@desplega.ai/agent-swarm 2.5.3 → 2.5.4

package/dist/{http-mxcqhhcs.js → http-tkp7d4kb.js}

@@ -289,7 +289,7 @@ import {
   hasCapability,
   getEnabledCapabilities,
   createServer
-} from "./cli-aecdcr77.js";
+} from "./cli-asq5ydm4.js";
 import {
   chatThreadOfContextKey,
   agentContextKey,
@@ -440,6 +440,12 @@ import {
   getPausedTasksForAgent2,
   resetOrphanedInProgressTasksForAgent2,
   updateTaskProgress2,
+  IdempotencyKeyTakenError,
+  workflowRequestFingerprint,
+  findAcceptedWorkflowOperation,
+  assertWorkflowIdempotencyKeyUnused,
+  recordAcceptedWorkflowOperation,
+  init_workflow_idempotency,
   getWorkflowRunParent,
   init_workflow_runs,
   CHAT_SDK_ADAPTER_NAMES,
@@ -737,7 +743,7 @@ import {
   countScriptRunJournalSteps2,
   countScriptRunJournalAgentTaskSteps2,
   init_db3
-} from "./cli-kxawjrxg.js";
+} from "./cli-jb30dzvk.js";
 import {
   PRIMARY_ROLE_NAMES2,
   getUserGrant2,
@@ -748,22 +754,26 @@ import {
   assertNotLastAdmin2,
   setUserRoles2,
   init_rbac_roles
-} from "./cli-99xgw26r.js";
-import"./cli-210xd1f4.js";
+} from "./cli-ff1tm9n9.js";
+import"./cli-c61mbdds.js";
 import {
   normalizeModelKey
-} from "./cli-fsdprwrg.js";
+} from "./cli-sbwsxvtd.js";
 import {
   upsertModelCatalogOverlay,
   deleteModelCatalogOverlay,
   loadModelsCatalog,
   requestModelCatalogRefresh2
-} from "./cli-n45mr7zh.js";
+} from "./cli-bvpgr9ny.js";
 import {
   AMP_ESTIMATE_MODELS,
   ampBillsCacheWrites,
   resolveAmpModel
 } from "./cli-9s05422w.js";
+import {
+  workflowEventBus2,
+  init_event_bus
+} from "./cli-dabehxhp.js";
 import {
   automationIntegrationFixUrl,
   preflightAutomation,
@@ -799,7 +809,7 @@ import {
   generateEdges,
   definitionNodeIds,
   validateDefinition
-} from "./cli-jjznk3f7.js";
+} from "./cli-gbfxp48k.js";
 import {
   require_dist2,
   isInvalidClientError,
@@ -879,14 +889,14 @@ import {
   typecheckWithAmbient,
   typecheckScript,
   parseSkillContent
-} from "./cli-p9rafdrb.js";
+} from "./cli-7p4jxgtt.js";
 import {
   buildAuthorizationUrl,
   exchangeAuthorizationCode,
   oauthAppRowToProviderConfig,
   forceRefreshAuthorizationOrThrow,
   forceRefreshTokenOrThrow
-} from "./cli-egjggehm.js";
+} from "./cli-tsma7p8v.js";
 import {
   signalProcessGroup,
   detachedProcessGroup,
@@ -917,8 +927,8 @@ import {
   getSlackApp2,
   startSlackApp2,
   stopSlackApp2
-} from "./cli-ce0ak9ms.js";
-import"./cli-s53vp709.js";
+} from "./cli-abs8ndtr.js";
+import"./cli-eftzyh9y.js";
 import"./cli-qqzmjxkf.js";
 import {
   _fetchHolder,
@@ -931,14 +941,10 @@ import {
   loadAllCodexOAuthSlots,
   getValidCodexOAuth
 } from "./cli-kxpfx2xr.js";
-import {
-  workflowEventBus2,
-  init_event_bus
-} from "./cli-dabehxhp.js";
 import {
   retryFailedRun2,
   cancelWorkflowRun2
-} from "./cli-e2ar4bp1.js";
+} from "./cli-x0f2v69c.js";
 import {
   duplicateGuardedQueryKey,
   warnIfCorsAllowsAnyOrigin,
@@ -983,7 +989,7 @@ import {
   bodyListTask,
   describeRequestRoute,
   route
-} from "./cli-1fc85mvt.js";
+} from "./cli-gwhjmh8g.js";
 import {
   FilesError,
   normalizeFilesError,
@@ -1011,7 +1017,7 @@ import {
   resolvePoolDelivery2,
   createPoolAgent2,
   init_db
-} from "./cli-vwn81jbs.js";
+} from "./cli-19202kew.js";
 import {
   RATING_MODEL_MAX_LENGTH,
   REFERENCES_SOURCE_MAX_LENGTH,
@@ -1027,7 +1033,7 @@ import {
   checkHeartbeatChecklist2,
   runHeartbeatSweep2,
   stopHeartbeat2
-} from "./cli-z21whrrg.js";
+} from "./cli-gn5af0x5.js";
 import"./cli-6n8axjv1.js";
 import {
   import_websocket,
@@ -1037,7 +1043,7 @@ import {
   runtimeSupervisorStatus,
   startRuntimeSupervisor,
   stopRuntimeSupervisor
-} from "./cli-svrj71pg.js";
+} from "./cli-1r5ad7j5.js";
 import"./cli-ns59dc6r.js";
 import {
   ACP_TARGET_IDS
@@ -1057,14 +1063,14 @@ import {
   memoryRelevance,
   isUnknownModelError,
   writeSkillsToFilesystem
-} from "./cli-hcpj2xqz.js";
+} from "./cli-277c31dw.js";
 import {
   inviteEmailToSharedOrg,
   ensureAgentFsCredentialsForAgent
