();
+init_types();
 init_secret_scrubber();
 
 // src/apps/row-store.ts
@@ -108560,14 +108147,14 @@ async function rebuildAppColumnIndexUnlocked(appId, model, columnName, column, r
     });
   }
 }
-function deleteAppRow(appId, model, _definition, rowId) {
+function deleteAppRow(appId, model, _definition, rowId, matches) {
   return withMutationLock(appId, model, async () => {
     const currentDefinition = await currentModelDefinition(appId, model);
     if (!currentDefinition)
       return false;
     const namespace = appsNamespace(appId);
     const row = await getAppRow(appId, model, rowId);
-    if (!row)
+    if (!row || matches && !matches(row))
       return false;
     for (const key of indexKeys(model, currentDefinition, row))
       await deleteKv2(namespace, key);
@@ -108602,11 +108189,6 @@ function purgeAppRows(appId, models, afterPurge) {
 }
 
 // src/apps/sync.ts
-init_zod();
-init_db3();
-init_db2();
-init_types();
-init_secret_scrubber();
 var MAX_PULL_RECORDS = 500;
 var MAX_PASS_WARNINGS = 20;
 var MAX_TASK_LIMIT = 200;
@@ -109192,7 +108774,176 @@ async function runAppSync(input) {
   return { ok: passes.every((pass) => pass.error === undefined), passes };
 }
 
+// src/apps/action-runner.ts
+function syncPassError(sync) {
+  const failed = sync.passes.filter((pass) => pass.error !== undefined);
+  if (failed.length === 0)
+    return;
+  return failed.map((pass) => `${pass.model}.${pass.source}: ${pass.error}`).join("; ");
+}
+async function runAppAction({
+  app,
+  name,
+  input = {},
+  caller,
+  actor
+}) {
+  const actions = app.definition.actions;
+  if (!actions || !Object.hasOwn(actions, name)) {
+    return { status: 404, body: { error: "app action not found" } };
+  }
+  const action = actions[name];
+  if (action.kind === "script") {
+    const script = await getScriptById(action.scriptId);
+    if (!script) {
+      return {
+        status: 400,
+        body: {
+          error: "invalid app action",
+          issues: [
+            {
+              path: `actions.${name}.scriptId`,
+              message: `script "${action.scriptId}" no longer exists`
+            }
+          ]
+        }
+      };
+    }
+    const runAsAgentId = getSavedScriptOwnerAgentId(script);
+    if (!runAsAgentId) {
+      return {
+        status: 400,
+        body: { error: "agentId is required: this script has no owning agent to run as" }
+      };
+    }
+    const output = await runSavedScriptAsAgent({
+      script,
+      input: { ...action.args, ...input, app: { id: app.id }, caller },
+      agentId: runAsAgentId
+    });
+    const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
+    const error = ok ? undefined : output.runtimeError ? `${output.runtimeError.name}: ${output.runtimeError.message}` : output.error ?? `Script exited with code ${output.exitCode}`;
+    return {
+      status: 200,
+      body: scrubObject({
+        ok,
+        result: output.result,
+        stdout: output.stdout,
+        ...error === undefined ? {} : { error },
+        durationMs: output.durationMs
+      })
+    };
+  }
+  if (action.kind === "sync") {
+    const startedAt = Date.now();
+    const sync = await runAppSync({
+      appId: app.id,
+      ...action.model === undefined ? {} : { model: action.model },
+      ...action.source === undefined ? {} : { source: action.source },
+      invokedBy: actor
+    });
+    const durationMs = Date.now() - startedAt;
+    if (sync.issues && sync.issues.length > 0) {
+      return { status: 400, body: { error: "invalid sync action", issues: sync.issues } };
+    }
+    const error = syncPassError(sync);
+    return {
+      status: 200,
+      body: scrubObject({
+        ok: sync.ok,
+        result: { passes: sync.passes },
+        ...error === undefined ? {} : { error },
+        durationMs
+      })
+    };
+  }
+  const lead = action.agentId ? null : await getLeadAgent2();
+  const taskPrompt = resolveTemplate("task.app.action", {
+    prompt: action.prompt,
+    app_id: app.id,
+    action_name: name,
+    input_json: JSON.stringify(input),
+    caller_json: JSON.stringify(caller)
+  });
+  const task = await createTaskWithSiblingAwareness(taskPrompt.text, {
+    source: "api",
+    agentId: action.agentId ?? lead?.id,
+    routingReason: action.agentId ? "human_pinned" : lead ? "skill" : undefined,
+    routingSource: action.agentId || lead ? "engine_default" : undefined,
+    key: normalizeAssetKey(`shared/app:${app.id}/action:${name}/`),
+    ...actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {}
+  }, { origin: "app" });
+  return {
+    status: 200,
+    body: { ok: true, taskId: task.id, status: task.status }
+  };
+}
+
+// src/tools/app-action-run.ts
+init_db3();
+init_rbac();
+function registerAppActionRunTool(server) {
+  createToolRegistrar(server)("app-action-run", {
+    title: "Run an app action",
+    description: "Run a declared app action as an agent. Scripts and extensions cannot invoke this tool.",
+    annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+    rbac: { permission: "app.use" },
+    inputSchema: object2({
+      appId: string2().min(1),
+      action: AppNameSchema,
+      input: record2(string2(), unknown()).optional()
+    }),
+    outputSchema: swarmToolOutputSchema({
+      ok: boolean().optional(),
+      result: unknown().optional(),
+      stdout: string2().optional(),
+      error: string2().optional(),
+      durationMs: number2().optional(),
+      taskId: string2().optional(),
+      status: string2().optional()
+    })
+  }, async ({ appId, action, input }, info) => {
+    if (info.callOrigin === "script-sdk" || info.callOrigin === "extension")
+      return toolErr("Scripts and extensions cannot run app actions.");
+    if (!info.agentId)
+      return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+    const agent = await getAgentById2(info.agentId);
+    const decision = can({
+      principal: { kind: "agent", agentId: info.agentId, isLead: agent?.isLead ?? false },
+      verb: "app.use",
+      resource: { kind: "app", appId },
+      source: "mcp"
+    });
+    if (!decision.allow)
