@desplega.ai/agent-swarm 2.4.0 → 2.4.2

package/dist/{cli-x719j3vs.js → cli-5rk36sjf.js}

@@ -332,19 +332,19 @@ import {
   recordInlineScriptRun2,
   exports_db,
   init_db3
-} from "./cli-rg7ntypm.js";
+} from "./cli-d3qqdy4c.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-5s5hx57y.js";
+} from "./cli-7awf1fp8.js";
 import {
   ensurePricingSeeded2,
   ensureRbacSeeded2,
   ensureModelProfilesSeeded2
-} from "./cli-kk2r80n5.js";
+} from "./cli-faypxz7q.js";
 import {
   loadModelsDevCache
-} from "./cli-tg9ksbn8.js";
+} from "./cli-h93c9vb3.js";
 import {
   buildCatalogEntries,
   listModelCatalog,
@@ -354,12 +354,12 @@ import {
   loadModelsCatalog,
   requestModelCatalogRefresh2,
   startPricingRefreshLoop2
-} from "./cli-ttaz6c7m.js";
+} from "./cli-saw9a6f6.js";
 import {
   ampPinProviderError,
   ampPinCatalogError,
   ampModelError
-} from "./cli-2rwet3r7.js";
+} from "./cli-sv5gb0yb.js";
 import {
   notifyAutomationPreflightFailure,
   isNeedsSetupFailure,
@@ -397,6 +397,7 @@ import {
   cancelWorkflowRunRows2,
   cancelWorkflowRun2,
   resumeWaitState2,
+  recoverResolvedWaitState2,
   resumeFromChildRun2,
   initWaitBusSubscriptions2,
   TriggerSchemaError,
@@ -410,7 +411,7 @@ import {
   buildNodeInterpolationCtx,
   interpolateNodeConfig,
   scriptBodyInterpolationError
-} from "./cli-nme7wery.js";
+} from "./cli-y2x52gs2.js";
 import {
   require_dist2,
   publicEndpointSsrfOptions,
@@ -448,8 +449,11 @@ import {
   runSavedScriptAsAgent,
   resolveSyncRunAs,
   AppNameSchema,
-  ColumnKindSchema,
+  ScalarColumnKindSchema,
   isIso8601Date,
+  jsonColumnSizeLabel,
+  jsonColumnValueIssue,
+  isValidColumnValue,
   SYSTEM_COLUMN_KINDS,
   SORTABLE_SYSTEM_DATE_COLUMNS,
   AppElementsSchema,
@@ -467,14 +471,14 @@ import {
   deleteApp,
   typecheckScript,
   parseSkillContent
-} from "./cli-nrrg0fvy.js";
+} from "./cli-h38rjv87.js";
 import {
   buildAuthorizationUrl,
   onAuthorizationRefreshed,
   ensureAuthorizationTokenOrThrow,
   ensureToken,
   ensureTokenOrThrow
-} from "./cli-b80a1100.js";
+} from "./cli-s6vr7r2d.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
@@ -504,14 +508,14 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-4fhyq711.js";
+} from "./cli-nn47d7e8.js";
 import {
   slackCode,
   slackMissingScopeMessage,
   withAutoJoin,
   externalChannelToolError2,
   getChannelBlockReason2
-} from "./cli-xfe63zx3.js";
+} from "./cli-pkht5hap.js";
 import {
   BaseExecutor,
   postApprovalCancellationUpdates,
@@ -528,11 +532,11 @@ import {
   definitionNodeIds,
   validateDefinition,
   applyDefinitionPatch
-} from "./cli-tj4j2ts4.js";
+} from "./cli-02qm7src.js";
 import {
   workflowEventBus2,
   init_event_bus
-} from "./cli-ptkpaqfy.js";
+} from "./cli-wt645v7q.js";
 import {
   duplicateGuardedQueryKey,
   parseQueryParams,
@@ -557,7 +561,7 @@ import {
   isPublicRoute,
   findRoute,
   route
-} from "./cli-02vhhssk.js";
+} from "./cli-efaqv1c7.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-7a91w22y.js";
@@ -569,7 +573,7 @@ import {
 import {
   getRuntimePool2,
   init_db
-} from "./cli-6ftrrwm1.js";
+} from "./cli-n85dqg6d.js";
 import {
   getMemoryRaterNames,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -580,7 +584,7 @@ import {
   COMPOSIO_HTTP_METHODS,
   executeComposioRequest,
   composioArgsFromParts
-} from "./cli-rdr166ht.js";
+} from "./cli-smvcw9z5.js";
 import {
   require_fast_deep_equal
 } from "./cli-bhp11egn.js";
@@ -594,7 +598,7 @@ import {
 import {
   canProvisionKind,
   init_runtime_providers
-} from "./cli-wk8ccrz6.js";
+} from "./cli-pw7v69vp.js";
 import {
   findUserById,
   findUserByExternalId,
@@ -610,7 +614,7 @@ import {
   resolveSessionToken,
   fingerprintApiKey,
   init_users
-} from "./cli-8cxkw1f5.js";
+} from "./cli-nmqdc2t3.js";
 import {
   isRbacEnabled,
   decideAdmission,
@@ -679,7 +683,7 @@ import {
   KvNamespaceSchema,
   KvKeySchema,
   init_types
-} from "./cli-a1esmmee.js";
+} from "./cli-fpmsqq59.js";
 import {
   generateDefaultClaudeMd2,
   generateDefaultSoulMd2,
@@ -688,7 +692,7 @@ import {
   taskAttachmentFetchCommand,
   taskAttachmentDisplayUrl,
   init_task_attachment_links
-} from "./cli-wyrr38xm.js";
+} from "./cli-x5mq1fyq.js";
 import {
   getSlackConfiguration,
   init_config
@@ -750,7 +754,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-mz1ezzzh.js";
+} from "./cli-shvfedvm.js";
 import {
   realtimeBus,
   init_bus
@@ -783,7 +787,7 @@ import {
   registerVolatileSecret,
   registerSensitiveKeyName,
   init_secret_scrubber
-} from "./cli-4mkvwgzr.js";
+} from "./cli-xf234ws8.js";
 import {
   isAlias,
   parseAlias,
@@ -797,7 +801,7 @@ import {
   openAICompatibleProviderIds,
   claudeCatalogModelId,
   init_src2
-} from "./cli-x3en6ct3.js";
+} from "./cli-nwyw3zhg.js";
 import {
   __toESM,
   __commonJS,
@@ -20252,17 +20256,12 @@ async function recoverWaitStates(registry) {
   let recovered = 0;
   for (const stuck of stuckRuns) {
     try {
-      let resumeStatus;
-      let payload;
-      if (stuck.waitStatus === "fired") {
-        resumeStatus = "fired";
-        payload = stuck.firedPayload != null ? safeJsonParse(stuck.firedPayload) : undefined;
-      } else if (stuck.waitStatus === "timeout") {
-        resumeStatus = "timeout";
+      if (stuck.waitStatus === "pending") {
+        const status = stuck.waitMode === "time" ? "fired" : "timeout";
+        await resumeWaitState2(stuck.waitId, status, undefined, registry);
       } else {
-        resumeStatus = stuck.waitMode === "time" ? "fired" : "timeout";
+        await recoverResolvedWaitState2(stuck.waitId, registry);
       }
-      await resumeWaitState2(stuck.waitId, resumeStatus, payload, registry);
       recovered++;
     } catch (err) {
       if (await failRunOnUnreadableReplay(stuck.runId, err))
@@ -20272,13 +20271,6 @@ async function recoverWaitStates(registry) {
   }
   return recovered;
 }
-function safeJsonParse(s) {
-  try {
-    return JSON.parse(s);
-  } catch {
-    return s;
-  }
-}
 async function getRunIdsByStatus(status) {
   const rows = await getDbClient2().query("SELECT id FROM workflow_runs WHERE status = ?", [status]);
   return rows.map((r) => r.id);
@@ -21154,7 +21146,7 @@ class NotifyExecutor extends BaseExecutor {
         }
       }
       case "slack": {
-        const { getSlackApp } = await import("./app-mqap8t8m.js");
+        const { getSlackApp } = await import("./app-9h14qvr6.js");
         const app = getSlackApp();
         if (!app) {
           return {
@@ -23705,6 +23697,13 @@ var SDK_TOOL_NAME_MAP = {
   app_list: "app-list",
   app_patch: "app-patch",
   app_query: "app-query",
+  app_rows_list: "app-rows-list",
+  app_row_get: "app-row-get",
+  app_row_create: "app-row-create",
+  app_rows_create: "app-rows-create",
+  app_row_patch: "app-row-patch",
+  app_row_delete: "app-row-delete",
+  app_rows_delete: "app-rows-delete",
   app_rollback: "app-rollback",
   app_sync: "app-sync",
   app_upsert: "app-upsert",
@@ -24161,7 +24160,7 @@ var NUDGES = {
     const definition = r.data?.app?.definition;
     const hasQueries = Object.keys(definition?.queries ?? {}).length > 0;
     const hasActions = Object.keys(definition?.actions ?? {}).length > 0;
-    return hasQueries || hasActions ? "This app's callable surface is `definition.queries` (run with `app-query`, passing any `$param` values) and `definition.actions` (invoke with `POST /api/apps/<id>/actions/<name>`; `sync` actions refresh sources)." : undefined;
+    return hasQueries || hasActions ? "Run `definition.queries` with `app-query` and supply each `$param` value. Invoke `definition.actions` with `app-action-run` through MCP or `POST /api/apps/<id>/actions/<name>` through REST. Sync actions refresh sources." : undefined;
   },
   "kv-get": (r) => {
     if (!r.ok)
@@ -24509,7 +24508,7 @@ function setPreloadedTools(server, names) {
 async function applyPreToolCall(name, args, requestInfo, inputSchema) {
   if (requestInfo.callOrigin !== "mcp")
     return { args };
-  const dispatcher = await import("./dispatcher-ewceb8ts.js");
+  const dispatcher = await import("./dispatcher-0a9wwjcx.js");
   const result = await dispatcher.dispatchPre("pre.tool.call", { tool: name, args, requestInfo }, inputSchema ? {
     validateModify: async (data) => {
       const schema = normalizeObjectSchema(inputSchema) ?? inputSchema;
@@ -33822,7 +33821,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp } = await import("./app-mqap8t8m.js");
+    const { getSlackApp } = await import("./app-9h14qvr6.js");
     const app = getSlackApp();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -33893,7 +33892,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient } = await import("./db-2xbyenjr.js");
+  const { getDbClient } = await import("./db-nn0hcmx5.js");
   await getDbClient().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -107243,7 +107242,7 @@ async function reloadGlobalConfigsAndIntegrations() {
   return runWithoutRequestAuth(() => reloadGlobalConfigsAndIntegrationsInner());
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
-  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-cdzyfrsp.js");
+  const { getEmbeddingProvider, resetEmbeddingProvider } = await import("./index-smxyk04s.js");
   const wasEmbeddingsConfigured = getEmbeddingProvider().isConfigured();
   const updated = await loadGlobalConfigsIntoEnv(true);
   await syncTelemetryEnabled("settings").catch((err) => {
@@ -107259,10 +107258,10 @@ async function reloadGlobalConfigsAndIntegrationsInner() {
     integrations.push("embeddings");
   }
   if (!wasEmbeddingsConfigured && isEmbeddingsConfigured) {
-    import("./boot-reembed-qr8a894z.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+    import("./boot-reembed-6yn53ms9.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
       console.error("[config-reload] memory backfill failed (non-fatal):", err);
     });
-    import("./boot-reembed-rj85jjhw.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+    import("./boot-reembed-7fcka4z5.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
       console.error("[config-reload] script backfill failed (non-fatal):", err);
     });
   }
@@ -107797,15 +107796,21 @@ var registerAcceptSteerTool = (server) => {
   }, async (args, info, _meta) => acceptSteerHandler(ownerCtx(info), args));
 };
 
-// src/tools/app-diff.ts
+// src/tools/app-action-run.ts
 init_zod();
 
-// src/apps/version.ts
+// src/apps/action-runner.ts
+init_key();
 init_db3();
+init_db2();
+init_resolver();
+init_secret_scrubber();
 
-// src/apps/schema-migrate.ts
+// src/apps/sync.ts
 init_zod();
 init_db3();
+init_db2();
+init_types();
 init_secret_scrubber();
 
 // src/apps/row-store.ts
@@ -107850,6 +107855,8 @@ function appIndexKey(model, column, value, rowId) {
 function isIndexed(column) {
   if (column.hidden === true)
     return false;
+  if (column.kind === "json")
+    return false;
   if (column.kind === "enum")
     return true;
   return column.index === true && (column.kind === "string" || column.kind === "boolean");
@@ -107867,15 +107874,7 @@ function indexKeys(model, definition, row) {
 function validValue(column, value) {
   if (value === null)
     return column.required !== true;
-  if (column.kind === "string")
-    return typeof value === "string";
-  if (column.kind === "number")
-    return typeof value === "number" && Number.isFinite(value);
-  if (column.kind === "boolean")
-    return typeof value === "boolean";
-  if (column.kind === "date")
-    return typeof value === "string" && isIso8601Date(value);
-  return typeof value === "string" && Boolean(column.enum?.includes(value));
+  return isValidColumnValue(column, value);
 }
 function joinKeyColumnNames(definition) {
   const names = new Set;
@@ -107931,7 +107930,19 @@ function prepareValues(definition, values, mode, options = {}) {
     if (!Object.hasOwn(definition.columns, name))
       continue;
     const column = definition.columns[name];
-    if (!validValue(column, value)) {
+    if (column.kind === "json" && value !== null) {
+      const issue = jsonColumnValueIssue(value);
+      if (issue === "unserializable") {
+        issues.push({ path: `values.${name}`, message: "must be a valid json value" });
+      } else if (issue === "non-finite") {
+        issues.push({ path: `values.${name}`, message: "json value contains a non-finite number" });
+      } else if (issue === "oversized") {
+        issues.push({
+          path: `values.${name}`,
+          message: `json value exceeds the ${jsonColumnSizeLabel()} size limit`
+        });
+      }
+    } else if (!validValue(column, value)) {
       issues.push({ path: `values.${name}`, message: `must be a valid ${column.kind} value` });
     }
   }
@@ -108145,14 +108156,14 @@ async function rebuildAppColumnIndexUnlocked(appId, model, columnName, column, r
     });
   }
 }
-function deleteAppRow(appId, model, _definition, rowId) {
+function deleteAppRow(appId, model, _definition, rowId, matches) {
   return withMutationLock(appId, model, async () => {
     const currentDefinition = await currentModelDefinition(appId, model);
     if (!currentDefinition)
       return false;
     const namespace = appsNamespace(appId);
     const row = await getAppRow(appId, model, rowId);
-    if (!row)
+    if (!row || matches && !matches(row))
       return false;
     for (const key of indexKeys(model, currentDefinition, row))
       await deleteKv2(namespace, key);
@@ -108187,11 +108198,6 @@ function purgeAppRows(appId, models, afterPurge) {
 }
 
 // src/apps/sync.ts
-init_zod();
-init_db3();
-init_db2();
-init_types();
-init_secret_scrubber();
 var MAX_PULL_RECORDS = 500;
 var MAX_PASS_WARNINGS = 20;
 var MAX_TASK_LIMIT = 200;
@@ -108463,17 +108469,6 @@ function applyTransform(value, transform) {
     }
   }
 }
-function validForKind(column, value) {
-  if (column.kind === "string")
-    return typeof value === "string";
-  if (column.kind === "number")
-    return typeof value === "number" && Number.isFinite(value);
-  if (column.kind === "boolean")
-    return typeof value === "boolean";
-  if (column.kind === "date")
-    return typeof value === "string" && isIso8601Date(value);
-  return typeof value === "string" && Boolean(column.enum?.includes(value));
-}
 function projectRecord(args) {
   const values = { [args.joinKey]: args.record.key };
   for (const [name, column] of args.bindings) {
@@ -108488,7 +108483,7 @@ function projectRecord(args) {
       warn(args.warnings, `column "${name}": transform "${binding.transform}" failed — ${error instanceof Error ? error.message : String(error)}`);
       value = null;
     }
-    if (value !== null && !validForKind(column, value)) {
+    if (value !== null && !isValidColumnValue(column, value)) {
       warn(args.warnings, `column "${name}": field "${binding.field}" produced a value that is not a valid ${column.kind}`);
       value = null;
     }
@@ -108496,8 +108491,12 @@ function projectRecord(args) {
   }
   return values;
 }
-function sameValue(existing, projected) {
-  return Object.is(existing ?? null, projected ?? null);
+function sameValue(column, existing, projected) {
+  const before = existing ?? null;
+  const after = projected ?? null;
+  if (column?.kind === "json")
+    return Bun.deepEquals(before, after);
+  return Object.is(before, after);
 }
 async function resolvePair(appId, model, source) {
   const app = await getApp(appId);
@@ -108587,7 +108586,7 @@ function reconcile(args) {
         tally.created += 1;
         return;
       }
-      const differs = Object.entries(values).some(([name, value]) => !sameValue(existing[name], value));
+      const differs = Object.entries(values).some(([name, value]) => !sameValue(modelDef.columns[name], existing[name], value));
       const updated = await patchAppRowUnlocked(appId, model, modelDef, existing.id, values, {
         allowSourceManaged: true,
         envelope,
@@ -108777,8 +108776,183 @@ async function runAppSync(input) {
   return { ok: passes.every((pass) => pass.error === undefined), passes };
 }
 
+// src/apps/action-runner.ts
+function syncPassError(sync) {
+  const failed = sync.passes.filter((pass) => pass.error !== undefined);
+  if (failed.length === 0)
+    return;
+  return failed.map((pass) => `${pass.model}.${pass.source}: ${pass.error}`).join("; ");
+}
+async function runAppAction({
+  app,
+  name,
+  input = {},
+  caller,
+  actor
+}) {
+  const actions = app.definition.actions;
+  if (!actions || !Object.hasOwn(actions, name)) {
+    return { status: 404, body: { error: "app action not found" } };
+  }
+  const action = actions[name];
+  if (action.kind === "script") {
+    const script = await getScriptById(action.scriptId);
+    if (!script) {
+      return {
+        status: 400,
+        body: {
+          error: "invalid app action",
+          issues: [
+            {
+              path: `actions.${name}.scriptId`,
+              message: `script "${action.scriptId}" no longer exists`
+            }
+          ]
+        }
+      };
+    }
+    const runAsAgentId = getSavedScriptOwnerAgentId(script);
+    if (!runAsAgentId) {
+      return {
+        status: 400,
+        body: { error: "agentId is required: this script has no owning agent to run as" }
+      };
+    }
+    const output = await runSavedScriptAsAgent({
+      script,
+      input: { ...action.args, ...input, app: { id: app.id }, caller },
+      agentId: runAsAgentId
+    });
+    const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
+    const error = ok ? undefined : output.runtimeError ? `${output.runtimeError.name}: ${output.runtimeError.message}` : output.error ?? `Script exited with code ${output.exitCode}`;
+    return {
+      status: 200,
+      body: scrubObject({
+        ok,
+        result: output.result,
+        stdout: output.stdout,
+        ...error === undefined ? {} : { error },
+        durationMs: output.durationMs
+      })
+    };
+  }
+  if (action.kind === "sync") {
+    const startedAt = Date.now();
+    const sync = await runAppSync({
+      appId: app.id,
+      ...action.model === undefined ? {} : { model: action.model },
+      ...action.source === undefined ? {} : { source: action.source },
+      invokedBy: actor
+    });
+    const durationMs = Date.now() - startedAt;
+    if (sync.issues && sync.issues.length > 0) {
+      return { status: 400, body: { error: "invalid sync action", issues: sync.issues } };
+    }
+    const error = syncPassError(sync);
+    return {
+      status: 200,
+      body: scrubObject({
+        ok: sync.ok,
+        result: { passes: sync.passes },
+        ...error === undefined ? {} : { error },
+        durationMs
+      })
+    };
+  }
+  const lead = action.agentId ? null : await getLeadAgent2();
+  const taskPrompt = resolveTemplate("task.app.action", {
+    prompt: action.prompt,
+    app_id: app.id,
+    action_name: name,
+    input_json: JSON.stringify(input),
+    caller_json: JSON.stringify(caller)
+  });
+  const task = await createTaskWithSiblingAwareness(taskPrompt.text, {
+    source: "api",
+    agentId: action.agentId ?? lead?.id,
+    routingReason: action.agentId ? "human_pinned" : lead ? "skill" : undefined,
+    routingSource: action.agentId || lead ? "engine_default" : undefined,
+    key: normalizeAssetKey(`shared/app:${app.id}/action:${name}/`),
+    ...actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {}
+  }, { origin: "app" });
+  return {
+    status: 200,
+    body: { ok: true, taskId: task.id, status: task.status }
+  };
+}
+
+// src/tools/app-action-run.ts
+init_db3();
+init_rbac();
+function registerAppActionRunTool(server) {
+  createToolRegistrar(server)("app-action-run", {
+    title: "Run an app action",
+    description: "Run a declared app action as an agent. Scripts and extensions cannot invoke this tool.",
+    annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+    rbac: { permission: "app.use" },
+    inputSchema: object2({
+      appId: string2().min(1),
+      action: AppNameSchema,
+      input: record2(string2(), unknown()).optional()
+    }),
+    outputSchema: swarmToolOutputSchema({
+      ok: boolean().optional(),
+      result: unknown().optional(),
+      stdout: string2().optional(),
+      error: string2().optional(),
+      durationMs: number2().optional(),
+      taskId: string2().optional(),
+      status: string2().optional()
+    })
+  }, async ({ appId, action, input }, info) => {
+    if (info.callOrigin === "script-sdk" || info.callOrigin === "extension")
+      return toolErr("Scripts and extensions cannot run app actions.");
+    if (!info.agentId)
+      return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+    const agent = await getAgentById2(info.agentId);
+    const decision = can({
+      principal: { kind: "agent", agentId: info.agentId, isLead: agent?.isLead ?? false },
+      verb: "app.use",
+      resource: { kind: "app", appId },
+      source: "mcp"
+    });
+    if (!decision.allow)
+      return toolErr(decision.reason);
+    const app = await getApp(appId);
+    if (!app)
+      return toolErr("App not found.");
+    if (appDefinitionNeedsRepair(app))
+      return toolErr("App definition needs repair.", { data: { issues: app.definitionError } });
+    const output = await runAppAction({
+      app,
+      name: action,
+      input,
+      actor: `agent:${info.agentId}`,
+      caller: { kind: "agent", id: info.agentId, ...agent?.name ? { name: agent.name } : {} }
+    });
+    if (output.status !== 200)
+      return toolErr(output.body.error ?? "Action failed.", { data: output.body });
+    return toolOk("Action invoked.", { data: output.body });
+  });
+}
+
+// src/tools/app-diff.ts
+init_zod();
+
+// src/apps/version.ts
+init_db3();
+
 // src/apps/schema-migrate.ts
-var MigrationValueSchema = union2([string2(), number2(), boolean()]);
+init_zod();
+init_db3();
+init_secret_scrubber();
+var MigrationValueSchema = union2([
+  string2(),
+  number2(),
+  boolean(),
+  record2(string2(), unknown()),
+  array2(unknown())
+]);
 var AppMigrationDirectiveSchema = union2([
   object2({ set: MigrationValueSchema }).strict(),
   object2({
@@ -109008,15 +109182,7 @@ function isPurgeDirective(directive) {
 function columnAccepts(column, value) {
   if (value === null)
     return column.hidden === true || column.required !== true;
-  if (column.kind === "string")
-    return typeof value === "string";
-  if (column.kind === "number")
-    return typeof value === "number" && Number.isFinite(value);
-  if (column.kind === "boolean")
-    return typeof value === "boolean";
-  if (column.kind === "date")
-    return typeof value === "string" && isIso8601Date(value);
-  return typeof value === "string" && Boolean(column.enum?.includes(value));
+  return isValidColumnValue(column, value);
 }
 function coerceValue(value, oldColumn, nextColumn) {
   if (columnAccepts(nextColumn, value))
@@ -109873,10 +110039,7 @@ async function upsertAppUserConfigValues(appId, scope, values) {
 }
 
 // src/http/apps.ts
-init_key();
 init_db3();
-init_db2();
-init_resolver();
 init_rbac();
 init_types();
 init_request_auth_context();
@@ -109969,7 +110132,7 @@ var AppSyncStatusSchema = object2({
 });
 var UserConfigValuesSchema = record2(string2(), union2([string2(), number2(), boolean(), _null()]));
 var AppUserConfigFieldSchema = object2({
-  kind: ColumnKindSchema,
+  kind: ScalarColumnKindSchema,
   default: union2([string2(), number2(), boolean()]).optional(),
   enum: array2(string2()).optional(),
   label: string2().optional()
@@ -110419,12 +110582,6 @@ function definitionNeedsRepair(res, app) {
   json(res, { error: "definition needs repair", issues: app.definitionError }, 409);
   return true;
 }
-function syncPassError(sync) {
-  const failed = sync.passes.filter((pass) => pass.error !== undefined);
-  if (failed.length === 0)
-    return;
-  return failed.map((pass) => `${pass.model}.${pass.source}: ${pass.error}`).join("; ");
-}
 function snapshotFailure(res) {
   jsonError(res, "failed to snapshot app", 500);
 }
@@ -110452,6 +110609,8 @@ async function resolveModel(appId, modelName, res) {
   return { app, model: app.definition.models[modelName] };
 }
 function parseFilterValue(raw, column) {
+  if (column.kind === "json")
+    throw new Error("json columns cannot be filtered");
   if (column.kind === "number") {
     if (!DECIMAL_NUMBER_PATTERN.test(raw))
       throw new Error("must be a decimal number");
@@ -110595,6 +110754,9 @@ function compareValues(left, right, direction, dateValues = false) {
 function rowValue(row, column) {
   return Object.hasOwn(row, column) ? row[column] : undefined;
 }
+function rowMatchesFilters(row, filters) {
+  return filters.every((filter) => rowValue(row, filter.column) === filter.value);
+}
 function applyQuery(rows, query, model, params = {}, queryName = "<unnamed>") {
   const filters = resolveQueryFilters(query, model, params, queryName);
   let selected = rows.filter((row) => filters.every(([column, value]) => rowValue(row, column) === value));
@@ -110607,6 +110769,29 @@ function applyQuery(rows, query, model, params = {}, queryName = "<unnamed>") {
   }
   return selected.slice(0, query.limit ?? 200);
 }
+async function selectAppRows(appId, modelName, model, filters, sortRaw, limit = 200, systemColumns = false) {
+  const jsonFilterIssues = filters.flatMap((filter) => Object.hasOwn(model.columns, filter.column) && model.columns[filter.column].kind === "json" ? [{ path: `filter.${filter.column}`, message: "json columns cannot be filtered" }] : []);
+  if (jsonFilterIssues.length > 0)
+    throw new AppRowValidationError(jsonFilterIssues);
+  const rows = (await listAppRows(appId, modelName, filters.flatMap((filter) => typeof filter.value === "string" || typeof filter.value === "number" || typeof filter.value === "boolean" ? [{ column: filter.column, value: filter.value }] : []))).filter((row) => rowMatchesFilters(row, filters));
+  if (sortRaw) {
+    const [column, dir, extra] = sortRaw.split(":");
+    if (extra !== undefined || !column || dir !== "asc" && dir !== "desc" || !SORTABLE_SYSTEM_DATE_COLUMNS.has(column) && !(systemColumns && Object.hasOwn(SYSTEM_COLUMN_KINDS, column)) && (!Object.hasOwn(model.columns, column) || model.columns[column].hidden === true)) {
+      throw new AppRowValidationError([
+        { path: "sort", message: "must be <column>:<asc|desc> for a known column" }
+      ]);
+    }
+    if (model.columns[column]?.kind === "json") {
+      throw new AppRowValidationError([{ path: "sort", message: "json columns cannot be sorted" }]);
+    }
+    rows.sort((a, b) => {
+      const result = compareValues(rowValue(a, column), rowValue(b, column), dir, SORTABLE_SYSTEM_DATE_COLUMNS.has(column) || Object.hasOwn(model.columns, column) && model.columns[column].kind === "date");
+      return result;
+    });
+  }
+  const total = rows.length;
+  return { rows: rows.slice(0, limit), total };
+}
 async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
   if (createAppRoute.match(req.method, pathSegments)) {
     if (enforceContentLengthCap(req, res, MAX_APP_BODY_BYTES) === BODY_TOO_LARGE)
@@ -110769,24 +110954,13 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
       json(res, { error: "invalid row query", issues }, 400);
       return true;
     }
-    const rows = (await listAppRows(parsed.params.id, parsed.params.model, filters.flatMap((filter) => typeof filter.value === "string" || typeof filter.value === "number" || typeof filter.value === "boolean" ? [{ column: filter.column, value: filter.value }] : []))).filter((row) => filters.every((filter) => rowValue(row, filter.column) === filter.value));
-    const sortRaw = parsed.query.sort;
-    if (sortRaw) {
-      const [column, dir, extra] = sortRaw.split(":");
-      if (extra !== undefined || !column || dir !== "asc" && dir !== "desc" || !SORTABLE_SYSTEM_DATE_COLUMNS.has(column) && (!Object.hasOwn(resolved.model.columns, column) || resolved.model.columns[column].hidden === true)) {
-        json(res, {
-          error: "invalid sort",
-          issues: [{ path: "sort", message: "must be <column>:<asc|desc> for a known column" }]
-        }, 400);
-        return true;
-      }
-      rows.sort((a, b) => {
-        const result = compareValues(rowValue(a, column), rowValue(b, column), dir, SORTABLE_SYSTEM_DATE_COLUMNS.has(column) || Object.hasOwn(resolved.model.columns, column) && resolved.model.columns[column].kind === "date");
-        return result;
-      });
+    try {
+      listRowsRoute.respond(res, 200, await selectAppRows(parsed.params.id, parsed.params.model, resolved.model, filters, parsed.query.sort, parsed.query.limit));
+    } catch (error) {
+      if (!(error instanceof AppRowValidationError))
+        throw error;
+      json(res, { error: "invalid sort", issues: error.issues }, 400);
     }
-    const total = rows.length;
-    listRowsRoute.respond(res, 200, { rows: rows.slice(0, parsed.query.limit ?? 200), total });
     return true;
   }
   if (getRowRoute.match(req.method, pathSegments)) {
@@ -110897,87 +111071,17 @@ async function handleApps(req, res, pathSegments, queryParams, myAgentId) {
     }
     if (definitionNeedsRepair(res, app))
       return true;
-    const actions = app.definition.actions;
-    if (!actions || !Object.hasOwn(actions, parsed.params.name)) {
-      jsonError(res, "app action not found", 404);
-      return true;
-    }
-    const action = actions[parsed.params.name];
-    const input = parsed.body.input ?? {};
-    if (action.kind === "script") {
-      const script = await getScriptById(action.scriptId);
-      if (!script) {
-        json(res, {
-          error: "invalid app action",
-          issues: [
-            {
-              path: `actions.${parsed.params.name}.scriptId`,
-              message: `script "${action.scriptId}" no longer exists`
-            }
-          ]
-        }, 400);
-        return true;
-      }
-      const runAsAgentId = getSavedScriptOwnerAgentId(script);
-      if (!runAsAgentId) {
-        jsonError(res, "agentId is required: this script has no owning agent to run as", 400);
-        return true;
-      }
-      const output = await runSavedScriptAsAgent({
-        script,
-        input: { ...action.args, ...input, app: { id: app.id }, caller },
-        agentId: runAsAgentId
-      });
-      const ok = output.exitCode === 0 && !output.error && !output.runtimeError;
-      const error = ok ? undefined : output.runtimeError ? `${output.runtimeError.name}: ${output.runtimeError.message}` : output.error ?? `Script exited with code ${output.exitCode}`;
-      runActionRoute.respond(res, 200, scrubObject({
-        ok,
-        result: output.result,
-        stdout: output.stdout,
-        ...error === undefined ? {} : { error },
-        durationMs: output.durationMs
-      }));
-      return true;
-    }
-    if (action.kind === "sync") {
-      const startedAt = Date.now();
-      const sync = await runAppSync({
-        appId: app.id,
-        ...action.model === undefined ? {} : { model: action.model },
-        ...action.source === undefined ? {} : { source: action.source },
-        invokedBy: actor
-      });
-      const durationMs = Date.now() - startedAt;
-      if (sync.issues && sync.issues.length > 0) {
-        json(res, { error: "invalid sync action", issues: sync.issues }, 400);
-        return true;
-      }
-      const error = syncPassError(sync);
-      runActionRoute.respond(res, 200, scrubObject({
-        ok: sync.ok,
-        result: { passes: sync.passes },
-        ...error === undefined ? {} : { error },
-        durationMs
-      }));
-      return true;
-    }
-    const lead = action.agentId ? null : await getLeadAgent2();
-    const taskPrompt = resolveTemplate("task.app.action", {
-      prompt: action.prompt,
-      app_id: app.id,
-      action_name: parsed.params.name,
-      input_json: JSON.stringify(input),
-      caller_json: JSON.stringify(caller)
+    const output = await runAppAction({
+      app,
+      name: parsed.params.name,
+      input: parsed.body.input,
+      caller,
+      actor
     });
-    const task = await createTaskWithSiblingAwareness(taskPrompt.text, {
-      source: "api",
-      agentId: action.agentId ?? lead?.id,
-      routingReason: action.agentId ? "human_pinned" : lead ? "skill" : undefined,
-      routingSource: action.agentId || lead ? "engine_default" : undefined,
-      key: normalizeAssetKey(`shared/app:${app.id}/action:${parsed.params.name}/`),
-      ...actor.startsWith("user:") ? { requestedByUserId: actor.slice("user:".length) } : {}
-    }, { origin: "app" });
-    runActionRoute.respond(res, 200, { ok: true, taskId: task.id, status: task.status });
+    if (output.status === 200)
+      runActionRoute.respond(res, 200, output.body);
+    else
+      json(res, output.body, output.status);
     return true;
   }
   if (syncAppRoute.match(req.method, pathSegments)) {
@@ -111720,6 +111824,137 @@ var registerAppRollbackTool = (server) => {
   });
 };
 
+// src/tools/app-rows.ts
+init_zod();
+init_db3();
+init_rbac();
+var base = { appId: string2().min(1), model: AppNameSchema };
+var rowId = string2().min(1);
+var values = record2(string2(), unknown());
+var equals = record2(string2(), union2([string2(), number2(), boolean()]));
+var limit = number2().int().min(1).max(1000);
+var rowOutput = { row: looseObject({}).optional() };
+var rowsOutput = { rows: array2(looseObject({})).optional() };
+function checkSize(value, max) {
+  if (Buffer.byteLength(JSON.stringify(value), "utf8") > max) {
+    throw new AppRowValidationError([
+      { path: "values", message: `Row input exceeds ${max} bytes.` }
+    ]);
+  }
+}
+function rowFilters(model, equals = {}) {
+  return Object.entries(equals).map(([column, value]) => {
+    const declared = Object.hasOwn(model.columns, column) ? model.columns[column] : undefined;
+    if (!declared && !Object.hasOwn(SYSTEM_COLUMN_KINDS, column) || declared?.hidden) {
+      throw new AppRowValidationError([
+        { path: `equals.${column}`, message: "Unknown or hidden column." }
+      ]);
+    }
+    if (declared?.kind === "json") {
+      throw new AppRowValidationError([
+        { path: `equals.${column}`, message: "json columns cannot be filtered" }
+      ]);
+    }
+    if (!validValue(declared ?? { kind: SYSTEM_COLUMN_KINDS[column] }, value)) {
+      throw new AppRowValidationError([
+        { path: `equals.${column}`, message: "Filter value must match the column kind." }
+      ]);
+    }
+    return { column, value };
+  });
+}
+function registerAppRowTools(server) {
+  function register(name, description, shape, output, operation, readOnly = false) {
+    createToolRegistrar(server)(name, {
+      title: description,
+      description,
+      annotations: { readOnlyHint: readOnly },
+      rbac: { permission: "app.use" },
+      inputSchema: object2({ ...base, ...shape }),
+      outputSchema: swarmToolOutputSchema(output)
+    }, async (args, info) => {
+      if (!info.agentId)
+        return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+      const { appId, model: modelName } = object2(base).parse(args);
+      const agent = await getAgentById2(info.agentId);
+      const decision = can({
+        principal: { kind: "agent", agentId: info.agentId, isLead: agent?.isLead ?? false },
+        verb: "app.use",
+        resource: { kind: "app", appId },
+        source: "mcp"
+      });
+      if (!decision.allow)
+        return toolErr(decision.reason);
+      const app = await getApp(appId);
+      if (!app)
+        return toolErr("App not found.");
+      if (appDefinitionNeedsRepair(app))
+        return toolErr("App definition needs repair.", { data: { issues: app.definitionError } });
+      if (!Object.hasOwn(app.definition.models, modelName))
+        return toolErr("Model not found.");
+      try {
+        return await operation(args, app.definition.models[modelName], `agent:${info.agentId}`);
+      } catch (error) {
+        if (error instanceof AppRowValidationError)
+          return toolErr(error.message, { data: { issues: error.issues } });
+        if (error instanceof AppRowAppNotFoundError)
+          return toolErr(error.message);
+        throw error;
+      }
+    });
+  }
+  register("app-rows-list", "List app rows with equality filters, sorting, and a limit.", {
+    equals: equals.optional(),
+    sort: string2().optional(),
+    limit: limit.optional()
+  }, { ...rowsOutput, total: number2().optional() }, async (args, model) => {
+    const data = await selectAppRows(args.appId, args.model, model, rowFilters(model, args.equals), args.sort, args.limit, true);
+    return toolOk(`Found ${data.total} row(s).`, { data });
+  }, true);
+  register("app-row-get", "Get an app row.", { rowId }, rowOutput, async (args) => {
+    const row = await getAppRow(args.appId, args.model, args.rowId);
+    return row ? toolOk("Row retrieved.", { data: { row } }) : toolErr("Row not found.");
+  }, true);
+  register("app-row-create", "Create an app row.", { values }, rowOutput, async (args, model, actor) => {
+    checkSize({ values: args.values }, MAX_APP_ROW_BODY_BYTES);
+    const row = await createAppRow(args.appId, args.model, model, args.values, { actor });
+    return toolOk("Row created.", { data: { row } });
+  });
+  register("app-rows-create", "Create up to 500 app rows within 10 MiB.", {
+    rows: array2(values).min(1).max(500)
+  }, rowsOutput, async (args, model, actor) => {
+    checkSize({ rows: args.rows }, MAX_APP_BULK_ROWS_BODY_BYTES);
+    for (const values of args.rows)
+      checkSize({ values }, MAX_APP_ROW_BODY_BYTES);
+    const rows = await createAppRows(args.appId, args.model, model, args.rows, { actor });
+    return toolOk(`Created ${rows.length} row(s).`, { data: { rows } });
+  });
+  register("app-row-patch", "Patch an app row.", { rowId, values }, rowOutput, async (args, model, actor) => {
+    checkSize({ values: args.values }, MAX_APP_ROW_BODY_BYTES);
+    const row = await patchAppRow(args.appId, args.model, model, args.rowId, args.values, {
+      actor
+    });
+    return row ? toolOk("Row updated.", { data: { row } }) : toolErr("Row not found.");
+  });
+  register("app-row-delete", "Delete an app row.", { rowId }, { ok: boolean().optional() }, async (args, model) => {
+    const deleted = await deleteAppRow(args.appId, args.model, model, args.rowId);
+    return deleted ? toolOk("Row deleted.", { data: { ok: true } }) : toolErr("Row not found.");
+  });
+  register("app-rows-delete", "Delete matching app rows. Supply at least one equality filter.", {
+    equals: equals.refine((value) => Object.keys(value).length > 0, "Supply at least one equality filter."),
+    limit: limit.optional()
+  }, { deleted: number2().optional() }, async (args, model) => {
+    const filters = rowFilters(model, args.equals);
+    const { rows } = await selectAppRows(args.appId, args.model, model, filters, undefined, args.limit ?? 1000, true);
+    const matches = (row) => rowMatchesFilters(row, filters);
+    let deleted = 0;
+    for (const row of rows)
+      if (await deleteAppRow(args.appId, args.model, model, row.id, matches))
+        deleted++;
+    return toolOk(`Deleted ${deleted} row(s).`, { data: { deleted } });
+  });
+}
+
 // src/tools/app-sync.ts
 init_zod();
 init_db3();
@@ -118952,7 +119187,7 @@ var registerModelCatalogOverlayUpsertTool = (server) => {
     description: "Add or update hand-verified facts for one model (e.g. a launch models.dev has not listed yet). Overlay fields win over models.dev; overlay prices fill pricing-table gaps so cost recompute prices the model. The row auto-expires once models.dev matches every fact you set.",
     annotations: { idempotentHint: true },
     inputSchema: object2({
-      provider: string2().min(1).describe(`models.dev provider id: anthropic, openai, openrouter, amazon-bedrock, opencode, ${openAICompatibleProviderIds().join(", ")}.`),
+      provider: string2().min(1).describe(`models.dev provider id: anthropic, openai, openrouter, amazon-bedrock, opencode, opencode-go, ${openAICompatibleProviderIds().join(", ")}.`),
       modelId: string2().min(1).describe("Model id as models.dev keys it (e.g. claude-opus-5-5)."),
       name: string2().optional().describe("Display name."),
       releaseDate: string2().optional().describe("Release date, YYYY-MM-DD."),
@@ -121700,7 +121935,7 @@ var varStorage = _localStorage;
 
 // node_modules/lib0/trait/equality.js
 var EqualityTraitSymbol = Symbol("Equality");
-var equals = (a, b) => a === b || !!a?.[EqualityTraitSymbol]?.(b) || false;
+var equals2 = (a, b) => a === b || !!a?.[EqualityTraitSymbol]?.(b) || false;
 
 // node_modules/lib0/object.js
 var assign = Object.assign;
@@ -121726,7 +121961,7 @@ var every = (obj, f) => {
   return true;
 };
 var hasProperty = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
-var equalFlat = (a, b) => a === b || size(a) === size(b) && every(a, (val, key) => (val !== undefined || hasProperty(b, key)) && equals(b[key], val));
+var equalFlat = (a, b) => a === b || size(a) === size(b) && every(a, (val, key) => (val !== undefined || hasProperty(b, key)) && equals2(b[key], val));
 var freeze = Object.freeze;
 var deepFreeze = (o) => {
   for (const key in o) {
@@ -133789,7 +134024,7 @@ async function emitBudgetRefusalSideEffects(ctx, inserted) {
       console.warn(`[budget-refusal-notify] Failed to create follow-up task for budget refusal (task=${ctx.task.id.slice(0, 8)}): ${err}`);
     }
   }
-  import("./event-bus-101fenkh.js").then(({ workflowEventBus }) => {
+  import("./event-bus-9vpk8gmq.js").then(({ workflowEventBus }) => {
     workflowEventBus.emit("task.budget_refused", {
       taskId: ctx.task.id,
       agentId: ctx.agentId,
@@ -135339,7 +135574,7 @@ var registerRetryWorkflowRunTool = (server) => {
   createToolRegistrar(server)("retry-workflow-run", {
     title: "Retry Workflow Run",
     annotations: { destructiveHint: false },
-    description: "Retry a failed workflow run from the beginning. The run must be in 'failed' status.",
+    description: "Resume the same failed workflow run from its failed step(s); completed steps are not re-run. Retrying re-creates the failed node's side effects (e.g. an agent task), so check the target state first if that work was already done manually.",
     inputSchema: object2({
       runId: string2().uuid().describe("Workflow run ID to retry")
     }),
@@ -135803,6 +136038,8 @@ async function createServer(opts = {}) {
   }
   if (hasCapability("pages")) {
     registerAppGetTool(server);
+    registerAppRowTools(server);
+    registerAppActionRunTool(server);
     registerAppHistoryTool(server);
     registerAppDiffTool(server);
     registerAppListTool(server);