-} from "./cli-3ngdk5te.js";
+} from "./cli-ethgy7ha.js";
 import {
   Anthropic
-} from "./cli-p6zs9h4y.js";
+} from "./cli-rr7zx19j.js";
 import {
   isCodexOAuthConfigKey
 } from "./cli-j4bwnpkm.js";
@@ -1093,6 +1099,7 @@ import {
   InvalidRuntimeTokenError,
   mintSessionToken,
   mintRuntimeToken,
+  isScriptRunToken,
   revokeSessionToken,
   AgentTokenExistsError,
   mintAgentToken,
@@ -1100,7 +1107,7 @@ import {
   revokeAgentTokens,
   fingerprintApiKey,
   init_users
-} from "./cli-e8jyq7d8.js";
+} from "./cli-6a1xg1p7.js";
 import"./cli-v41kn3cd.js";
 import"./cli-wgtk7xxr.js";
 import"./cli-1f0gp9vz.js";
@@ -1269,7 +1276,7 @@ import {
   IDENTITY_FIELD_BUDGETS,
   IdentityFieldBudgetError,
   init_identity_field_budget
-} from "./cli-gpv60278.js";
+} from "./cli-e42vss7b.js";
 import {
   getSlackConfiguration,
   init_config
@@ -1278,16 +1285,6 @@ import {
   isSteeringEnabled2,
   init_steering_enabled
 } from "./cli-4sydckyj.js";
-import {
-  interpolate,
-  init_template,
-  getTemplateDefinition,
-  getAllTemplateDefinitions,
-  init_registry,
-  resolveTemplate,
-  init_resolver,
-  init_session_templates
-} from "./cli-tx00c0h6.js";
 import {
   MODEL_SCOPED_WINDOWS,
   activeModelBlocks,
@@ -1303,6 +1300,16 @@ import {
   getOpenRouterAttributionHeaders,
   init_openrouter_base_url
 } from "./cli-dfyv0jdy.js";
+import {
+  interpolate,
+  init_template,
+  getTemplateDefinition,
+  getAllTemplateDefinitions,
+  init_registry,
+  resolveTemplate,
+  init_resolver,
+  init_session_templates
+} from "./cli-dqygeeh5.js";
 import {
   init_zod
 } from "./cli-4chz1hye.js";
@@ -1337,7 +1344,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-y561h5a9.js";
+} from "./cli-xtrz6bzs.js";
 import {
   realtimeBus,
   init_bus
@@ -6044,6 +6051,7 @@ async function fillOrgLogoFromWebsite(website) {
 // src/http/config.ts
 init_rbac_roles();
 init_swarm_config_guard();
+init_users();
 init_rbac();
 init_types();
 init_request_auth_context();
@@ -6513,6 +6521,28 @@ async function resolveSecretsRead(req, includeSecrets, resolvedScope) {
     secretsNote: includeSecrets && scope === "none" ? SECRETS_FORCE_MASK_NOTE : ""
   };
 }
+async function scriptRunHeldConfigIds(req) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind !== "agent" || auth.tokenKind !== "agent")
+    return;
+  if (!await isScriptRunToken(auth.tokenId))
+    return;
+  const held = stripApiOnlyKeys(await getResolvedConfig2(auth.agentId, undefined, { includeRepoSecrets: false }));
+  return new Set(held.map((config) => config.id));
+}
+async function maskConfigRead(req, configs, includeSecrets) {
+  const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
+  const held = includeSecrets && !effectiveIncludeSecrets ? await scriptRunHeldConfigIds(req) : undefined;
+  const reveal = (config) => effectiveIncludeSecrets || !!held?.has(config.id);
+  const result = configs.map((config) => config.isSecret && !reveal(config) ? maskSecrets2([config])[0] : config);
+  for (const config of result) {
+    if (config.isSecret && config.value && reveal(config)) {
+      registerVolatileSecret(config.value, `config:${config.key}`);
+    }
+  }
+  const anyMasked = result.some((config) => config.isSecret && !reveal(config));
+  return { result, secretsNote: held && !anyMasked ? "" : secretsNote };
+}
 async function ensureConfigAdmin(req, res, verb) {
   return ensureHttpPermission(req, res, verb, verb === "config.write.any" ? "Writing swarm config requires the lead agent" : "Deleting swarm config requires the lead agent");
 }
@@ -6757,13 +6787,9 @@ async function handleConfig(req, res, pathSegments, queryParams) {
       jsonError(res, "Config not found", 404);
       return true;
     }
-    const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
-    const singleResult = effectiveIncludeSecrets ? config : maskSecrets2([config])[0];
-    if (effectiveIncludeSecrets && singleResult.isSecret && singleResult.value) {