+      return toolErr(decision.reason);
+    const app = await getApp(appId);
+    if (!app)
+      return toolErr("App not found.");
+    if (appDefinitionNeedsRepair(app))
+      return toolErr("App definition needs repair.", { data: { issues: app.definitionError } });
+    const output = await runAppAction({
+      app,
+      name: action,
+      input,
+      actor: `agent:${info.agentId}`,
+      caller: { kind: "agent", id: info.agentId, ...agent?.name ? { name: agent.name } : {} }
+    });
+    if (output.status !== 200)
+      return toolErr(output.body.error ?? "Action failed.", { data: output.body });
+    return toolOk("Action invoked.", { data: output.body });
+  });
+}
+
+// src/tools/app-diff.ts
+init_zod();
+
+// src/apps/version.ts
+init_db3();
+
 // src/apps/schema-migrate.ts
+init_zod();
+init_db3();
+init_secret_scrubber();
 var MigrationValueSchema = union2([string2(), number2(), boolean()]);
 var AppMigrationDirectiveSchema = union2([
   object2({ set: MigrationValueSchema }).strict(),
@@ -110288,86 +110039,11 @@ async function upsertAppUserConfigValues(appId, scope, values) {
 }
 
 // src/http/apps.ts
-init_key();
 init_db3();
-init_db2();
-init_resolver();
 init_rbac();
 init_types();
 init_request_auth_context();
 init_secret_scrubber();
-
-// src/be/audit-user.ts
-init_request_auth_context();
-init_db3();
-init_users();
-async function resolveTaskAuditUserId(sourceTaskId, callerAgentId) {
-  if (!callerAgentId)
-    return null;
-  let resolvedSourceTaskId = sourceTaskId;
-  if (!resolvedSourceTaskId) {
-    const currentTask = await getAgentCurrentTask2(callerAgentId);
-    if (currentTask)
-      resolvedSourceTaskId = currentTask.id;
-  }
-  if (!resolvedSourceTaskId)
-    return null;
-  const task = await getTaskById2(resolvedSourceTaskId);
-  if (!task)
-    return null;
-  if (task.agentId !== callerAgentId)
-    return null;
-  if (task.requestedByUserId)
-    return task.requestedByUserId;
-  if (task.slackUserId) {
-    const user = await findUserByExternalId("slack", task.slackUserId);
-    if (user)
-      return user.id;
-  }
-  return null;
-}
-async function resolveHttpAuditUserId(req, callerAgentId) {
-  const auth = getRequestAuth(req);
-  if (auth?.kind === "user")
-    return auth.userId;
-  const header = req.headers["x-source-task-id"];
-  const sourceTaskId = Array.isArray(header) ? header[0] : header;
-  return resolveTaskAuditUserId(sourceTaskId, callerAgentId);
-}
-
-// src/http/favorite-owner.ts
-init_users();
-init_request_auth_context();
-var DASHBOARD_USER_HEADER = "x-swarm-user-id";
-function dashboardUserIdHeader(req) {
-  const raw = req.headers[DASHBOARD_USER_HEADER];
-  const value = (Array.isArray(raw) ? raw[0] : raw)?.trim();
-  return value ? value : null;
-}
-async function resolveHttpFavoriteOwner(req, callerAgentId, opts = {}) {
-  const auth = getRequestAuth(req);
-  if (auth?.kind === "user") {
-    return { scope: `user:${auth.userId}`, userId: auth.userId, actorId: auth.userId };
-  }
-  if (auth?.kind === "operator" && !callerAgentId) {
-    const pickedUserId = opts.dashboardUser === false || auth.page ? null : dashboardUserIdHeader(req);
-    if (pickedUserId) {
-      const user = await findUserById(pickedUserId);
-      if (user?.status === "active") {
-        return { scope: `user:${user.id}`, userId: user.id, actorId: user.id };
-      }
-    }
-    return {
-      scope: "operator",
-      userId: null,
-      actorId: auth.fingerprint
-    };
-  }
-  const userId = await resolveHttpAuditUserId(req, callerAgentId);
-  return userId ? { scope: `user:${userId}`, userId, actorId: userId } : null;
-}
-
-// src/http/apps.ts
 var MAX_APP_BODY_BYTES = 5 * 1024 * 1024;
 var MAX_APP_ROW_BODY_BYTES = 1 * 1024 * 1024;
 var MAX_APP_BULK_ROWS_BODY_BYTES = 10 * 1024 * 1024;
@@ -110851,24 +110527,32 @@ var syncAppRoute = route({
   },
   rbac: { permission: "app.use" }
 });
-async function authorizeApp(req, res, myAgentId, verb, resource) {
+async function authorizeAppCaller(req, res, myAgentId, verb, resource) {
   const auth = getRequestAuth(req);
   let principal;
   let actor;
+  let caller;
   if (auth?.kind === "operator") {
     principal = { kind: "operator" };
-    actor = "operator";
+    const agent = myAgentId && !auth.page ? await getAgentById2(myAgentId) : null;
+    actor = agent ? `agent:${agent.id}` : "operator";
+    caller = agent ? { kind: "agent", id: agent.id, name: agent.name } : { kind: "operator", id: null };
   } else if (auth?.kind === "user") {
     principal = { kind: "user", userId: auth.userId };
     actor = `user:${auth.userId}`;
-  } else if (auth?.kind === "guest") {
+    caller = { kind: "user", id: auth.userId, name: auth.user.name };
+  } else if (auth?.kind === "guest" || auth?.kind === "controller") {
     principal = { kind: "guest" };
     actor = "guest";
+    caller = { kind: "guest", id: null };
   } else {
     const agent = myAgentId ? await getAgentById2(myAgentId) : null;
     principal = { kind: "agent", agentId: myAgentId ?? "", isLead: agent?.isLead ?? false };
     actor = myAgentId ? `agent:${myAgentId}` : "agent";
+    caller = { kind: "agent", id: myAgentId ?? null, name: agent?.name };
   }
+  if (auth?.page)
+    caller.pageId = auth.page.id;
   const decision = can({
     principal,
     verb,
@@ -110876,10 +110560,13 @@ async function authorizeApp(req, res, myAgentId, verb, resource) {
     source: "http"
   });
   if (decision.allow)
-    return actor;
+    return { actor, caller };
   jsonError(res, decision.reason, 403);
   return null;
 }
+async function authorizeApp(req, res, myAgentId, verb, resource) {
+  return (await authorizeAppCaller(req, res, myAgentId, verb, resource))?.actor ?? null;
+}
 async function authorizeAppManage(req, res, myAgentId, appId) {
   return await authorizeApp(req, res, myAgentId, "app.manage", appId ? { kind: "app", appId } : { kind: "none" });
 }
@@ -110895,12 +110582,6 @@ function definitionNeedsRepair(res, app) {
   json(res, { error: "definition needs repair", issues: app.definitionError }, 409);
   return true;
 }
-function syncPassError(sync) {
