@elevasis/ui 2.21.0 → 2.22.0

package/dist/hooks/index.d.ts

@@ -7,17 +7,10 @@ import * as zustand from 'zustand';
 import { Edge } from '@xyflow/react';
 
 /**
- * Query key factory for executions TanStack Query hooks.
- * Uses organization UUID (not name) for cache isolation.
+ * Error categories for observability grouping and classification.
+ * Used to categorize errors in the execution_errors table metadata.
  */
-declare const executionsKeys: {
-    all: readonly ["executions"];
-    resources: (orgId: string | null) => readonly ["executions", "resources", string | null];
-    resourceDefinition: (orgId: string | null, resourceId: string) => readonly ["executions", "definition", string | null, string];
-    executionsListBase: (orgId: string | null, resourceId: string) => readonly ["executions", "list", string | null, string];
-    executions: (orgId: string | null, resourceId: string, resourceStatus?: string, limit?: number, offset?: number) => readonly ["executions", "list", string | null, string, string, number | null, number];
-    execution: (orgId: string | null, resourceId: string, executionId: string) => readonly ["executions", "execution", string | null, string, string];
-};
+type ExecutionErrorCategory = 'llm' | 'tool' | 'workflow' | 'agent' | 'validation' | 'system';
 
 /**
  * Workflow-specific logging types and utilities
@@ -267,10 +260,170 @@ interface FormSchema {
 }
 
 /**
- * Error categories for observability grouping and classification.
- * Used to categorize errors in the execution_errors table metadata.
+ * Serialized Registry Types
+ *
+ * Pre-computed JSON-safe types for API responses and Command View.
+ * Serialization happens once at API startup, enabling instant response times.
  */
-type ExecutionErrorCategory = 'llm' | 'tool' | 'workflow' | 'agent' | 'validation' | 'system';
+
+/**
+ * Serialized form field for API responses
+ */
+interface SerializedFormField {
+    name: string;
+    label: string;
+    type: FormFieldType;
+    defaultValue?: unknown;
+    required?: boolean;
+    placeholder?: string;
+    description?: string;
+    options?: Array<{
+        label: string;
+        value: string | number;
+    }>;
+    min?: number;
+    max?: number;
+}
+/**
+ * Serialized form schema for API responses
+ */
+interface SerializedFormSchema {
+    title?: string;
+    description?: string;
+    fields: SerializedFormField[];
+    layout?: 'vertical' | 'horizontal' | 'grid';
+}
+/**
+ * Serialized execution form schema for API responses
+ */
+interface SerializedExecutionFormSchema extends SerializedFormSchema {
+    fieldMappings?: Record<string, string>;
+    submitButton?: {
+        label?: string;
+        loadingLabel?: string;
+        confirmMessage?: string;
+    };
+}
+/**
+ * Serialized schedule config for API responses
+ */
+interface SerializedScheduleConfig {
+    enabled: boolean;
+    defaultSchedule?: string;
+    allowedPatterns?: string[];
+}
+/**
+ * Serialized webhook config for API responses
+ */
+interface SerializedWebhookConfig {
+    enabled: boolean;
+    payloadSchema?: unknown;
+}
+/**
+ * Serialized execution interface for API responses
+ */
+interface SerializedExecutionInterface {
+    form: SerializedExecutionFormSchema;
+    schedule?: SerializedScheduleConfig;
+    webhook?: SerializedWebhookConfig;
+}
+/**
+ * Serialized agent definition (JSON-safe)
+ * Result of serializeDefinition(AgentDefinition)
+ */
+interface SerializedAgentDefinition {
+    config: {
+        resourceId: string;
+        name: string;
+        description: string;
+        version: string;
+        type: 'agent';
+        status: 'dev' | 'prod';
+        links?: ResourceLink[];
+        category?: ResourceCategory;
+        /** Whether this resource is archived and should be excluded from registration and deployment */
+        archived?: boolean;
+        systemPrompt: string;
+        constraints?: {
+            maxIterations?: number;
+            timeout?: number;
+            maxSessionMemoryKeys?: number;
+            maxMemoryTokens?: number;
+        };
+        sessionCapable?: boolean;
+        memoryPreferences?: string;
+    };
+    modelConfig: {
+        provider: string;
+        model: string;
+        apiKey: string;
+        temperature: number;
+        maxOutputTokens: number;
+        topP?: number;
+        modelOptions?: Record<string, unknown>;
+    };
+    contract: {
+        inputSchema: object;
+        outputSchema?: object;
+    };
+    tools: Array<{
+        name: string;
+        description: string;
+        inputSchema?: object;
+        outputSchema?: object;
+    }>;
+    knowledgeMap?: {
+        nodeCount: number;
+        nodes: Array<{
+            id: string;
+            description: string;
+            loaded: boolean;
+            hasPrompt: boolean;
+        }>;
+    };
+    metricsConfig?: object;
+    interface?: SerializedExecutionInterface;
+}
+/**
+ * Serialized workflow definition (JSON-safe)
+ * Result of serializeDefinition(WorkflowDefinition)
+ */
+interface SerializedWorkflowDefinition {
+    config: {
+        resourceId: string;
+        name: string;
+        description: string;
+        version: string;
+        type: 'workflow';
+        status: 'dev' | 'prod';
+        links?: ResourceLink[];
+        category?: ResourceCategory;
+        /** Whether this resource is archived and should be excluded from registration and deployment */
+        archived?: boolean;
+    };
+    entryPoint: string;
+    steps: Array<{
+        id: string;
+        name: string;
+        description: string;
+        inputSchema?: object;
+        outputSchema?: object;
+        next: {
+            type: 'linear' | 'conditional';
+            target?: string;
+            routes?: Array<{
+                target: string;
+            }>;
+            default?: string;
+        } | null;
+    }>;
+    contract: {
+        inputSchema: object;
+        outputSchema?: object;
+    };
+    metricsConfig?: object;
+    interface?: SerializedExecutionInterface;
+}
 
 /**
  * Memory type definitions
@@ -1984,6 +2137,7 @@ type Database = {
                 Row: {
                     config: Json;
                     created_at: string | null;
+                    effective_permissions: string[];
                     id: string;
                     membership_status: string | null;
                     organization_id: string;
@@ -1995,6 +2149,7 @@ type Database = {
                 Insert: {
                     config?: Json;
                     created_at?: string | null;
+                    effective_permissions?: string[];
                     id?: string;
                     membership_status?: string | null;
                     organization_id: string;
@@ -2006,6 +2161,7 @@ type Database = {
                 Update: {
                     config?: Json;
                     created_at?: string | null;
+                    effective_permissions?: string[];
                     id?: string;
                     membership_status?: string | null;
                     organization_id?: string;
@@ -2031,92 +2187,233 @@ type Database = {
                     }
                 ];
             };
-            organizations: {
+            org_rol_assignments: {
                 Row: {
-                    config: Json;
-                    created_at: string;
-                    id: string;
-                    is_test: boolean;
-                    metadata: Json;
-                    name: string;
-                    status: string;
-                    updated_at: string;
-                    workos_org_id: string;
+                    granted_at: string;
+                    granted_by: string | null;
+                    membership_id: string;
+                    role_id: string;
                 };
                 Insert: {
-                    config?: Json;
-                    created_at?: string;
-                    id?: string;
-                    is_test?: boolean;
-                    metadata?: Json;
-                    name: string;
-                    status?: string;
-                    updated_at?: string;
-                    workos_org_id: string;
+                    granted_at?: string;
+                    granted_by?: string | null;
+                    membership_id: string;
+                    role_id: string;
                 };
                 Update: {
-                    config?: Json;
-                    created_at?: string;
-                    id?: string;
-                    is_test?: boolean;
-                    metadata?: Json;
-                    name?: string;
-                    status?: string;
-                    updated_at?: string;
-                    workos_org_id?: string;
+                    granted_at?: string;
+                    granted_by?: string | null;
+                    membership_id?: string;
+                    role_id?: string;
                 };
-                Relationships: [];
+                Relationships: [
+                    {
+                        foreignKeyName: "org_rol_assignments_granted_by_fkey";
+                        columns: ["granted_by"];
+                        isOneToOne: false;
+                        referencedRelation: "users";
+                        referencedColumns: ["id"];
+                    },
+                    {
+                        foreignKeyName: "org_rol_assignments_membership_id_fkey";
+                        columns: ["membership_id"];
+                        isOneToOne: false;
+                        referencedRelation: "org_memberships";
+                        referencedColumns: ["id"];
+                    },
+                    {
+                        foreignKeyName: "org_rol_assignments_role_id_fkey";
+                        columns: ["role_id"];
+                        isOneToOne: false;
+                        referencedRelation: "org_rol_definitions";
+                        referencedColumns: ["id"];
+                    }
+                ];
             };
-            prj_milestones: {
+            org_rol_definitions: {
                 Row: {
-                    checklist: Json | null;
-                    completed_at: string | null;
                     created_at: string;
                     description: string | null;
-                    due_date: string | null;
                     id: string;
-                    metadata: Json | null;
+                    is_system: boolean;
                     name: string;
-                    organization_id: string;
-                    project_id: string;
-                    sequence: number;
-                    status: string;
+                    organization_id: string | null;
+                    slug: string;
                     updated_at: string;
                 };
                 Insert: {
-                    checklist?: Json | null;
-                    completed_at?: string | null;
                     created_at?: string;
                     description?: string | null;
-                    due_date?: string | null;
                     id?: string;
-                    metadata?: Json | null;
+                    is_system?: boolean;
                     name: string;
-                    organization_id: string;
-                    project_id: string;
-                    sequence?: number;
-                    status?: string;
+                    organization_id?: string | null;
+                    slug: string;
                     updated_at?: string;
                 };
                 Update: {
-                    checklist?: Json | null;
-                    completed_at?: string | null;
                     created_at?: string;
                     description?: string | null;
-                    due_date?: string | null;
                     id?: string;
-                    metadata?: Json | null;
+                    is_system?: boolean;
                     name?: string;
-                    organization_id?: string;
-                    project_id?: string;
-                    sequence?: number;
-                    status?: string;
+                    organization_id?: string | null;
+                    slug?: string;
                     updated_at?: string;
                 };
                 Relationships: [
                     {
-                        foreignKeyName: "fk_milestones_project";
-                        columns: ["project_id"];
+                        foreignKeyName: "org_rol_definitions_organization_id_fkey";
+                        columns: ["organization_id"];
+                        isOneToOne: false;
+                        referencedRelation: "organizations";
+                        referencedColumns: ["id"];
+                    }
+                ];
+            };
+            org_rol_grants: {
+                Row: {
+                    granted_at: string;
+                    permission_key: string;
+                    role_id: string;
+                };
+                Insert: {
+                    granted_at?: string;
+                    permission_key: string;
+                    role_id: string;
+                };
+                Update: {
+                    granted_at?: string;
+                    permission_key?: string;
+                    role_id?: string;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "org_rol_grants_permission_key_fkey";
+                        columns: ["permission_key"];
+                        isOneToOne: false;
+                        referencedRelation: "org_rol_permissions";
+                        referencedColumns: ["key"];
+                    },
+                    {
+                        foreignKeyName: "org_rol_grants_role_id_fkey";
+                        columns: ["role_id"];
+                        isOneToOne: false;
+                        referencedRelation: "org_rol_definitions";
+                        referencedColumns: ["id"];
+                    }
+                ];
+            };
+            org_rol_permissions: {
+                Row: {
+                    created_at: string;
+                    description: string;
+                    is_org_grantable: boolean;
+                    key: string;
+                    updated_at: string;
+                };
+                Insert: {
+                    created_at?: string;
+                    description: string;
+                    is_org_grantable?: boolean;
+                    key: string;
+                    updated_at?: string;
+                };
+                Update: {
+                    created_at?: string;
+                    description?: string;
+                    is_org_grantable?: boolean;
+                    key?: string;
+                    updated_at?: string;
+                };
+                Relationships: [];
+            };
+            organizations: {
+                Row: {
+                    config: Json;
+                    created_at: string;
+                    id: string;
+                    is_test: boolean;
+                    metadata: Json;
+                    name: string;
+                    status: string;
+                    updated_at: string;
+                    workos_org_id: string;
+                };
+                Insert: {
+                    config?: Json;
+                    created_at?: string;
+                    id?: string;
+                    is_test?: boolean;
+                    metadata?: Json;
+                    name: string;
+                    status?: string;
+                    updated_at?: string;
+                    workos_org_id: string;
+                };
+                Update: {
+                    config?: Json;
+                    created_at?: string;
+                    id?: string;
+                    is_test?: boolean;
+                    metadata?: Json;
+                    name?: string;
+                    status?: string;
+                    updated_at?: string;
+                    workos_org_id?: string;
+                };
+                Relationships: [];
+            };
+            prj_milestones: {
+                Row: {
+                    checklist: Json | null;
+                    completed_at: string | null;
+                    created_at: string;
+                    description: string | null;
+                    due_date: string | null;
+                    id: string;
+                    metadata: Json | null;
+                    name: string;
+                    organization_id: string;
+                    project_id: string;
+                    sequence: number;
+                    status: string;
+                    updated_at: string;
+                };
+                Insert: {
+                    checklist?: Json | null;
+                    completed_at?: string | null;
+                    created_at?: string;
+                    description?: string | null;
+                    due_date?: string | null;
+                    id?: string;
+                    metadata?: Json | null;
+                    name: string;
+                    organization_id: string;
+                    project_id: string;
+                    sequence?: number;
+                    status?: string;
+                    updated_at?: string;
+                };
+                Update: {
+                    checklist?: Json | null;
+                    completed_at?: string | null;
+                    created_at?: string;
+                    description?: string | null;
+                    due_date?: string | null;
+                    id?: string;
+                    metadata?: Json | null;
+                    name?: string;
+                    organization_id?: string;
+                    project_id?: string;
+                    sequence?: number;
+                    status?: string;
+                    updated_at?: string;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "fk_milestones_project";
+                        columns: ["project_id"];
                         isOneToOne: false;
                         referencedRelation: "prj_projects";
                         referencedColumns: ["id"];
@@ -2788,7 +3085,8 @@ type Database = {
                     created_at: string;
                     description: string | null;
                     id: string;
-                    key: string;
+                    key_hash: string;
+                    key_prefix: string | null;
                     last_triggered_at: string | null;
                     name: string;
                     organization_id: string;
@@ -2801,7 +3099,8 @@ type Database = {
                     created_at?: string;
                     description?: string | null;
                     id?: string;
-                    key: string;
+                    key_hash: string;
+                    key_prefix?: string | null;
                     last_triggered_at?: string | null;
                     name: string;
                     organization_id: string;
@@ -2814,7 +3113,8 @@ type Database = {
                     created_at?: string;
                     description?: string | null;
                     id?: string;
-                    key?: string;
+                    key_hash?: string;
+                    key_prefix?: string | null;
                     last_triggered_at?: string | null;
                     name?: string;
                     organization_id?: string;
@@ -2860,6 +3160,13 @@ type Database = {
                 Args: never;
                 Returns: string;
             };
+            can_assign_role_in_org: {
+                Args: {
+                    p_role_id: string;
+                    p_target_membership_id: string;
+                };
+                Returns: boolean;
+            };
             current_user_is_platform_admin: {
                 Args: never;
                 Returns: boolean;
@@ -2889,6 +3196,10 @@ type Database = {
                     user_id: string;
                 }[];
             };
+            get_platform_credential_kek: {
+                Args: never;
+                Returns: string;
+            };
             get_storage_org_id: {
                 Args: {
                     file_path: string;
@@ -2899,6 +3210,13 @@ type Database = {
                 Args: never;
                 Returns: string;
             };
+            has_org_permission: {
+                Args: {
+                    org_id: string;
+                    perm_key: string;
+                };
+                Returns: boolean;
+            };
             is_org_admin: {
                 Args: {
                     org_id: string;
@@ -2931,6 +3249,22 @@ type Database = {
                 Args: never;
                 Returns: Json;
             };
+            recompute_all_memberships: {
+                Args: never;
+                Returns: undefined;
+            };
+            sync_all_memberships_with_role: {
+                Args: {
+                    p_role_id: string;
+                };
+                Returns: undefined;
+            };
+            sync_one_membership: {
+                Args: {
+                    p_membership_id: string;
+                };
+                Returns: undefined;
+            };
             upsert_user_profile: {
                 Args: never;
                 Returns: {
@@ -2963,790 +3297,960 @@ type Tables<DefaultSchemaTableNameOrOptions extends keyof (DefaultSchema["Tables
     Row: infer R;
 } ? R : never : never;
 
-/**
- * Time range selector for dashboard metrics
- */
-type TimeRange = '1h' | '24h' | '7d' | '30d';
-/**
- * Execution health metrics response
- * Success rate, P95 duration, execution counts, and trend data
- * trendData includes executionCount for throughput visualization (eliminates separate API call)
- */
-interface ExecutionHealthMetrics {
-    successRate: number;
-    p95Duration: number;
-    totalExecutions: number;
-    trendData: Array<{
-        time: string;
-        rate: number;
-        successCount: number;
-        errorCount: number;
-        warningCount: number;
-        executionCount: number;
-    }>;
-    statusCounts: {
-        success: number;
-        failed: number;
-        pending: number;
-        warning: number;
-    };
-    peakPeriod: string;
-    granularity: 'hour' | 'day';
-}
-/**
- * Error analysis metrics response
- * Error categories and top failing resources
- */
-interface ErrorAnalysisMetrics {
-    totalErrors: number;
-    errorsByCategory: Array<{
-        category: string;
-        count: number;
-        percentage: number;
-    }>;
-    topFailingResources: Array<{
-        resourceId: string;
+type SupabaseUserProfile = Tables<'users'>;
+type SupabaseApiKey = Tables<'api_keys'>;
+/** API response type for API key list items (omits sensitive key_hash) */
+type ApiKeyListItem = Omit<SupabaseApiKey, 'key_hash'>;
+
+/** Raw database row type for acq_deals table */
+type AcqDealRow = Database['public']['Tables']['acq_deals']['Row'];
+type DealStage = 'interested' | 'proposal' | 'closing' | 'closed_won' | 'closed_lost' | 'nurturing';
+interface DealContact {
+    id: string;
+    first_name: string | null;
+    last_name: string | null;
+    email: string;
+    title: string | null;
+    headline: string | null;
+    linkedin_url: string | null;
+    pipeline_status: Record<string, unknown> | null;
+    enrichment_data: Record<string, unknown> | null;
+    company: {
+        id: string;
         name: string;
-        errorCount: number;
-        failureRate: number;
-    }>;
+        domain: string | null;
+        website: string | null;
+        linkedin_url: string | null;
+        segment: string | null;
+        category: string | null;
+        num_employees: number | null;
+    } | null;
 }
-/**
- * Business impact metrics response
- * ROI, labor savings, and cost analysis
- */
-interface BusinessImpactMetrics$1 {
-    totalSavingsUsd: number;
-    totalCostUsd: number;
-    netSavingsUsd: number;
-    roi: number;
+interface DealFilters {
+    stage?: DealStage;
+    search?: string;
+    limit?: number;
+    offset?: number;
+}
+/** Deal list item with joined contact and company data */
+interface DealListItem extends AcqDealRow {
+    contact: DealContact | null;
 }
+type DealDetail = DealListItem;
+/** Task kind options for a deal task (human follow-up action type) */
+type AcqDealTaskKind = 'call' | 'email' | 'meeting' | 'other';
 /**
- * Cost breakdown metrics response
- * Per-resource cost analysis
+ * A CRM to-do item attached to a deal representing a human follow-up action.
+ * Transformed from AcqDealTaskRow with camelCase properties.
  */
-interface CostBreakdownMetrics {
-    resources: Array<{
-        resourceId: string;
-        totalCostUsd: number;
-        executionCount: number;
-        avgCostUsd: number;
-    }>;
+interface AcqDealTask {
+    id: string;
+    organizationId: string;
+    dealId: string;
+    title: string;
+    description: string | null;
+    kind: AcqDealTaskKind;
+    dueAt: string | null;
+    assigneeUserId: string | null;
+    completedAt: string | null;
+    completedByUserId: string | null;
+    createdAt: string;
+    updatedAt: string;
+    createdByUserId: string | null;
 }
 /**
- * Dashboard metrics response
- * Aggregates core observability metrics in a single response
- * Note: Throughput data is now included in executionHealth.trendData.executionCount
+ * Live-scan aggregate telemetry for a single list, computed on demand from
+ * the list junction tables and current contact deliverability state.
  */
-interface DashboardMetrics {
-    executionHealth: ExecutionHealthMetrics;
-    costBreakdown: CostBreakdownMetrics;
-    businessImpact: BusinessImpactMetrics$1;
-    /** ISO timestamp of the currently active deployment, or null if none */
-    activeDeploymentDate: string | null;
-    /** Deployment version of the active deployment, or null if none */
-    activeDeploymentVersion: string | null;
+interface ListTelemetry {
+    listId: string;
+    totalCompanies: number;
+    totalContacts: number;
+    stageCounts: {
+        populated: number;
+        extracted: number;
+        qualified: number;
+        discovered: number;
+        verified: number;
+        personalized: number;
+        uploaded: number;
+    };
+    deliverability: {
+        valid: number;
+        risky: number;
+        invalid: number;
+        unknown: number;
+        bounced: number;
+    };
+    /** Reserved -- active workflow IDs associated with this list. */
+    activeWorkflows?: string[];
 }
+
 /**
- * Error record for list view (ErrorBreakdownTable)
+ * Lead Service Types
+ * CRUD operation types for the acquisition platform (lists, companies, contacts, deals)
+ *
+ * Implementation: apps/api/src/acquisition/lead-service.ts (LeadService class)
  */
-interface ErrorRecord {
+
+interface AcqDealNote {
     id: string;
-    timestamp: string;
-    errorType: string;
-    message: string;
-    executionId: string;
-    resourceId: string;
-    resourceName: string;
-    severity: 'critical' | 'warning' | 'info';
-    category: ExecutionErrorCategory;
-    resolved: boolean;
-    resolvedAt: string | null;
-    resolvedBy: string | null;
+    dealId: string;
+    organizationId: string;
+    authorUserId: string | null;
+    body: string;
+    createdAt: string;
+    updatedAt: string;
 }
+
 /**
- * Full error detail for modal view (ErrorDetailsModal)
+ * Action configuration for HITL tasks
+ * Defines available user actions and their behavior
  */
-interface ErrorDetailFull extends ErrorRecord {
-    stackTrace?: string;
-    retryAttempt?: number;
-    stepName?: string;
-    stepSequence?: number;
-    errorContext?: Record<string, unknown>;
-    executionContext?: Record<string, unknown>;
+interface ActionConfig {
+    /** Unique action identifier (e.g., 'approve', 'retry', 'escalate') */
+    id: string;
+    /** Display label for UI button */
+    label: string;
+    /** Button variant/style */
+    type: 'primary' | 'secondary' | 'danger' | 'outline';
+    /** Tabler icon name (e.g., 'IconCheck', 'IconRefresh') */
+    icon?: string;
+    /** Button color (Mantine theme colors) */
+    color?: string;
+    /** Button variant (Mantine button variant, e.g., 'light', 'filled', 'outline') */
+    variant?: string;
+    /** Execution target (agent/workflow to invoke) */
+    target?: {
+        resourceType: 'agent' | 'workflow';
+        resourceId: string;
+        /**
+         * Optional session ID for agent continuation.
+         * If provided, invokes a new turn on the existing session instead of standalone execution.
+         * Only valid when resourceType is 'agent'.
+         */
+        sessionId?: string;
+    };
+    /** Form schema for collecting action-specific data */
+    form?: FormSchema;
+    /** Payload template for pre-filling forms */
+    payloadTemplate?: unknown;
+    /** Requires confirmation dialog */
+    requiresConfirmation?: boolean;
+    /** Confirmation message */
+    confirmationMessage?: string;
+    /** Help text / tooltip */
+    description?: string;
 }
+
 /**
- * Error details API response (paginated)
+ * Origin resource type - where an execution/task originated from.
+ * Used for audit trails and tracking execution lineage.
  */
-interface ErrorDetailResponse {
-    errors: ErrorRecord[];
-    total: number;
-    page: number;
-    limit: number;
-}
+type OriginResourceType = 'agent' | 'workflow' | 'scheduler' | 'api';
 /**
- * Error trend data for time-series charts
+ * Origin tracking metadata - who/what created this execution/task.
+ * Used by both TaskScheduler and CommandQueue for complete audit trails.
  */
-interface ErrorTrend {
-    time: string;
-    errorCount: number;
-    criticalCount: number;
-    warningCount: number;
-    infoCount: number;
+interface OriginTracking {
+    originExecutionId: string;
+    originResourceType: OriginResourceType;
+    originResourceId: string;
 }
+
 /**
- * Summary of executions for a single resource
- * Used by RecentExecutionsByResource dashboard component
+ * Command queue task with flexible action system
  */
-interface ResourceExecutionSummary {
-    resourceId: string;
-    resourceType: string;
-    resourceName: string | null;
-    lastExecution: string;
-    totalExecutions: number;
-    successCount: number;
-    failureCount: number;
-    warningCount: number;
-    successRate: number;
+interface Task extends OriginTracking {
+    id: string;
+    organizationId: string;
+    actions: ActionConfig[];
+    context: unknown;
+    selectedAction?: string;
+    actionPayload?: unknown;
+    description?: string;
+    priority: number;
+    /** Optional checkpoint identifier for grouping related human approval tasks */
+    humanCheckpoint?: string;
+    status: QueueTaskStatus;
+    /**
+     * Target resource tracking — mirrors origin columns.
+     * Set when task is created; patchable to redirect execution to a different resource.
+     */
+    targetResourceId?: string;
+    targetResourceType?: 'agent' | 'workflow';
+    /**
+     * Execution ID for the action that runs AFTER user approval.
+     * NULL until execution starts.
+     *
+     * Naming distinction:
+     * - originExecutionId = Parent execution that CREATED the HITL task
+     * - targetExecutionId = Child execution that RUNS AFTER user approval
+     */
+    targetExecutionId?: string;
+    createdAt: Date;
+    completedAt?: Date;
+    completedBy?: string;
+    expiresAt?: Date;
+    idempotencyKey?: string | null;
 }
 /**
- * Response from getRecentExecutionsByResource endpoint
+ * Task status values
+ * - pending: awaiting action
+ * - processing: execution in progress after user approval
+ * - completed: action was taken and execution succeeded
+ * - failed: execution failed, task can be retried
+ * - expired: timed out before action
  */
-interface RecentExecutionsByResourceResponse {
-    resources: ResourceExecutionSummary[];
-}
-/** Resource identifier for health queries */
-interface ResourceIdentifier {
-    entityType: string;
-    entityId: string;
-}
-/** Time-bucketed health data point */
-interface ResourceHealthDataPoint {
-    time: string;
-    success: number;
-    failure: number;
-    warning: number;
-    rate: number;
-}
-/** Health data for a single resource */
-interface ResourceHealth {
-    entityType: string;
-    entityId: string;
-    entityName: string | null;
-    trendData: ResourceHealthDataPoint[];
-    summary: {
-        total: number;
-        successRate: number;
-    };
+type QueueTaskStatus = 'pending' | 'processing' | 'completed' | 'failed' | 'expired';
+/**
+ * Parameters for patching mutable metadata on a task
+ */
+interface PatchTaskParams {
+    humanCheckpoint?: string | null;
+    description?: string;
+    priority?: number;
+    context?: Record<string, unknown>;
+    actions?: unknown[];
+    targetResourceId?: string | null;
+    targetResourceType?: 'agent' | 'workflow' | null;
+    targetExecutionId?: string;
+    status?: 'pending' | 'failed' | 'completed';
 }
-/** Batch response with all requested resources */
-interface ResourcesHealthResponse {
-    resources: ResourceHealth[];
+interface CommandQueueListResponse {
+    tasks: Task[];
+    total: number;
 }
+
 /**
- * Cost trend data point for time-series charts
- * Represents a single time bucket (hour or day)
+ * Checkpoint list item for sidebar grouping
+ * The id field contains the resourceId of the human checkpoint
  */
-interface CostTrendDataPoint {
-    time: string;
-    totalCostUsd: number;
-    executionCount: number;
-    avgCostPerExecution: number;
+interface CheckpointListItem {
+    /** Human checkpoint resourceId (or 'ungrouped' for tasks without checkpoint) */
+    id: string;
+    /** Display name (same as id, or "Ungrouped" for null) */
+    name: string;
+    /** Task count for this checkpoint */
+    count: number;
 }
 /**
- * Cost trends response (time-series data)
+ * Status counts for pie chart display
  */
-interface CostTrendsResponse {
-    trendData: CostTrendDataPoint[];
-    granularity: 'hour' | 'day';
-    totalCostUsd: number;
-    totalExecutions: number;
+interface StatusCounts {
+    pending: number;
+    completed: number;
+    expired: number;
 }
 /**
- * Cost summary response with MTD and projections
+ * Priority counts for donut chart display
  */
-interface CostSummaryResponse {
-    current: {
-        totalCostUsd: number;
-        executionCount: number;
-    };
-    previous: {
-        totalCostUsd: number;
-        executionCount: number;
-    };
-    mtd: {
-        totalCostUsd: number;
-        daysElapsed: number;
-    };
-    projection: {
-        monthlyCostUsd: number;
-        confidence: 'low' | 'medium' | 'high';
-    };
-    trend: {
-        changePercent: number;
-        direction: 'up' | 'down' | 'flat';
-    };
+interface PriorityCounts {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
 }
 /**
- * Cost by model data for model-level breakdown
+ * Response from GET /command-queue/checkpoints endpoint
  */
-interface CostByModelData {
-    model: string;
-    totalCostUsd: number;
-    callCount: number;
-    totalInputTokens: number;
-    totalOutputTokens: number;
-    avgCostPerCall: number;
+interface CheckpointListResponse {
+    checkpoints: CheckpointListItem[];
+    /** Total tasks across all checkpoints */
+    total: number;
+    /** Breakdown by status for donut chart */
+    statusCounts: StatusCounts;
+    /** Breakdown by priority for donut chart */
+    priorityCounts: PriorityCounts;
 }
+
 /**
- * Cost by model response
+ * Target for schedule execution - identifies what resource to execute.
+ * Unlike ExecutionTarget, payload is NOT included here because schedules
+ * store payload in the scheduleConfig (varies per step/item).
  */
-interface CostByModelResponse {
-    models: CostByModelData[];
-    totalCostUsd: number;
-    totalCallCount: number;
+interface ScheduleTarget {
+    resourceType: 'agent' | 'workflow';
+    resourceId: string;
 }
-
 /**
- * Supported integration types
- *
- * These represent the available integration adapters that can be used with tools.
- * Each integration type corresponds to an adapter implementation.
- *
- * Note: Concrete adapter implementations are deferred until needed.
- * This type provides compile-time safety and auto-completion for tool definitions.
+ * Optional origin tracking for schedules.
+ * Unlike OriginTracking (which is required), these fields are all optional
+ * for schedules created directly via API (not triggered by another resource).
  */
-type IntegrationType = 'gmail' | 'google-sheets' | 'slack' | 'github' | 'linear' | 'attio' | 'airtable' | 'salesforce' | 'hubspot' | 'stripe' | 'twilio' | 'sendgrid' | 'mailgun' | 'zapier' | 'webhook' | 'apify' | 'instantly' | 'resend' | 'signature-api' | 'dropbox' | 'anymailfinder' | 'tomba' | 'millionverifier';
-
-declare const LinkSchema: z.ZodObject<{
-    nodeId: z.ZodString;
-    kind: z.ZodEnum<{
-        contains: "contains";
-        references: "references";
-        exposes: "exposes";
-        maps_to: "maps_to";
-        "operates-on": "operates-on";
-        uses: "uses";
-    }>;
-}, z.core.$strip>;
-type Link = z.infer<typeof LinkSchema>;
-
-declare const ResourceCategorySchema: z.ZodEnum<{
-    production: "production";
-    diagnostic: "diagnostic";
-    internal: "internal";
-    testing: "testing";
-}>;
-type ResourceCategory = z.infer<typeof ResourceCategorySchema>;
-type ResourceLink = Link;
+interface ScheduleOriginTracking {
+    originExecutionId?: string;
+    originResourceType?: OriginResourceType;
+    originResourceId?: string;
+}
+type TaskScheduleConfig = RecurringScheduleConfig | RelativeScheduleConfig | AbsoluteScheduleConfig;
+interface RecurringScheduleConfig {
+    type: 'recurring';
+    cron?: string;
+    interval?: 'daily' | 'weekly' | 'monthly';
+    time?: string;
+    timezone: string;
+    payload: Record<string, unknown>;
+    endAt?: string | null;
+    overduePolicy?: 'skip' | 'execute';
+}
+interface RelativeScheduleConfig {
+    type: 'relative';
+    anchorAt: string;
+    anchorLabel?: string;
+    items: RelativeScheduleItem[];
+    overduePolicy?: 'skip' | 'execute';
+}
+interface RelativeScheduleItem {
+    offset: string;
+    payload: Record<string, unknown>;
+    label?: string;
+}
+interface AbsoluteScheduleConfig {
+    type: 'absolute';
+    items: AbsoluteScheduleItem[];
+    overduePolicy?: 'skip' | 'execute';
+}
+interface AbsoluteScheduleItem {
+    runAt: string;
+    payload: Record<string, unknown>;
+    label?: string;
+}
+interface TaskSchedule extends ScheduleOriginTracking {
+    id: string;
+    organizationId: string;
+    name: string;
+    description?: string;
+    target: ScheduleTarget;
+    scheduleConfig: TaskScheduleConfig;
+    nextRunAt?: Date;
+    currentStep: number;
+    status: 'active' | 'paused' | 'completed' | 'cancelled';
+    lastRunAt?: Date;
+    lastExecutionId?: string;
+    maxRetries: number;
+    idempotencyKey?: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
 
 /**
- * Resource Registry type definitions
+ * Wire-format DTO for notification API responses.
+ * Dates are ISO 8601 strings (not Date objects like the domain Notification type).
+ * Used by frontend hooks that consume /api/notifications.
  */
+interface NotificationDTO {
+    id: string;
+    userId: string;
+    organizationId: string;
+    category: string;
+    title: string;
+    message: string;
+    actionUrl: string | null;
+    read: boolean;
+    readAt: string | null;
+    createdAt: string;
+}
 
-/**
- * Environment/deployment status for resources
- */
-type ResourceStatus = 'dev' | 'prod';
-/**
- * All resource types in the platform
- * Used as the discriminator field in ResourceDefinition
- */
-type ResourceType = 'agent' | 'workflow' | 'trigger' | 'integration' | 'external' | 'human';
-/**
- * Base interface for ALL platform resources
- * Shared by both executable (agents, workflows) and non-executable (triggers, integrations, etc.) resources
- */
-interface ResourceDefinition {
-    /** Unique resource identifier */
-    resourceId: string;
-    /** Display name */
-    name: string;
-    /** Purpose and functionality description */
-    description: string;
-    /** Version for change tracking and evolution */
-    version: string;
-    /** Resource type discriminator */
-    type: ResourceType;
-    /** Environment/deployment status */
-    status: ResourceStatus;
-    /** Graph links to Organization Model nodes */
-    links?: ResourceLink[];
-    /** Infrastructure category for filtering */
-    category?: ResourceCategory;
-    /** Whether the agent supports multi-turn sessions (agents only) */
-    sessionCapable?: boolean;
-    /** Whether the resource is local (monorepo) or remote (externally deployed) */
-    origin?: 'local' | 'remote';
-    /** Whether this resource is archived and should be excluded from registration and deployment */
-    archived?: boolean;
+type ProjectRow = Database['public']['Tables']['prj_projects']['Row'];
+type ProjectUpdate = Database['public']['Tables']['prj_projects']['Update'];
+type MilestoneRow = Database['public']['Tables']['prj_milestones']['Row'];
+type MilestoneUpdate = Database['public']['Tables']['prj_milestones']['Update'];
+type TaskRow = Database['public']['Tables']['prj_tasks']['Row'];
+type TaskUpdate = Database['public']['Tables']['prj_tasks']['Update'];
+type ProjectStatus = 'active' | 'on_track' | 'at_risk' | 'blocked' | 'completed' | 'paused';
+type ProjectKind = 'client_engagement' | 'internal' | 'research' | 'other';
+type MilestoneStatus = 'upcoming' | 'in_progress' | 'completed' | 'overdue' | 'blocked';
+type TaskStatus = 'planned' | 'in_progress' | 'blocked' | 'completed' | 'cancelled' | 'submitted' | 'approved' | 'rejected' | 'revision_requested';
+type TaskType = 'documentation' | 'code' | 'report' | 'design' | 'other';
+type NoteType = 'call_note' | 'status_update' | 'issue' | 'blocker' | 'agent_learning';
+interface ProjectFilters {
+    status?: ProjectStatus;
+    kind?: ProjectKind;
+    companyId?: string;
+    search?: string;
 }
-/** Webhook provider identifiers */
-type WebhookProviderType = 'cal-com' | 'stripe' | 'signature-api' | 'instantly' | 'apify' | 'test';
-/** Webhook trigger configuration */
-interface WebhookTriggerConfig {
-    /** Provider identifier */
-    provider: WebhookProviderType;
-    /** Event type for documentation (not used for matching - workflow handles routing) */
-    event?: string;
-    /** Optional filtering (e.g., specific form ID for Fillout) */
-    filter?: Record<string, string>;
-    /** References credential in credentials table for per-org webhook secrets */
-    credentialName?: string;
+interface MilestoneFilters {
+    status?: MilestoneStatus;
+    projectId?: string;
 }
-/** Schedule trigger configuration */
-interface ScheduleTriggerConfig {
-    /** Cron expression (e.g., '0 6 * * *') */
-    cron: string;
-    /** Optional timezone (default: UTC) */
-    timezone?: string;
+interface TaskFilters {
+    status?: TaskStatus;
+    type?: TaskType;
+    milestoneId?: string;
+    projectId?: string;
 }
-/** Event trigger configuration */
-interface EventTriggerConfig {
-    /** Internal event type */
-    eventType: string;
-    /** Event source */
-    source?: string;
+interface NoteFilters {
+    type?: NoteType;
+    projectId?: string;
 }
-/** Union of all trigger configs */
-type TriggerConfig = WebhookTriggerConfig | ScheduleTriggerConfig | EventTriggerConfig;
+interface ProjectWithCounts extends ProjectRow {
+    milestoneCount: number;
+    taskCount: number;
+    completedMilestones?: number;
+    completedTasks?: number;
+}
+interface ProjectDetail extends ProjectRow {
+    milestones: MilestoneRow[];
+    tasks: TaskRow[];
+    company: {
+        id: string;
+        name: string;
+        domain: string | null;
+    } | null;
+}
+
+declare const ListCompaniesQuerySchema: z.ZodObject<{
+    search: z.ZodOptional<z.ZodString>;
+    listId: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    website: z.ZodOptional<z.ZodString>;
+    segment: z.ZodOptional<z.ZodString>;
+    category: z.ZodOptional<z.ZodString>;
+    batchId: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        invalid: "invalid";
+    }>>;
+    includeAll: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodBoolean>>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strict>;
+declare const ListContactsQuerySchema: z.ZodObject<{
+    search: z.ZodOptional<z.ZodString>;
+    listId: z.ZodOptional<z.ZodString>;
+    openingLineIsNull: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodBoolean>>;
+    batchId: z.ZodOptional<z.ZodString>;
+    contactStatus: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        invalid: "invalid";
+    }>>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strict>;
+declare const AcqCompanyResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    domain: z.ZodNullable<z.ZodString>;
+    linkedinUrl: z.ZodNullable<z.ZodString>;
+    website: z.ZodNullable<z.ZodString>;
+    numEmployees: z.ZodNullable<z.ZodNumber>;
+    foundedYear: z.ZodNullable<z.ZodNumber>;
+    locationCity: z.ZodNullable<z.ZodString>;
+    locationState: z.ZodNullable<z.ZodString>;
+    category: z.ZodNullable<z.ZodString>;
+    categoryPain: z.ZodNullable<z.ZodString>;
+    segment: z.ZodNullable<z.ZodString>;
+    pipelineStatus: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    enrichmentData: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    source: z.ZodNullable<z.ZodString>;
+    batchId: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        active: "active";
+        invalid: "invalid";
+    }>;
+    contactCount: z.ZodNumber;
+    verticalResearch: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+declare const AcqContactResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    companyId: z.ZodNullable<z.ZodString>;
+    email: z.ZodString;
+    emailValid: z.ZodNullable<z.ZodEnum<{
+        VALID: "VALID";
+        INVALID: "INVALID";
+        RISKY: "RISKY";
+        UNKNOWN: "UNKNOWN";
+    }>>;
+    firstName: z.ZodNullable<z.ZodString>;
+    lastName: z.ZodNullable<z.ZodString>;
+    linkedinUrl: z.ZodNullable<z.ZodString>;
+    title: z.ZodNullable<z.ZodString>;
+    headline: z.ZodNullable<z.ZodString>;
+    filterReason: z.ZodNullable<z.ZodString>;
+    openingLine: z.ZodNullable<z.ZodString>;
+    source: z.ZodNullable<z.ZodString>;
+    sourceId: z.ZodNullable<z.ZodString>;
+    pipelineStatus: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    enrichmentData: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    attioPersonId: z.ZodNullable<z.ZodString>;
+    batchId: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        active: "active";
+        invalid: "invalid";
+    }>;
+    company: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        domain: z.ZodNullable<z.ZodString>;
+        website: z.ZodNullable<z.ZodString>;
+        linkedinUrl: z.ZodNullable<z.ZodString>;
+        segment: z.ZodNullable<z.ZodString>;
+        category: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            invalid: "invalid";
+        }>;
+    }, z.core.$strip>>>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+type ListCompaniesQuery = z.infer<typeof ListCompaniesQuerySchema>;
+type ListContactsQuery = z.infer<typeof ListContactsQuerySchema>;
+type AcqCompanyResponse = z.infer<typeof AcqCompanyResponseSchema>;
+type AcqContactResponse = z.infer<typeof AcqContactResponseSchema>;
+
+type MessageType = MessageEvent['type'];
 /**
- * Trigger metadata - entry points that initiate resource execution
- *
- * Triggers represent how executions start: webhooks from external services,
- * scheduled cron jobs, platform events, or manual user actions.
- *
- * BREAKING CHANGES (2025-11-30):
- * - Now extends ResourceDefinition (inherits: resourceId, name, description, version, type, status, links, category)
- * - Field renames: `id` -> `resourceId` (inherited), `type` -> `triggerType`
- * - Relationship rename: `invokes` -> `triggers` (unified vocabulary)
- * - New required fields: `version` (inherited), `type: 'trigger'` (inherited)
- * - triggers object now includes `externalResources` option
- *
- * @example
- * // TriggerDefinition - metadata only
- * {
- *   resourceId: 'trigger-new-order',
- *   type: 'trigger',
- *   triggerType: 'webhook',
- *   name: 'New Order',
- *   description: 'Webhook from Shopify on new orders',
- *   version: '1.0.0',
- *   status: 'prod',
- *   webhookPath: '/webhooks/shopify/orders'
- * }
- *
- * // Relationships declared in ResourceRelationships (not on TriggerDefinition):
- * // relationships: {
- * //   'trigger-new-order': { triggers: { workflows: ['order-fulfillment-workflow'] } }
- * // }
+ * Session Data Transfer Object (DTO)
+ * Transform type for API responses (snake_case DB → camelCase frontend)
+ * Used by frontend apps to display session data
  */
-interface TriggerDefinition extends ResourceDefinition {
-    /** Resource type discriminator (narrowed from base union) */
-    type: 'trigger';
-    /** Trigger mechanism type (renamed from 'type' to avoid collision with base type discriminator) */
-    triggerType: 'webhook' | 'schedule' | 'manual' | 'event';
-    /** Type-specific configuration */
-    config?: TriggerConfig;
-    /** For webhook triggers: path like '/webhooks/shopify/orders' */
-    webhookPath?: string;
-    /** For schedule triggers: cron expression like '0 6 * * *' */
-    schedule?: string;
-    /** For event triggers: event type like 'low-stock-alert' */
-    eventType?: string;
+interface SessionDTO {
+    sessionId: string;
+    resourceId: string;
+    organizationId: string;
+    userId?: string | null;
+    turnCount: number;
+    isEnded: boolean;
+    title?: string | null;
+    memorySnapshot?: AgentMemory;
+    metadata?: Record<string, unknown> | null;
+    createdAt: Date;
+    updatedAt: Date;
+    endedAt?: Date | null;
+}
+interface ChatMessage {
+    id: string;
+    role: 'user' | 'assistant';
+    messageType: MessageType;
+    text: string;
+    metadata?: MessageEvent;
+    turnNumber: number;
+    messageIndex?: number;
+    createdAt: Date;
+}
+/** Token usage data sent with turn:complete WebSocket events */
+interface SessionTokenUsage {
+    /** Tokens consumed by this turn's input */
+    turnInputTokens: number;
+    /** Tokens generated by this turn's output */
+    turnOutputTokens: number;
+    /** Total tokens for this turn (turnInputTokens + turnOutputTokens) */
+    turnTotalTokens: number;
+    /** Cumulative input tokens across all turns in this session */
+    cumulativeInputTokens: number;
+    /** Cumulative output tokens across all turns in this session */
+    cumulativeOutputTokens: number;
+    /** The model's context window size for this session (e.g., 200K) */
+    contextWindowSize: number;
 }
+
 /**
- * Integration metadata - external service connections
- *
- * References credentials table for actual connection. No connection status
- * stored here (queried at runtime from credentials table).
- *
- * BREAKING CHANGES (2025-11-30):
- * - Now extends ResourceDefinition (inherits: resourceId, name, description, version, type, status, links, category)
- * - Field renames: `id` -> `resourceId` (inherited)
- * - New required field: `status` (inherited) - organizations must add status to all integrations
- * - New required field: `version` (inherited) - organizations must add version to all integrations
- * - New required field: `type: 'integration'` (inherited) - resource type discriminator
+ * Multi-tenancy configuration types
  *
- * @example
- * {
- *   resourceId: 'integration-shopify-prod',
- *   type: 'integration',
- *   provider: 'shopify',
- *   credentialName: 'shopify-prod',
- *   name: 'Shopify Production',
- *   description: 'E-commerce platform',
- *   version: '1.0.0',
- *   status: 'prod'
- * }
+ * Config is stored in dedicated `config` columns (NOT nested in metadata):
+ * - organizations.config: Org-level config (no feature toggles -- all features available by default)
+ * - org_memberships.config: Per-user-per-org feature overrides
+ * - users.config: User-global config
  */
-interface IntegrationDefinition extends ResourceDefinition {
-    /** Resource type discriminator (narrowed from base union) */
-    type: 'integration';
-    /** Integration provider type */
-    provider: IntegrationType;
-    /** References credentials table (e.g., 'shopify-prod', 'zendesk-api') */
-    credentialName: string;
-}
-/**
- * External platform type
- * Supported third-party automation platforms
- */
-type ExternalPlatform = 'n8n' | 'make' | 'zapier' | 'other';
 /**
- * External automation resource metadata
- *
- * Represents workflows/automations running on third-party platforms
- * (n8n, Make, Zapier, etc.) for visualization in Command View.
- *
- * NOTE: This is metadata ONLY for visualization. No execution logic,
- * no API integration with external platforms, no status syncing.
- *
- * BREAKING CHANGES (2025-11-30):
- * - Now extends ResourceDefinition (inherits: resourceId, name, description, version, type, status, links, category)
- * - Field renames: `id` -> `resourceId` (inherited)
- * - New required field: `version` (inherited) - organizations must add version to all external resources
- * - New required field: `type: 'external'` (inherited) - resource type discriminator
- * - REMOVED FIELD: `triggeredBy` - per relationship-consolidation design, all relationships are forward-only declarations
- *
- * @example
- * {
- *   resourceId: 'external-n8n-order-sync',
- *   type: 'external',
- *   version: '1.0.0',
- *   platform: 'n8n',
- *   name: 'Shopify Order Sync',
- *   description: 'Legacy n8n workflow for syncing Shopify orders',
- *   status: 'prod',
- *   platformUrl: 'https://n8n.client.com/workflow/123',
- *   triggers: { workflows: ['order-fulfillment-workflow'] },
- *   uses: { integrations: ['integration-shopify-prod'] }
- * }
+ * Per-user-per-org config (stored in org_memberships.config)
+ * Controls which features a specific member can access within their org.
+ * Keys are feature IDs from the organization model (e.g. crm, lead-gen, projects, seo).
  */
-interface ExternalResourceDefinition extends ResourceDefinition {
-    /** Resource type discriminator (narrowed from base union) */
-    type: 'external';
-    /** Platform type */
-    platform: ExternalPlatform;
-    /** Link to external platform (e.g., n8n workflow editor URL) */
-    platformUrl?: string;
-    /** Platform's internal ID/reference */
-    externalId?: string;
-    /** What this external resource triggers (external -> internal) */
-    triggers?: {
-        /** Elevasis workflow resourceIds this external automation triggers */
-        workflows?: string[];
-        /** Elevasis agent resourceIds this external automation triggers */
-        agents?: string[];
-    };
-    /** Integrations this external resource uses (shared credentials) */
-    uses?: {
-        /** Integration IDs this external automation uses */
-        integrations?: string[];
-    };
+interface MembershipFeatureConfig {
+    features?: Record<string, boolean>;
 }
 /**
- * Human Checkpoint definition - human decision points in automation
- *
- * Represents where human judgment is deployed in the automation landscape.
- * Tasks with matching command_queue_group are routed to this checkpoint.
- *
- * BREAKING CHANGES (2025-11-30):
- * - Now extends ResourceDefinition (inherits: resourceId, name, description, version, type, status, links, category)
- * - Field renames: `id` -> `resourceId` (inherited)
- * - description is now REQUIRED (was optional) - organizations must add description to all human checkpoints
- * - New required field: `version` (inherited) - organizations must add version to all human checkpoints
- * - New required field: `type: 'human'` (inherited) - resource type discriminator
- *
- * @example
- * {
- *   resourceId: 'sales-approval',
- *   type: 'human',
- *   name: 'Sales Approval Queue',
- *   description: 'High-value order approvals for sales team',
- *   version: '1.0.0',
- *   status: 'prod',
- *   requestedBy: { agents: ['order-processor-agent'] },
- *   routesTo: { agents: ['order-fulfillment-agent'] }
- * }
+ * User-global config (stored in users.config)
+ * Theme and onboarding are user-specific, NOT org-specific
  */
-interface HumanCheckpointDefinition extends ResourceDefinition {
-    /** Resource type discriminator (narrowed from base union) */
-    type: 'human';
-    /** Resources that create tasks for this checkpoint */
-    requestedBy?: {
-        /** Agent resourceIds that request approval here */
-        agents?: string[];
-        /** Workflow resourceIds that request approval here */
-        workflows?: string[];
+interface UserConfig {
+    theme?: {
+        preset?: 'default' | 'tactical' | 'regal' | 'cyber-volt' | 'aurora' | 'rose-gold' | 'midnight' | 'titanium' | 'obsidian' | 'honey' | 'abyss' | 'canopy' | 'slate' | 'cyber-strike' | 'cyber-chrome' | 'cyber-void' | 'nirvana' | 'wave' | 'synapse' | 'cortex' | 'helios' | 'graphite' | 'quarry' | 'canyon' | 'nord' | 'catppuccin' | 'tokyo-night' | 'gruvbox';
+        colorScheme?: 'light' | 'dark' | 'auto';
     };
-    /** Resources that receive approved decisions */
-    routesTo?: {
-        /** Agent resourceIds that handle approved tasks */
-        agents?: string[];
-        /** Workflow resourceIds that handle approved tasks */
-        workflows?: string[];
+    onboarding?: {
+        completed?: boolean;
+        completedAt?: string;
+        role?: string;
+        primaryUseCase?: string[];
+        experienceLevel?: string;
+        /** Onboarding guide system state (set by checklist/tour system) */
+        guides?: {
+            completedIds?: string[];
+            dismissed?: boolean;
+            completedAt?: string;
+        };
     };
 }
 
 /**
- * Command View Types
+ * Memberships Domain - Zod Validation Schemas
  *
- * Unified type definitions for the Command View graph visualization.
- * These types are used by both backend serialization and frontend rendering.
+ * Validation schemas for membership management endpoints.
+ * Includes request bodies, query params, and path params.
  *
- * Command View shows the resource graph: agents, workflows, triggers, integrations,
- * external resources, and human checkpoints with their relationships.
+ * Security:
+ * - All schemas use .strict() to prevent mass assignment attacks
+ * - UUID validation prevents invalid references
+ * - Role enum validation prevents privilege escalation
+ * - organizationId never accepted in body (from JWT when needed)
  */
 
 /**
- * Extended agent metadata for Command View
- * Includes model and capability information for graph display
+ * Membership status validation
+ * Note: Database constraint only allows 'active' | 'inactive'
  */
-interface CommandViewAgent extends ResourceDefinition {
-    type: 'agent';
-    modelProvider: string;
-    modelId: string;
-    toolCount: number;
-    hasKnowledgeMap: boolean;
-    hasMemory: boolean;
-    sessionCapable: boolean;
-}
+declare const MembershipStatusSchema: z.ZodEnum<{
+    active: "active";
+    inactive: "inactive";
+}>;
+type MembershipStatus = z.infer<typeof MembershipStatusSchema>;
+
 /**
- * Extended workflow metadata for Command View
- * Includes step information for graph display
+ * Organization Membership types based on WorkOS API
  */
-interface CommandViewWorkflow extends ResourceDefinition {
-    type: 'workflow';
-    stepCount: number;
-    entryPoint: string;
+interface OrganizationMembership {
+    object: 'organization_membership';
+    id: string;
+    userId: string;
+    organizationId: string;
+    role: {
+        slug: string;
+    };
+    status: 'active' | 'inactive';
+    createdAt: string;
+    updatedAt: string;
 }
 /**
- * Relationship types between resources
- *
- * - triggers: Resource initiates/starts another resource (orange)
- * - uses: Resource uses an integration (teal)
- * - approval: Resource requires human approval (yellow)
+ * Request interfaces for membership operations
  */
-type RelationshipType$1 = 'triggers' | 'uses' | 'approval';
+interface CreateMembershipRequest {
+    userId: string;
+    organizationId: string;
+    roleSlug?: string;
+}
+interface UpdateMembershipRequest {
+    roleSlug: string;
+}
+interface ListMembershipsParams {
+    userId?: string;
+    organizationId?: string;
+    statuses?: MembershipStatus[];
+    limit?: number;
+    before?: string;
+    after?: string;
+    order?: 'asc' | 'desc';
+}
 /**
- * Command View edge (relationship between resources)
+ * Response interfaces
  */
-interface CommandViewEdge$1 {
-    id: string;
-    source: string;
-    target: string;
-    relationship: RelationshipType$1;
-    label?: string;
+interface ListMembershipsResponse {
+    data: OrganizationMembership[];
+    listMetadata?: {
+        before?: string | null;
+        after?: string | null;
+    };
 }
 /**
- * Command View data structure
- * Complete graph data for visualization
- *
- * Backend serializes this once at startup and serves it via /command-view endpoint.
- * Frontend consumes this directly for graph rendering.
+ * Extended membership with user and organization details for UI
  */
-interface CommandViewData {
-    workflows: CommandViewWorkflow[];
-    agents: CommandViewAgent[];
-    triggers: TriggerDefinition[];
-    integrations: IntegrationDefinition[];
-    externalResources: ExternalResourceDefinition[];
-    humanCheckpoints: HumanCheckpointDefinition[];
-    edges: CommandViewEdge$1[];
+interface MembershipWithDetails extends OrganizationMembership {
+    user?: {
+        id: string;
+        email: string;
+        firstName?: string;
+        lastName?: string;
+        profilePictureUrl?: string;
+    };
+    organization?: {
+        id: string;
+        name: string;
+        workos_org_id: string;
+        primaryDomain?: string;
+        is_test?: boolean;
+        status?: string;
+        metadata?: Record<string, unknown>;
+        config?: Record<string, unknown>;
+    };
+    config?: MembershipFeatureConfig;
 }
 
 /**
- * Serialized Registry Types
- *
- * Pre-computed JSON-safe types for API responses and Command View.
- * Serialization happens once at API startup, enabling instant response times.
+ * Time range selector for dashboard metrics
  */
-
+type TimeRange = '1h' | '24h' | '7d' | '30d';
 /**
- * Serialized form field for API responses
+ * Execution health metrics response
+ * Success rate, P95 duration, execution counts, and trend data
+ * trendData includes executionCount for throughput visualization (eliminates separate API call)
  */
-interface SerializedFormField {
-    name: string;
-    label: string;
-    type: FormFieldType;
-    defaultValue?: unknown;
-    required?: boolean;
-    placeholder?: string;
-    description?: string;
-    options?: Array<{
-        label: string;
-        value: string | number;
+interface ExecutionHealthMetrics {
+    successRate: number;
+    p95Duration: number;
+    totalExecutions: number;
+    trendData: Array<{
+        time: string;
+        rate: number;
+        successCount: number;
+        errorCount: number;
+        warningCount: number;
+        executionCount: number;
     }>;
-    min?: number;
-    max?: number;
+    statusCounts: {
+        success: number;
+        failed: number;
+        pending: number;
+        warning: number;
+    };
+    peakPeriod: string;
+    granularity: 'hour' | 'day';
 }
 /**
- * Serialized form schema for API responses
+ * Error analysis metrics response
+ * Error categories and top failing resources
  */
-interface SerializedFormSchema {
-    title?: string;
-    description?: string;
-    fields: SerializedFormField[];
-    layout?: 'vertical' | 'horizontal' | 'grid';
+interface ErrorAnalysisMetrics {
+    totalErrors: number;
+    errorsByCategory: Array<{
+        category: string;
+        count: number;
+        percentage: number;
+    }>;
+    topFailingResources: Array<{
+        resourceId: string;
+        name: string;
+        errorCount: number;
+        failureRate: number;
+    }>;
 }
 /**
- * Serialized execution form schema for API responses
+ * Business impact metrics response
+ * ROI, labor savings, and cost analysis
  */
-interface SerializedExecutionFormSchema extends SerializedFormSchema {
-    fieldMappings?: Record<string, string>;
-    submitButton?: {
-        label?: string;
-        loadingLabel?: string;
-        confirmMessage?: string;
-    };
+interface BusinessImpactMetrics$1 {
+    totalSavingsUsd: number;
+    totalCostUsd: number;
+    netSavingsUsd: number;
+    roi: number;
 }
 /**
- * Serialized schedule config for API responses
+ * Cost breakdown metrics response
+ * Per-resource cost analysis
  */
-interface SerializedScheduleConfig {
-    enabled: boolean;
-    defaultSchedule?: string;
-    allowedPatterns?: string[];
+interface CostBreakdownMetrics {
+    resources: Array<{
+        resourceId: string;
+        totalCostUsd: number;
+        executionCount: number;
+        avgCostUsd: number;
+    }>;
 }
 /**
- * Serialized webhook config for API responses
+ * Dashboard metrics response
+ * Aggregates core observability metrics in a single response
+ * Note: Throughput data is now included in executionHealth.trendData.executionCount
  */
-interface SerializedWebhookConfig {
-    enabled: boolean;
-    payloadSchema?: unknown;
+interface DashboardMetrics {
+    executionHealth: ExecutionHealthMetrics;
+    costBreakdown: CostBreakdownMetrics;
+    businessImpact: BusinessImpactMetrics$1;
+    /** ISO timestamp of the currently active deployment, or null if none */
+    activeDeploymentDate: string | null;
+    /** Deployment version of the active deployment, or null if none */
+    activeDeploymentVersion: string | null;
 }
 /**
- * Serialized execution interface for API responses
+ * Error record for list view (ErrorBreakdownTable)
  */
-interface SerializedExecutionInterface {
-    form: SerializedExecutionFormSchema;
-    schedule?: SerializedScheduleConfig;
-    webhook?: SerializedWebhookConfig;
+interface ErrorRecord {
+    id: string;
+    timestamp: string;
+    errorType: string;
+    message: string;
+    executionId: string;
+    resourceId: string;
+    resourceName: string;
+    severity: 'critical' | 'warning' | 'info';
+    category: ExecutionErrorCategory;
+    resolved: boolean;
+    resolvedAt: string | null;
+    resolvedBy: string | null;
 }
 /**
- * Serialized agent definition (JSON-safe)
- * Result of serializeDefinition(AgentDefinition)
+ * Full error detail for modal view (ErrorDetailsModal)
  */
-interface SerializedAgentDefinition {
-    config: {
-        resourceId: string;
-        name: string;
-        description: string;
-        version: string;
-        type: 'agent';
-        status: 'dev' | 'prod';
-        links?: ResourceLink[];
-        category?: ResourceCategory;
-        /** Whether this resource is archived and should be excluded from registration and deployment */
-        archived?: boolean;
-        systemPrompt: string;
-        constraints?: {
-            maxIterations?: number;
-            timeout?: number;
-            maxSessionMemoryKeys?: number;
-            maxMemoryTokens?: number;
-        };
-        sessionCapable?: boolean;
-        memoryPreferences?: string;
-    };
-    modelConfig: {
-        provider: string;
-        model: string;
-        apiKey: string;
-        temperature: number;
-        maxOutputTokens: number;
-        topP?: number;
-        modelOptions?: Record<string, unknown>;
-    };
-    contract: {
-        inputSchema: object;
-        outputSchema?: object;
-    };
-    tools: Array<{
-        name: string;
-        description: string;
-        inputSchema?: object;
-        outputSchema?: object;
-    }>;
-    knowledgeMap?: {
-        nodeCount: number;
-        nodes: Array<{
-            id: string;
-            description: string;
-            loaded: boolean;
-            hasPrompt: boolean;
-        }>;
-    };
-    metricsConfig?: object;
-    interface?: SerializedExecutionInterface;
+interface ErrorDetailFull extends ErrorRecord {
+    stackTrace?: string;
+    retryAttempt?: number;
+    stepName?: string;
+    stepSequence?: number;
+    errorContext?: Record<string, unknown>;
+    executionContext?: Record<string, unknown>;
 }
 /**
- * Serialized workflow definition (JSON-safe)
- * Result of serializeDefinition(WorkflowDefinition)
+ * Error details API response (paginated)
  */
-interface SerializedWorkflowDefinition {
-    config: {
-        resourceId: string;
-        name: string;
-        description: string;
-        version: string;
-        type: 'workflow';
-        status: 'dev' | 'prod';
-        links?: ResourceLink[];
-        category?: ResourceCategory;
-        /** Whether this resource is archived and should be excluded from registration and deployment */
-        archived?: boolean;
-    };
-    entryPoint: string;
-    steps: Array<{
-        id: string;
-        name: string;
-        description: string;
-        inputSchema?: object;
-        outputSchema?: object;
-        next: {
-            type: 'linear' | 'conditional';
-            target?: string;
-            routes?: Array<{
-                target: string;
-            }>;
-            default?: string;
-        } | null;
-    }>;
-    contract: {
-        inputSchema: object;
-        outputSchema?: object;
-    };
-    metricsConfig?: object;
-    interface?: SerializedExecutionInterface;
+interface ErrorDetailResponse {
+    errors: ErrorRecord[];
+    total: number;
+    page: number;
+    limit: number;
 }
-
 /**
- * Base Execution Engine type definitions
- * Core types shared across all Execution Engine resources
+ * Error trend data for time-series charts
  */
-
+interface ErrorTrend {
+    time: string;
+    errorCount: number;
+    criticalCount: number;
+    warningCount: number;
+    infoCount: number;
+}
 /**
- * Unified message event type - covers all message types in sessions
- * Replaces separate SessionTurnMessages and AgentActivityEvent mechanisms
+ * Summary of executions for a single resource
+ * Used by RecentExecutionsByResource dashboard component
  */
+interface ResourceExecutionSummary {
+    resourceId: string;
+    resourceType: string;
+    resourceName: string | null;
+    lastExecution: string;
+    totalExecutions: number;
+    successCount: number;
+    failureCount: number;
+    warningCount: number;
+    successRate: number;
+}
 /**
- * Structured action metadata attached to assistant messages.
- * Frontend reads this instead of parsing text prefixes.
+ * Response from getRecentExecutionsByResource endpoint
  */
-type AssistantAction = {
-    kind: 'navigate';
-    path: string;
-    reason: string;
-} | {
-    kind: 'update_filters';
-    timeRange: string | null;
-    statusFilter: string | null;
-    searchQuery: string | null;
-};
-type MessageEvent = {
-    type: 'user_message';
+interface RecentExecutionsByResourceResponse {
+    resources: ResourceExecutionSummary[];
+}
+/** Resource identifier for health queries */
+interface ResourceIdentifier {
+    entityType: string;
+    entityId: string;
+}
+/** Time-bucketed health data point */
+interface ResourceHealthDataPoint {
+    time: string;
+    success: number;
+    failure: number;
+    warning: number;
+    rate: number;
+}
+/** Health data for a single resource */
+interface ResourceHealth {
+    entityType: string;
+    entityId: string;
+    entityName: string | null;
+    trendData: ResourceHealthDataPoint[];
+    summary: {
+        total: number;
+        successRate: number;
+    };
+}
+/** Batch response with all requested resources */
+interface ResourcesHealthResponse {
+    resources: ResourceHealth[];
+}
+/**
+ * Cost trend data point for time-series charts
+ * Represents a single time bucket (hour or day)
+ */
+interface CostTrendDataPoint {
+    time: string;
+    totalCostUsd: number;
+    executionCount: number;
+    avgCostPerExecution: number;
+}
+/**
+ * Cost trends response (time-series data)
+ */
+interface CostTrendsResponse {
+    trendData: CostTrendDataPoint[];
+    granularity: 'hour' | 'day';
+    totalCostUsd: number;
+    totalExecutions: number;
+}
+/**
+ * Cost summary response with MTD and projections
+ */
+interface CostSummaryResponse {
+    current: {
+        totalCostUsd: number;
+        executionCount: number;
+    };
+    previous: {
+        totalCostUsd: number;
+        executionCount: number;
+    };
+    mtd: {
+        totalCostUsd: number;
+        daysElapsed: number;
+    };
+    projection: {
+        monthlyCostUsd: number;
+        confidence: 'low' | 'medium' | 'high';
+    };
+    trend: {
+        changePercent: number;
+        direction: 'up' | 'down' | 'flat';
+    };
+}
+/**
+ * Cost by model data for model-level breakdown
+ */
+interface CostByModelData {
+    model: string;
+    totalCostUsd: number;
+    callCount: number;
+    totalInputTokens: number;
+    totalOutputTokens: number;
+    avgCostPerCall: number;
+}
+/**
+ * Cost by model response
+ */
+interface CostByModelResponse {
+    models: CostByModelData[];
+    totalCostUsd: number;
+    totalCallCount: number;
+}
+
+/**
+ * Base Execution Engine type definitions
+ * Core types shared across all Execution Engine resources
+ */
+
+/**
+ * Unified message event type - covers all message types in sessions
+ * Replaces separate SessionTurnMessages and AgentActivityEvent mechanisms
+ */
+/**
+ * Structured action metadata attached to assistant messages.
+ * Frontend reads this instead of parsing text prefixes.
+ */
+type AssistantAction = {
+    kind: 'navigate';
+    path: string;
+    reason: string;
+} | {
+    kind: 'update_filters';
+    timeRange: string | null;
+    statusFilter: string | null;
+    searchQuery: string | null;
+};
+type MessageEvent = {
+    type: 'user_message';
     text: string;
 } | {
     type: 'assistant_message';
@@ -3784,717 +4288,502 @@ type MessageEvent = {
  */
 type AIResourceDefinition = SerializedWorkflowDefinition | SerializedAgentDefinition;
 
-type SupabaseUserProfile = Tables<'users'>;
-type SupabaseApiKey = Tables<'api_keys'>;
-/** API response type for API key list items (omits sensitive key_hash) */
-type ApiKeyListItem = Omit<SupabaseApiKey, 'key_hash'>;
-
-/** Raw database row type for acq_deals table */
-type AcqDealRow = Database['public']['Tables']['acq_deals']['Row'];
-type DealStage = 'interested' | 'proposal' | 'closing' | 'closed_won' | 'closed_lost' | 'nurturing';
-interface DealContact {
-    id: string;
-    first_name: string | null;
-    last_name: string | null;
-    email: string;
-    title: string | null;
-    headline: string | null;
-    linkedin_url: string | null;
-    pipeline_status: Record<string, unknown> | null;
-    enrichment_data: Record<string, unknown> | null;
-    company: {
-        id: string;
-        name: string;
-        domain: string | null;
-        website: string | null;
-        linkedin_url: string | null;
-        segment: string | null;
-        category: string | null;
-        num_employees: number | null;
-    } | null;
-}
-interface DealFilters {
-    stage?: DealStage;
-    search?: string;
-    limit?: number;
-    offset?: number;
-}
-/** Deal list item with joined contact and company data */
-interface DealListItem extends AcqDealRow {
-    contact: DealContact | null;
-}
-type DealDetail = DealListItem;
-/** Task kind options for a deal task (human follow-up action type) */
-type AcqDealTaskKind = 'call' | 'email' | 'meeting' | 'other';
 /**
- * A CRM to-do item attached to a deal representing a human follow-up action.
- * Transformed from AcqDealTaskRow with camelCase properties.
+ * Supported integration types
+ *
+ * These represent the available integration adapters that can be used with tools.
+ * Each integration type corresponds to an adapter implementation.
+ *
+ * Note: Concrete adapter implementations are deferred until needed.
+ * This type provides compile-time safety and auto-completion for tool definitions.
  */
-interface AcqDealTask {
-    id: string;
-    organizationId: string;
-    dealId: string;
-    title: string;
-    description: string | null;
-    kind: AcqDealTaskKind;
-    dueAt: string | null;
-    assigneeUserId: string | null;
-    completedAt: string | null;
-    completedByUserId: string | null;
-    createdAt: string;
-    updatedAt: string;
-    createdByUserId: string | null;
-}
+type IntegrationType = 'gmail' | 'google-sheets' | 'slack' | 'github' | 'linear' | 'attio' | 'airtable' | 'salesforce' | 'hubspot' | 'stripe' | 'twilio' | 'sendgrid' | 'mailgun' | 'zapier' | 'webhook' | 'apify' | 'instantly' | 'resend' | 'signature-api' | 'dropbox' | 'anymailfinder' | 'tomba' | 'millionverifier';
+
 /**
- * Live-scan aggregate telemetry for a single list, computed on demand from
- * the list junction tables and current contact deliverability state.
+ * Resource Registry type definitions
  */
-interface ListTelemetry {
-    listId: string;
-    totalCompanies: number;
-    totalContacts: number;
-    stageCounts: {
-        populated: number;
-        extracted: number;
-        qualified: number;
-        discovered: number;
-        verified: number;
-        personalized: number;
-        uploaded: number;
-    };
-    deliverability: {
-        valid: number;
-        risky: number;
-        invalid: number;
-        unknown: number;
-        bounced: number;
-    };
-    /** Reserved -- active workflow IDs associated with this list. */
-    activeWorkflows?: string[];
-}
 
 /**
- * Lead Service Types
- * CRUD operation types for the acquisition platform (lists, companies, contacts, deals)
- *
- * Implementation: apps/api/src/acquisition/lead-service.ts (LeadService class)
+ * Environment/deployment status for resources
  */
-
-interface AcqDealNote {
-    id: string;
-    dealId: string;
-    organizationId: string;
-    authorUserId: string | null;
-    body: string;
-    createdAt: string;
-    updatedAt: string;
-}
-
+type ResourceStatus = 'dev' | 'prod';
 /**
- * Action configuration for HITL tasks
- * Defines available user actions and their behavior
+ * All resource types in the platform
+ * Used as the discriminator field in ResourceDefinition
  */
-interface ActionConfig {
-    /** Unique action identifier (e.g., 'approve', 'retry', 'escalate') */
-    id: string;
-    /** Display label for UI button */
-    label: string;
-    /** Button variant/style */
-    type: 'primary' | 'secondary' | 'danger' | 'outline';
-    /** Tabler icon name (e.g., 'IconCheck', 'IconRefresh') */
-    icon?: string;
-    /** Button color (Mantine theme colors) */
-    color?: string;
-    /** Button variant (Mantine button variant, e.g., 'light', 'filled', 'outline') */
-    variant?: string;
-    /** Execution target (agent/workflow to invoke) */
-    target?: {
-        resourceType: 'agent' | 'workflow';
-        resourceId: string;
-        /**
-         * Optional session ID for agent continuation.
-         * If provided, invokes a new turn on the existing session instead of standalone execution.
-         * Only valid when resourceType is 'agent'.
-         */
-        sessionId?: string;
-    };
-    /** Form schema for collecting action-specific data */
-    form?: FormSchema;
-    /** Payload template for pre-filling forms */
-    payloadTemplate?: unknown;
-    /** Requires confirmation dialog */
-    requiresConfirmation?: boolean;
-    /** Confirmation message */
-    confirmationMessage?: string;
-    /** Help text / tooltip */
-    description?: string;
-}
-
-/**
- * Origin resource type - where an execution/task originated from.
- * Used for audit trails and tracking execution lineage.
- */
-type OriginResourceType = 'agent' | 'workflow' | 'scheduler' | 'api';
-/**
- * Origin tracking metadata - who/what created this execution/task.
- * Used by both TaskScheduler and CommandQueue for complete audit trails.
- */
-interface OriginTracking {
-    originExecutionId: string;
-    originResourceType: OriginResourceType;
-    originResourceId: string;
-}
-
+type ResourceType = 'agent' | 'workflow' | 'trigger' | 'integration' | 'external' | 'human';
 /**
- * Command queue task with flexible action system
+ * Base interface for ALL platform resources
+ * Shared by both executable (agents, workflows) and non-executable (triggers, integrations, etc.) resources
  */
-interface Task extends OriginTracking {
-    id: string;
-    organizationId: string;
-    actions: ActionConfig[];
-    context: unknown;
-    selectedAction?: string;
-    actionPayload?: unknown;
-    description?: string;
-    priority: number;
-    /** Optional checkpoint identifier for grouping related human approval tasks */
-    humanCheckpoint?: string;
-    status: QueueTaskStatus;
-    /**
-     * Target resource tracking — mirrors origin columns.
-     * Set when task is created; patchable to redirect execution to a different resource.
-     */
-    targetResourceId?: string;
-    targetResourceType?: 'agent' | 'workflow';
-    /**
-     * Execution ID for the action that runs AFTER user approval.
-     * NULL until execution starts.
-     *
-     * Naming distinction:
-     * - originExecutionId = Parent execution that CREATED the HITL task
-     * - targetExecutionId = Child execution that RUNS AFTER user approval
-     */
-    targetExecutionId?: string;
-    createdAt: Date;
-    completedAt?: Date;
-    completedBy?: string;
-    expiresAt?: Date;
-    idempotencyKey?: string | null;
+interface ResourceDefinition {
+    /** Unique resource identifier */
+    resourceId: string;
+    /** Display name */
+    name: string;
+    /** Purpose and functionality description */
+    description: string;
+    /** Version for change tracking and evolution */
+    version: string;
+    /** Resource type discriminator */
+    type: ResourceType;
+    /** Environment/deployment status */
+    status: ResourceStatus;
+    /** Graph links to Organization Model nodes */
+    links?: ResourceLink[];
+    /** Infrastructure category for filtering */
+    category?: ResourceCategory;
+    /** Whether the agent supports multi-turn sessions (agents only) */
+    sessionCapable?: boolean;
+    /** Whether the resource is local (monorepo) or remote (externally deployed) */
+    origin?: 'local' | 'remote';
+    /** Whether this resource is archived and should be excluded from registration and deployment */
+    archived?: boolean;
 }
-/**
- * Task status values
- * - pending: awaiting action
- * - processing: execution in progress after user approval
- * - completed: action was taken and execution succeeded
- * - failed: execution failed, task can be retried
- * - expired: timed out before action
- */
-type QueueTaskStatus = 'pending' | 'processing' | 'completed' | 'failed' | 'expired';
-/**
- * Parameters for patching mutable metadata on a task
- */
-interface PatchTaskParams {
-    humanCheckpoint?: string | null;
-    description?: string;
-    priority?: number;
-    context?: Record<string, unknown>;
-    actions?: unknown[];
-    targetResourceId?: string | null;
-    targetResourceType?: 'agent' | 'workflow' | null;
-    targetExecutionId?: string;
-    status?: 'pending' | 'failed' | 'completed';
+/** Webhook provider identifiers */
+type WebhookProviderType = 'cal-com' | 'stripe' | 'signature-api' | 'instantly' | 'apify' | 'test';
+/** Webhook trigger configuration */
+interface WebhookTriggerConfig {
+    /** Provider identifier */
+    provider: WebhookProviderType;
+    /** Event type for documentation (not used for matching - workflow handles routing) */
+    event?: string;
+    /** Optional filtering (e.g., specific form ID for Fillout) */
+    filter?: Record<string, string>;
+    /** References credential in credentials table for per-org webhook secrets */
+    credentialName?: string;
 }
-interface CommandQueueListResponse {
-    tasks: Task[];
-    total: number;
+/** Schedule trigger configuration */
+interface ScheduleTriggerConfig {
+    /** Cron expression (e.g., '0 6 * * *') */
+    cron: string;
+    /** Optional timezone (default: UTC) */
+    timezone?: string;
 }
-
-/**
- * Checkpoint list item for sidebar grouping
- * The id field contains the resourceId of the human checkpoint
- */
-interface CheckpointListItem {
-    /** Human checkpoint resourceId (or 'ungrouped' for tasks without checkpoint) */
-    id: string;
-    /** Display name (same as id, or "Ungrouped" for null) */
-    name: string;
-    /** Task count for this checkpoint */
-    count: number;
+/** Event trigger configuration */
+interface EventTriggerConfig {
+    /** Internal event type */
+    eventType: string;
+    /** Event source */
+    source?: string;
 }
+/** Union of all trigger configs */
+type TriggerConfig = WebhookTriggerConfig | ScheduleTriggerConfig | EventTriggerConfig;
 /**
- * Status counts for pie chart display
+ * Trigger metadata - entry points that initiate resource execution
+ *
+ * Triggers represent how executions start: webhooks from external services,
+ * scheduled cron jobs, platform events, or manual user actions.
+ *
+ * BREAKING CHANGES (2025-11-30):
+ * - Now extends ResourceDefinition (inherits: resourceId, name, description, version, type, status, links, category)
+ * - Field renames: `id` -> `resourceId` (inherited), `type` -> `triggerType`
+ * - Relationship rename: `invokes` -> `triggers` (unified vocabulary)
+ * - New required fields: `version` (inherited), `type: 'trigger'` (inherited)
+ * - triggers object now includes `externalResources` option
+ *
+ * @example
+ * // TriggerDefinition - metadata only
+ * {
+ *   resourceId: 'trigger-new-order',
+ *   type: 'trigger',
+ *   triggerType: 'webhook',
+ *   name: 'New Order',
+ *   description: 'Webhook from Shopify on new orders',
+ *   version: '1.0.0',
+ *   status: 'prod',
+ *   webhookPath: '/webhooks/shopify/orders'
+ * }
+ *
+ * // Relationships declared in ResourceRelationships (not on TriggerDefinition):
+ * // relationships: {
+ * //   'trigger-new-order': { triggers: { workflows: ['order-fulfillment-workflow'] } }
+ * // }
  */
-interface StatusCounts {
-    pending: number;
-    completed: number;
-    expired: number;
+interface TriggerDefinition extends ResourceDefinition {
+    /** Resource type discriminator (narrowed from base union) */
+    type: 'trigger';
+    /** Trigger mechanism type (renamed from 'type' to avoid collision with base type discriminator) */
+    triggerType: 'webhook' | 'schedule' | 'manual' | 'event';
+    /** Type-specific configuration */
+    config?: TriggerConfig;
+    /** For webhook triggers: path like '/webhooks/shopify/orders' */
+    webhookPath?: string;
+    /** For schedule triggers: cron expression like '0 6 * * *' */
+    schedule?: string;
+    /** For event triggers: event type like 'low-stock-alert' */
+    eventType?: string;
 }
 /**
- * Priority counts for donut chart display
+ * Integration metadata - external service connections
+ *
+ * References credentials table for actual connection. No connection status
+ * stored here (queried at runtime from credentials table).
+ *
+ * BREAKING CHANGES (2025-11-30):
+ * - Now extends ResourceDefinition (inherits: resourceId, name, description, version, type, status, links, category)
+ * - Field renames: `id` -> `resourceId` (inherited)
+ * - New required field: `status` (inherited) - organizations must add status to all integrations
+ * - New required field: `version` (inherited) - organizations must add version to all integrations
+ * - New required field: `type: 'integration'` (inherited) - resource type discriminator
+ *
+ * @example
+ * {
+ *   resourceId: 'integration-shopify-prod',
+ *   type: 'integration',
+ *   provider: 'shopify',
+ *   credentialName: 'shopify-prod',
+ *   name: 'Shopify Production',
+ *   description: 'E-commerce platform',
+ *   version: '1.0.0',
+ *   status: 'prod'
+ * }
  */
-interface PriorityCounts {
-    critical: number;
-    high: number;
-    medium: number;
-    low: number;
+interface IntegrationDefinition extends ResourceDefinition {
+    /** Resource type discriminator (narrowed from base union) */
+    type: 'integration';
+    /** Integration provider type */
+    provider: IntegrationType;
+    /** References credentials table (e.g., 'shopify-prod', 'zendesk-api') */
+    credentialName: string;
 }
 /**
- * Response from GET /command-queue/checkpoints endpoint
+ * External platform type
+ * Supported third-party automation platforms
  */
-interface CheckpointListResponse {
-    checkpoints: CheckpointListItem[];
-    /** Total tasks across all checkpoints */
-    total: number;
-    /** Breakdown by status for donut chart */
-    statusCounts: StatusCounts;
-    /** Breakdown by priority for donut chart */
-    priorityCounts: PriorityCounts;
-}
-
+type ExternalPlatform = 'n8n' | 'make' | 'zapier' | 'other';
 /**
- * Target for schedule execution - identifies what resource to execute.
- * Unlike ExecutionTarget, payload is NOT included here because schedules
- * store payload in the scheduleConfig (varies per step/item).
- */
-interface ScheduleTarget {
-    resourceType: 'agent' | 'workflow';
-    resourceId: string;
-}
-/**
- * Optional origin tracking for schedules.
- * Unlike OriginTracking (which is required), these fields are all optional
- * for schedules created directly via API (not triggered by another resource).
- */
-interface ScheduleOriginTracking {
-    originExecutionId?: string;
-    originResourceType?: OriginResourceType;
-    originResourceId?: string;
-}
-type TaskScheduleConfig = RecurringScheduleConfig | RelativeScheduleConfig | AbsoluteScheduleConfig;
-interface RecurringScheduleConfig {
-    type: 'recurring';
-    cron?: string;
-    interval?: 'daily' | 'weekly' | 'monthly';
-    time?: string;
-    timezone: string;
-    payload: Record<string, unknown>;
-    endAt?: string | null;
-    overduePolicy?: 'skip' | 'execute';
-}
-interface RelativeScheduleConfig {
-    type: 'relative';
-    anchorAt: string;
-    anchorLabel?: string;
-    items: RelativeScheduleItem[];
-    overduePolicy?: 'skip' | 'execute';
-}
-interface RelativeScheduleItem {
-    offset: string;
-    payload: Record<string, unknown>;
-    label?: string;
-}
-interface AbsoluteScheduleConfig {
-    type: 'absolute';
-    items: AbsoluteScheduleItem[];
-    overduePolicy?: 'skip' | 'execute';
-}
-interface AbsoluteScheduleItem {
-    runAt: string;
-    payload: Record<string, unknown>;
-    label?: string;
-}
-interface TaskSchedule extends ScheduleOriginTracking {
-    id: string;
-    organizationId: string;
-    name: string;
-    description?: string;
-    target: ScheduleTarget;
-    scheduleConfig: TaskScheduleConfig;
-    nextRunAt?: Date;
-    currentStep: number;
-    status: 'active' | 'paused' | 'completed' | 'cancelled';
-    lastRunAt?: Date;
-    lastExecutionId?: string;
-    maxRetries: number;
-    idempotencyKey?: string;
-    createdAt: Date;
-    updatedAt: Date;
-}
-
-/**
- * Wire-format DTO for notification API responses.
- * Dates are ISO 8601 strings (not Date objects like the domain Notification type).
- * Used by frontend hooks that consume /api/notifications.
+ * External automation resource metadata
+ *
+ * Represents workflows/automations running on third-party platforms
+ * (n8n, Make, Zapier, etc.) for visualization in Command View.
+ *
+ * NOTE: This is metadata ONLY for visualization. No execution logic,
+ * no API integration with external platforms, no status syncing.
+ *
+ * BREAKING CHANGES (2025-11-30):
+ * - Now extends ResourceDefinition (inherits: resourceId, name, description, version, type, status, links, category)
+ * - Field renames: `id` -> `resourceId` (inherited)
+ * - New required field: `version` (inherited) - organizations must add version to all external resources
+ * - New required field: `type: 'external'` (inherited) - resource type discriminator
+ * - REMOVED FIELD: `triggeredBy` - per relationship-consolidation design, all relationships are forward-only declarations
+ *
+ * @example
+ * {
+ *   resourceId: 'external-n8n-order-sync',
+ *   type: 'external',
+ *   version: '1.0.0',
+ *   platform: 'n8n',
+ *   name: 'Shopify Order Sync',
+ *   description: 'Legacy n8n workflow for syncing Shopify orders',
+ *   status: 'prod',
+ *   platformUrl: 'https://n8n.client.com/workflow/123',
+ *   triggers: { workflows: ['order-fulfillment-workflow'] },
+ *   uses: { integrations: ['integration-shopify-prod'] }
+ * }
  */
-interface NotificationDTO {
-    id: string;
-    userId: string;
-    organizationId: string;
-    category: string;
-    title: string;
-    message: string;
-    actionUrl: string | null;
-    read: boolean;
-    readAt: string | null;
-    createdAt: string;
-}
-
-type ProjectRow = Database['public']['Tables']['prj_projects']['Row'];
-type ProjectUpdate = Database['public']['Tables']['prj_projects']['Update'];
-type MilestoneRow = Database['public']['Tables']['prj_milestones']['Row'];
-type MilestoneUpdate = Database['public']['Tables']['prj_milestones']['Update'];
-type TaskRow = Database['public']['Tables']['prj_tasks']['Row'];
-type TaskUpdate = Database['public']['Tables']['prj_tasks']['Update'];
-type ProjectStatus = 'active' | 'on_track' | 'at_risk' | 'blocked' | 'completed' | 'paused';
-type ProjectKind = 'client_engagement' | 'internal' | 'research' | 'other';
-type MilestoneStatus = 'upcoming' | 'in_progress' | 'completed' | 'overdue' | 'blocked';
-type TaskStatus = 'planned' | 'in_progress' | 'blocked' | 'completed' | 'cancelled' | 'submitted' | 'approved' | 'rejected' | 'revision_requested';
-type TaskType = 'documentation' | 'code' | 'report' | 'design' | 'other';
-type NoteType = 'call_note' | 'status_update' | 'issue' | 'blocker' | 'agent_learning';
-interface ProjectFilters {
-    status?: ProjectStatus;
-    kind?: ProjectKind;
-    companyId?: string;
-    search?: string;
-}
-interface MilestoneFilters {
-    status?: MilestoneStatus;
-    projectId?: string;
-}
-interface TaskFilters {
-    status?: TaskStatus;
-    type?: TaskType;
-    milestoneId?: string;
-    projectId?: string;
-}
-interface NoteFilters {
-    type?: NoteType;
-    projectId?: string;
-}
-interface ProjectWithCounts extends ProjectRow {
-    milestoneCount: number;
-    taskCount: number;
-    completedMilestones?: number;
-    completedTasks?: number;
-}
-interface ProjectDetail extends ProjectRow {
-    milestones: MilestoneRow[];
-    tasks: TaskRow[];
-    company: {
-        id: string;
-        name: string;
-        domain: string | null;
-    } | null;
+interface ExternalResourceDefinition extends ResourceDefinition {
+    /** Resource type discriminator (narrowed from base union) */
+    type: 'external';
+    /** Platform type */
+    platform: ExternalPlatform;
+    /** Link to external platform (e.g., n8n workflow editor URL) */
+    platformUrl?: string;
+    /** Platform's internal ID/reference */
+    externalId?: string;
+    /** What this external resource triggers (external -> internal) */
+    triggers?: {
+        /** Elevasis workflow resourceIds this external automation triggers */
+        workflows?: string[];
+        /** Elevasis agent resourceIds this external automation triggers */
+        agents?: string[];
+    };
+    /** Integrations this external resource uses (shared credentials) */
+    uses?: {
+        /** Integration IDs this external automation uses */
+        integrations?: string[];
+    };
 }
-
-declare const ListCompaniesQuerySchema: z.ZodObject<{
-    search: z.ZodOptional<z.ZodString>;
-    listId: z.ZodOptional<z.ZodString>;
-    domain: z.ZodOptional<z.ZodString>;
-    website: z.ZodOptional<z.ZodString>;
-    segment: z.ZodOptional<z.ZodString>;
-    category: z.ZodOptional<z.ZodString>;
-    batchId: z.ZodOptional<z.ZodString>;
-    status: z.ZodOptional<z.ZodEnum<{
-        active: "active";
-        invalid: "invalid";
-    }>>;
-    includeAll: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodBoolean>>;
-    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-}, z.core.$strict>;
-declare const ListContactsQuerySchema: z.ZodObject<{
-    search: z.ZodOptional<z.ZodString>;
-    listId: z.ZodOptional<z.ZodString>;
-    openingLineIsNull: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodBoolean>>;
-    batchId: z.ZodOptional<z.ZodString>;
-    contactStatus: z.ZodOptional<z.ZodEnum<{
-        active: "active";
-        invalid: "invalid";
-    }>>;
-    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-    offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-}, z.core.$strict>;
-declare const AcqCompanyResponseSchema: z.ZodObject<{
-    id: z.ZodString;
-    organizationId: z.ZodString;
-    name: z.ZodString;
-    domain: z.ZodNullable<z.ZodString>;
-    linkedinUrl: z.ZodNullable<z.ZodString>;
-    website: z.ZodNullable<z.ZodString>;
-    numEmployees: z.ZodNullable<z.ZodNumber>;
-    foundedYear: z.ZodNullable<z.ZodNumber>;
-    locationCity: z.ZodNullable<z.ZodString>;
-    locationState: z.ZodNullable<z.ZodString>;
-    category: z.ZodNullable<z.ZodString>;
-    categoryPain: z.ZodNullable<z.ZodString>;
-    segment: z.ZodNullable<z.ZodString>;
-    pipelineStatus: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    enrichmentData: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    source: z.ZodNullable<z.ZodString>;
-    batchId: z.ZodNullable<z.ZodString>;
-    status: z.ZodEnum<{
-        active: "active";
-        invalid: "invalid";
-    }>;
-    contactCount: z.ZodNumber;
-    verticalResearch: z.ZodNullable<z.ZodString>;
-    createdAt: z.ZodString;
-    updatedAt: z.ZodString;
-}, z.core.$strip>;
-declare const AcqContactResponseSchema: z.ZodObject<{
-    id: z.ZodString;
-    organizationId: z.ZodString;
-    companyId: z.ZodNullable<z.ZodString>;
-    email: z.ZodString;
-    emailValid: z.ZodNullable<z.ZodEnum<{
-        VALID: "VALID";
-        INVALID: "INVALID";
-        RISKY: "RISKY";
-        UNKNOWN: "UNKNOWN";
-    }>>;
-    firstName: z.ZodNullable<z.ZodString>;
-    lastName: z.ZodNullable<z.ZodString>;
-    linkedinUrl: z.ZodNullable<z.ZodString>;
-    title: z.ZodNullable<z.ZodString>;
-    headline: z.ZodNullable<z.ZodString>;
-    filterReason: z.ZodNullable<z.ZodString>;
-    openingLine: z.ZodNullable<z.ZodString>;
-    source: z.ZodNullable<z.ZodString>;
-    sourceId: z.ZodNullable<z.ZodString>;
-    pipelineStatus: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    enrichmentData: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    attioPersonId: z.ZodNullable<z.ZodString>;
-    batchId: z.ZodNullable<z.ZodString>;
-    status: z.ZodEnum<{
-        active: "active";
-        invalid: "invalid";
-    }>;
-    company: z.ZodOptional<z.ZodNullable<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        domain: z.ZodNullable<z.ZodString>;
-        website: z.ZodNullable<z.ZodString>;
-        linkedinUrl: z.ZodNullable<z.ZodString>;
-        segment: z.ZodNullable<z.ZodString>;
-        category: z.ZodNullable<z.ZodString>;
-        status: z.ZodEnum<{
-            active: "active";
-            invalid: "invalid";
-        }>;
-    }, z.core.$strip>>>;
-    createdAt: z.ZodString;
-    updatedAt: z.ZodString;
-}, z.core.$strip>;
-type ListCompaniesQuery = z.infer<typeof ListCompaniesQuerySchema>;
-type ListContactsQuery = z.infer<typeof ListContactsQuerySchema>;
-type AcqCompanyResponse = z.infer<typeof AcqCompanyResponseSchema>;
-type AcqContactResponse = z.infer<typeof AcqContactResponseSchema>;
-
-type MessageType = MessageEvent['type'];
 /**
- * Session Data Transfer Object (DTO)
- * Transform type for API responses (snake_case DB → camelCase frontend)
- * Used by frontend apps to display session data
+ * Human Checkpoint definition - human decision points in automation
+ *
+ * Represents where human judgment is deployed in the automation landscape.
+ * Tasks with matching command_queue_group are routed to this checkpoint.
+ *
+ * BREAKING CHANGES (2025-11-30):
+ * - Now extends ResourceDefinition (inherits: resourceId, name, description, version, type, status, links, category)
+ * - Field renames: `id` -> `resourceId` (inherited)
+ * - description is now REQUIRED (was optional) - organizations must add description to all human checkpoints
+ * - New required field: `version` (inherited) - organizations must add version to all human checkpoints
+ * - New required field: `type: 'human'` (inherited) - resource type discriminator
+ *
+ * @example
+ * {
+ *   resourceId: 'sales-approval',
+ *   type: 'human',
+ *   name: 'Sales Approval Queue',
+ *   description: 'High-value order approvals for sales team',
+ *   version: '1.0.0',
+ *   status: 'prod',
+ *   requestedBy: { agents: ['order-processor-agent'] },
+ *   routesTo: { agents: ['order-fulfillment-agent'] }
+ * }
  */
-interface SessionDTO {
-    sessionId: string;
-    resourceId: string;
-    organizationId: string;
-    userId?: string | null;
-    turnCount: number;
-    isEnded: boolean;
-    title?: string | null;
-    memorySnapshot?: AgentMemory;
-    metadata?: Record<string, unknown> | null;
-    createdAt: Date;
-    updatedAt: Date;
-    endedAt?: Date | null;
-}
-interface ChatMessage {
-    id: string;
-    role: 'user' | 'assistant';
-    messageType: MessageType;
-    text: string;
-    metadata?: MessageEvent;
-    turnNumber: number;
-    messageIndex?: number;
-    createdAt: Date;
-}
-/** Token usage data sent with turn:complete WebSocket events */
-interface SessionTokenUsage {
-    /** Tokens consumed by this turn's input */
-    turnInputTokens: number;
-    /** Tokens generated by this turn's output */
-    turnOutputTokens: number;
-    /** Total tokens for this turn (turnInputTokens + turnOutputTokens) */
-    turnTotalTokens: number;
-    /** Cumulative input tokens across all turns in this session */
-    cumulativeInputTokens: number;
-    /** Cumulative output tokens across all turns in this session */
-    cumulativeOutputTokens: number;
-    /** The model's context window size for this session (e.g., 200K) */
-    contextWindowSize: number;
+interface HumanCheckpointDefinition extends ResourceDefinition {
+    /** Resource type discriminator (narrowed from base union) */
+    type: 'human';
+    /** Resources that create tasks for this checkpoint */
+    requestedBy?: {
+        /** Agent resourceIds that request approval here */
+        agents?: string[];
+        /** Workflow resourceIds that request approval here */
+        workflows?: string[];
+    };
+    /** Resources that receive approved decisions */
+    routesTo?: {
+        /** Agent resourceIds that handle approved tasks */
+        agents?: string[];
+        /** Workflow resourceIds that handle approved tasks */
+        workflows?: string[];
+    };
 }
 
 /**
- * Multi-tenancy configuration types
+ * Command View Types
  *
- * Config is stored in dedicated `config` columns (NOT nested in metadata):
- * - organizations.config: Org-level config (no feature toggles -- all features available by default)
- * - org_memberships.config: Per-user-per-org feature overrides
- * - users.config: User-global config
+ * Unified type definitions for the Command View graph visualization.
+ * These types are used by both backend serialization and frontend rendering.
+ *
+ * Command View shows the resource graph: agents, workflows, triggers, integrations,
+ * external resources, and human checkpoints with their relationships.
  */
+
 /**
- * Per-user-per-org config (stored in org_memberships.config)
- * Controls which features a specific member can access within their org.
- * Keys are feature IDs from the organization model (e.g. crm, lead-gen, projects, seo).
+ * Extended agent metadata for Command View
+ * Includes model and capability information for graph display
  */
-interface MembershipFeatureConfig {
-    features?: Record<string, boolean>;
+interface CommandViewAgent extends ResourceDefinition {
+    type: 'agent';
+    modelProvider: string;
+    modelId: string;
+    toolCount: number;
+    hasKnowledgeMap: boolean;
+    hasMemory: boolean;
+    sessionCapable: boolean;
 }
 /**
- * User-global config (stored in users.config)
- * Theme and onboarding are user-specific, NOT org-specific
+ * Extended workflow metadata for Command View
+ * Includes step information for graph display
  */
-interface UserConfig {
-    theme?: {
-        preset?: 'default' | 'tactical' | 'regal' | 'cyber-volt' | 'aurora' | 'rose-gold' | 'midnight' | 'titanium' | 'obsidian' | 'honey' | 'abyss' | 'canopy' | 'slate' | 'cyber-strike' | 'cyber-chrome' | 'cyber-void' | 'nirvana' | 'wave' | 'synapse' | 'cortex' | 'helios' | 'graphite' | 'quarry' | 'canyon' | 'nord' | 'catppuccin' | 'tokyo-night' | 'gruvbox';
-        colorScheme?: 'light' | 'dark' | 'auto';
-    };
-    onboarding?: {
-        completed?: boolean;
-        completedAt?: string;
-        role?: string;
-        primaryUseCase?: string[];
-        experienceLevel?: string;
-        /** Onboarding guide system state (set by checklist/tour system) */
-        guides?: {
-            completedIds?: string[];
-            dismissed?: boolean;
-            completedAt?: string;
-        };
-    };
+interface CommandViewWorkflow extends ResourceDefinition {
+    type: 'workflow';
+    stepCount: number;
+    entryPoint: string;
 }
-
 /**
- * Memberships Domain - Zod Validation Schemas
- *
- * Validation schemas for membership management endpoints.
- * Includes request bodies, query params, and path params.
+ * Relationship types between resources
  *
- * Security:
- * - All schemas use .strict() to prevent mass assignment attacks
- * - UUID validation prevents invalid references
- * - Role enum validation prevents privilege escalation
- * - organizationId never accepted in body (from JWT when needed)
+ * - triggers: Resource initiates/starts another resource (orange)
+ * - uses: Resource uses an integration (teal)
+ * - approval: Resource requires human approval (yellow)
  */
-
+type RelationshipType$1 = 'triggers' | 'uses' | 'approval';
 /**
- * Membership status validation
- * Note: Database constraint only allows 'active' | 'inactive'
+ * Command View edge (relationship between resources)
  */
-declare const MembershipStatusSchema: z.ZodEnum<{
-    active: "active";
-    inactive: "inactive";
-}>;
-type MembershipStatus = z.infer<typeof MembershipStatusSchema>;
-
+interface CommandViewEdge$1 {
+    id: string;
+    source: string;
+    target: string;
+    relationship: RelationshipType$1;
+    label?: string;
+}
 /**
- * Organization Membership types based on WorkOS API
+ * Command View data structure
+ * Complete graph data for visualization
+ *
+ * Backend serializes this once at startup and serves it via /command-view endpoint.
+ * Frontend consumes this directly for graph rendering.
  */
-interface OrganizationMembership {
-    object: 'organization_membership';
+interface CommandViewData {
+    workflows: CommandViewWorkflow[];
+    agents: CommandViewAgent[];
+    triggers: TriggerDefinition[];
+    integrations: IntegrationDefinition[];
+    externalResources: ExternalResourceDefinition[];
+    humanCheckpoints: HumanCheckpointDefinition[];
+    edges: CommandViewEdge$1[];
+}
+
+declare const LinkSchema: z.ZodObject<{
+    nodeId: z.ZodString;
+    kind: z.ZodEnum<{
+        contains: "contains";
+        references: "references";
+        exposes: "exposes";
+        maps_to: "maps_to";
+        "operates-on": "operates-on";
+        uses: "uses";
+    }>;
+}, z.core.$strip>;
+type Link = z.infer<typeof LinkSchema>;
+
+declare const ResourceCategorySchema: z.ZodEnum<{
+    production: "production";
+    diagnostic: "diagnostic";
+    internal: "internal";
+    testing: "testing";
+}>;
+type ResourceCategory = z.infer<typeof ResourceCategorySchema>;
+type ResourceLink = Link;
+
+type ExecutionStatus = 'pending' | 'running' | 'completed' | 'failed' | 'warning';
+interface APIExecutionSummary {
     id: string;
-    userId: string;
-    organizationId: string;
-    role: {
-        slug: string;
-    };
-    status: 'active' | 'inactive';
-    createdAt: string;
-    updatedAt: string;
+    status: ExecutionStatus;
+    startTime: number;
+    endTime?: number;
+    resourceStatus?: ResourceStatus;
+}
+interface APIExecutionDetail extends APIExecutionSummary {
+    executionLogs: ExecutionLogMessage[];
+    input?: unknown;
+    result?: unknown;
+    error?: string;
+    resourceStatus: ResourceStatus;
+    apiVersion?: string | null;
+    resourceVersion?: string | null;
+    sdkVersion?: string | null;
+    isArchived?: boolean;
+    archivedLogCount?: number;
+}
+interface APIExecutionListResponse {
+    executions: APIExecutionSummary[];
+    total?: number;
+    limit?: number;
+    offset?: number;
+    hasMore?: boolean;
 }
+
 /**
- * Request interfaces for membership operations
+ * @deprecated Use TimeRange from '@repo/core' directly. Kept as alias for backward compatibility.
  */
-interface CreateMembershipRequest {
-    userId: string;
-    organizationId: string;
-    roleSlug?: string;
+type StatsTimeRange = TimeRange;
+/** Stats returned by /command-view/stats (counts only, no error details) */
+interface ResourceStats {
+    resourceId: string;
+    totalRuns: number;
+    successCount: number;
+    failureCount: number;
+    warningCount: number;
+    lastRunAt: string | null;
 }
-interface UpdateMembershipRequest {
-    roleSlug: string;
+/** Response from /command-view/resource-errors (on-demand) */
+interface ResourceErrorsResponse {
+    resourceId: string;
+    errors: ErrorSummary[];
+    totalErrors: number;
+    timeRange: StatsTimeRange;
 }
-interface ListMembershipsParams {
-    userId?: string;
-    organizationId?: string;
-    statuses?: MembershipStatus[];
-    limit?: number;
-    before?: string;
-    after?: string;
-    order?: 'asc' | 'desc';
+interface ErrorSummary {
+    executionId: string;
+    errorType: string;
+    errorMessage: string;
+    occurredAt: string;
+}
+/** Single execution summary for Recent Executions list in command view */
+interface CommandViewExecution {
+    executionId: string;
+    status: ExecutionStatus;
+    startedAt: string;
+    completedAt: string | null;
+    errorMessage: string | null;
+}
+/** Response from /command-view/resource-executions (on-demand) */
+interface ResourceExecutionsResponse {
+    resourceId: string;
+    executions: CommandViewExecution[];
+    totalExecutions: number;
+    timeRange: StatsTimeRange;
+    page: number;
+    limit: number;
+}
+interface HumanCheckpointStats {
+    checkpointId: string;
+    pendingCount: number;
+    completedCount: number;
+    expiredCount: number;
+    lastDecisionAt: string | null;
+}
+/** Response from /command-view/stats */
+interface CommandViewStatsResponse {
+    resources: Record<string, ResourceStats>;
+    humanCheckpoints: Record<string, HumanCheckpointStats>;
+    timeRange: StatsTimeRange;
+    generatedAt: string;
+}
+
+type ActivityType = 'workflow_execution' | 'agent_run' | 'hitl_action' | 'webhook_received' | 'webhook_executed' | 'webhook_failed' | 'credential_change' | 'credential_read' | 'api_key_change' | 'deployment_change' | 'membership_change';
+type ActivityStatus = 'success' | 'failure' | 'pending' | 'approved' | 'rejected' | 'completed';
+interface Activity {
+    id: string;
+    organizationId: string;
+    activityType: ActivityType;
+    status: ActivityStatus;
+    title: string;
+    description: string | null;
+    entityType: string;
+    entityId: string;
+    entityName: string | null;
+    metadata: Record<string, unknown> | null;
+    actorId: string | null;
+    actorType: string | null;
+    occurredAt: Date;
+    createdAt: Date;
 }
+
 /**
- * Response interfaces
+ * Canonical permission catalog.
+ *
+ * Source of truth for the permission keys used by:
+ *   - RLS policies in Supabase (via has_org_permission(org_id, key))
+ *   - API middleware (via requireOrganizationPermission(key))
+ *   - UI hooks (via useOrganizationPermissions().hasPermission(key))
+ *
+ * The DB table `org_rol_permissions` mirrors this constant. Reconciliation
+ * runs at API boot (insert-or-update only — never auto-delete; see the
+ * deletion runbook in the auth-role-system-redesign doc).
+ *
+ * Adding a permission:
+ *   1. Add an entry below.
+ *   2. Add a row to the migration / via reconcilePermissionCatalog at boot.
+ *   3. Reference it in RLS / middleware as needed.
+ *   4. Optionally grant it to one or more system roles in org_rol_grants.
+ *
+ * Removing a permission: follow the deletion runbook — never just delete
+ * the entry. Existing role grants and policy references must be cleared first.
  */
-interface ListMembershipsResponse {
-    data: OrganizationMembership[];
-    listMetadata?: {
-        before?: string | null;
-        after?: string | null;
-    };
-}
+declare const PERMISSIONS: {
+    readonly ORG_READ: "org.read";
+    readonly ORG_MANAGE: "org.manage";
+    readonly ORG_DELETE: "org.delete";
+    readonly MEMBERS_MANAGE: "members.manage";
+    readonly ROLES_MANAGE: "roles.manage";
+    readonly SECRETS_MANAGE: "secrets.manage";
+    readonly OPERATIONS_READ: "operations.read";
+    readonly OPERATIONS_MANAGE: "operations.manage";
+    readonly WORK_MANAGE: "work.manage";
+};
+type PermissionKey = (typeof PERMISSIONS)[keyof typeof PERMISSIONS];
 /**
- * Extended membership with user and organization details for UI
+ * Static metadata for each permission. Mirrored into org_rol_permissions on
+ * boot reconciliation. is_org_grantable=false means the permission is reserved
+ * to system roles only — custom roles cannot include it (privilege-escalation guard).
  */
-interface MembershipWithDetails extends OrganizationMembership {
-    user?: {
-        id: string;
-        email: string;
-        firstName?: string;
-        lastName?: string;
-        profilePictureUrl?: string;
-    };
-    organization?: {
-        id: string;
-        name: string;
-        workos_org_id: string;
-        primaryDomain?: string;
-        is_test?: boolean;
-        status?: string;
-        metadata?: Record<string, unknown>;
-        config?: Record<string, unknown>;
-    };
-    config?: MembershipFeatureConfig;
-}
-
-type ExecutionStatus = 'pending' | 'running' | 'completed' | 'failed' | 'warning';
-interface APIExecutionSummary {
-    id: string;
-    status: ExecutionStatus;
-    startTime: number;
-    endTime?: number;
-    resourceStatus?: ResourceStatus;
-}
-interface APIExecutionDetail extends APIExecutionSummary {
-    executionLogs: ExecutionLogMessage[];
-    input?: unknown;
-    result?: unknown;
-    error?: string;
-    resourceStatus: ResourceStatus;
-    apiVersion?: string | null;
-    resourceVersion?: string | null;
-    sdkVersion?: string | null;
-    isArchived?: boolean;
-    archivedLogCount?: number;
-}
-interface APIExecutionListResponse {
-    executions: APIExecutionSummary[];
-    total?: number;
-    limit?: number;
-    offset?: number;
-    hasMore?: boolean;
+interface PermissionDescriptor {
+    key: PermissionKey;
+    description: string;
+    isOrgGrantable: boolean;
 }
 
 /**
@@ -4541,6 +4830,63 @@ declare const ExecutionHistoryResponseSchema: z.ZodObject<{
 type ExecutionHistoryItem = z.infer<typeof ExecutionHistoryItemSchema>;
 type ExecutionHistoryResponse = z.infer<typeof ExecutionHistoryResponseSchema>;
 
+/**
+ * Deployment types — browser-safe
+ *
+ * Canonical API response types for the deployment resource.
+ * The API's transformRow converts snake_case DB columns to these camelCase fields.
+ */
+type DeploymentStatus = 'deploying' | 'active' | 'failed' | 'rolled_back' | 'stopped';
+interface Deployment {
+    id: string;
+    organizationId: string;
+    status: DeploymentStatus;
+    sdkVersion: string;
+    deploymentVersion: string | null;
+    port: number | null;
+    pid: number | null;
+    tarballPath: string | null;
+    errorMessage: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+
+/**
+ * GET /api/credentials - List credentials
+ */
+declare const ListCredentialsResponseSchema: z.ZodObject<{
+    credentials: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodString;
+        provider: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** API response type for a single credential list item */
+type CredentialListItem = z.infer<typeof ListCredentialsResponseSchema>['credentials'][number];
+
+declare function useOrganizationPermissions(): {
+    hasPermission: (key: PermissionKey | string) => boolean;
+    permissions: string[];
+    isPlatformAdmin: boolean;
+    isReady: boolean;
+};
+declare function useHasPermission(key: PermissionKey | string): boolean;
+
+/**
+ * Query key factory for executions TanStack Query hooks.
+ * Uses organization UUID (not name) for cache isolation.
+ */
+declare const executionsKeys: {
+    all: readonly ["executions"];
+    resources: (orgId: string | null) => readonly ["executions", "resources", string | null];
+    resourceDefinition: (orgId: string | null, resourceId: string) => readonly ["executions", "definition", string | null, string];
+    executionsListBase: (orgId: string | null, resourceId: string) => readonly ["executions", "list", string | null, string];
+    executions: (orgId: string | null, resourceId: string, resourceStatus?: string, limit?: number, offset?: number) => readonly ["executions", "list", string | null, string, string, number | null, number];
+    execution: (orgId: string | null, resourceId: string, executionId: string) => readonly ["executions", "execution", string | null, string, string];
+};
+
 /**
  * Fetch the execution list for a given resource.
  *
@@ -4644,119 +4990,6 @@ interface BulkDeleteExecutionsResult {
  */
 declare function useBulkDeleteExecutions(): _tanstack_react_query.UseMutationResult<BulkDeleteExecutionsResult, Error, BulkDeleteExecutionsParams, unknown>;
 
-/**
- * @deprecated Use TimeRange from '@repo/core' directly. Kept as alias for backward compatibility.
- */
-type StatsTimeRange = TimeRange;
-/** Stats returned by /command-view/stats (counts only, no error details) */
-interface ResourceStats {
-    resourceId: string;
-    totalRuns: number;
-    successCount: number;
-    failureCount: number;
-    warningCount: number;
-    lastRunAt: string | null;
-}
-/** Response from /command-view/resource-errors (on-demand) */
-interface ResourceErrorsResponse {
-    resourceId: string;
-    errors: ErrorSummary[];
-    totalErrors: number;
-    timeRange: StatsTimeRange;
-}
-interface ErrorSummary {
-    executionId: string;
-    errorType: string;
-    errorMessage: string;
-    occurredAt: string;
-}
-/** Single execution summary for Recent Executions list in command view */
-interface CommandViewExecution {
-    executionId: string;
-    status: ExecutionStatus;
-    startedAt: string;
-    completedAt: string | null;
-    errorMessage: string | null;
-}
-/** Response from /command-view/resource-executions (on-demand) */
-interface ResourceExecutionsResponse {
-    resourceId: string;
-    executions: CommandViewExecution[];
-    totalExecutions: number;
-    timeRange: StatsTimeRange;
-    page: number;
-    limit: number;
-}
-interface HumanCheckpointStats {
-    checkpointId: string;
-    pendingCount: number;
-    completedCount: number;
-    expiredCount: number;
-    lastDecisionAt: string | null;
-}
-/** Response from /command-view/stats */
-interface CommandViewStatsResponse {
-    resources: Record<string, ResourceStats>;
-    humanCheckpoints: Record<string, HumanCheckpointStats>;
-    timeRange: StatsTimeRange;
-    generatedAt: string;
-}
-
-type ActivityType = 'workflow_execution' | 'agent_run' | 'hitl_action' | 'webhook_received' | 'webhook_executed' | 'webhook_failed' | 'credential_change' | 'api_key_change' | 'deployment_change' | 'membership_change';
-type ActivityStatus = 'success' | 'failure' | 'pending' | 'approved' | 'rejected' | 'completed';
-interface Activity {
-    id: string;
-    organizationId: string;
-    activityType: ActivityType;
-    status: ActivityStatus;
-    title: string;
-    description: string | null;
-    entityType: string;
-    entityId: string;
-    entityName: string | null;
-    metadata: Record<string, unknown> | null;
-    actorId: string | null;
-    actorType: string | null;
-    occurredAt: Date;
-    createdAt: Date;
-}
-
-/**
- * Deployment types — browser-safe
- *
- * Canonical API response types for the deployment resource.
- * The API's transformRow converts snake_case DB columns to these camelCase fields.
- */
-type DeploymentStatus = 'deploying' | 'active' | 'failed' | 'rolled_back' | 'stopped';
-interface Deployment {
-    id: string;
-    organizationId: string;
-    status: DeploymentStatus;
-    sdkVersion: string;
-    deploymentVersion: string | null;
-    port: number | null;
-    pid: number | null;
-    tarballPath: string | null;
-    errorMessage: string | null;
-    createdAt: string;
-    updatedAt: string;
-}
-
-/**
- * GET /api/credentials - List credentials
- */
-declare const ListCredentialsResponseSchema: z.ZodObject<{
-    credentials: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        type: z.ZodString;
-        provider: z.ZodNullable<z.ZodString>;
-        createdAt: z.ZodString;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-/** API response type for a single credential list item */
-type CredentialListItem = z.infer<typeof ListCredentialsResponseSchema>['credentials'][number];
-
 /**
  * Fetch all available Execution Engine resources (workflows, agents, pipelines).
  *
@@ -5707,10 +5940,6 @@ declare function createFeatureAccessHook({ useInitialization, useOrganization }:
     checkFeature: (featureKey: string) => FeatureAccessResult;
     isReady: boolean;
 };
-/**
- * @deprecated Use `createFeatureAccessHook` instead. This alias will be removed in a future release.
- */
-declare const createUseFeatureAccess: typeof createFeatureAccessHook;
 
 interface UseSSEConnectionOptions {
     manager: SSEConnectionManagerLike;
@@ -6169,6 +6398,8 @@ interface UseCommandViewStatsOptions {
  */
 declare function useCommandViewStats(timeRange?: StatsTimeRange, options?: UseCommandViewStatsOptions): _tanstack_react_query.UseQueryResult<CommandViewStatsResponse, Error>;
 
+type CommandViewVisualizationMode = 'cluster' | 'swimlane' | 'focus' | 'network' | 'spatial';
+
 /**
  * Command View Types
  *
@@ -6290,15 +6521,28 @@ interface CommandViewStore {
     setShowIntegrations: (v: boolean) => void;
     fitViewOnFilter: boolean;
     setFitViewOnFilter: (v: boolean) => void;
+    visualizationMode: CommandViewVisualizationMode;
+    setVisualizationMode: (v: CommandViewVisualizationMode) => void;
     selectedNodeId: string | null;
     setSelectedNodeId: (id: string | null) => void;
+    resourcesHidden: boolean;
+    setResourcesHidden: (v: boolean) => void;
+    diagnosticsHidden: boolean;
+    setDiagnosticsHidden: (v: boolean) => void;
+    diagnosticCategories: string[];
+    revealedIds: Set<string>;
+    setRevealedIds: (ids: Iterable<string>) => void;
+    clearRevealedIds: () => void;
+    hasVisibilityInteraction: boolean;
+    markVisibilityInteraction: () => void;
+    resetVisibilityInteraction: () => void;
 }
 /**
  * Shared store for Command View filter/settings state.
  * Allows CommandViewPage (graph) and CommandViewSidebarContent (sidebar) to share state.
  *
- * Persisted to localStorage: showIntegrations, fitViewOnFilter
- * Not persisted (reset on reload): statusFilter, selectedNodeId
+ * Persisted to localStorage: showIntegrations, fitViewOnFilter, resource/diagnostic visibility preferences.
+ * Not persisted (reset on reload): statusFilter, selectedNodeId, revealedIds, CTA interaction state.
  */
 declare const useCommandViewStore: zustand.UseBoundStore<Omit<zustand.StoreApi<CommandViewStore>, "setState" | "persist"> & {
     setState(partial: CommandViewStore | Partial<CommandViewStore> | ((state: CommandViewStore) => CommandViewStore | Partial<CommandViewStore>), replace?: false | undefined): unknown;
@@ -6307,6 +6551,9 @@ declare const useCommandViewStore: zustand.UseBoundStore<Omit<zustand.StoreApi<C
         setOptions: (options: Partial<zustand_middleware.PersistOptions<CommandViewStore, {
             showIntegrations: boolean;
             fitViewOnFilter: boolean;
+            visualizationMode: CommandViewVisualizationMode;
+            resourcesHidden: boolean;
+            diagnosticsHidden: boolean;
         }, unknown>>) => void;
         clearStorage: () => void;
         rehydrate: () => Promise<void> | void;
@@ -6316,6 +6563,9 @@ declare const useCommandViewStore: zustand.UseBoundStore<Omit<zustand.StoreApi<C
         getOptions: () => Partial<zustand_middleware.PersistOptions<CommandViewStore, {
             showIntegrations: boolean;
             fitViewOnFilter: boolean;
+            visualizationMode: CommandViewVisualizationMode;
+            resourcesHidden: boolean;
+            diagnosticsHidden: boolean;
         }, unknown>>;
     };
 }>;
@@ -7593,10 +7843,56 @@ declare function useReactivateMembership(): _tanstack_react_query.UseMutationRes
     previousData: unknown;
 }>;
 
+type OrgRolDefinitionRow = Database['public']['Tables']['org_rol_definitions']['Row'];
+type OrgRole = OrgRolDefinitionRow & {
+    grants?: string[];
+    memberCount?: number;
+};
+type CreateOrgRoleInput = {
+    name: string;
+    slug: string;
+    description?: string;
+    permissionKeys: string[];
+};
+type UpdateOrgRoleInput = Partial<CreateOrgRoleInput>;
+type AssignRoleInput = {
+    membershipId: string;
+    roleId: string;
+};
+type RevokeRoleInput = {
+    membershipId: string;
+    roleId: string;
+};
+
+declare function useOrgRoles(orgId?: string): _tanstack_react_query.UseQueryResult<{
+    roles: OrgRole[];
+}, Error>;
+
+declare function usePermissionCatalog(): _tanstack_react_query.UseQueryResult<{
+    permissions: PermissionDescriptor[];
+}, Error>;
+
+declare function useCreateOrgRole(): _tanstack_react_query.UseMutationResult<OrgRole, Error, CreateOrgRoleInput, unknown>;
+
+interface UpdateOrgRoleParams {
+    roleId: string;
+    input: UpdateOrgRoleInput;
+}
+declare function useUpdateOrgRole(): _tanstack_react_query.UseMutationResult<OrgRole, Error, UpdateOrgRoleParams, unknown>;
+
+declare function useDeleteOrgRole(): _tanstack_react_query.UseMutationResult<void, Error, string, unknown>;
+
+declare function useAssignRole(): _tanstack_react_query.UseMutationResult<void, Error, AssignRoleInput, unknown>;
+declare function useRevokeRole(): _tanstack_react_query.UseMutationResult<void, Error, RevokeRoleInput, unknown>;
+
+declare function useEffectivePermissions(membershipId: string | undefined): _tanstack_react_query.UseQueryResult<{
+    permissions: string[];
+}, Error>;
+
 declare function useListWebhookEndpoints(): _tanstack_react_query.UseQueryResult<{
     id: string;
     organizationId: string;
-    key: string;
+    keyPrefix: string | null;
     name: string;
     description: string | null;
     resourceId: string | null;
@@ -7605,12 +7901,13 @@ declare function useListWebhookEndpoints(): _tanstack_react_query.UseQueryResult
     requestCount: number;
     createdAt: string;
     updatedAt: string;
+    key?: string | undefined;
 }[], Error>;
 
 declare function useCreateWebhookEndpoint(): _tanstack_react_query.UseMutationResult<{
     id: string;
     organizationId: string;
-    key: string;
+    keyPrefix: string | null;
     name: string;
     description: string | null;
     resourceId: string | null;
@@ -7619,6 +7916,7 @@ declare function useCreateWebhookEndpoint(): _tanstack_react_query.UseMutationRe
     requestCount: number;
     createdAt: string;
     updatedAt: string;
+    key?: string | undefined;
 }, Error, {
     name: string;
     resourceId?: string | undefined;
@@ -7660,7 +7958,8 @@ type UpdateWebhookEndpointRequest = z.infer<typeof UpdateWebhookEndpointRequestS
 declare const WebhookEndpointResponseSchema: z.ZodObject<{
     id: z.ZodString;
     organizationId: z.ZodString;
-    key: z.ZodString;
+    key: z.ZodOptional<z.ZodString>;
+    keyPrefix: z.ZodNullable<z.ZodString>;
     name: z.ZodString;
     description: z.ZodNullable<z.ZodString>;
     resourceId: z.ZodNullable<z.ZodString>;
@@ -7678,7 +7977,7 @@ type WebhookEndpointResponse = z.infer<typeof WebhookEndpointResponseSchema>;
 declare function useUpdateWebhookEndpoint(): _tanstack_react_query.UseMutationResult<{
     id: string;
     organizationId: string;
-    key: string;
+    keyPrefix: string | null;
     name: string;
     description: string | null;
     resourceId: string | null;
@@ -7687,6 +7986,7 @@ declare function useUpdateWebhookEndpoint(): _tanstack_react_query.UseMutationRe
     requestCount: number;
     createdAt: string;
     updatedAt: string;
+    key?: string | undefined;
 }, Error, {
     endpointId: string;
     data: UpdateWebhookEndpointRequest;
@@ -8255,5 +8555,5 @@ declare function useCreateNote(): _tanstack_react_query.UseMutationResult<{
     type?: string;
 }, "organization_id">, unknown>;
 
-export { ApiKeyService, CredentialService, DeploymentService, OperationsService, OrganizationMembershipService, REFETCH_INTERVAL_RUNNING, WS_MAX_RETRIES_BEFORE_ERROR, WS_RECONNECT_BASE_DELAY, WS_RECONNECT_MAX_DELAY, WebhookEndpointService, acquisitionListKeys, collectResourceFilterFacets, companyKeys, contactKeys, createFeatureAccessHook, createUseFeatureAccess, dealKeys, dealNoteKeys, dealTaskKeys, executionsKeys, filterByDomainFilters, getResourceFilterFacetIds, isSessionCapable, labelResourceFilterFacet, milestoneKeys, noteKeys, observabilityKeys, operationsKeys, projectActivityKeys, projectKeys, requestsKeys, scheduleKeys, sessionsKeys, sortData, taskKeys, useActivateDeployment, useActivities, useActivitiesRealtime, useActivityFilters, useActivityTrend, useArchiveSession, useArchivedLogs, useBatchDelete, useBatchTelemetry, useBatchedResourcesHealth, useBulkDeleteExecutions, useBusinessImpact, useCancelExecution, useCancelSchedule, useCheckpointTasks, useCommandQueue, useCommandQueueTotals, useCommandViewData, useCommandViewDomainFilters, useCommandViewLayout, useCommandViewStats, useCommandViewStore, useCompanies, useCompany, useCompanyFacets, useCompleteDealTask, useContact, useContacts, useCostBreakdown, useCostByModel, useCostSummary, useCostTrends, useCreateApiKey, useCreateCompany, useCreateContact, useCreateCredential, useCreateDealNote, useCreateDealTask, useCreateProject as useCreateDeliveryProject, useCreateList, useCreateMilestone, useCreateNote, useCreateSchedule, useCreateSession, useCreateTask, useCreateWebhookEndpoint, useCredentials, useDashboardMetrics, useDeactivateDeployment, useDeactivateMembership, useDealDetail, useDealNotes, useDealTasks, useDealTasksDue, useDeals, useDealsLookup, useDealsSummary, useDeleteApiKey, useDeleteCompanies, useDeleteContacts, useDeleteCredential, useDeleteDeal, useDeleteProject as useDeleteDeliveryProject, useDeleteTask as useDeleteDeliveryTask, useDeleteDeployment, useDeleteExecution, useDeleteList, useDeleteMilestone, useDeleteRequest, useDeleteSchedule, useDeleteSession, useDeleteTask$1 as useDeleteTask, useDeleteWebhookEndpoint, useErrorAnalysis, useErrorDetail, useErrorDetails, useErrorDistribution, useErrorNotification, useErrorTrends, useExecuteAsync, useExecuteResource, useExecution, useExecutionHealth, useExecutionLogSSE, useExecutionLogs, useExecutionLogsFilters, useExecutionPanelState, useExecutions, useGetExecutionHistory, useGetSchedule, useGraphStats, useList, useListApiKeys, useListDeployments, useListExecutions, useListProgress, useListSchedules, useListWebhookEndpoints, useLists, useListsTelemetry, useMarkAllAsRead, useMarkAsRead, useMergedExecution, useMilestones, useNotificationCount as useNotificationCountSSE, useNotifications, useOrganizationMembers, usePaginationState, usePatchTask, usePauseSchedule, useProject, useProjectActivities, useProjectMilestones, useProjectNotes, useProjectRealtime, useProjectTasks, useProjects, useReactivateMembership, useRecentExecutionsByResource, useRequest, useRequestsList, useResolveAllErrors, useResolveError, useResolveErrorsByExecution, useResourceDefinition, useResourceErrors, useResourceExecutions, useResourceSearch, useResources, useResourcesDomainFilters, useResourcesHealth, useResumeSchedule, useRetryExecution, useSSEConnection, useScheduledTasks, useSession, useSessionExecution, useSessionExecutions, useSessionMessages, useSessionWebSocket, useSessions, useSortedData, useStatusFilter, useSubmitAction, useSuccessNotification, useSyncDealStage, useTableSelection, useTableSort, useTasks, useTestNotification, useTimeRangeDates, useTopFailingResources, useUnresolveError, useUnresolvedErrors, useUpdateAnchor, useUpdateApiKey, useUpdateCompany, useUpdateContact, useUpdateCredential, useUpdateProject as useUpdateDeliveryProject, useUpdateList, useUpdateListConfig, useUpdateMemberConfig, useUpdateMilestone, useUpdateRequestStatus, useUpdateSchedule, useUpdateTask, useUpdateWebhookEndpoint, useUserMemberships, useVisibleResources, useWarningNotification };
-export type { AcqCompanyWithCount, AcqContactWithCompany, AcqDealNote, AcqDealTask, AcqDealTaskKind, ActivityFilters, ActivityTrendResponse, BulkDeleteExecutionsParams, BulkDeleteExecutionsResult, BusinessImpactMetrics, CancelExecutionParams, CancelExecutionResult, ChatMessage, CreateApiKeyRequest, CreateApiKeyResponse, CreateCredentialRequest, CreateCredentialResponse, CreateScheduleInput, CreateSessionResponse, CredentialListItem, DealDetail, DealLookupFilters, DealLookupItem, DealSummaryStageItem, DealsSummaryResponse, DeleteExecutionParams, Deployment, ErrorDistributionItem, ErrorDistributionParams, ErrorFilters, ErrorTrendsParams, ExecuteAsyncParams, ExecuteAsyncResult, ExecutionErrorDetails, ExecutionHistoryItem, ExecutionHistoryResponse, ExecutionLogsFilters, ExecutionLogsPageResponse, FailingResource, FeatureAccessResult, GetMessagesResponse, ListActivitiesResponse, ListApiKeysResponse, ListCredentialsResponse, ListSchedulesFilters, ListSchedulesResponse, ListWebhookEndpointsResponse, MessageEvent, MessageType, RequestRow, RequestsListFilters, ResourceFilterFacet, ResourcesResponse, RetryExecutionParams, SessionDTO, SessionExecution, SessionExecutionsResponse, SessionListItem, SessionTokenUsage, SortDirection, SortState, StaleDealSummaryItem, StatusFilter, SubmitActionRequest, SubmitActionResponse, TaskSchedule, TopFailingResourcesParams, UpdateScheduleInput, UseActivitiesParams, UseActivityTrendParams, UseBatchedResourcesHealthParams, UseExecuteResourceOptions, UseExecutionHealthParams, UseExecutionLogsParams, UseExecutionPanelStateOptions, UseExecutionPanelStateReturn, UseNotificationCountArgs, UseResourcesHealthParams, UseSSEConnectionOptions, UseScheduledTasksOptions, WebSocketState };
+export { ApiKeyService, CredentialService, DeploymentService, OperationsService, OrganizationMembershipService, REFETCH_INTERVAL_RUNNING, WS_MAX_RETRIES_BEFORE_ERROR, WS_RECONNECT_BASE_DELAY, WS_RECONNECT_MAX_DELAY, WebhookEndpointService, acquisitionListKeys, collectResourceFilterFacets, companyKeys, contactKeys, createFeatureAccessHook, dealKeys, dealNoteKeys, dealTaskKeys, executionsKeys, filterByDomainFilters, getResourceFilterFacetIds, isSessionCapable, labelResourceFilterFacet, milestoneKeys, noteKeys, observabilityKeys, operationsKeys, projectActivityKeys, projectKeys, requestsKeys, scheduleKeys, sessionsKeys, sortData, taskKeys, useActivateDeployment, useActivities, useActivitiesRealtime, useActivityFilters, useActivityTrend, useArchiveSession, useArchivedLogs, useAssignRole, useBatchDelete, useBatchTelemetry, useBatchedResourcesHealth, useBulkDeleteExecutions, useBusinessImpact, useCancelExecution, useCancelSchedule, useCheckpointTasks, useCommandQueue, useCommandQueueTotals, useCommandViewData, useCommandViewDomainFilters, useCommandViewLayout, useCommandViewStats, useCommandViewStore, useCompanies, useCompany, useCompanyFacets, useCompleteDealTask, useContact, useContacts, useCostBreakdown, useCostByModel, useCostSummary, useCostTrends, useCreateApiKey, useCreateCompany, useCreateContact, useCreateCredential, useCreateDealNote, useCreateDealTask, useCreateProject as useCreateDeliveryProject, useCreateList, useCreateMilestone, useCreateNote, useCreateOrgRole, useCreateSchedule, useCreateSession, useCreateTask, useCreateWebhookEndpoint, useCredentials, useDashboardMetrics, useDeactivateDeployment, useDeactivateMembership, useDealDetail, useDealNotes, useDealTasks, useDealTasksDue, useDeals, useDealsLookup, useDealsSummary, useDeleteApiKey, useDeleteCompanies, useDeleteContacts, useDeleteCredential, useDeleteDeal, useDeleteProject as useDeleteDeliveryProject, useDeleteTask as useDeleteDeliveryTask, useDeleteDeployment, useDeleteExecution, useDeleteList, useDeleteMilestone, useDeleteOrgRole, useDeleteRequest, useDeleteSchedule, useDeleteSession, useDeleteTask$1 as useDeleteTask, useDeleteWebhookEndpoint, useEffectivePermissions, useErrorAnalysis, useErrorDetail, useErrorDetails, useErrorDistribution, useErrorNotification, useErrorTrends, useExecuteAsync, useExecuteResource, useExecution, useExecutionHealth, useExecutionLogSSE, useExecutionLogs, useExecutionLogsFilters, useExecutionPanelState, useExecutions, useGetExecutionHistory, useGetSchedule, useGraphStats, useHasPermission, useList, useListApiKeys, useListDeployments, useListExecutions, useListProgress, useListSchedules, useListWebhookEndpoints, useLists, useListsTelemetry, useMarkAllAsRead, useMarkAsRead, useMergedExecution, useMilestones, useNotificationCount as useNotificationCountSSE, useNotifications, useOrgRoles, useOrganizationMembers, useOrganizationPermissions, usePaginationState, usePatchTask, usePauseSchedule, usePermissionCatalog, useProject, useProjectActivities, useProjectMilestones, useProjectNotes, useProjectRealtime, useProjectTasks, useProjects, useReactivateMembership, useRecentExecutionsByResource, useRequest, useRequestsList, useResolveAllErrors, useResolveError, useResolveErrorsByExecution, useResourceDefinition, useResourceErrors, useResourceExecutions, useResourceSearch, useResources, useResourcesDomainFilters, useResourcesHealth, useResumeSchedule, useRetryExecution, useRevokeRole, useSSEConnection, useScheduledTasks, useSession, useSessionExecution, useSessionExecutions, useSessionMessages, useSessionWebSocket, useSessions, useSortedData, useStatusFilter, useSubmitAction, useSuccessNotification, useSyncDealStage, useTableSelection, useTableSort, useTasks, useTestNotification, useTimeRangeDates, useTopFailingResources, useUnresolveError, useUnresolvedErrors, useUpdateAnchor, useUpdateApiKey, useUpdateCompany, useUpdateContact, useUpdateCredential, useUpdateProject as useUpdateDeliveryProject, useUpdateList, useUpdateListConfig, useUpdateMemberConfig, useUpdateMilestone, useUpdateOrgRole, useUpdateRequestStatus, useUpdateSchedule, useUpdateTask, useUpdateWebhookEndpoint, useUserMemberships, useVisibleResources, useWarningNotification };
+export type { AcqCompanyWithCount, AcqContactWithCompany, AcqDealNote, AcqDealTask, AcqDealTaskKind, ActivityFilters, ActivityTrendResponse, AssignRoleInput, BulkDeleteExecutionsParams, BulkDeleteExecutionsResult, BusinessImpactMetrics, CancelExecutionParams, CancelExecutionResult, ChatMessage, CreateApiKeyRequest, CreateApiKeyResponse, CreateCredentialRequest, CreateCredentialResponse, CreateOrgRoleInput, CreateScheduleInput, CreateSessionResponse, CredentialListItem, DealDetail, DealLookupFilters, DealLookupItem, DealSummaryStageItem, DealsSummaryResponse, DeleteExecutionParams, Deployment, ErrorDistributionItem, ErrorDistributionParams, ErrorFilters, ErrorTrendsParams, ExecuteAsyncParams, ExecuteAsyncResult, ExecutionErrorDetails, ExecutionHistoryItem, ExecutionHistoryResponse, ExecutionLogsFilters, ExecutionLogsPageResponse, FailingResource, FeatureAccessResult, GetMessagesResponse, ListActivitiesResponse, ListApiKeysResponse, ListCredentialsResponse, ListSchedulesFilters, ListSchedulesResponse, ListWebhookEndpointsResponse, MessageEvent, MessageType, OrgRole, RequestRow, RequestsListFilters, ResourceFilterFacet, ResourcesResponse, RetryExecutionParams, RevokeRoleInput, SessionDTO, SessionExecution, SessionExecutionsResponse, SessionListItem, SessionTokenUsage, SortDirection, SortState, StaleDealSummaryItem, StatusFilter, SubmitActionRequest, SubmitActionResponse, TaskSchedule, TopFailingResourcesParams, UpdateOrgRoleInput, UpdateScheduleInput, UseActivitiesParams, UseActivityTrendParams, UseBatchedResourcesHealthParams, UseExecuteResourceOptions, UseExecutionHealthParams, UseExecutionLogsParams, UseExecutionPanelStateOptions, UseExecutionPanelStateReturn, UseNotificationCountArgs, UseResourcesHealthParams, UseSSEConnectionOptions, UseScheduledTasksOptions, WebSocketState };