-      registerVolatileSecret(singleResult.value, `config:${singleResult.key}`);
-    }
+    const { result, secretsNote } = await maskConfigRead(req, [config], includeSecrets);
     getConfigById.respond(res, 200, {
-      ...singleResult,
+      ...result[0],
       ...secretsNote ? { message: `Found 1 config(s).${secretsNote}` } : {}
     });
     return true;
@@ -6773,20 +6799,12 @@ async function handleConfig(req, res, pathSegments, queryParams) {
     if (!parsed)
       return true;
     const includeSecrets = parsed.query.includeSecrets === "true";
-    const { effectiveIncludeSecrets, secretsNote } = await resolveSecretsRead(req, includeSecrets);
     const configs = stripApiOnlyKeys(await getSwarmConfigs2({
       scope: parsed.query.scope || undefined,
       scopeId: parsed.query.scopeId || undefined,
       key: parsed.query.key
     }));
-    const listResult = effectiveIncludeSecrets ? configs : maskSecrets2(configs);
-    if (effectiveIncludeSecrets) {
-      for (const c of listResult) {
-        if (c.isSecret && c.value) {
-          registerVolatileSecret(c.value, `config:${c.key}`);
-        }
-      }
-    }
+    const { result: listResult, secretsNote } = await maskConfigRead(req, configs, includeSecrets);
     listConfig.respond(res, 200, {
       configs: listResult,
       ...secretsNote ? { message: `Found ${listResult.length} config(s).${secretsNote}` } : {}
@@ -10207,6 +10225,36 @@ declare module "swarm-extension" {
     origin: TaskCreateOrigin;
     requestInfo?: RequestInfo;
   }
+  /** A pre.task.create hook blocked a task before it was created. */
+  export interface TaskBlockedEvent {
+    /** The extension that blocked, or whose model/agent rewrite was rejected. */
+    extension: {
+      id: string;
+      name: string;
+    };
+    /** The scrubbed block reason. */
+    reason: string;
+    origin: TaskCreateOrigin;
+    source?: AgentTask["source"];
+    requester: {
+      userId?: string;
+      agentId?: string;
+      slackUserId?: string;
+    };
+    context?: {
+      contextKey?: string;
+      scheduleId?: string;
+      workflowRunId?: string;
+      workflowRunStepId?: string;
+      parentTaskId?: string;
+      vcsRepo?: string;
+      vcsNumber?: number;
+      slackChannelId?: string;
+      slackThreadTs?: string;
+    };
+    /** The original task description, scrubbed and cut to 500 characters. */
+    description: string;
+  }
   export type TaskCreateModify = Partial<
     Pick<
       CreateTaskOptions,
@@ -10509,6 +10557,11 @@ declare module "swarm-extension" {
       modify: never;
       result: void;
     };
+    "post.task.blocked": {
+      event: TaskBlockedEvent;
+      modify: never;
+      result: void;
+    };
     "post.task.completed": {
       event: TaskCompletedEvent;
       modify: never;
@@ -39250,8 +39303,66 @@ async function handleWorkflowEvents(req, res, pathSegments, queryParams) {
 // src/http/workflows.ts
 init_zod();
 init_db3();
+init_workflow_idempotency();
 init_workflow_runs();
 init_types();
+
+// src/http/idempotency-key.ts
+init_zod();
+init_workflow_idempotency();
+init_request_auth_context();
+var IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
+var IDEMPOTENT_REPLAYED_HEADER = "Idempotent-Replayed";
+var idempotencyKeyHeader = (accepted) => object2({
+  "Idempotency-Key": string2().regex(IDEMPOTENCY_KEY_PATTERN).optional().describe("Optional client-generated key, 1-255 visible ASCII characters (a UUID works). " + `The first request the server accepts under a key ${accepted}; a retry with the same key ` + "and an equivalent body gets that request's status and body back (with " + `\`${IDEMPOTENT_REPLAYED_HEADER}: true\`) and changes nothing. The key is scoped to the ` + "caller's identity and this operation; it is not a credential. The same key with a " + "different body is a 409. A request rejected before it is accepted (validation, auth, " + "not found, disabled) does not use up the key. Accepted keys do not expire.")
+});
+function idempotencyPrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  switch (auth?.kind) {
+    case "user":
+      return `user:${auth.userId}`;
+    case "agent":
+      return `agent:${auth.agentId}`;
+    case "controller":
+      return `controller:${auth.controllerId}`;
+    case "guest":
+      return null;
+    default:
+      return myAgentId ? `agent:${myAgentId}` : "operator";
+  }
+}
+function readIdempotencyKey(req, res, myAgentId) {
+  const raw = req.headers["idempotency-key"];
+  if (raw === undefined)
+    return;
+  const key = Array.isArray(raw) ? raw.join(", ") : raw;
+  if (!IDEMPOTENCY_KEY_PATTERN.test(key)) {
+    jsonError(res, "Idempotency-Key must be 1-255 visible ASCII characters", 400);
+    return null;
+  }
+  const principal = idempotencyPrincipal(req, myAgentId);
+  if (!principal) {
+    jsonError(res, "Idempotency-Key needs an identified caller", 400);
+    return null;
+  }
+  return { principal, key };
+}
+async function replayAcceptedOperation(res, claim, send) {
+  const accepted = await findAcceptedWorkflowOperation(claim);
+  if (!accepted)
+    return false;
+  if (accepted.fingerprint !== claim.fingerprint) {
+    jsonError(res, "Idempotency-Key was already used for a different request", 409);
+  } else if (accepted.resourceDeletedAt !== null) {
+    jsonError(res, "The workflow this Idempotency-Key created or triggered was deleted; send a new key to start over", 410);
+  } else {
+    res.setHeader(IDEMPOTENT_REPLAYED_HEADER, "true");
+    send(accepted.body);
+  }
+  return true;
+}
+
+// src/http/workflows.ts
 var WorkflowWithFavoriteSchema = WorkflowSchema.extend({ favorite: boolean() });
 var WorkflowSaveResponseSchema = WorkflowSchema.extend({
   warnings: array2(string2()).optional()
@@ -39313,6 +39424,7 @@ var createWorkflowRoute = route({
   pattern: ["api", "workflows"],
   summary: "Create a new workflow",
   tags: ["Workflows"],
+  headers: idempotencyKeyHeader("creates one workflow"),
   body: object2({
     name: string2().min(1),
     key: AssetKeySchema.optional(),
@@ -39330,7 +39442,9 @@ var createWorkflowRoute = route({
   }),
   responses: {
     201: { description: "Workflow created", schema: WorkflowSaveResponseSchema },
-    400: { description: "Invalid definition" }
+    400: { description: "Invalid definition, or a malformed Idempotency-Key" },
+    409: { description: "Idempotency-Key was already used for a different request" },
+    410: { description: "The workflow created under this Idempotency-Key was deleted" }
   }
 });
 var getWorkflowRoute = route({
@@ -39434,16 +39548,20 @@ var triggerWorkflowRoute = route({
   path: "/api/workflows/{id}/trigger",
   pattern: ["api", "workflows", null, "trigger"],
   summary: "Trigger a workflow execution",
+  description: "With an `Idempotency-Key`, a retry returns the accepted run's `runId` and `skipped` without starting, resuming or waiting for anything, even after the workflow was disabled or edited and whatever state the run is in now.",
   tags: ["Workflows"],
   params: object2({ id: string2() }),
+  headers: idempotencyKeyHeader("starts one run"),
   responses: {
     201: {
       description: "Workflow run started (or skipped if cooldown active)",
       schema: object2({ runId: string2(), skipped: boolean() })
     },
-    400: { description: "Workflow is disabled" },
+    400: { description: "Workflow is disabled, or a malformed Idempotency-Key" },
     401: { description: "Unauthorized" },
-    404: { description: "Workflow not found" }
+    404: { description: "Workflow not found" },
+    409: { description: "Idempotency-Key was already used for a different request" },
+    410: { description: "The workflow triggered under this Idempotency-Key was deleted" }
   }
 });
 var validateTriggerRoute = route({
@@ -39688,9 +39806,21 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     return true;
   }
   if (createWorkflowRoute.match(req.method, pathSegments)) {
+    const idempotency = readIdempotencyKey(req, res, myAgentId);
+    if (idempotency === null)
+      return true;
     const parsed = await createWorkflowRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    const claim = idempotency && {
+      ...idempotency,
+      operation: "workflow.create",
+      targetId: "",
+      fingerprint: workflowRequestFingerprint("workflow.create", parsed.body)
+    };
+    const replayCreate = (body) => createWorkflowRoute.respond(res, 201, body);
+    if (claim && await replayAcceptedOperation(res, claim, replayCreate))
+      return true;
     const validation = validateDefinition(parsed.body.definition, getExecutorRegistry2());
     if (!validation.valid) {
       jsonError(res, `Invalid definition: ${validation.errors.join("; ")}`, 400);
@@ -39712,7 +39842,7 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       }
       throw error;
     }
-    const workflow = await createWorkflow2({
+    const data = {
       key,
       name: parsed.body.name,
       description: parsed.body.description,
@@ -39728,8 +39858,34 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       vcsRepo: parsed.body.vcsRepo,
       createdByAgentId: myAgentId ?? undefined,
       createdBy: await resolveHttpAuditUserId(req, myAgentId) ?? undefined
-    }, "api");
-    createWorkflowRoute.respond(res, 201, await withSaveWarnings(workflow));
+    };
+    if (!claim) {
+      const workflow = await createWorkflow2(data, "api");
+      createWorkflowRoute.respond(res, 201, await withSaveWarnings(workflow));
+      return true;
+    }
+    const warnings = await workflowSaveWarnings(parsed.body.definition, getExecutorRegistry2());
+    let saved;
+    try {
+      saved = await getDbClient2().transaction(async () => {
+        await assertWorkflowIdempotencyKeyUnused(claim);
+        const workflow = await createWorkflow2(data, "api");
+        const body = warnings.length > 0 ? { ...workflow, warnings } : workflow;
+        await recordAcceptedWorkflowOperation(claim, {
+          workflowId: workflow.id,
+          status: 201,
+          body
+        });
+        return body;
+      });
+    } catch (err) {
+      if (err instanceof IdempotencyKeyTakenError) {
+        if (await replayAcceptedOperation(res, claim, replayCreate))
+          return true;
+      }
+      throw err;
+    }
+    createWorkflowRoute.respond(res, 201, saved);
     return true;
   }
   if (getWorkflowRoute.match(req.method, pathSegments)) {
@@ -39931,9 +40087,26 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
     return true;
   }
   if (triggerWorkflowRoute.match(req.method, pathSegments)) {
+    const idempotency = readIdempotencyKey(req, res, myAgentId);
+    if (idempotency === null)
+      return true;
     const parsed = await triggerWorkflowRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
+    let claim;
+    let keyedBody;
+    const replayTrigger = (body) => triggerWorkflowRoute.respond(res, 201, body);
+    if (idempotency) {
+      keyedBody = await parseBody(req);
+      claim = {
+        ...idempotency,
+        operation: "workflow.trigger",
+        targetId: parsed.params.id,
+        fingerprint: workflowRequestFingerprint("workflow.trigger", keyedBody)
+      };
+      if (await replayAcceptedOperation(res, claim, replayTrigger))
+        return true;
+    }
     const workflow = await getWorkflow2(parsed.params.id);
     if (!workflow) {
       res.writeHead(404);
@@ -39944,20 +40117,39 @@ async function handleWorkflows(req, res, pathSegments, queryParams, myAgentId) {
       jsonError(res, "Workflow is disabled", 400);
       return true;
     }
-    const body = await parseBody(req);
+    const body = idempotency ? keyedBody : await parseBody(req);
     let runId;
+    let accepted;
     try {
       runId = await startWorkflowExecution2(workflow, body, getExecutorRegistry2(), {
         triggerType: "api",
-        requestedByUserId: await resolveHttpAuditUserId(req, myAgentId) ?? undefined
+        requestedByUserId: await resolveHttpAuditUserId(req, myAgentId) ?? undefined,
+        accept: claim ? async (run) => {
+          const response = { runId: run.runId, skipped: run.skipped };
+          await recordAcceptedWorkflowOperation(claim, {
+            workflowId: workflow.id,
+            runId: run.runId,
+            status: 201,
+            body: response
+          });
+          accepted = response;
+        } : undefined
       });
     } catch (err) {
       if (err instanceof TriggerSchemaError) {
         triggerSchemaErrorResponse(res, err.message, err.validationErrors);
         return true;
       }
+      if (claim && err instanceof IdempotencyKeyTakenError) {
+        if (await replayAcceptedOperation(res, claim, replayTrigger))
+          return true;
+      }
       throw err;
     }
+    if (accepted) {
+      triggerWorkflowRoute.respond(res, 201, accepted);
+      return true;
+    }
     const run = await getWorkflowRun2(runId);
     const skipped = run?.status === "skipped";
     triggerWorkflowRoute.respond(res, 201, { runId, skipped });
@@ -40427,7 +40619,7 @@ var httpServer = createHttpServer(async (req, res) => {
   });
 });
 var detachRealtime = attachRealtimeTransport(httpServer);
-var { attachControllerTransport } = await import("./controllers-connect-bqm1rtft.js");
+var { attachControllerTransport } = await import("./controllers-connect-xp05dj6x.js");
 var detachControllers = attachControllerTransport(httpServer);
 var stopWorkerNudges = startWorkerNudgeListener();
 var stopRoomDeletion = realtimeBus.subscribe("room:namespace-deleted", (namespace) => {
@@ -40456,7 +40648,7 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-spwxjgay.js");
+    const { stopScheduler } = await import("./index-xdaahthb.js");
     stopScheduler();
   }
   stopHeartbeat2();
@@ -40468,7 +40660,7 @@ async function shutdown() {
   await stopSlackApp2();
   await stopChatSdk();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-dsd8rtgx.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-v4ta8wgg.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -40548,21 +40740,21 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { ensurePricingSeeded } = await import("./boot-seeds-5zmax2wr.js");
+  const { ensurePricingSeeded } = await import("./boot-seeds-x28v3fhb.js");
   ensurePricingSeeded();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-xvak5p4v.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-fsk1e1zc.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureModelProfilesSeeded } = await import("./boot-seeds-5zmax2wr.js");
+  const { ensureModelProfilesSeeded } = await import("./boot-seeds-x28v3fhb.js");
   await ensureModelProfilesSeeded();
 } catch (err) {
   console.error("[startup] Failed to seed model profiles:", err);
 }
 try {
-  const { ensureRbacSeeded } = await import("./boot-seeds-5zmax2wr.js");
+  const { ensureRbacSeeded } = await import("./boot-seeds-x28v3fhb.js");
   ensureRbacSeeded();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -40570,7 +40762,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-n1vbvta9.js");
+  const { runAllSeeders } = await import("./index-q7m26kvs.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -40633,39 +40825,39 @@ httpServer.listen(port, async () => {
   await initWorkflows2();
   await startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-spwxjgay.js");
-    const { getExecutorRegistry } = await import("./index-srg522m6.js");
+    const { startScheduler } = await import("./index-xdaahthb.js");
+    const { getExecutorRegistry } = await import("./index-1ef1myq2.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-kw2mmat7.js");
+    const { startHeartbeat } = await import("./index-nmm79qgr.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   startPoolRouting();
   startRuntimeSupervisor();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-dsd8rtgx.js");
+    const { startOAuthKeepalive } = await import("./keepalive-v4ta8wgg.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-q2c3bnvm.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-vjnnandw.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   await startMemoryGc();
   await startDbRetention();
   startHumanFreeDrain();
-  import("./boot-reembed-5b3d2eea.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-w75maga2.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-jsmfrpzf.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-dwzfttdr.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-sweep-s73gerxy.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
+  import("./boot-scrub-sweep-e9kq43kf.js").then(({ runBootScrubSweep }) => runBootScrubSweep()).catch((err) => {
     console.error("[boot-scrub-sweep] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {