@desplega.ai/agent-swarm 2.4.3 → 2.4.4

package/dist/{cli-sds5zzs8.js → cli-9fhkkpj5.js}

@@ -5,8 +5,9 @@ import {
   validateRuntimeTokenTtlHours,
   init_swarm_config_guard,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
+  registerVolatileSecret,
   unregisterVolatileSecret,
   init_secret_scrubber
 } from "./cli-xf234ws8.js";
@@ -264,11 +265,12 @@ async function resolveUserByToken(plaintext) {
 async function mintSessionToken(agentId, taskId, ttlMs, parent) {
   if (parent) {
     return await getDbClient2().transaction(async (client) => {
-      const row = await client.get(`SELECT expiresAt FROM session_tokens WHERE id = ? AND agentId = ? AND runtimeId = ?
-         AND revokedAt IS NULL AND expiresAt > ?`, [parent.tokenId, agentId, parent.runtimeId, new Date().toISOString()]);
+      const row = await client.get(parent.runtimeId ? `SELECT expiresAt FROM session_tokens WHERE id = ? AND agentId = ? AND runtimeId = ?
+             AND revokedAt IS NULL AND expiresAt > ?` : `SELECT expiresAt FROM session_tokens WHERE id = ? AND agentId = ? AND ${AGENT_TOKEN_BINDING}
+             AND revokedAt IS NULL AND expiresAt > ?`, parent.runtimeId ? [parent.tokenId, agentId, parent.runtimeId, new Date().toISOString()] : [parent.tokenId, agentId, new Date().toISOString()]);
       if (!row)
         throw new InvalidRuntimeTokenError;
-      return await insertSessionToken(agentId, taskId, null, ttlMs, parent.runtimeId, row.expiresAt);
+      return await insertSessionToken(agentId, taskId, null, ttlMs, parent.runtimeId, row.expiresAt, null, parent.runtimeId ? null : parent.tokenId);
     });
   }
   return await insertSessionToken(agentId, taskId, null, ttlMs);
@@ -280,7 +282,7 @@ function runtimeTokenTtlMs() {
 async function mintRuntimeToken(agentId, runtimeId, ttlMs = runtimeTokenTtlMs()) {
   return await insertSessionToken(agentId, null, runtimeId, ttlMs);
 }
-async function insertSessionToken(agentId, taskId, runtimeId, ttlMs, parentRuntimeId = null, expiresAtCeiling, controllerId = null) {
+async function insertSessionToken(agentId, taskId, runtimeId, ttlMs, parentRuntimeId = null, expiresAtCeiling, controllerId = null, parentTokenId = null) {
   const plaintext = `${SESSION_TOKEN_PREFIX}${base62(randomBytes(24))}`;
   const tokenId = randomUUID().replace(/-/g, "");
   const hash = sha256Hex(plaintext);
@@ -288,8 +290,8 @@ async function insertSessionToken(agentId, taskId, runtimeId, ttlMs, parentRunti
   const now = new Date;
   const expiresAt = new Date(Math.min(now.getTime() + ttlMs, expiresAtCeiling ? Date.parse(expiresAtCeiling) : Infinity)).toISOString();
   await getDbClient2().run(`INSERT INTO session_tokens
-     (id, tokenHash, tokenPreview, agentId, taskId, runtimeId, parentRuntimeId, expiresAt, createdAt, controllerId)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+     (id, tokenHash, tokenPreview, agentId, taskId, runtimeId, parentRuntimeId, expiresAt, createdAt, controllerId, parentTokenId)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
     tokenId,
     hash,
     preview,
@@ -299,7 +301,8 @@ async function insertSessionToken(agentId, taskId, runtimeId, ttlMs, parentRunti
     parentRuntimeId,
     expiresAt,
     now.toISOString(),
-    controllerId
+    controllerId,
+    parentTokenId
   ]);
   return { tokenId, plaintext };
 }
@@ -309,11 +312,24 @@ async function revokeSessionToken(tokenId) {
     if (row?.runtimeId) {
       await revokeRuntimeTokensForRuntime(row.runtimeId);
     } else {
-      await client.run("UPDATE session_tokens SET revokedAt = ? WHERE id = ? AND revokedAt IS NULL", [new Date().toISOString(), tokenId]);
-      getDbClient2().afterCommit(() => closeSessionTokenConnections([tokenId]));
+      await revokeTokensWithChildren(client, [tokenId]);
     }
   });
 }
+async function revokeTokensWithChildren(client, tokenIds) {
+  if (tokenIds.length === 0)
+    return;
+  const placeholders = tokenIds.map(() => "?").join(", ");
+  const children = await client.query(`SELECT id FROM session_tokens WHERE parentTokenId IN (${placeholders})`, tokenIds);
+  const ids = [...tokenIds, ...children.map((row) => row.id)];
+  await client.run(`UPDATE session_tokens SET revokedAt = ?
+     WHERE id IN (${ids.map(() => "?").join(", ")}) AND revokedAt IS NULL`, [new Date().toISOString(), ...ids]);
+  getDbClient2().afterCommit(() => {
+    for (const id of tokenIds)
+      unregisterVolatileSecret(`agent-token:${id}`);
+    closeSessionTokenConnections(ids);
+  });
+}
 async function revokeRuntimeTokensForRuntime(runtimeId) {
   await getDbClient2().transaction(async (client) => {
     const rows = await client.query("SELECT id FROM session_tokens WHERE runtimeId = ? OR parentRuntimeId = ?", [runtimeId, runtimeId]);
@@ -325,6 +341,50 @@ async function revokeRuntimeTokensForRuntime(runtimeId) {
     });
   });
 }
+function storedExpiry(ttlMs) {
+  return ttlMs === null ? AGENT_TOKEN_NO_EXPIRY : new Date(Date.now() + ttlMs).toISOString();
+}
+function publicExpiry(expiresAt) {
+  return expiresAt === AGENT_TOKEN_NO_EXPIRY ? null : expiresAt;
+}
+async function activeAgentTokenIds(client, agentId) {
+  const rows = await client.query(`SELECT id FROM session_tokens WHERE agentId = ? AND ${AGENT_TOKEN_BINDING}
+     AND revokedAt IS NULL AND expiresAt > ?`, [agentId, new Date().toISOString()]);
+  return rows.map((row) => row.id);
+}
+async function insertAgentToken(agentId, ttlMs) {
+  const expiresAt = storedExpiry(ttlMs);
+  const token = await insertSessionToken(agentId, null, null, Number.MAX_SAFE_INTEGER, null, expiresAt);
+  getDbClient2().afterCommit(() => registerVolatileSecret(token.plaintext, `agent-token:${token.tokenId}`));
+  return { ...token, expiresAt: publicExpiry(expiresAt) };
+}
+async function mintAgentToken(agentId, ttlMs = AGENT_TOKEN_DEFAULT_TTL_MS) {
+  return await getDbClient2().transaction(async (client) => {
+    if ((await activeAgentTokenIds(client, agentId)).length > 0) {
+      throw new AgentTokenExistsError;
+    }
+    return await insertAgentToken(agentId, ttlMs);
+  });
+}
+async function rotateAgentToken(agentId, graceMs, ttlMs = AGENT_TOKEN_DEFAULT_TTL_MS) {
+  return await getDbClient2().transaction(async (client) => {
+    const previous = await activeAgentTokenIds(client, agentId);
+    if (previous.length === 0)
+      return null;
+    const previousExpiresAt = new Date(Date.now() + graceMs).toISOString();
+    const placeholders = previous.map(() => "?").join(", ");
+    await client.run(`UPDATE session_tokens SET expiresAt = ?
+       WHERE (id IN (${placeholders}) OR parentTokenId IN (${placeholders})) AND expiresAt > ?`, [previousExpiresAt, ...previous, ...previous, previousExpiresAt]);
+    return { ...await insertAgentToken(agentId, ttlMs), previousExpiresAt };
+  });
+}
+async function revokeAgentTokens(agentId) {
+  return await getDbClient2().transaction(async (client) => {
+    const ids = await activeAgentTokenIds(client, agentId);
+    await revokeTokensWithChildren(client, ids);
+    return ids.length;
+  });
+}
 async function resolveSessionToken(plaintext, options = {}) {
   if (!plaintext.startsWith(SESSION_TOKEN_PREFIX))
     return null;
@@ -356,6 +416,7 @@ async function resolveSessionToken(plaintext, options = {}) {
   return {
     kind: "agent",
     tokenId: row.id,
+    tokenKind: row.taskId !== null ? "task" : row.runtimeId !== null ? "runtime" : "agent",
     agentId: row.agentId,
     taskId: row.taskId,
     runtimeId: row.runtimeId,
@@ -365,7 +426,7 @@ async function resolveSessionToken(plaintext, options = {}) {
 function fingerprintApiKey(rawKey) {
   return `op:${sha256Hex(rawKey).slice(0, 16)}`;
 }
-var TOKEN_PREFIX = "aswt_", SESSION_TOKEN_PREFIX = "aseph_", InvalidRuntimeTokenError;
+var TOKEN_PREFIX = "aswt_", SESSION_TOKEN_PREFIX = "aseph_", InvalidRuntimeTokenError, AGENT_TOKEN_BINDING = "taskId IS NULL AND runtimeId IS NULL AND controllerId IS NULL AND parentRuntimeId IS NULL", AGENT_TOKEN_NO_EXPIRY = "9999-12-31T23:59:59.999Z", AGENT_TOKEN_DEFAULT_TTL_MS = null, AgentTokenExistsError;
 var init_users = __esm(() => {
   init_telemetry_identity();
   init_secret_scrubber();
@@ -377,6 +438,11 @@ var init_users = __esm(() => {
       super("Runtime token is no longer valid");
     }
   };
+  AgentTokenExistsError = class AgentTokenExistsError extends Error {
+    constructor() {
+      super("Agent already has an active token; rotate or revoke it");
+    }
+  };
 });
 
-export { registerSessionTokenConnection, closeSessionTokenConnections, init_session_token_connections, findUserById, findUserByExternalId, findUserByEmail, findUsersByName, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, InvalidRuntimeTokenError, mintSessionToken, mintRuntimeToken, insertSessionToken, revokeSessionToken, revokeRuntimeTokensForRuntime, resolveSessionToken, fingerprintApiKey, init_users };
+export { registerSessionTokenConnection, closeSessionTokenConnections, init_session_token_connections, findUserById, findUserByExternalId, findUserByEmail, findUsersByName, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, InvalidRuntimeTokenError, mintSessionToken, mintRuntimeToken, insertSessionToken, revokeSessionToken, revokeRuntimeTokensForRuntime, AgentTokenExistsError, mintAgentToken, rotateAgentToken, revokeAgentTokens, resolveSessionToken, fingerprintApiKey, init_users };

package/dist/{cli-vq9gqarq.js → cli-amyhm3gj.js}

@@ -1,7 +1,7 @@
 import {
   getDb2,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   openAICompatibleProviderIds,
   withRegistryCatalogSections,

package/dist/{cli-bxrqvpg5.js → cli-b8k7epj1.js}

@@ -10,7 +10,7 @@ import {
   init_steering,
   createLogEntry2,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   ackSlackMessage,
   buildBufferFlushBlocks,
@@ -20,7 +20,7 @@ import {
   ensureSlackThreadTree2,
   registerTreeMessage,
   getSlackApp2
-} from "./cli-tkf4x6ha.js";
+} from "./cli-qkhc5aqy.js";
 import {
   createAdditiveBuffer,
   TaskCreationBlockedError,
@@ -30,15 +30,15 @@ import {
   createSlackTaskWithFiles,
   notifySlackFileFailures,
   extractSlackMessageText
-} from "./cli-kgnkyabk.js";
+} from "./cli-v3yr2gbg.js";
 import {
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-4yef8ghv.js";
+} from "./cli-2v045xyf.js";
 import {
   findUserByExternalId,
   init_users
-} from "./cli-sds5zzs8.js";
+} from "./cli-9fhkkpj5.js";
 import {
   isSteeringEnabled2,
   init_steering_enabled

package/dist/{cli-8vverzf7.js → cli-ba8ne1es.js}

@@ -320,6 +320,7 @@ var init_legacy_policy = __esm(() => {
     "runtime_pool.write": operatorOrUser,
     "runtime_pool.bind": leadOrOperatorOrUser,
     "runtime_controller.write": operatorOrUser,
+    "agent.token.manage": operatorOrUser,
     "extension.write": extensionWrite,
     "extension.activate": extensionActivation,
     "extension.install.inline": leadOrOperatorOrUser
@@ -369,6 +370,10 @@ var init_permissions = __esm(() => {
       description: "View or diff another agent's context history.",
       namespace: "agent"
     },
+    "agent.token.manage": {
+      description: "Mint, rotate, or revoke an agent-bound worker token.",
+      namespace: "agent"
+    },
     "task.cancel.any": {
       description: "Cancel any task (beyond tasks the caller created).",
       namespace: "task"

package/dist/{cli-58vwn100.js → cli-bnz0r3kc.js}

@@ -14,7 +14,7 @@ import {
 import {
   DEFAULT_MODEL_TIER_MAP,
   init_types
-} from "./cli-836ehxmt.js";
+} from "./cli-nc35pxb7.js";
 import {
   resolveTemplateFromCode,
   resolveTemplateAsync,

package/dist/{cli-6eyncg0y.js → cli-cynvc9fj.js}

@@ -9,20 +9,21 @@ import {
   init_active_sessions,
   getSteeringMessageById2,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   getUserGrant2,
   init_rbac_roles
-} from "./cli-qp2m4btv.js";
+} from "./cli-4dg55wsk.js";
 import {
   findUserById,
   findUserByExternalId,
   init_users
-} from "./cli-sds5zzs8.js";
+} from "./cli-9fhkkpj5.js";
 import {
   isRbacEnabled,
+  can,
   init_rbac
-} from "./cli-8vverzf7.js";
+} from "./cli-ba8ne1es.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -502,7 +503,7 @@ function route(def) {
       try {
         const rawBody = def.body ? await parseBody(req, def.maxBodyBytes) : undefined;
         if (def.session && "bodyTaskIds" in def.session) {
-          const { bodySessionDenial } = await import("./session-access-2zg285a1.js");
+          const { bodySessionDenial } = await import("./session-access-cv3mq6mc.js");
           const denial = await bodySessionDenial(req, def.session.bodyTaskIds(rawBody));
           if (denial) {
             jsonError(res, denial, 403);
@@ -770,6 +771,33 @@ function readableByFor2(actor) {
   return actor.kind === "user" ? { userId: actor.userId } : undefined;
 }
 var SESSION_WRITE_DENIED2 = "You can't write in this session. Ask the owner to share it with edit access.";
+async function hasSessionWrite(req, myAgentId, taskId) {
+  const access = await sessionAccessFor2(await resolveSessionActor2(req, myAgentId), taskId);
+  return hasSessionAccess(access, "write");
+}
+async function denyParentAttach2(req, res, myAgentId, parentTask, principal) {
+  const attach = can({
+    principal,
+    verb: "task.parent.attach",
+    resource: {
+      kind: "task",
+      taskId: parentTask.id,
+      requestedByUserId: parentTask.requestedByUserId,
+      creatorAgentId: parentTask.creatorAgentId,
+      agentId: parentTask.agentId
+    },
+    source: "http"
+  });
+  if (!attach.allow) {
+    jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
+    return true;
+  }
+  if (!await hasSessionWrite(req, myAgentId, parentTask.id)) {
+    jsonError(res, SESSION_WRITE_DENIED2, 403);
+    return true;
+  }
+  return false;
+}
 async function denialFor(actor, taskId, needed) {
   if (actor.kind === "bypass")
     return null;
@@ -845,4 +873,4 @@ async function userAgentIdentityDenial2(req, def, pathSegments) {
   return USER_AGENT_HEADER_DENIED;
 }
 
-export { duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, hasSessionAccess, getSessionRoot, sessionAccessForRoot, listActiveSessionShares, toSessionSharesState, setSessionShares, resolveTaskAuditUserId, resolveHttpAuditUserId, dashboardUserIdHeader, resolveHttpFavoriteOwner, resolveSessionActor2, sessionAccessFor2, SESSION_READ_DENIED2, canReadSession2, readableByFor2, SESSION_WRITE_DENIED2, pathSessionDenial2, bodySessionDenial2, userAgentIdentityDenial2, runtimeInstanceHeader, bodyTask, bodyListTask, routeRegistry, isPublicRoute, findRoute, describeRequestRoute, route };
+export { duplicateGuardedQueryKey, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, allowedCredentialRedirect, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, writeUnhandledError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, hasSessionAccess, getSessionRoot, sessionAccessForRoot, listActiveSessionShares, toSessionSharesState, setSessionShares, resolveTaskAuditUserId, resolveHttpAuditUserId, dashboardUserIdHeader, resolveHttpFavoriteOwner, resolveSessionActor2, sessionAccessFor2, SESSION_READ_DENIED2, canReadSession2, readableByFor2, SESSION_WRITE_DENIED2, denyParentAttach2, pathSessionDenial2, bodySessionDenial2, userAgentIdentityDenial2, runtimeInstanceHeader, bodyTask, bodyListTask, routeRegistry, isPublicRoute, findRoute, describeRequestRoute, route };

package/dist/{cli-f0p0f6ja.js → cli-dqb4n629.js}

@@ -4,7 +4,7 @@ import {
   CONTROLLER_COMMAND_TIMEOUT_MS,
   RuntimeHandleSchema,
   ControllerStatusResultSchema
-} from "./cli-mzkwkbdy.js";
+} from "./cli-82d3nkc3.js";
 import {
   getDbClient2,
   isRuntimePoolsEnabled,
@@ -21,7 +21,7 @@ import {
   upsertSwarmConfig2,
   getResolvedConfig2,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   runtimeStaleThresholdMinutes,
   getRuntimeInstanceById,
@@ -31,7 +31,7 @@ import {
   listRuntimeInstancesForPool,
   createWorkerTaskFollowUp,
   canClaim
-} from "./cli-kgnkyabk.js";
+} from "./cli-v3yr2gbg.js";
 import {
   getRuntimeController2,
   getRuntimeControllerTarget2,
@@ -42,7 +42,7 @@ import {
   getPoolForAgent2,
   resolvePoolDelivery2,
   init_db
-} from "./cli-gx0j2khs.js";
+} from "./cli-w6nadkh4.js";
 import {
   workflowEventBus2,
   init_event_bus
@@ -61,12 +61,12 @@ import {
 import {
   mintRuntimeToken,
   init_users
-} from "./cli-sds5zzs8.js";
+} from "./cli-9fhkkpj5.js";
 import {
   TERMINAL_TASK_STATUSES,
   isTerminalTaskStatus,
   init_types
-} from "./cli-836ehxmt.js";
+} from "./cli-nc35pxb7.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -522,7 +522,7 @@ async function recoverSessions(runtimeId, reason) {
   }
   if (!sessions.length)
     return;
-  const { remediateTaskForDeadRuntime } = await import("./heartbeat-zzfksckz.js");
+  const { remediateTaskForDeadRuntime } = await import("./heartbeat-wd03zhn0.js");
   for (const session of sessions) {
     try {
       const task = await getTaskById2(session.taskId);

package/dist/{cli-pygdsgh8.js → cli-esxerzg7.js}

@@ -9,7 +9,7 @@ import {
   acquireOAuthRefreshLock,
   releaseOAuthRefreshLock,
   init_oauth
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   scrubSecrets,
   registerVolatileSecret,

package/dist/{cli-dm8p2dpf.js → cli-gqvh8d8a.js}

@@ -10,7 +10,7 @@ import {
   getMostRecentTaskInThread2,
   reactionName,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   TaskCreationBlockedError,
   buildEffectiveText,
@@ -23,7 +23,7 @@ import {
   extractTaskFromMessage,
   extractSlackMessageText,
   dispatchPre2
-} from "./cli-kgnkyabk.js";
+} from "./cli-v3yr2gbg.js";
 import {
   noteSlackInboundSideEffect,
   ignoreSlackInbound,
@@ -34,14 +34,14 @@ import {
   isSlackRenderV2Enabled2,
   ensureSlackThreadTree2,
   registerTreeMessage
-} from "./cli-tkf4x6ha.js";
+} from "./cli-qkhc5aqy.js";
 import {
   isBlockExternalEnabled2,
   invalidateChannelExternality2,
   getChannelBlockReason2,
   shouldBlockChannel2,
   leaveExternalChannel2
-} from "./cli-v87dr6e3.js";
+} from "./cli-1d70crsy.js";
 import {
   workflowEventBus2,
   init_event_bus
@@ -50,7 +50,7 @@ import {
   enrichSlackUserEmail,
   resolveSlackUserId,
   rewriteSlackMentions
-} from "./cli-4yef8ghv.js";
+} from "./cli-2v045xyf.js";
 import {
   wasEventSeen,
   requestSlackThreadSteering,
@@ -58,7 +58,7 @@ import {
   bufferThreadMessage,
   getBufferMessageCount,
   instantFlush
-} from "./cli-bxrqvpg5.js";
+} from "./cli-b8k7epj1.js";
 import {
   resolveTemplate,
   init_resolver

package/dist/{cli-p0qerd2r.js → cli-hj3debgw.js}

@@ -6,7 +6,7 @@ import {
   getResolvedConfig2,
   getAllUsers2,
   init_db3
-} from "./cli-vcgscaan.js";
+} from "./cli-p20r8w42.js";
 import {
   scrubSecrets,
   init_secret_scrubber

package/dist/{cli-836ehxmt.js → cli-nc35pxb7.js}

@@ -2833,9 +2833,9 @@ var init_types = __esm(() => {
   }).openapi("SwarmScriptNodeConfig");
   WorkflowNodeSchema = object2({
     id: string2().describe("Unique node identifier, used in 'next' and 'inputs' mappings"),
-    type: string2().describe("Executor type: 'agent-task', 'script', 'swarm-script', 'raw-llm', 'system-one-decision', 'validate', 'property-match'"),
+    type: string2().describe("Executor type: 'agent-task', 'script', 'swarm-script', 'raw-llm', 'system-one-decision', 'system-one-extraction', 'validate', 'property-match'"),
     label: string2().optional().describe("Human-readable label for UI display"),
-    config: record2(string2(), unknown()).describe("Executor-specific config. For agent-task: { template, outputSchema?, agentId?, routingReason?, routingNote?, tags?, priority?, dir?, vcsRepo?, model? }; configured agentId defaults routingReason to human_pinned. " + "For script: { runtime, script, args?, timeout? }. " + "For swarm-script: { scriptName, scope?, pinHash?, args?, fsMode?, timeoutMs? (1000-300000) }. " + "For system-one-decision (typed decisions, Jev by default): { provider? ('typesafe' default | 'openrouter' | 'laya'; a literal, never a {{token}}), state, questions: { <id>: { type: 'noul'|'choice'|'score', instructions, criteria? } }, returns: { <id>: { type } }, model? (provider-specific; unset = the provider's default, and laya has none so it sends no model and picks its own checkpoint), timeoutMs?, maxRetries? (0-3), humanReview? { band: { min, max } (0-1, inclusive), approvers: { users?, roles?, policy }, title?, timeout?, notifications? } }; each provider needs its own global secret (TYPESAFE_API_KEY, OPENROUTER_API_KEY, or LAYA_API_KEY; laya also needs the global config LAYA_URL), and a save warns and a run fails before any node executes when one is missing; system-one-decision nodes must not set retry or validation.retry. With humanReview, an answer whose confidence is inside the band waits for a person (human-in-the-loop approval), and next must map ports { approved, rejected?, timeout? }. " + "Agent-task templates and ordinary config values support {{interpolation}} from the node's inputs context, including trigger and declared upstream aliases. " + "SECURITY: executable source for script/swarm-script nodes does not interpolate trigger.* or upstream node outputs; only input/workflow/swarm/run values are allowed in inline script source, and named swarm-script source is not workflow-interpolated. " + 'Pass dynamic values through config.args instead (inline script receives them as argv, with runtime: "bash" running bash -c <script> ...args so args[0] is $0 and args[1] is $1; swarm-script receives its args object). ' + "NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, " + "while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."),
+    config: record2(string2(), unknown()).describe("Executor-specific config. For agent-task: { template, outputSchema?, agentId?, routingReason?, routingNote?, tags?, priority?, dir?, vcsRepo?, model? }; configured agentId defaults routingReason to human_pinned. " + "For script: { runtime, script, args?, timeout? }. " + "For swarm-script: { scriptName, scope?, pinHash?, args?, fsMode?, timeoutMs? (1000-300000) }. " + "For system-one-decision (typed decisions, Jev by default): { provider? ('typesafe' default | 'openrouter' | 'laya'; a literal, never a {{token}}), state, questions: { <id>: { type: 'noul'|'choice'|'score', instructions, criteria? } }, returns: { <id>: { type } }, model? (provider-specific; unset = the provider's default, and laya has none so it sends no model and picks its own checkpoint), timeoutMs?, maxRetries? (0-3), humanReview? { band: { min, max } (0-1, inclusive), approvers: { users?, roles?, policy }, title?, timeout?, notifications? } }; each provider needs its own global secret (TYPESAFE_API_KEY, OPENROUTER_API_KEY, or LAYA_API_KEY; laya also needs the global config LAYA_URL), and a save warns and a run fails before any node executes when one is missing; system-one-decision nodes must not set retry or validation.retry. With humanReview, an answer whose confidence is inside the band waits for a person (human-in-the-loop approval), and next must map ports { approved, rejected?, timeout? }. " + "For system-one-extraction (typed extraction, Cloudflare Clairic by default): { provider? ('cloudflare'; a literal), state (text to read; may be empty when images are sent), fields: { <id>: { type: 'text'|'number'|'date'|'time'|'datetime'|'duration'|'list'|'estimate'|'forecast', instructions?, ...type options (number: unit?, integer?, decimals?; duration: unit? (seconds..years), integer?, decimals?; list: items ('text'|'number'|'date'); estimate: min, max, step?, scale?, unit?; forecast: min, max, horizon?, interval?, scale?, unit?; text/number/date/time/datetime/duration: null_threshold?) } }, images? (max 4 base64 data: URLs or { content_type, base64 }), referenceDate? (YYYY-MM-DD), model?, timeoutMs?, maxRetries? (0-3) }; output answers.<id> carries value (null when the input does not say), guess, p_null, confidence, span/spans, and for estimate/forecast median/p10/p90. Needs the global secret CLOUDFLARE_API_TOKEN (or CLOUDFLARE_API_KEY) and the global config CLOUDFLARE_ACCOUNT_ID; must not set retry or validation.retry. " + "Agent-task templates and ordinary config values support {{interpolation}} from the node's inputs context, including trigger and declared upstream aliases. " + "SECURITY: executable source for script/swarm-script nodes does not interpolate trigger.* or upstream node outputs; only input/workflow/swarm/run values are allowed in inline script source, and named swarm-script source is not workflow-interpolated. " + 'Pass dynamic values through config.args instead (inline script receives them as argv, with runtime: "bash" running bash -c <script> ...args so args[0] is $0 and args[1] is $1; swarm-script receives its args object). ' + "NOTE: config.outputSchema on agent-task nodes validates the AGENT's raw JSON output, " + "while node-level outputSchema validates the EXECUTOR's return value ({taskId, taskOutput})."),
     next: union2([string2(), array2(string2()), record2(string2(), string2())]).optional().describe("Next node(s): string for simple chaining, string[] for fan-out to parallel nodes, or record for port-based routing ({pass: 'a', fail: 'b'})"),
     validation: StepValidationConfigSchema.optional(),
     retry: RetryPolicySchema.optional(),

package/dist/{cli-vcgscaan.js → cli-p20r8w42.js}

@@ -22,7 +22,7 @@ import {
   VersionableFieldSchema,
   SessionCostModelBreakdownSchema,
   init_types
-} from "./cli-836ehxmt.js";
+} from "./cli-nc35pxb7.js";
 import {
   generateDefaultClaudeMd2,
   generateDefaultSoulMd2,
@@ -105,7 +105,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-1xsraagq.js";
+} from "./cli-pccfmtb5.js";
 import {
   realtimeBus,
   init_bus
@@ -4837,7 +4837,7 @@ var init_runtime = __esm(() => {
 // src/telemetry-identity.ts
 async function loadUserRole(userId) {
   try {
-    const { getUserGrant } = await import("./rbac-roles-mb470p4e.js");
+    const { getUserGrant } = await import("./rbac-roles-ejxx9b35.js");
     const grant = await getUserGrant(userId);
     const role = grant.grantsAll ? "admin" : "member";
     const user = await getDbClient2().get("SELECT json_extract(metadata, '$.jobFunction') AS jobFunction FROM users WHERE id = ? AND json_valid(metadata)", [userId]);
@@ -8345,7 +8345,7 @@ function validateConfigValue(key, value) {
 function validateExportToEnv(key, exportToEnv) {
   return exportToEnv === true && isEnvExportRestrictedKey(key) ? envExportRestrictedError(key) : null;
 }
-var TEAMS_SDK_ENV_KEYS, RESERVED_KEYS, API_ONLY_CONFIG_KEYS, INTERNAL_CONFIG_KEYS, BOOLEAN_LITERALS, MAX_DB_RETENTION_DAYS = 1e6, DB_RETENTION_TUNING_BOUNDS, APPS_JSON_COLUMN_MAX_BYTES_BOUNDS, validateControllerTokenTtlDays, validateControllerGraceSec, VALIDATED_KEYS;
+var TEAMS_SDK_ENV_KEYS, RESERVED_KEYS, API_ONLY_CONFIG_KEYS, INTERNAL_CONFIG_KEYS, BOOLEAN_LITERALS, MAX_DB_RETENTION_DAYS = 1e6, DB_RETENTION_TUNING_BOUNDS, APPS_JSON_COLUMN_MAX_BYTES_BOUNDS, CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS, validateControllerTokenTtlDays, validateControllerGraceSec, VALIDATED_KEYS;
 var init_swarm_config_guard = __esm(() => {
   init_schema();
   init_telemetry_ranking();
@@ -8388,6 +8388,7 @@ var init_swarm_config_guard = __esm(() => {
     DB_RETENTION_MAX_STATEMENT_MS: { min: 25, max: 5000 }
   };
   APPS_JSON_COLUMN_MAX_BYTES_BOUNDS = { min: 1024, max: 16777216 };
+  CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS = { min: 1, max: 216 };
   validateControllerTokenTtlDays = boundedIntegerValidators(["RUNTIME_CONTROLLER_TOKEN_TTL_DAYS"], 1, 3650).RUNTIME_CONTROLLER_TOKEN_TTL_DAYS;
   validateControllerGraceSec = boundedIntegerValidators(["RUNTIME_CONTROLLER_GRACE_SEC"], 0, 86400).RUNTIME_CONTROLLER_GRACE_SEC;
   VALIDATED_KEYS = {
@@ -8593,6 +8594,7 @@ var init_swarm_config_guard = __esm(() => {
     ], 1),
     ...boundedIntegerValidatorsFor(DB_RETENTION_TUNING_BOUNDS),
     ...boundedIntegerValidators(["APPS_JSON_COLUMN_MAX_BYTES"], APPS_JSON_COLUMN_MAX_BYTES_BOUNDS.min, APPS_JSON_COLUMN_MAX_BYTES_BOUNDS.max),
+    ...boundedIntegerValidators(["CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS"], CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS.min, CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS.max),
     ...boundedIntegerValidators([
       "SESSION_LOG_RETENTION_DAYS",
       "AGENT_LOG_RETENTION_DAYS",
@@ -19085,7 +19087,7 @@ async function loadSecretRegistry() {
     result.failed += 1;
   }
   try {
-    const { loadRuntimeControllerSecrets } = await import("./db-h06dxp05.js");
+    const { loadRuntimeControllerSecrets } = await import("./db-sgd12bt9.js");
     const loaded = await loadRuntimeControllerSecrets();
     result.runtimeController = loaded.count;
     result.failed += loaded.failed;
@@ -27675,4 +27677,4 @@ var init_db3 = __esm(() => {
   };
 });
 
-export { slackContextKey, chatSdkContextKey, chatThreadOfContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, azureDevOpsWorkItemContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, init_catalog, catalog_default, COMPANY_TEAM_SIZES, COMPANY_USE_CASES, USER_FUNCTIONS, init_company_profile, mapTriggerSurface, init_telemetry_context, TELEMETRY_PROXY_ORIGIN, normalizeOrgWebsite, orgLogoUrl, isFilledOrgLogoUrl, init_org_website, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, getCurrentRequestUserId, init_request_auth_context, setTelemetryIngestObserver, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, setTelemetryRoleResolver, setTelemetryFunctionResolver, isTelemetryReady, track, trackRelayed, telemetry, emitIntegrationConnected, init_telemetry, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, assertUrlSafe, parseEgressAllowlist, init_egress_guard, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, isInTransaction, init_db_client, breaksJsonValidity, scrubJsonValue, init_scrub_json, sealJson, init_sealed_json, getPromptTemplateDefaultDrift, init_default_drift, init_templates, init_templates2, isSqliteVecAvailable2, resolveSqliteVecExtensionPath2, __resetSqliteVecExtensionPathCacheForTests2, initDb2, getDb2, closeDb2, getDbClient2, init_runtime, cachedUserRole, cachedUserFunction, configureOrgDomainPersistence, recomputeOrgDomain, scheduleOrgDomainRecompute, init_telemetry_identity, resolveTriggerSurface, emitTaskTelemetry, init_telemetry_trigger, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, isEnvExportRestrictedKey, init_config_env_export, MASKED_SECRET_VALUE, init_config_secrets, HeartbeatExpiryError, init_heartbeat_expiry, isRuntimePoolsEnabled, init_runtime_pools_flag, normalizeDate, normalizeDateRequired, init_date_utils, rowToAgent, updateAgentCredentialState2, updateAgentCredentialMissing2, createAgent2, getAgentById2, EXTENSION_AGENT_ROLE2, NOT_EXTENSION_AGENT_SQL2, isExtensionAgent2, extensionAgentAssignmentError2, ReservedAgentRoleError2, reservedRoleViolation2, ExtensionAgentAssignmentError2, getAllAgents2, getAgentStatusCounts2, getLeadAgent2, updateAgentStatus2, updateAgentMaxTasks2, updateAgentProvider2, setAgentHarnessProvider2, updateAgentCredStatus2, listAgentsWithCredStatusByProvider2, getAgentHarnessProviders2, updateAgentActivity2, MAX_EMPTY_POLLS2, incrementEmptyPollCount2, resetEmptyPollCount2, shouldBlockPolling2, deleteAgent2, getActiveTaskCount2, hasCapacity2, getRemainingCapacity2, updateAgentStatusFromCapacity2, isPoolAffinityEnforcementEnabled2, buildRoutingAffinityFromAgent2, isAgentEligibleForTask2, getAgentDailyTaskCounts2, init_agents, listApprovalRequestSummaries2, getPendingApprovalVoteState2, recordApprovalVotes2, computeContentHash2, createContextVersion2, getLatestContextVersion2, getContextVersion2, getContextVersionHistory2, vcsRepoName, vcsRepoUrlMatches, init_vcs_repo_match, rowToAgentTask, getTaskById2, getChildTasks2, TASK_LINEAGE_LIMITS2, getTaskLineage2, hasNonTerminalResumeChild2, SUPERSEDED_RESUME_REPAIR_WINDOW_MS2, getSupersededTasksWithoutResume2, getSupersededTasksWithUnsettledDependents2, hasNonTerminalRerouteDecisionChild2, getTasksByAgentId2, getAgentCurrentTask2, getTasksByStatus2, findTaskByVcs2, findTaskByGitHub2, readableSessionCondition, getAllTasks2, getTasksCount2, getTaskStats2, getCompletedSlackTasks2, getPendingSlackRelayTasks2, markSlackRelayAttempted2, markSlackRelayDelivered2, markFinalizedSlackRelaysDelivered2, getPendingChatRelayTasks2, giveUpStaleChatRelays2, markChatRelayAttempted2, recordChatRelayError2, markChatRelayDelivered2, markChatRelayGivenUp2, getRecentlyFinishedWorkerTasks2, markTasksNotified2, resetTasksNotified2, getInProgressSlackTasks2, getSlackTasksMissingTree2, getInProgressTasksByContextKey2, isLinearTrackerContextKey2, findExistingLinearTrackerContextWork2, getLatestTaskByContextKey2, getLatestScriptRunStepTaskByContextKey2, getAgentWorkingOnThread2, getLatestActiveTaskInThread2, getLatestLeadTaskInThread2, getAgentWorkingOnContextKey2, getLatestActiveTaskByContextKey2, getLatestLeadTaskByContextKey2, getMostRecentTaskInThread2, findCompletedTaskInThread2, findRecentCancelledTaskInThread2, init_read, MODEL_PROFILE_CONFIG_KEY, listModelProfiles, getModelProfileByName, createModelProfile, updateModelProfile, modelProfileReferences, modelProfileRefError, deleteModelProfile, getAgentDefaultProfileName, repoModelOverrideKeys, taskProfileError, init_model_profiles, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, onTaskStarted, init_task_lifecycle_events, channelTopic, addWorkerSubscription, removeWorkerSubscription, listSubscribedWorkerAgents, init_channels, publishWorkerNudge, init_worker_nudges, createTask2, getPendingTaskForAgent2, assignUnassignedTaskPending2, startTask2, updateTaskClaudeSessionId2, recordTaskProviderIfUnset2, updateTaskTitle2, completeTask2, failTask2, overwriteTerminalTaskResultText2, cancelTask2, supersedeTask2, settleSupersededTaskDependents2, backfillSupersedeTaskResumeTaskId2, pauseTask2, resumeTask2, getPausedTasksForAgent2, getOrphanedInProgressTasksForAgent2, resetOrphanedInProgressTasksForAgent2, getRecentlyCancelledTasksForAgent2, deleteTask2, updateTaskProgress2, getChildWorkflowRunId, getWorkflowRunParent, getWorkflowRunLineage, getSettledChildRunParentSteps, init_workflow_runs, CHAT_SDK_ADAPTER_NAMES, CHAT_SDK_ADAPTER_SCHEMAS, ChatSdkAdaptersDraftSchema, firstIssueText, isAdapterEntryEnabled, init_schema, TELEMETRY_RANKING_KEY, PUBLIC_RANKING_ENABLED_KEY, RANKING_CATEGORIES, readTelemetryRanking, rankingFormSchema, buildListing, init_telemetry_ranking, resolveQuickJSPoolSize, init_quickjs_pool_config, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, completedStatusIcon, init_reaction_shortcode, API_DRAINING_HEADER, API_DRAIN_MAX_MS_LIMIT, isApiDrainingResponse, init_api_drain, parseEnabledTools, init_enabled_tools, parseTaskToolManifest, CHAT_TASK_ONLY_TOOLS, isChatSdkTask, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isApiOnlyConfigKey, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, APPS_JSON_COLUMN_MAX_BYTES_BOUNDS, validateRuntimeTokenTtlHours, validateControllerTokenTtlDays, validateControllerGraceSec, validateConfigValue, validateExportToEnv, init_swarm_config_guard, getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, init_oauth, OpenAI2, init_openai, CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, LONGTERM_ROOT, MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE, MEMORY_KEY_MAX_LENGTH, isLongtermKey, longtermKeyError, isConsolidatedKey, consolidatedKeyMessage, resolveStoreKey, init_key_paths, computeScore, rerank, init_reranker, rowToCandidate, init_sqlite_store, getEmbeddingProvider2, resetEmbeddingProvider2, getMemoryStore2, init_memory, embeddingProvider, embedScript, searchScripts, reembedAllScripts, init_embeddings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, init_db2, oauthSecretName, registerStoredSecret, loadSecretRegistry, init_secret_registry, STEERING_MOVED_ERROR, SteeringRequestError, isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, carryUnhandledSteering, requestSteering, init_steering, WorkflowReplayStateError, init_workflow_replay, SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS2, refreshActiveSessionOnActivity2, getActiveSessionById, init_active_sessions, recordKeySeatMismatch2, getScriptRunExecutionArgs2, getSlackRenderV2ActivatedAt2, ensureSlackRenderV2Activation2, getSlackDelegationActivatedAt2, ensureSlackDelegationActivation2, isPendingSlackMessage2, isSettledSlackMessage2, recordSlackMessage2, reserveSlackMessage2, bindSlackMessageTimestamp2, updateSlackMessageRecord2, markSlackTreeRendered2, deleteSlackMessageRecord2, getSlackTreeMessage2, getSlackTreeMessageByThread2, getSlackOutcomeMessage2, getResolvableDeferralOutcomes2, markSlackDeferralResolved2, noteSlackOutcomeDeliveryFailure2, abandonSlackOutcomeDelivery2, getSlackTreeMessages2, getSlackMessageByChannelTs2, getSlackTasksInThread2, listSlackThreadsAwaitingHuman2, isSlackThreadAwaitingHuman2, markTaskSlackReplySent2, setSlackMessageTracking2, updateTaskVcs2, insertTaskAttachment2, recordTaskPullRequestAttachments2, getAssetKeyMappingByProvider2, upsertAssetKeyMapping2, getAssetKeyMapping2, listAssetSummaries2, moveAssetKey2, deleteTaskAttachment2, replaceTaskAttachment2, getTaskAttachments2, createSteeringMessage2, getSteeringMessagesForTask2, getSteeringMessageById2, getPendingSteeringForTask2, getPendingSteeringForAgent2, markSteeringDelivered2, markSteeringHandled2, markSteeringPromoted2, cancelPendingSteeringForTask2, hasPendingSteering2, getAgentWithTasks2, getAllAgentsWithTasks2, createLogEntry2, getLogsByAgentId2, getLogsByTaskId2, getLogsByTaskIdAndEventType2, getLogsByTaskIdChronological2, getLogsByEventType2, getAllLogs2, findRecentSimilarTasks2, createTaskExtended2, claimTask2, releaseTask2, acceptTask2, rejectTask2, moveTaskToBacklog2, moveTaskFromBacklog2, promoteDraftTask2, refreshDraftTaskLease2, promoteAbandonedDraftTasks2, releaseStaleReviewingTasks2, releaseStaleOfferedTasksForOfflineAgents2, getOfferedTasksForAgent2, claimOfferedTask2, getUnassignedTasksCount2, getUnassignedTaskIds2, getUnassignedTaskIdsForAgent2, checkDependencies2, getDependentTasks2, cascadeFailDependents2, updateAgentProfile2, updateAgentName2, createChannel2, getMessageById2, getChannelById2, getChannelByName2, getAllChannels2, deleteChannel2, postMessage2, getChannelMessages2, updateReadState2, getLastReadAt2, getUnreadMessages2, getMentionsForAgent2, getInboxSummary2, claimMentions2, releaseMentionProcessing2, releaseStaleMentionProcessing2, createService2, getServiceById2, getServiceByAgentAndName2, getServicesByAgentId2, getAllServices2, updateServiceStatus2, deleteService2, upsertService2, deleteServicesByAgentId2, createSessionLogs2, getSessionLogsByTaskId2, getSessionLogsBySession2, createSessionCost2, getSessionCostsByTaskId2, getSessionCostsByAgentId2, getAllSessionCosts2, getSessionCostsFiltered2, UNATTRIBUTED_USER_ID2, getSessionCostSummary2, getAttributionByPerson2, getDashboardCostSummary2, createInboxMessage2, getInboxMessageById2, getUnreadInboxMessages2, claimInboxMessages2, markInboxMessageRead2, markInboxMessageResponded2, markInboxMessageDelegated2, releaseStaleProcessingInbox2, getConcurrentContext2, getScheduledTasks2, getScheduledTaskById2, getScheduledTaskByName2, createScheduledTask2, updateScheduledTask2, deleteScheduledTask2, getDueScheduledTasks2, autoEncryptLegacyPlaintextSecrets2, maskSecrets2, getSwarmConfigs2, getInjectableGlobalConfigs2, getSwarmConfigById2, getSwarmConfigLookupById2, upsertSwarmConfig2, emitBuiltInIntegrationConnectedOnce2, deleteSwarmConfig2, deleteSwarmConfigByKey2, getResolvedConfig2, getSwarmRepos2, getSwarmRepoById2, getSwarmRepoByName2, getSwarmRepoByUrl2, createSwarmRepo2, updateSwarmRepo2, deleteSwarmRepo2, getAgentMailInboxMapping2, getAgentMailInboxMappingsByAgent2, getAllAgentMailInboxMappings2, createAgentMailInboxMapping2, deleteAgentMailInboxMapping2, findTaskByAgentMailThread2, insertActiveSession2, deleteActiveSession2, deleteActiveSessionById2, getActiveSessions2, heartbeatActiveSession2, cleanupStaleSessions2, cleanupAgentSessions2, updateActiveSessionProviderSessionId2, getActiveSessionForTask2, reassociateSessionLogs2, getStalledInProgressTasks2, getStalePinnedResumes2, failPendingResumeIfUnclaimed2, getIdleWorkersWithCapacity2, getUnassignedPoolTasks2, getStaleUnassignedAffinityTasks2, getRecentFailedTasks2, getRecentCompletedCount2, getRecentFailedCount2, createWorkflow2, getWorkflow2, listWorkflows2, updateWorkflow2, deleteWorkflow2, getWorkflowsByScheduleId2, createWorkflowRun2, getWorkflowRun2, updateWorkflowRun2, listWorkflowRuns2, countWorkflowRuns2, listWorkflowRunsPage2, createWorkflowRunStep2, getWorkflowRunStep2, updateWorkflowRunStep2, getWorkflowRunStepsByRunId2, getStuckWorkflowRuns2, getLastSuccessfulRun2, getLastRunStart2, getRetryableSteps2, getCompletedStepNodeIds2, getTaskByWorkflowRunStepId2, detachTaskFromWorkflowRunStep2, getStepByIdempotencyKey2, getStepCountForNode2, getLatestStepForNode2, getCurrentStepForNode2, createWorkflowVersion2, getWorkflowVersions2, getWorkflowVersion2, createAppVersion2, getAppVersions2, getAppVersion2, createPage2, getPage2, getPageBySlug2, getLatestPageBySlug2, listPagesByAgent2, listAllPages2, countAllPages2, countPagesByAgent2, updatePage2, deletePage2, incrementPageViewCount2, createPageVersion2, getPageVersions2, getPageVersion2, createMetric2, getMetric2, getMetricBySlug2, listMetricsByAgent2, listAllMetrics2, countAllMetrics2, countMetricsByAgent2, updateMetric2, deleteMetric2, createMetricVersion2, getMetricVersions2, getMetricVersion2, getPromptTemplates2, getPromptTemplateById2, upsertPromptTemplate2, deletePromptTemplate2, resetPromptTemplateToDefault2, getPromptTemplateHistory2, resolvePromptTemplate2, checkoutPromptTemplate2, getAllChannelActivityCursors2, getChannelActivityCursor2, upsertChannelActivityCursor2, createApprovalRequest2, getApprovalRequestById2, resolveApprovalRequest2, cancelApprovalRequestById2, cancelPendingApprovalRequestsForRun2, listCancelledApprovalRequestsForRun2, listCancelledApprovalRequestsForStep2, claimApprovalCancellationNotification2, completeApprovalCancellationNotificationClaim2, releaseApprovalCancellationNotificationClaim2, updateApprovalRequestNotifications2, listApprovalRequests2, getStuckApprovalRuns2, getApprovalRequestByStepId2, getExpiredPendingApprovals2, getStaleApprovalRequests2, createWaitState2, getWaitStateById2, getWaitStateByStepId2, getDueWaitStates2, getPendingEventWaitNames2, getPendingWaitsByEvent2, resolveWaitState2, getStuckWaitRuns2, SKILL_FILE_LIMITS2, normalizeSkillFilePath2, createSkill2, updateSkill2, listSkillFileManifest2, getSkillFiles2, getSkillFile2, upsertSkillFile2, upsertSkillFiles2, deleteSkillFile2, deleteSkill2, getSkillById2, getSkillByName2, listSkills2, searchSkills2, installSkill2, getSystemDefaultSkills2, installSystemDefaultSkillsForAgent2, uninstallSkill2, getAgentSkills2, toggleAgentSkill2, createMcpServer2, emitMcpServerConnectedTelemetry2, updateMcpServer2, deleteMcpServer2, getMcpServerById2, getMcpServerByName2, listMcpServers2, installMcpServer2, uninstallMcpServer2, getAgentMcpServers2, createContextSnapshot2, getContextSnapshotsByTaskId2, getContextSnapshotsBySessionId2, getContextSummaryByTaskId2, getAvailableKeyIndices2, recordKeyUsage2, setApiKeyPlan2, markKeyRateLimited2, recordKeyAuthFailure2, recordKeyRateLimitWindows2, setApiKeyName2, clearKeyRateLimit2, getKeyStatuses2, getKeyCostSummary2, getUserById2, getAllUsers2, createUser2, updateUser2, deleteUser2, listInboxState2, upsertInboxState2, listFavorites2, listUserFavorites2, getFavoriteItemIdSet2, setFavorite2, setUserFavorite2, withFavoriteFlags2, listTaskTemplates2, getRootTaskChain2, listRecentSessions2, countSessions2, getBudget2, getBudgets2, upsertBudget2, deleteBudget2, getAllPricingRows2, getPricingRows2, getActivePricingRow2, insertPricingRow2, deletePricingRow2, getDailySpendForAgent2, getDailySpendGlobal2, getDailySpendForUser2, recordBudgetRefusalNotification2, getBudgetRefusalNotification2, getRecentBudgetRefusalNotifications2, hasBudgetRefusalNotificationToday2, setBudgetRefusalFollowUpTaskId2, getLiveAgentCounts2, getReadyAgentCounts2, getInstanceActivity2, getSwarmMetrics2, hasFirstCompletedTask2, getKv2, sweepExpiredKv2, sweepExpiredKvPrefix2, upsertKv2, claimKv2, deleteKv2, KvTypeCollisionError2, incrKv2, kvPrefixUpperBound2, listKv2, countKv2, createScriptRun2, recordInlineScriptRun2, getScriptRun2, getScriptRunByIdempotencyKey2, listScriptRuns2, countScriptRuns2, countActiveScriptRuns2, updateScriptRun2, updateScriptRunIfNotTerminal2, updateScriptRunIfRunning2, getRunningScriptRuns2, getScriptRunJournalStep2, upsertScriptRunJournalStep2, listScriptRunJournalSteps2, countScriptRunJournalSteps2, countScriptRunJournalAgentTaskSteps2, exports_db, init_db3 };
+export { slackContextKey, chatSdkContextKey, chatThreadOfContextKey, agentmailContextKey, githubContextKey, gitlabContextKey, azureDevOpsContextKey, azureDevOpsWorkItemContextKey, linearContextKey, buildJiraContextKey, scheduleContextKey, workflowContextKey, agentContextKey, pageContextKey, init_context_key, checkSlackRoutingCoherence, init_slack_routing, init_catalog, catalog_default, COMPANY_TEAM_SIZES, COMPANY_USE_CASES, USER_FUNCTIONS, init_company_profile, mapTriggerSurface, init_telemetry_context, TELEMETRY_PROXY_ORIGIN, normalizeOrgWebsite, orgLogoUrl, isFilledOrgLogoUrl, init_org_website, beginRequestAuthScope, setRequestAuth, getRequestAuth, getCurrentRequestAuth, runWithoutRequestAuth, getCurrentRequestUserId, init_request_auth_context, setTelemetryIngestObserver, isTelemetryEnabled, _resolveIntegrationType, _resolveIntegrationProvider, initTelemetry, setTelemetryRoleResolver, setTelemetryFunctionResolver, isTelemetryReady, track, trackRelayed, telemetry, emitIntegrationConnected, init_telemetry, auditAssetKeys, init_asset_key_audit, CredentialBindingSchema, placeholderForConfigKey, CredentialBroker, DEFAULT_CREDENTIAL_BINDINGS, assertUrlSafe, parseEgressAllowlist, init_egress_guard, init_credential_broker, encryptSecret, decryptSecret, getEncryptionKey, init_crypto, isInTransaction, init_db_client, breaksJsonValidity, scrubJsonValue, init_scrub_json, sealJson, init_sealed_json, getPromptTemplateDefaultDrift, init_default_drift, init_templates, init_templates2, isSqliteVecAvailable2, resolveSqliteVecExtensionPath2, __resetSqliteVecExtensionPathCacheForTests2, initDb2, getDb2, closeDb2, getDbClient2, init_runtime, cachedUserRole, cachedUserFunction, configureOrgDomainPersistence, recomputeOrgDomain, scheduleOrgDomainRecompute, init_telemetry_identity, resolveTriggerSurface, emitTaskTelemetry, init_telemetry_trigger, CODEX_AUTH_WATCH_NAMESPACE, codexAuthBenchMarkerKey, isCodexAuthFailureReason, init_codex_auth_failure, isEnvExportRestrictedKey, init_config_env_export, MASKED_SECRET_VALUE, init_config_secrets, HeartbeatExpiryError, init_heartbeat_expiry, isRuntimePoolsEnabled, init_runtime_pools_flag, normalizeDate, normalizeDateRequired, init_date_utils, rowToAgent, updateAgentCredentialState2, updateAgentCredentialMissing2, createAgent2, getAgentById2, EXTENSION_AGENT_ROLE2, NOT_EXTENSION_AGENT_SQL2, isExtensionAgent2, extensionAgentAssignmentError2, ReservedAgentRoleError2, reservedRoleViolation2, ExtensionAgentAssignmentError2, getAllAgents2, getAgentStatusCounts2, getLeadAgent2, updateAgentStatus2, updateAgentMaxTasks2, updateAgentProvider2, setAgentHarnessProvider2, updateAgentCredStatus2, listAgentsWithCredStatusByProvider2, getAgentHarnessProviders2, updateAgentActivity2, MAX_EMPTY_POLLS2, incrementEmptyPollCount2, resetEmptyPollCount2, shouldBlockPolling2, deleteAgent2, getActiveTaskCount2, hasCapacity2, getRemainingCapacity2, updateAgentStatusFromCapacity2, isPoolAffinityEnforcementEnabled2, buildRoutingAffinityFromAgent2, isAgentEligibleForTask2, getAgentDailyTaskCounts2, init_agents, listApprovalRequestSummaries2, getPendingApprovalVoteState2, recordApprovalVotes2, computeContentHash2, createContextVersion2, getLatestContextVersion2, getContextVersion2, getContextVersionHistory2, vcsRepoName, vcsRepoUrlMatches, init_vcs_repo_match, rowToAgentTask, getTaskById2, getChildTasks2, TASK_LINEAGE_LIMITS2, getTaskLineage2, hasNonTerminalResumeChild2, SUPERSEDED_RESUME_REPAIR_WINDOW_MS2, getSupersededTasksWithoutResume2, getSupersededTasksWithUnsettledDependents2, hasNonTerminalRerouteDecisionChild2, getTasksByAgentId2, getAgentCurrentTask2, getTasksByStatus2, findTaskByVcs2, findTaskByGitHub2, readableSessionCondition, getAllTasks2, getTasksCount2, getTaskStats2, getCompletedSlackTasks2, getPendingSlackRelayTasks2, markSlackRelayAttempted2, markSlackRelayDelivered2, markFinalizedSlackRelaysDelivered2, getPendingChatRelayTasks2, giveUpStaleChatRelays2, markChatRelayAttempted2, recordChatRelayError2, markChatRelayDelivered2, markChatRelayGivenUp2, getRecentlyFinishedWorkerTasks2, markTasksNotified2, resetTasksNotified2, getInProgressSlackTasks2, getSlackTasksMissingTree2, getInProgressTasksByContextKey2, isLinearTrackerContextKey2, findExistingLinearTrackerContextWork2, getLatestTaskByContextKey2, getLatestScriptRunStepTaskByContextKey2, getAgentWorkingOnThread2, getLatestActiveTaskInThread2, getLatestLeadTaskInThread2, getAgentWorkingOnContextKey2, getLatestActiveTaskByContextKey2, getLatestLeadTaskByContextKey2, getMostRecentTaskInThread2, findCompletedTaskInThread2, findRecentCancelledTaskInThread2, init_read, MODEL_PROFILE_CONFIG_KEY, listModelProfiles, getModelProfileByName, createModelProfile, updateModelProfile, modelProfileReferences, modelProfileRefError, deleteModelProfile, getAgentDefaultProfileName, repoModelOverrideKeys, taskProfileError, init_model_profiles, setHumanFreeQueueListener, drainHumanFreeReclassifyQueue, init_human_free, onTaskStarted, init_task_lifecycle_events, channelTopic, addWorkerSubscription, removeWorkerSubscription, listSubscribedWorkerAgents, init_channels, publishWorkerNudge, init_worker_nudges, createTask2, getPendingTaskForAgent2, assignUnassignedTaskPending2, startTask2, updateTaskClaudeSessionId2, recordTaskProviderIfUnset2, updateTaskTitle2, completeTask2, failTask2, overwriteTerminalTaskResultText2, cancelTask2, supersedeTask2, settleSupersededTaskDependents2, backfillSupersedeTaskResumeTaskId2, pauseTask2, resumeTask2, getPausedTasksForAgent2, getOrphanedInProgressTasksForAgent2, resetOrphanedInProgressTasksForAgent2, getRecentlyCancelledTasksForAgent2, deleteTask2, updateTaskProgress2, getChildWorkflowRunId, getWorkflowRunParent, getWorkflowRunLineage, getSettledChildRunParentSteps, init_workflow_runs, CHAT_SDK_ADAPTER_NAMES, CHAT_SDK_ADAPTER_SCHEMAS, ChatSdkAdaptersDraftSchema, firstIssueText, isAdapterEntryEnabled, init_schema, TELEMETRY_RANKING_KEY, PUBLIC_RANKING_ENABLED_KEY, RANKING_CATEGORIES, readTelemetryRanking, rankingFormSchema, buildListing, init_telemetry_ranking, resolveQuickJSPoolSize, init_quickjs_pool_config, SLACK_REACTION_DEFAULTS, SLACK_REACTION_CONFIG_KEYS, reactionName, completedStatusIcon, init_reaction_shortcode, API_DRAINING_HEADER, API_DRAIN_MAX_MS_LIMIT, isApiDrainingResponse, init_api_drain, parseEnabledTools, init_enabled_tools, parseTaskToolManifest, CHAT_TASK_ONLY_TOOLS, isChatSdkTask, selectTaskTools, init_task_tool_manifest, tierConfigKey, init_model_tier_keys, isApiOnlyConfigKey, isInternalConfigKey, internalConfigKeyError, isReservedConfigKey, reservedKeyError, MAX_DB_RETENTION_DAYS, DB_RETENTION_TUNING_BOUNDS, APPS_JSON_COLUMN_MAX_BYTES_BOUNDS, CODEX_OAUTH_KEEP_WARM_MAX_AGE_HOURS_BOUNDS, validateRuntimeTokenTtlHours, validateControllerTokenTtlDays, validateControllerGraceSec, validateConfigValue, validateExportToEnv, init_swarm_config_guard, getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, createOAuthPending, consumeOAuthPending, gcOAuthPending, markAuthorizationRefreshFailed, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, init_oauth, OpenAI2, init_openai, CANDIDATE_SET_MULTIPLIER, isGraphExpansionEnabled, EMBEDDING_DIMENSIONS, init_constants, LONGTERM_ROOT, MEMORY_KEY_PATTERN, MEMORY_KEY_PATTERN_MESSAGE, MEMORY_KEY_MAX_LENGTH, isLongtermKey, longtermKeyError, isConsolidatedKey, consolidatedKeyMessage, resolveStoreKey, init_key_paths, computeScore, rerank, init_reranker, rowToCandidate, init_sqlite_store, getEmbeddingProvider2, resetEmbeddingProvider2, getMemoryStore2, init_memory, embeddingProvider, embedScript, searchScripts, reembedAllScripts, init_embeddings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, init_db2, oauthSecretName, registerStoredSecret, loadSecretRegistry, init_secret_registry, STEERING_MOVED_ERROR, SteeringRequestError, isSteeringEnabled, getTaskSteeringFields, getTaskSteeringFieldsForTasks, promotePendingSteeringForTask, markSteeringUndeliverable, carryUnhandledSteering, requestSteering, init_steering, WorkflowReplayStateError, init_workflow_replay, SESSION_ACTIVITY_REFRESH_MIN_INTERVAL_MS2, refreshActiveSessionOnActivity2, getActiveSessionById, init_active_sessions, recordKeySeatMismatch2, getScriptRunExecutionArgs2, getSlackRenderV2ActivatedAt2, ensureSlackRenderV2Activation2, getSlackDelegationActivatedAt2, ensureSlackDelegationActivation2, isPendingSlackMessage2, isSettledSlackMessage2, recordSlackMessage2, reserveSlackMessage2, bindSlackMessageTimestamp2, updateSlackMessageRecord2, markSlackTreeRendered2, deleteSlackMessageRecord2, getSlackTreeMessage2, getSlackTreeMessageByThread2, getSlackOutcomeMessage2, getResolvableDeferralOutcomes2, markSlackDeferralResolved2, noteSlackOutcomeDeliveryFailure2, abandonSlackOutcomeDelivery2, getSlackTreeMessages2, getSlackMessageByChannelTs2, getSlackTasksInThread2, listSlackThreadsAwaitingHuman2, isSlackThreadAwaitingHuman2, markTaskSlackReplySent2, setSlackMessageTracking2, updateTaskVcs2, insertTaskAttachment2, recordTaskPullRequestAttachments2, getAssetKeyMappingByProvider2, upsertAssetKeyMapping2, getAssetKeyMapping2, listAssetSummaries2, moveAssetKey2, deleteTaskAttachment2, replaceTaskAttachment2, getTaskAttachments2, createSteeringMessage2, getSteeringMessagesForTask2, getSteeringMessageById2, getPendingSteeringForTask2, getPendingSteeringForAgent2, markSteeringDelivered2, markSteeringHandled2, markSteeringPromoted2, cancelPendingSteeringForTask2, hasPendingSteering2, getAgentWithTasks2, getAllAgentsWithTasks2, createLogEntry2, getLogsByAgentId2, getLogsByTaskId2, getLogsByTaskIdAndEventType2, getLogsByTaskIdChronological2, getLogsByEventType2, getAllLogs2, findRecentSimilarTasks2, createTaskExtended2, claimTask2, releaseTask2, acceptTask2, rejectTask2, moveTaskToBacklog2, moveTaskFromBacklog2, promoteDraftTask2, refreshDraftTaskLease2, promoteAbandonedDraftTasks2, releaseStaleReviewingTasks2, releaseStaleOfferedTasksForOfflineAgents2, getOfferedTasksForAgent2, claimOfferedTask2, getUnassignedTasksCount2, getUnassignedTaskIds2, getUnassignedTaskIdsForAgent2, checkDependencies2, getDependentTasks2, cascadeFailDependents2, updateAgentProfile2, updateAgentName2, createChannel2, getMessageById2, getChannelById2, getChannelByName2, getAllChannels2, deleteChannel2, postMessage2, getChannelMessages2, updateReadState2, getLastReadAt2, getUnreadMessages2, getMentionsForAgent2, getInboxSummary2, claimMentions2, releaseMentionProcessing2, releaseStaleMentionProcessing2, createService2, getServiceById2, getServiceByAgentAndName2, getServicesByAgentId2, getAllServices2, updateServiceStatus2, deleteService2, upsertService2, deleteServicesByAgentId2, createSessionLogs2, getSessionLogsByTaskId2, getSessionLogsBySession2, createSessionCost2, getSessionCostsByTaskId2, getSessionCostsByAgentId2, getAllSessionCosts2, getSessionCostsFiltered2, UNATTRIBUTED_USER_ID2, getSessionCostSummary2, getAttributionByPerson2, getDashboardCostSummary2, createInboxMessage2, getInboxMessageById2, getUnreadInboxMessages2, claimInboxMessages2, markInboxMessageRead2, markInboxMessageResponded2, markInboxMessageDelegated2, releaseStaleProcessingInbox2, getConcurrentContext2, getScheduledTasks2, getScheduledTaskById2, getScheduledTaskByName2, createScheduledTask2, updateScheduledTask2, deleteScheduledTask2, getDueScheduledTasks2, autoEncryptLegacyPlaintextSecrets2, maskSecrets2, getSwarmConfigs2, getInjectableGlobalConfigs2, getSwarmConfigById2, getSwarmConfigLookupById2, upsertSwarmConfig2, emitBuiltInIntegrationConnectedOnce2, deleteSwarmConfig2, deleteSwarmConfigByKey2, getResolvedConfig2, getSwarmRepos2, getSwarmRepoById2, getSwarmRepoByName2, getSwarmRepoByUrl2, createSwarmRepo2, updateSwarmRepo2, deleteSwarmRepo2, getAgentMailInboxMapping2, getAgentMailInboxMappingsByAgent2, getAllAgentMailInboxMappings2, createAgentMailInboxMapping2, deleteAgentMailInboxMapping2, findTaskByAgentMailThread2, insertActiveSession2, deleteActiveSession2, deleteActiveSessionById2, getActiveSessions2, heartbeatActiveSession2, cleanupStaleSessions2, cleanupAgentSessions2, updateActiveSessionProviderSessionId2, getActiveSessionForTask2, reassociateSessionLogs2, getStalledInProgressTasks2, getStalePinnedResumes2, failPendingResumeIfUnclaimed2, getIdleWorkersWithCapacity2, getUnassignedPoolTasks2, getStaleUnassignedAffinityTasks2, getRecentFailedTasks2, getRecentCompletedCount2, getRecentFailedCount2, createWorkflow2, getWorkflow2, listWorkflows2, updateWorkflow2, deleteWorkflow2, getWorkflowsByScheduleId2, createWorkflowRun2, getWorkflowRun2, updateWorkflowRun2, listWorkflowRuns2, countWorkflowRuns2, listWorkflowRunsPage2, createWorkflowRunStep2, getWorkflowRunStep2, updateWorkflowRunStep2, getWorkflowRunStepsByRunId2, getStuckWorkflowRuns2, getLastSuccessfulRun2, getLastRunStart2, getRetryableSteps2, getCompletedStepNodeIds2, getTaskByWorkflowRunStepId2, detachTaskFromWorkflowRunStep2, getStepByIdempotencyKey2, getStepCountForNode2, getLatestStepForNode2, getCurrentStepForNode2, createWorkflowVersion2, getWorkflowVersions2, getWorkflowVersion2, createAppVersion2, getAppVersions2, getAppVersion2, createPage2, getPage2, getPageBySlug2, getLatestPageBySlug2, listPagesByAgent2, listAllPages2, countAllPages2, countPagesByAgent2, updatePage2, deletePage2, incrementPageViewCount2, createPageVersion2, getPageVersions2, getPageVersion2, createMetric2, getMetric2, getMetricBySlug2, listMetricsByAgent2, listAllMetrics2, countAllMetrics2, countMetricsByAgent2, updateMetric2, deleteMetric2, createMetricVersion2, getMetricVersions2, getMetricVersion2, getPromptTemplates2, getPromptTemplateById2, upsertPromptTemplate2, deletePromptTemplate2, resetPromptTemplateToDefault2, getPromptTemplateHistory2, resolvePromptTemplate2, checkoutPromptTemplate2, getAllChannelActivityCursors2, getChannelActivityCursor2, upsertChannelActivityCursor2, createApprovalRequest2, getApprovalRequestById2, resolveApprovalRequest2, cancelApprovalRequestById2, cancelPendingApprovalRequestsForRun2, listCancelledApprovalRequestsForRun2, listCancelledApprovalRequestsForStep2, claimApprovalCancellationNotification2, completeApprovalCancellationNotificationClaim2, releaseApprovalCancellationNotificationClaim2, updateApprovalRequestNotifications2, listApprovalRequests2, getStuckApprovalRuns2, getApprovalRequestByStepId2, getExpiredPendingApprovals2, getStaleApprovalRequests2, createWaitState2, getWaitStateById2, getWaitStateByStepId2, getDueWaitStates2, getPendingEventWaitNames2, getPendingWaitsByEvent2, resolveWaitState2, getStuckWaitRuns2, SKILL_FILE_LIMITS2, normalizeSkillFilePath2, createSkill2, updateSkill2, listSkillFileManifest2, getSkillFiles2, getSkillFile2, upsertSkillFile2, upsertSkillFiles2, deleteSkillFile2, deleteSkill2, getSkillById2, getSkillByName2, listSkills2, searchSkills2, installSkill2, getSystemDefaultSkills2, installSystemDefaultSkillsForAgent2, uninstallSkill2, getAgentSkills2, toggleAgentSkill2, createMcpServer2, emitMcpServerConnectedTelemetry2, updateMcpServer2, deleteMcpServer2, getMcpServerById2, getMcpServerByName2, listMcpServers2, installMcpServer2, uninstallMcpServer2, getAgentMcpServers2, createContextSnapshot2, getContextSnapshotsByTaskId2, getContextSnapshotsBySessionId2, getContextSummaryByTaskId2, getAvailableKeyIndices2, recordKeyUsage2, setApiKeyPlan2, markKeyRateLimited2, recordKeyAuthFailure2, recordKeyRateLimitWindows2, setApiKeyName2, clearKeyRateLimit2, getKeyStatuses2, getKeyCostSummary2, getUserById2, getAllUsers2, createUser2, updateUser2, deleteUser2, listInboxState2, upsertInboxState2, listFavorites2, listUserFavorites2, getFavoriteItemIdSet2, setFavorite2, setUserFavorite2, withFavoriteFlags2, listTaskTemplates2, getRootTaskChain2, listRecentSessions2, countSessions2, getBudget2, getBudgets2, upsertBudget2, deleteBudget2, getAllPricingRows2, getPricingRows2, getActivePricingRow2, insertPricingRow2, deletePricingRow2, getDailySpendForAgent2, getDailySpendGlobal2, getDailySpendForUser2, recordBudgetRefusalNotification2, getBudgetRefusalNotification2, getRecentBudgetRefusalNotifications2, hasBudgetRefusalNotificationToday2, setBudgetRefusalFollowUpTaskId2, getLiveAgentCounts2, getReadyAgentCounts2, getInstanceActivity2, getSwarmMetrics2, hasFirstCompletedTask2, getKv2, sweepExpiredKv2, sweepExpiredKvPrefix2, upsertKv2, claimKv2, deleteKv2, KvTypeCollisionError2, incrKv2, kvPrefixUpperBound2, listKv2, countKv2, createScriptRun2, recordInlineScriptRun2, getScriptRun2, getScriptRunByIdempotencyKey2, listScriptRuns2, countScriptRuns2, countActiveScriptRuns2, updateScriptRun2, updateScriptRunIfNotTerminal2, updateScriptRunIfRunning2, getRunningScriptRuns2, getScriptRunJournalStep2, upsertScriptRunJournalStep2, listScriptRunJournalSteps2, countScriptRunJournalSteps2, countScriptRunJournalAgentTaskSteps2, exports_db, init_db3 };

package/dist/{cli-1xsraagq.js → cli-pccfmtb5.js}

@@ -7,7 +7,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@desplega.ai/agent-swarm",
-    version: "2.4.3",
+    version: "2.4.4",
     description: "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
     keywords: [
       "agent-swarm.dev",
@@ -186,8 +186,8 @@ var init_package = __esm(() => {
       "@desplega/model-catalog": "workspace:*",
       "@desplega/model-routing": "workspace:*",
       "@faker-js/faker": "^10.4.0",
-      "@opencode/plugin": "2.0.32",
-      "@opencode/sdk": "2.0.32",
+      "@opencode/plugin": "2.1.1",
+      "@opencode/sdk": "2.1.1",
       "@oxlint/plugins": "1.78.0",
       "@types/bun": "latest",
       "dependency-cruiser": "^18.0.0",
@@ -205,7 +205,7 @@ var init_package = __esm(() => {
       bun: ">=1.3.12"
     },
     dependencies: {
-      "@agentclientprotocol/sdk": "1.9.0",
+      "@agentclientprotocol/sdk": "2.0.0",
       "@ai-sdk/openai": "^3.0.41",
       "@anthropic-ai/claude-agent-sdk": "0.3.304",
       "@anthropic-ai/sdk": "^0.135.0",