-  const failed = sync.passes.filter((pass) => pass.error !== undefined);
-  if (failed.length === 0)
-    return;
-  return failed.map((pass) => `${pass.model}.${pass.source}: ${pass.error}`).join("; ");
-}
 function snapshotFailure(res) {
   jsonError(res, "failed to snapshot app", 500);
 }
@@ -111071,6 +110752,9 @@ function compareValues(left, right, direction, dateValues = false) {
 function rowValue(row, column) {
   return Object.hasOwn(row, column) ? row[column] : undefined;
 }
+function rowMatchesFilters(row, filters) {
+  return filters.every((filter) => rowValue(row, filter.column) === filter.value);
+}
 function applyQuery(rows, query, model, params = {}, queryName = "<unnamed>") {
   const filters = resolveQueryFilters(query, model, params, queryName);
   let selected = rows.filter((row) => filters.every(([column, value]) => rowValue(row, column) === value));
@@ -111083,6 +110767,23 @@ function applyQuery(rows, query, model, params = {}, queryName = "<unnamed>") {
   }
   return selected.slice(0, query.limit ?? 200);
 }
+async function selectAppRows(appId, modelName, model, filters, sortRaw, limit = 200, systemColumns = false) {
+  const rows = (await listAppRows(appId, modelName, filters.flatMap((filter) => typeof filter.value === "string" || typeof filter.value === "number" || typeof filter.value === "boolean" ? [{ column: filter.column, value: filter.value }] : []))).filter((row) => rowMatchesFilters(row, filters));
+  if (sortRaw) {
+    const [column, dir, extra] = sortRaw.split(":");
+    if (extra !== undefined || !column || dir !== "asc" && dir !== "desc" || !SORTABLE_SYSTEM_DATE_COLUMNS.has(column) && !(systemColumns && Object.hasOwn(SYSTEM_COLUMN_KINDS, column)) && (!Object.hasOwn(model.columns, column) || model.columns[column].hidden === true)) {
+      throw new AppRowValidationError([
+        { path: "sort", message: "must be <column>:<asc|desc> for a known column" }
+      ]);
+    }
+    rows.sort((a, b) => {
+      const result = compareValues(rowValue(a, column), rowValue(b, column), dir, SORTABLE_SYSTEM_DATE_COLUMNS.has(column) || Object.hasOwn(model.columns, column) && model.columns[column].kind === "date");
+      return result;
+    });
+  }
+  const total = rows.length;
+  return { rows: rows.slice(0, limit), total };
+}
 async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
   if (createAppRoute.match(req.method, pathSegments)) {
     if (enforceContentLengthCap(req, res, MAX_APP_BODY_BYTES) === BODY_TOO_LARGE)
@@ -111245,24 +110946,13 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
       json(res, { error: "invalid row query", issues }, 400);
       return true;
     }
-    const rows = (await listAppRows(parsed.params.id, parsed.params.model, filters.flatMap((filter) => typeof filter.value === "string" || typeof filter.value === "number" || typeof filter.value === "boolean" ? [{ column: filter.column, value: filter.value }] : []))).filter((row) => filters.every((filter) => rowValue(row, filter.column) === filter.value));
-    const sortRaw = parsed.query.sort;
-    if (sortRaw) {
-      const [column, dir, extra] = sortRaw.split(":");
-      if (extra !== undefined || !column || dir !== "asc" && dir !== "desc" || !SORTABLE_SYSTEM_DATE_COLUMNS.has(column) && (!Object.hasOwn(resolved.model.columns, column) || resolved.model.columns[column].hidden === true)) {
-        json(res, {
-          error: "invalid sort",
-          issues: [{ path: "sort", message: "must be <column>:<asc|desc> for a known column" }]
-        }, 400);
-        return true;
-      }
-      rows.sort((a, b) => {
-        const result = compareValues(rowValue(a, column), rowValue(b, column), dir, SORTABLE_SYSTEM_DATE_COLUMNS.has(column) || Object.hasOwn(resolved.model.columns, column) && resolved.model.columns[column].kind === "date");
-        return result;
-      });
+    try {
+      listRowsRoute.respond(res, 200, await selectAppRows(parsed.params.id, parsed.params.model, resolved.model, filters, parsed.query.sort, parsed.query.limit));
+    } catch (error) {
+      if (!(error instanceof AppRowValidationError))
+        throw error;
+      json(res, { error: "invalid sort", issues: error.issues }, 400);
     }
-    const total = rows.length;
-    listRowsRoute.respond(res, 200, { rows: rows.slice(0, parsed.query.limit ?? 200), total });
     return true;
   }
   if (getRowRoute.match(req.method, pathSegments)) {
@@ -111359,9 +111049,13 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
     const parsed = await runActionRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
-    const actor = await authorizeAppUse(req, res, myAgentId, parsed.params.id);
-    if (!actor)
+    const identity = await authorizeAppCaller(req, res, myAgentId, "app.use", {
+      kind: "app",
+      appId: parsed.params.id
+    });
+    if (!identity)
       return true;
+    const { actor, caller } = identity;
     const app = await getApp(parsed.params.id);
     if (!app) {
       jsonError(res, "app not found", 404);
@@ -111369,86 +111063,17 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
     }
     if (definitionNeedsRepair(res, app))
       return true;
-    const actions = app.definition.actions;
-    if (!actions || !Object.hasOwn(actions, parsed.params.name)) {
-      jsonError(res, "app action not found", 404);
-      return true;
-    }
-    const action = actions[parsed.params.name];
-    const input = parsed.body.input ?? {};
-    if (action.kind === "script") {
-      const script = await getScriptById(action.scriptId);
-      if (!script) {
-        json(res, {
-          error: "invalid app action",
-          issues: [
-            {
-              path: `actions.${parsed.params.name}.scriptId`,
-              message: `script "${action.scriptId}" no longer exists`
-            }
-          ]
-        }, 400);
-        return true;
-      }
-      const runAsAgentId = getSavedScriptOwnerAgentId(script);
-      if (!runAsAgentId) {
-        jsonError(res, "agentId is required: this script has no owning agent to run as", 400);
-        return true;
-      }
-      const output = await runSavedScriptAsAgent({
-        script,
-        input: { ...action.args, ...input, app: { id: app.id } },
-        agentId: runAsAgentId
-      });
-      const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
-      const error = ok ? undefined : output.runtimeError ? `${output.runtimeError.name}: ${output.runtimeError.message}` : output.error ?? `Script exited with code ${output.exitCode}`;
-      runActionRoute.respond(res, 200, scrubObject({
-        ok,
-        result: output.result,
-        stdout: output.stdout,
-        ...error === undefined ? {} : { error },
-        durationMs: output.durationMs
-      }));
-      return true;
-    }
-    if (action.kind === "sync") {
-      const startedAt = Date.now();
-      const sync = await runAppSync({
-        appId: app.id,
-        ...action.model === undefined ? {} : { model: action.model },
-        ...action.source === undefined ? {} : { source: action.source },
-        invokedBy: actor
-      });
-      const durationMs = Date.now() - startedAt;
-      if (sync.issues && sync.issues.length > 0) {
-        json(res, { error: "invalid sync action", issues: sync.issues }, 400);
-        return true;
-      }
-      const error = syncPassError(sync);
-      runActionRoute.respond(res, 200, scrubObject({
-        ok: sync.ok,
-        result: { passes: sync.passes },
-        ...error === undefined ? {} : { error },
-        durationMs
-      }));
-      return true;
-    }
-    const lead = action.agentId ? null : await getLeadAgent2();
-    const taskPrompt = resolveTemplate("task.app.action", {
-      prompt: action.prompt,
-      app_id: app.id,
-      action_name: parsed.params.name,
-      input_json: JSON.stringify(input)
+    const output = await runAppAction({
+      app,
+      name: parsed.params.name,
+      input: parsed.body.input,
+      caller,
+      actor
     });
-    const task = await createTaskWithSiblingAwareness(taskPrompt.text, {
-      source: "api",
-      agentId: action.agentId ?? lead?.id,
-      routingReason: action.agentId ? "human_pinned" : lead ? "skill" : undefined,
-      routingSource: action.agentId || lead ? "engine_default" : undefined,
-      key: normalizeAssetKey(`shared/app:${app.id}/action:${parsed.params.name}/`),
-      ...actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {}
-    }, { origin: "app" });
-    runActionRoute.respond(res, 200, { ok: true, taskId: task.id, status: task.status });
+    if (output.status === 200)
+      runActionRoute.respond(res, 200, output.body);
+    else
+      json(res, output.body, output.status);
     return true;
   }
   if (syncAppRoute.match(req.method, pathSegments)) {
@@ -112191,6 +111816,132 @@ var registerAppRollbackTool = (server) => {
   });
 };
 
+// src/tools/app-rows.ts
+init_zod();
+init_db3();
+init_rbac();
+var base = { appId: string2().min(1), model: AppNameSchema };
+var rowId = string2().min(1);
+var values = record2(string2(), unknown());
+var equals = record2(string2(), union2([string2(), number2(), boolean()]));
+var limit = number2().int().min(1).max(1000);
+var rowOutput = { row: looseObject({}).optional() };
+var rowsOutput = { rows: array2(looseObject({})).optional() };
+function checkSize(value, max) {
+  if (Buffer.byteLength(JSON.stringify(value), "utf8") > max) {
+    throw new AppRowValidationError([
+      { path: "values", message: `Row input exceeds ${max} bytes.` }
+    ]);
+  }
+}
+function rowFilters(model, equals = {}) {
+  return Object.entries(equals).map(([column, value]) => {
+    const declared = Object.hasOwn(model.columns, column) ? model.columns[column] : undefined;
+    if (!declared && !Object.hasOwn(SYSTEM_COLUMN_KINDS, column) || declared?.hidden) {
+      throw new AppRowValidationError([
+        { path: `equals.${column}`, message: "Unknown or hidden column." }
+      ]);
+    }
+    if (!validValue(declared ?? { kind: SYSTEM_COLUMN_KINDS[column] }, value)) {
+      throw new AppRowValidationError([
+        { path: `equals.${column}`, message: "Filter value must match the column kind." }
+      ]);
+    }
+    return { column, value };
+  });
+}
+function registerAppRowTools(server) {
+  function register(name, description, shape, output, operation, readOnly = false) {
+    createToolRegistrar(server)(name, {
+      title: description,
+      description,
+      annotations: { readOnlyHint: readOnly },
+      rbac: { permission: "app.use" },
+      inputSchema: object2({ ...base, ...shape }),
+      outputSchema: swarmToolOutputSchema(output)
+    }, async (args, info) => {
+      if (!info.agentId)
+        return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+      const { appId, model: modelName } = object2(base).parse(args);
+      const agent = await getAgentById2(info.agentId);
+      const decision = can({
+        principal: { kind: "agent", agentId: info.agentId, isLead: agent?.isLead ?? false },
+        verb: "app.use",
+        resource: { kind: "app", appId },
+        source: "mcp"
+      });
+      if (!decision.allow)
+        return toolErr(decision.reason);
+      const app = await getApp(appId);
+      if (!app)
+        return toolErr("App not found.");
+      if (appDefinitionNeedsRepair(app))
+        return toolErr("App definition needs repair.", { data: { issues: app.definitionError } });
+      if (!Object.hasOwn(app.definition.models, modelName))
+        return toolErr("Model not found.");
+      try {
+        return await operation(args, app.definition.models[modelName], `agent:${info.agentId}`);
+      } catch (error) {
+        if (error instanceof AppRowValidationError)
+          return toolErr(error.message, { data: { issues: error.issues } });
+        if (error instanceof AppRowAppNotFoundError)
+          return toolErr(error.message);
+        throw error;
+      }
+    });
+  }
+  register("app-rows-list", "List app rows with equality filters, sorting, and a limit.", {
+    equals: equals.optional(),
+    sort: string2().optional(),
+    limit: limit.optional()
+  }, { ...rowsOutput, total: number2().optional() }, async (args, model) => {
+    const data = await selectAppRows(args.appId, args.model, model, rowFilters(model, args.equals), args.sort, args.limit, true);
+    return toolOk(`Found ${data.total} row(s).`, { data });
+  }, true);
+  register("app-row-get", "Get an app row.", { rowId }, rowOutput, async (args) => {
+    const row = await getAppRow(args.appId, args.model, args.rowId);
+    return row ? toolOk("Row retrieved.", { data: { row } }) : toolErr("Row not found.");
+  }, true);
+  register("app-row-create", "Create an app row.", { values }, rowOutput, async (args, model, actor) => {
+    checkSize({ values: args.values }, MAX_APP_ROW_BODY_BYTES);
+    const row = await createAppRow(args.appId, args.model, model, args.values, { actor });
+    return toolOk("Row created.", { data: { row } });
+  });
+  register("app-rows-create", "Create up to 500 app rows within 10 MiB.", {
+    rows: array2(values).min(1).max(500)
+  }, rowsOutput, async (args, model, actor) => {
+    checkSize({ rows: args.rows }, MAX_APP_BULK_ROWS_BODY_BYTES);
+    for (const values of args.rows)
+      checkSize({ values }, MAX_APP_ROW_BODY_BYTES);
+    const rows = await createAppRows(args.appId, args.model, model, args.rows, { actor });
+    return toolOk(`Created ${rows.length} row(s).`, { data: { rows } });
+  });
+  register("app-row-patch", "Patch an app row.", { rowId, values }, rowOutput, async (args, model, actor) => {
+    checkSize({ values: args.values }, MAX_APP_ROW_BODY_BYTES);
+    const row = await patchAppRow(args.appId, args.model, model, args.rowId, args.values, {
+      actor
+    });
+    return row ? toolOk("Row updated.", { data: { row } }) : toolErr("Row not found.");
+  });
+  register("app-row-delete", "Delete an app row.", { rowId }, { ok: boolean().optional() }, async (args, model) => {
+    const deleted = await deleteAppRow(args.appId, args.model, model, args.rowId);
+    return deleted ? toolOk("Row deleted.", { data: { ok: true } }) : toolErr("Row not found.");
+  });
+  register("app-rows-delete", "Delete matching app rows. Supply at least one equality filter.", {
+    equals: equals.refine((value) => Object.keys(value).length > 0, "Supply at least one equality filter."),
+    limit: limit.optional()
+  }, { deleted: number2().optional() }, async (args, model) => {
+    const filters = rowFilters(model, args.equals);
+    const { rows } = await selectAppRows(args.appId, args.model, model, filters, undefined, args.limit ?? 1000, true);
+    const matches = (row) => rowMatchesFilters(row, filters);
+    let deleted = 0;
+    for (const row of rows)
+      if (await deleteAppRow(args.appId, args.model, model, row.id, matches))
+        deleted++;
+    return toolOk(`Deleted ${deleted} row(s).`, { data: { deleted } });
+  });
+}
+
 // src/tools/app-sync.ts
 init_zod();
 init_db3();
@@ -119423,7 +119174,7 @@ var registerModelCatalogOverlayUpsertTool = (server) => {
     description: "Add or update hand-verified facts for one model (e.g. a launch models.dev has not listed yet). Overlay fields win over models.dev; overlay prices fill pricing-table gaps so cost recompute prices the model. The row auto-expires once models.dev matches every fact you set.",
     annotations: { idempotentHint: true },
     inputSchema: object2({
-      provider: string2().min(1).describe(`models.dev provider id: anthropic, openai, openrouter, amazon-bedrock, opencode, ${openAICompatibleProviderIds().join(", ")}.`),
+      provider: string2().min(1).describe(`models.dev provider id: anthropic, openai, openrouter, amazon-bedrock, opencode, opencode-go, ${openAICompatibleProviderIds().join(", ")}.`),
       modelId: string2().min(1).describe("Model id as models.dev keys it (e.g. claude-opus-5-5)."),
       name: string2().optional().describe("Display name."),
       releaseDate: string2().optional().describe("Release date, YYYY-MM-DD."),
@@ -121283,6 +121034,7 @@ init_context_key();
 init_runtime_pools_flag();
 var COMB_PRESENCE_NAMESPACE = /^presence:comb:[A-Za-z0-9_-]{1,64}:[A-Za-z0-9_-]{1,64}$/;
 var COMB_PRESENCE_OPERATIONS = new Set(["join", "leave", "presence"]);
+var SESSION_PRESENCE_NAMESPACE = /^presence:session:([A-Za-z0-9_-]{1,64})$/;
 function pageNamespace(pageId) {
   try {
     return pageContextKey({ pageId });
@@ -121375,6 +121127,9 @@ async function authorizeRoomNamespace(namespace, info, access, name) {
     }
     return null;
   }
+  if (namespace.startsWith("presence:session:")) {
+    return authorizeSessionPresence(namespace, info, access);
+  }
   const reservedError = reservedNamespaceError(namespace);
   if (reservedError)
     return reservedError;
@@ -121410,6 +121165,48 @@ async function authorizeRoomNamespace(namespace, info, access, name) {
   }
   return null;
 }
+function sessionAccessTopic(rootTaskId) {
+  return `session-access:${rootTaskId}`;
+}
+function sessionPresenceRoot(namespace) {
+  return SESSION_PRESENCE_NAMESPACE.exec(namespace)?.[1];
+}
+async function authorizeSessionPresence(namespace, info, access) {
+  const match = SESSION_PRESENCE_NAMESPACE.exec(namespace);
+  if (!match)
+    return "invalid session presence namespace";
+  if (info.pageId || info.agentId || !info.isOperator && !info.userId) {
+    return "Session presence requires dashboard authentication";
+  }
+  if (typeof access !== "string" || !COMB_PRESENCE_OPERATIONS.has(access)) {
+    return "Session presence rooms only allow join, leave, and presence";
+  }
+  const principal = info.isOperator ? { kind: "operator" } : { kind: "user", userId: info.userId };
+  if (!can({
+    principal,
+    verb: "session.presence",
+    resource: { kind: "kv-namespace", namespace },
+    source: info.callOrigin === "mcp" ? "mcp" : "http"
+  }).allow) {
+    return "Session presence requires the session.presence permission";
+  }
+  if (info.userId && isRbacEnabled()) {
+    const grant = await getUserGrant2(info.userId);
+    if (!grant.grantsAll && !grant.verbs.has("session.presence")) {
+      return "Session presence requires the session.presence permission";
+    }
+  }
+  const viewerId = info.isOperator ? info.dashboardUserId : info.userId;
+  if (info.isOperator && !viewerId)
+    return null;
+  const root = await getSessionRoot(match[1]);
+  if (!root || root.id !== match[1])
+    return "session not found";
+  if (await sessionAccessForRoot(viewerId ?? null, root) === "none") {
+    return "You don't have access to this session";
+  }
+  return null;
+}
 
 // node_modules/lib0/map.js
 var create = () => new Map;
@@ -122125,7 +121922,7 @@ var varStorage = _localStorage;
 
 // node_modules/lib0/trait/equality.js
 var EqualityTraitSymbol = Symbol("Equality");
-var equals = (a, b) => a === b || !!a?.[EqualityTraitSymbol]?.(b) || false;
+var equals2 = (a, b) => a === b || !!a?.[EqualityTraitSymbol]?.(b) || false;
 
 // node_modules/lib0/object.js
 var assign = Object.assign;
@@ -122151,7 +121948,7 @@ var every = (obj, f) => {
   return true;
 };
 var hasProperty = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
-var equalFlat = (a, b) => a === b || size(a) === size(b) && every(a, (val, key) => (val !== undefined || hasProperty(b, key)) && equals(b[key], val));
+var equalFlat = (a, b) => a === b || size(a) === size(b) && every(a, (val, key) => (val !== undefined || hasProperty(b, key)) && equals2(b[key], val));
 var freeze = Object.freeze;
 var deepFreeze = (o) => {
   for (const key in o) {
@@ -128073,6 +127870,7 @@ init_db3();
 // src/be/events.ts
 init_secret_scrubber();
 init_db3();
+init_read();
 init_scrub_json();
 
 // src/be/memory/key-browser.ts
@@ -128402,6 +128200,13 @@ async function getEventCountsFiltered(filters) {
 async function getEventsFiltered(filters) {
   const conditions = [];
   const params = [];
+  if (filters.readableBy) {
+    const readable = readableSessionCondition(filters.readableBy.userId, "events.taskId", {
+      nullable: true
+    });
+    conditions.push(readable.sql);
+    params.push(...readable.params);
+  }
   if (filters.category) {
     conditions.push("category = ?");
     params.push(filters.category);
@@ -132266,13 +132071,30 @@ var registerSlackListChannelsTool = (server) => {
 init_zod();
 init_db3();
 init_rbac();
+
+// src/slack/dm.ts
+function isSlackUserId(id) {
+  return /^[UW][A-Z0-9]+$/.test(id);
+}
+async function resolveSlackConversationId(client, channelId) {
+  if (!isSlackUserId(channelId))
+    return channelId;
+  const result = await client.conversations.open({ users: channelId });
+  const dmId = result.channel?.id;
+  if (!dmId) {
+    throw new Error(`conversations.open returned no DM channel for user ${channelId}`);
+  }
+  return dmId;
+}
+
+// src/tools/slack-post.ts
 var registerSlackPostTool = (server) => {
   createToolRegistrar(server)("slack-post", {
     title: "Post message to Slack channel",
     description: "Post a message to a Slack channel. By default creates a new top-level message; pass `threadTs` to post as a threaded reply under an existing message (obtain the ts from `slack-start-thread`). Requires lead privileges.",
     annotations: { openWorldHint: true },
     inputSchema: object2({
-      channelId: string2().min(1).describe("The Slack channel ID to post to."),
+      channelId: string2().min(1).describe("The Slack channel ID to post to. A user ID (U…/W…) posts in the bot's DM with that user."),
       message: string2().min(1).max(4000).describe("The message content to post."),
       blocks: array2(record2(string2(), unknown())).max(50).optional().describe("Optional Block Kit blocks. When omitted, a mrkdwn section is generated."),
       threadTs: string2().optional().describe("Optional parent message ts to thread under. Obtain via `slack-start-thread`. When omitted, posts as a new top-level message.")
@@ -132280,7 +132102,7 @@ var registerSlackPostTool = (server) => {
     outputSchema: swarmToolOutputSchema({
       messageTs: string2().optional()
     })
-  }, async ({ channelId, message, threadTs, blocks }, requestInfo, _meta) => {
+  }, async ({ channelId: requestedChannelId, message, threadTs, blocks }, requestInfo, _meta) => {
     if (!requestInfo.agentId) {
       return toolErr("Agent ID not found.");
     }
@@ -132301,6 +132123,13 @@ var registerSlackPostTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.");
     }
+    let channelId;
+    try {
+      channelId = await resolveSlackConversationId(app.client, requestedChannelId);
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      return toolErr(`Failed to open a DM with ${requestedChannelId}: ${errorMsg}`);
+    }
     const blockReason = await getChannelBlockReason2(app.client, channelId);
     if (blockReason) {
       return toolErr(externalChannelToolError2(channelId, blockReason));
@@ -132311,15 +132140,7 @@ var registerSlackPostTool = (server) => {
       const contextKey = sourceTask?.contextKey;
       const tree = threadTs ? await getSlackTreeMessageByThread2(channelId, threadTs) : null;
       const messageBlocks = [
-        ...blocks ?? [
-          {
-            type: "section",
-            text: {
-              type: "mrkdwn",
-              text: slackMessage
-            }
-          }
-        ]
+        ...blocks ?? buildMrkdwnSectionBlocks(slackMessage)
       ];
       if (sourceTask && tree) {
         if (messageBlocks.length >= 50) {
@@ -132403,7 +132224,7 @@ var registerSlackReadTool = (server) => {
     inputSchema: object2({
       inboxMessageId: uuid().optional().describe("Read thread history for an inbox message."),
       taskId: uuid().optional().describe("Read thread history for a task."),
-      channelId: string2().optional().describe("Slack channel ID to read from (requires lead privileges)."),
+      channelId: string2().optional().describe("Slack channel ID to read from (requires lead privileges). A user ID (U…/W…) reads the bot's DM with that user."),
       threadTs: string2().optional().describe("Thread timestamp (required with channelId for thread history)."),
       limit: number2().int().min(1).max(100).default(20).describe("Maximum number of messages to retrieve (default: 20, max: 100)."),
       includeFiles: boolean().default(true).describe("Include file attachments in the response (default: true). From a task, they are also stored as attachments of that task.")
@@ -132471,6 +132292,14 @@ var registerSlackReadTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.", { data: { messages: [] } });
     }
+    try {
+      slackChannelId = await resolveSlackConversationId(app.client, slackChannelId);
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      return toolErr(`Failed to open a DM with ${slackChannelId}: ${errorMsg}`, {
+        data: { messages: [] }
+      });
+    }
     const blockReason = await getChannelBlockReason2(app.client, slackChannelId);
     if (blockReason) {
       return toolErr(externalChannelToolError2(slackChannelId, blockReason), {
@@ -132679,15 +132508,7 @@ var registerSlackReplyTool = (server) => {
       const renderedBlocks = blocks?.map((block) => JSON.parse(JSON.stringify(block, (key, value) => key === "text" && typeof value === "string" ? stripInvalidTaskCitations(value, citations) : value?.type === "mrkdwn" && typeof value.text === "string" ? { ...value, text: renderTaskCitations(value.text, citations, "slack", false) } : value)));
       const tree = await getSlackTreeMessageByThread2(slackChannelId, slackThreadTs);
       const messageBlocks = [
-        ...renderedBlocks ?? [
-          {
-            type: "section",
-            text: {
-              type: "mrkdwn",
-              text: slackMessage
-            }
-          }
-        ]
+        ...renderedBlocks ?? buildMrkdwnSectionBlocks(slackMessage)
       ];
       for (const group of taskCitationSourceGroups(blocks ? JSON.stringify(blocks) : message, citations)) {
         const caption = buildCaptionBlock(group.items, {
@@ -132760,7 +132581,7 @@ var registerSlackStartThreadTool = (server) => {
     description: "Post a new top-level message to a Slack channel and return its ts so the caller can thread replies under it. Pass the returned `ts` as `threadTs` on subsequent `slack-post` calls to keep replies in the same thread. Requires lead privileges.",
     annotations: { openWorldHint: true },
     inputSchema: object2({
-      channelId: string2().min(1).describe("The Slack channel ID to post to."),
+      channelId: string2().min(1).describe("The Slack channel ID to post to. A user ID (U…/W…) opens the bot's DM with that user; use the returned channelId afterwards."),
       message: string2().min(1).max(4000).describe("The message content to post."),
       blocks: array2(record2(string2(), unknown())).max(50).optional().describe("Optional Block Kit blocks. When omitted, a mrkdwn section is generated.")
     }),
@@ -132769,7 +132590,7 @@ var registerSlackStartThreadTool = (server) => {
       ts: string2().optional(),
       messageTs: string2().optional()
     })
-  }, async ({ channelId, message, blocks }, requestInfo, _meta) => {
+  }, async ({ channelId: requestedChannelId, message, blocks }, requestInfo, _meta) => {
     if (!requestInfo.agentId) {
       return toolErr("Agent ID not found.");
     }
@@ -132790,21 +132611,20 @@ var registerSlackStartThreadTool = (server) => {
     if (!app) {
       return toolErr("Slack not configured.");
     }
+    let channelId;
+    try {
+      channelId = await resolveSlackConversationId(app.client, requestedChannelId);
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      return toolErr(`Failed to open a DM with ${requestedChannelId}: ${errorMsg}`);
+    }
     const blockReason = await getChannelBlockReason2(app.client, channelId);
     if (blockReason) {
       return toolErr(externalChannelToolError2(channelId, blockReason));
     }
     try {
       const slackMessage = markdownToSlack(message);
-      const messageBlocks = blocks ?? [
-        {
-          type: "section",
-          text: {
-            type: "mrkdwn",
-            text: slackMessage
-          }
-        }
-      ];
+      const messageBlocks = blocks ?? buildMrkdwnSectionBlocks(slackMessage);
       const result = await withAutoJoin(app.client, channelId, () => app.client.chat.postMessage({
         channel: channelId,
         text: slackMessage,
@@ -132894,15 +132714,7 @@ var registerSlackUpdateTool = (server) => {
         text: slackMessage,
         unfurl_links: false,
         unfurl_media: false,
-        blocks: [
-          {
-            type: "section",
-            text: {
-              type: "mrkdwn",
-              text: slackMessage
-            }
-          }
-        ]
+        blocks: buildMrkdwnSectionBlocks(slackMessage)
       };
       const result = await app.client.chat.update(updatePayload);
       return toolOk("Message updated successfully.", { data: { messageTs: result.ts } });
@@ -134199,7 +134011,7 @@ async function emitBudgetRefusalSideEffects(ctx, inserted) {
       console.warn(`[budget-refusal-notify] Failed to create follow-up task for budget refusal (task=${ctx.task.id.slice(0, 8)}): ${err}`);
     }
   }
-  import("./event-bus-101fenkh.js").then(({ workflowEventBus }) => {
+  import("./event-bus-9vpk8gmq.js").then(({ workflowEventBus }) => {
     workflowEventBus.emit("task.budget_refused", {
       taskId: ctx.task.id,
       agentId: ctx.agentId,
@@ -135749,7 +135561,7 @@ var registerRetryWorkflowRunTool = (server) => {
   createToolRegistrar(server)("retry-workflow-run", {
     title: "Retry Workflow Run",
     annotations: { destructiveHint: false },
-    description: "Retry a failed workflow run from the beginning. The run must be in 'failed' status.",
+    description: "Resume the same failed workflow run from its failed step(s); completed steps are not re-run. Retrying re-creates the failed node's side effects (e.g. an agent task), so check the target state first if that work was already done manually.",
     inputSchema: object2({
       runId: string2().uuid().describe("Workflow run ID to retry")
     }),
@@ -136213,6 +136025,8 @@ async function createServer(opts = {}) {
   }
   if (hasCapability("pages")) {
     registerAppGetTool(server);
+    registerAppRowTools(server);
+    registerAppActionRunTool(server);
     registerAppHistoryTool(server);
     registerAppDiffTool(server);
     registerAppListTool(server);
@@ -136294,4 +136108,4 @@ async function createServer(opts = {}) {
   return server;
 }
 
-export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, handleWebhookTrigger, verifyHmacSignature, WebhookError, snapshotAndUpdateWorkflow, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry2, initWorkflows2, dispatchScheduleTarget, calculateNextRun2, startScheduler2, stopScheduler2, runScheduleNow2, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError2, isRegistered2, isExtensionAgentId2, getExtensionBridgeToken2, resolveBridgeCallOrigin2, extensionIdForAgent2, runContext2, registerLoaded2, unregister2, listRegistered2, dispatchPre2, dispatchPost2, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };
+export { DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, resolveIdentity, renderIdentity, createAdditiveBuffer, taskModelPin, resumedTaskModelSelection, listHarnessModelSupport, recordHarnessModelSupport, agentRanModel, getAgentHarnessCliVersion, setAgentHarnessCliVersion, sanitizeModelTierOverrides, parseModelTierOverridesHeader, setAgentModelTierOverrides, previewModelTiers, recordClaimModelResolution, harnessModelErrorFor, poolTaskRunsOnHarness, explicitModelError, explicitModelErrorForAgent, referencedBundlePaths, skillDirs, TaskCreationBlockedError, recordUnmappedIdentity, MAX_TASK_ATTACHMENT_BYTES, recordTaskAttachmentUpload, buildEffectiveText, bufferedFileFailures, fetchSlackFiles, createSlackTaskWithFiles, notifySlackFileFailures, isRuntimePoolWakeable, isAgentReachable, hasOtherUserMention, broadcastMatches, routeMessage, extractTaskFromMessage, extractSlackMessageText, recoverIncompleteRuns, handleWebhookTrigger, verifyHmacSignature, WebhookError, snapshotAndUpdateWorkflow, RawLlmConfigSchema, RawLlmOutputSchema, executeRawLlm, getExecutorRegistry2, initWorkflows2, dispatchScheduleTarget, calculateNextRun2, startScheduler2, stopScheduler2, runScheduleNow2, ExtensionAssetConflictError, ExtensionOwnershipError, getExtensionFiles, getExtensionById, getExtensionByName, listExtensions, listExtensionVersions, updateExtensionMeta, listExtensionRuns, SDK_ALLOWLIST, mcpToolNameForSdkMethod, mcpOverflowAuthError, hasKvViewArgs, resolveKvView, toolErr, createToolRegistrar, handleMcpBridge, Redacted, SCRIPT_SDK_RESPONSE_LIMIT_BYTES, readScriptSdkJsonResponse, ExtensionConfigError, ExtensionLifecycleError, setExtensionLoopbackBaseUrl, enableExtension, disableExtension, activateVersion, ExtensionAssetsInvalidError, installExtensionWithAssets, uninstallExtension, reloadExtension, loadEnabledExtensions, stopExtensionRuntime, ExtensionAbortedError2, isRegistered2, isExtensionAgentId2, getExtensionBridgeToken2, resolveBridgeCallOrigin2, extensionIdForAgent2, runContext2, registerLoaded2, unregister2, listRegistered2, dispatchPre2, dispatchPost2, stripSiblingBlock, createTaskWithSiblingAwareness, isInboxAllowed, isSenderAllowed, handleMessageReceived, isAzureDevOpsEnabled, initAzureDevOps, verifyAzureDevOpsWebhook, repointTrackerSyncBySwarmId, isAzureDevOpsUrl, canonicalAzureDevOpsRepoUrl, parseAzureDevOpsRepoUrl, createdPullRequestOf, commentedPayloadOf, handlePullRequestCreated, handlePullRequestCommented, handleWorkItemCreated, handleWorkItemUpdated, handleWorkItemCommented, handleWorkItemDeleted, handleWorkItemRestored, initAzureDevOpsOutbound, AGENT_MAX_TASKS_CONFIG_KEY, reconcileAgentMaxTasksPolicy, resetAgentMaxTasksMirror, upsertSwarmConfigWithPolicyMirror, runtimeStaleThresholdMinutes, upsertRuntimeInstance, getRuntimeInstanceById, insertProvisioningRuntime, markRuntimeTerminated, touchRuntimeInstance, countActiveRuntimeInstancesForAgent, listRuntimeInstancesForAgent, setRuntimeCredentialReady, reconcileAgentStatusFromRuntimes, agentsWithLiveRuntime, expireStaleRuntimeInstances, listRuntimeInstancesForPool, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, getTelemetryIngestAnchor, initApiTelemetry, syncTelemetryEnabled, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2, handleNote, handlePipeline, isChatSdkEnabled, getChatSdkConfig, errorMessage, resolveAdapterApiUrl, trackBackground, TelegramBotApiError, callTelegramBotApi, isTrustedTeamsServiceUrl, isChatSdkStopping, startChatSdk, getChatInstance, isChatAdapterConfigured, getChatSdkHealth, stopChatSdk, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, userCtx, handleApps, cancelApprovalRequest, cancelApprovalRequestAndRun, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, getPageEditCounter, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, REBOOT_RETRY_PIN_TAG, getPinCandidateAgent, resolveLeadOnlyRecoveryAssignment, getResumeGeneration, getNextResumeGeneration, inheritedModelSelection, createWorkerTaskFollowUp, createResumeFollowUp, createRerouteDecisionTask, createPoolStarvationDecisionTask, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, updateMcpServerChecked, updateTouchesStdioExecution, MemoryKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, isApiDraining, drainApi, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, changesAllowMerge, updateSwarmRepoChecked, getCombConfig, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, sessionAccessTopic, sessionPresenceRoot, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, MEMORY_KEYS_DEFAULT_PREFIX, MEMORY_KEYS_MAX_LIMIT, estimateTokens, posteriorMean, listMemoryKeys, checkChunkIntegrity, getMemoryChunks, getPosteriorsByIds, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, workflowModelErrors, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer };