@ever-works/activepieces-plugin 1.0.0 → 1.0.6

package/dist/index.js

@@ -0,0 +1,3465 @@
+// ../../../node_modules/.pnpm/@ever-co+connect-contracts@1.0.0-rc.2/node_modules/@ever-co/connect-contracts/dist/index.js
+var CONSTANTS = {
+  "$comment": "Wire constants of the Ever Platform modules. tools/split-integrations.mjs refreshes the fields read from the contract (contracts_version, code patterns, install_sources, products, stats_headers, feed_event_types, integration_keys, root_keys); every other value is a default a product may override by its own configuration.",
+  "contracts_version": "1.0.0-rc.2",
+  "connect_code_pattern": "^EVC(-[0-9A-HJKMNP-TV-Za-hj-kmnp-tv-z]{4}){3}$",
+  "link_code_pattern": "^EVL(-[0-9A-HJKMNP-TV-Za-hj-kmnp-tv-z]{4}){3}$",
+  "install_sources": "^(cloud|self-hosted|ever\\.sh|works_app|desktop|partner:[a-z0-9-]{2,32})$",
+  "products": [
+    "gauzy",
+    "teams",
+    "works",
+    "rec",
+    "traduora",
+    "demand"
+  ],
+  "instance_kinds": [
+    "cloud",
+    "self_hosted",
+    "works_app"
+  ],
+  "instance_token_prefix": "evit_",
+  "entitlement_typ": "ever-entitlement+jwt",
+  "intent_typ": "ever-intent+jwt",
+  "assertion_typ": "ever-assertion+jwt",
+  "key_manifest_typ": "ever-key-manifest+jwt",
+  "stats_link_typ": "ever-stats-link+jwt",
+  "client_assertion_typ": "JWT",
+  "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+  "entitlement_aud": "ever-connect",
+  "stats_headers": {
+    "key": "Ever-Stats-Key",
+    "signature": "Ever-Stats-Signature",
+    "key_id": "Ever-Stats-Key-Id"
+  },
+  "stats_signature_prefix": "ed25519=",
+  "feed_event_types": [
+    "ever.consent.consent.granted",
+    "ever.consent.consent.revoked",
+    "ever.consent.integration.disabled",
+    "ever.consent.integration.enabled",
+    "ever.consent.integration.scope_bumped",
+    "ever.entitlements.entitlement.issued",
+    "ever.entitlements.entitlement.revoked",
+    "ever.entitlements.usage.limit_reached",
+    "ever.registry.instance.approved",
+    "ever.registry.instance.connected",
+    "ever.registry.instance.disconnected",
+    "ever.registry.instance.key_rotated",
+    "ever.registry.instance.revoked",
+    "ever.registry.instance.seen",
+    "ever.registry.managed_operation.requested",
+    "ever.registry.managed_operation.state_changed",
+    "ever.registry.membership.created",
+    "ever.registry.membership.removed",
+    "ever.registry.membership.role_changed",
+    "ever.registry.person.deletion_requested",
+    "ever.registry.person.export_requested",
+    "ever.registry.tenant_link.created",
+    "ever.registry.tenant_link.orphaned",
+    "ever.registry.tenant_link.resumed",
+    "ever.registry.tenant_link.suspended",
+    "ever.registry.tenant_link.unlinked"
+  ],
+  "integration_keys": [
+    "instance_url",
+    "stats_link",
+    "ever_id_login",
+    "counterparty_lookup",
+    "counterparty_discoverable",
+    "profile_import",
+    "usage_reporting",
+    "app_sync",
+    "billing_link",
+    "webhooks",
+    "managed_operations",
+    "provider_access",
+    "marketplace_installs"
+  ],
+  "key_manifest_path": "/.well-known/ever-keys.json",
+  "assertion_audience_path": "/v1/instances/token",
+  "assertion_max_ttl_s": 300,
+  "assertion_max_skew_s": 300,
+  "token_ttl_s": 3600,
+  "token_refresh_after_s": 3e3,
+  "key_rotation_overlap_s": 604800,
+  "entitlement": {
+    "validity_s": 604800,
+    "refresh_after_s": 21600,
+    "grace_s": 2592e3,
+    "max_reads_per_hour": 6
+  },
+  "key_manifest": {
+    "refresh_s": 86400,
+    "unknown_kid_refresh_min_s": 600,
+    "lifetime_s": 2592e3
+  },
+  "heartbeat_interval_s": 86400,
+  "heartbeat_after_boot_max_s": 300,
+  "heartbeat_min_interval_s": 60,
+  "feed": {
+    "wait_s": 25,
+    "interval_fallback_s": 900,
+    "page_limit": 50
+  },
+  "stats": {
+    "send_interval_s": 86400,
+    "min_interval_s": 3600,
+    "max_bytes": 16384,
+    "final_resend_days": [
+      1,
+      2,
+      3
+    ],
+    "reports_per_day": 24
+  },
+  "lookup": {
+    "normalization_version": 1,
+    "max_hashes_per_query": 100,
+    "cache_positive_s": 86400,
+    "cache_negative_s": 3600,
+    "salt_cache_s": 86400
+  },
+  "mirror": {
+    "max_bytes": 4194304,
+    "interval_s": 30
+  },
+  "step_up_max_age_s": 300,
+  "stats_link_statement_max_age_s": 600,
+  "timeouts_ms": {
+    "read": 6e3,
+    "write": 1e4
+  },
+  "user_agent_pattern": "ever-connect-sdk/<sdk version> (<product>/<product version>)",
+  "root_keys": [
+    {
+      "kid": "ever-202610-0d77",
+      "iss": "https://api-dev.ever.co",
+      "kty": "OKP",
+      "crv": "Ed25519",
+      "x": "cgULEqOov0n4s9I8luZboIgJp9mIGusmsSdSL4oCjKk",
+      "use": "sig",
+      "alg": "EdDSA"
+    },
+    {
+      "kid": "ever-202610-8704",
+      "iss": "https://api-stage.ever.co",
+      "kty": "OKP",
+      "crv": "Ed25519",
+      "x": "Ync-MW21JL72GOiS-RVrlvS3gyFH5Krh5f6I66jw1Qc",
+      "use": "sig",
+      "alg": "EdDSA"
+    }
+  ],
+  "root_keys_file_env": "EVER_PLATFORM_ROOT_KEYS_FILE",
+  "root_keys_file_hosts": [
+    "localhost",
+    "127.0.0.0/8",
+    "::1",
+    "10.0.0.0/8",
+    "172.16.0.0/12",
+    "192.168.0.0/16",
+    "*.localhost"
+  ]
+};
+var FEED_EVENT_TYPES = CONSTANTS.feed_event_types;
+var PROBLEM_CODES = [
+  "validation_failed",
+  "not_found",
+  "unauthorized",
+  "forbidden_role",
+  "forbidden_scope",
+  "ambiguous_credentials",
+  "credential_revoked",
+  "instance_disconnected",
+  "instance_pending_approval",
+  "not_connection_owner",
+  "integration_disabled",
+  "integration_revoked",
+  "denied_by_policy",
+  "integration_not_available",
+  "entitlement_required",
+  "tier_required",
+  "limit_exceeded",
+  "rate_limited",
+  "idempotency_mismatch",
+  "idempotency_in_progress",
+  "stale_version",
+  "module_disabled",
+  "handle_taken",
+  "handle_reserved",
+  "handle_retired",
+  "handle_invalid",
+  "handle_held",
+  "handle_held_by_you",
+  "code_invalid",
+  "code_expired",
+  "product_mismatch",
+  "product_not_supported",
+  "key_mismatch",
+  "signature_invalid",
+  "unlinked_org",
+  "schema_violation",
+  "mirror_owned_field",
+  "illegal_transition",
+  "already_exists",
+  "already_completed",
+  "billing_active",
+  "sso_required",
+  "reauth_required",
+  "session_required",
+  "step_up_required",
+  "session_bound",
+  "authorization_pending",
+  "slow_down",
+  "expired_token",
+  "already_connected",
+  "already_linked",
+  "already_claimed",
+  "invalid_client",
+  "public_jwk_invalid",
+  "identifier_claimed",
+  "salt_version_unknown",
+  "salt_version_retired",
+  "hashes_invalid",
+  "lookup_key_required",
+  "required_component",
+  "resync_required",
+  "last_owner",
+  "last_auth_method",
+  "instances_linked",
+  "install_in_progress",
+  "slug_reserved",
+  "checklist_incomplete",
+  "scope_version_outdated",
+  "method_not_allowed",
+  "payload_too_large",
+  "unsupported_media_type",
+  "gone",
+  "unavailable",
+  "upstream",
+  "database_absent",
+  "database_unreachable",
+  "topic_private",
+  "keys_unavailable",
+  "internal_error"
+];
+var CODES = new Set(PROBLEM_CODES);
+
+// ../../contracts/dist/index.js
+var USER_SELECTABLE_WORK_KINDS = [
+  "website",
+  "landing-page",
+  "blog",
+  "directory",
+  "awesome-repo",
+  "repo",
+  "app"
+];
+var WORK_KINDS = [...USER_SELECTABLE_WORK_KINDS, "company", "campaign", "project", "default"];
+var WORK_KIND_SET = new Set(WORK_KINDS);
+var GOAL_KINDS = ["metric", "delivery"];
+var GOAL_KIND_SET = new Set(GOAL_KINDS);
+var RECORD_VISIBILITIES = ["private", "team", "organization"];
+var RECORD_VISIBILITY_SET = new Set(RECORD_VISIBILITIES);
+var RECORD_LIST_VIEWS = ["mine", "shared", "organization"];
+var RECORD_LIST_VIEW_SET = new Set(RECORD_LIST_VIEWS);
+var APP_DEPENDENCY_BACKUP_OVERDUE_MS = 26 * 36e5;
+var APP_DEPENDENCY_MANAGED = {
+  pgRoleConnectionLimit: 20,
+  pgDatabaseConnectionLimit: 25,
+  pgStatementTimeoutMs: 6e4,
+  pgIdleInTransactionTimeoutMs: 6e4,
+  bucketQuotaGiB: 10,
+  redisMaxMemoryMiB: 256,
+  backupMaxAgeMs: 864e5
+};
+var APP_ENV_VALIDATION_REFUSAL_CODES = [
+  "invalidName",
+  "reservedName",
+  "valueTooLarge",
+  "controlCharacter",
+  "lengthMismatch",
+  "tooShort",
+  "tooLong",
+  "patternMismatch"
+];
+var APP_ENV_API_ERROR_CODES = [
+  "generatedValueUseRotate",
+  "neverRotateNotAcknowledged",
+  "rotateConfirmationMismatch",
+  "secureStorageUnavailable",
+  "tooManyValues",
+  "valuesTooLarge",
+  "malformedLine",
+  "rotateRateLimited"
+];
+var APP_ENV_ERROR_CODES = [...APP_ENV_VALIDATION_REFUSAL_CODES, ...APP_ENV_API_ERROR_CODES];
+var APP_LAUNCHER_CLIENT_CACHE_MS = 5 * 6e4;
+var MANAGED_HOSTING_REASONS = [
+  "licenseNotGreen",
+  "upstreamAgreementMissing",
+  "entryDisallows",
+  "blueprintNotVerified",
+  "managedTierDisabled"
+];
+var MANAGED_HOSTING_AVAILABILITIES = ["available", ...MANAGED_HOSTING_REASONS];
+var APP_PRIVATE_COPY_MAX_SIZE_KB = 512e3;
+var APP_DEPLOY_MAX_DURATION_S = 7200;
+var APP_DEPLOY_LOCK_STALE_S = APP_DEPLOY_MAX_DURATION_S + 60;
+var APPS_CATALOG_LAST_GOOD_REGISTRY_MS = 7 * 864e5;
+var APP_REPOSITORY_STAGE_LIMITS = {
+  "private-copy": {
+    maxSizeKb: APP_PRIVATE_COPY_MAX_SIZE_KB,
+    fetchesLfs: false,
+    refusalCodes: ["too_large_for_private_copy", "uses_lfs"]
+  },
+  provisioning: {
+    maxSizeKb: 3 * 1024 * 1024,
+    refusalCodes: ["repository-too-large"]
+  },
+  build: {
+    refusalCodes: []
+  },
+  sandbox: {
+    refusalCodes: []
+  }
+};
+var TENANT_POSTGRES_ROLE_CONNECTION_LIMIT = APP_DEPENDENCY_MANAGED.pgRoleConnectionLimit;
+var TENANT_POSTGRES_DATABASE_CONNECTION_LIMIT = APP_DEPENDENCY_MANAGED.pgDatabaseConnectionLimit;
+var TENANT_POSTGRES_STATEMENT_TIMEOUT_MS = APP_DEPENDENCY_MANAGED.pgStatementTimeoutMs;
+var TENANT_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS = APP_DEPENDENCY_MANAGED.pgIdleInTransactionTimeoutMs;
+var APP_PROVISION_LIMITS = {
+  attemptsDefault: 3,
+  attemptsMin: 1,
+  attemptsMax: 5,
+  attemptsPerAnswer: 2,
+  questionsMax: 3,
+  attemptsCeiling: 9,
+  optionsMax: 4,
+  tokenCapDefault: 3e6,
+  tokenCapMin: 5e5,
+  tokenCapMax: 1e7,
+  runnerMinuteCapDefault: 240,
+  runnerMinuteCapMin: 60,
+  runnerMinuteCapMax: 600,
+  /** Two starts of the same App Work inside this window yield one row (§4 "Start semantics"). */
+  startDedupeMs: 1e4,
+  analysisRunMs: 45 * 6e4,
+  iterateRunMs: 30 * 6e4,
+  forkWaitMs: 30 * 6e4,
+  activeDeadlineMs: 8 * 36e5,
+  /**
+   * Verification-Build reservation: `min(headSpec.build.resources.timeoutMinutes, buildMinutesMax)
+   * + runnerBootMinutesMax` — 90 minutes at the defaults, and the number §6.4 compares against the cap.
+   */
+  buildMinutesMax: 60,
+  jobSecondsMax: 900,
+  startupSecondsMax: 900,
+  smokeRequestMs: 3e4,
+  smokeTotalMs: 3e5,
+  runnerBootMinutesMax: 30,
+  runnerBootMemoryGiB: 12,
+  buildMemoryGiBMax: 14,
+  namespaceTtlMinutes: 90,
+  repoMaxBytes: 3 * 1024 ** 3,
+  diffMaxFiles: 12,
+  diffMaxLines: 3e3,
+  fileMaxBytes: 128 * 1024,
+  outputMaxBytes: 512 * 1024,
+  reportMaxChars: 4e4,
+  instructionFileMaxBytes: 32 * 1024,
+  logTailLines: 200,
+  logTailBytes: 16 * 1024,
+  evidenceCommentMaxChars: 6e4,
+  chatMessagesMax: 12,
+  questionReminderMs: 72 * 36e5,
+  questionExpiryMs: 14 * 864e5,
+  activePerUser: 3,
+  activePerOrg: 10,
+  startsPerHour: 10,
+  pollMs: 5e3,
+  infraRetries: 3,
+  infraRetryWindowMs: 30 * 6e4,
+  suggestionsPer30Days: 5,
+  autoReprovisionPerSync: 1,
+  autoReprovisionPer7Days: 2,
+  clusterProbeMs: 1e4,
+  podPendingInfraMs: 10 * 6e4
+};
+var MAX_CANDIDATE_OPTIONS = APP_PROVISION_LIMITS.optionsMax - 1;
+var KB_EXPORT_MAX_BYTES = 200 * 1024 * 1024;
+var TERMINAL_MAX_FRAME_BYTES = 1024 * 1024;
+var COMPUTER_MAX_FRAME_BYTES = 512 * 1024;
+var COMPUTER_MAX_BATCH_BYTES = 512 * 1024;
+var COMPUTER_MAX_WIRE_FRAME_BYTES = Math.ceil(COMPUTER_MAX_FRAME_BYTES * 4 / 3) + 4096;
+var COMPUTER_QUALITY_PRESETS = Object.freeze({
+  sharp: Object.freeze({ width: 1280, maxFps: 8, keyframeMs: 5e3, q: 70 }),
+  smooth: Object.freeze({ width: 960, maxFps: 15, keyframeMs: 5e3, q: 55 }),
+  steady: Object.freeze({ width: 800, maxFps: 2, keyframeMs: 2e3, q: 45 })
+});
+var COMPUTER_CONTROL_IDLE_MS_DEFAULT = 10 * 6e4;
+var COMPUTER_CONTROL_CEILING_MS_DEFAULT = 60 * 6e4;
+var COMPUTER_KEY_MODIFIER_ALT = 1;
+var COMPUTER_KEY_MODIFIER_CTRL = 2;
+var COMPUTER_KEY_MODIFIER_META = 4;
+var CTRL = COMPUTER_KEY_MODIFIER_CTRL;
+var META = COMPUTER_KEY_MODIFIER_META;
+var ALT = COMPUTER_KEY_MODIFIER_ALT;
+function withCtrlOrMeta(code, key) {
+  return [
+    { code, requires: CTRL, label: `Ctrl/\u2318+${key}` },
+    { code, requires: META, label: `Ctrl/\u2318+${key}` }
+  ];
+}
+var COMPUTER_BLOCKED_SHORTCUTS = Object.freeze([
+  ...withCtrlOrMeta("KeyC", "C"),
+  ...withCtrlOrMeta("KeyX", "X"),
+  ...withCtrlOrMeta("KeyV", "V"),
+  ...withCtrlOrMeta("KeyW", "W"),
+  ...withCtrlOrMeta("KeyT", "T"),
+  ...withCtrlOrMeta("KeyN", "N"),
+  ...withCtrlOrMeta("KeyQ", "Q"),
+  ...withCtrlOrMeta("Tab", "Tab"),
+  { code: "Tab", requires: ALT, label: "Alt+Tab" },
+  { code: "F4", requires: ALT, label: "Alt+F4" },
+  { code: "Delete", requires: CTRL | ALT, label: "Ctrl+Alt+Delete" },
+  { code: "MetaLeft", requires: 0, label: "\u2318/Win" },
+  { code: "MetaRight", requires: 0, label: "\u2318/Win" }
+]);
+var TASK_BOARD_STATUSES = [
+  "backlog",
+  "todo",
+  "in_progress",
+  "in_review",
+  "blocked",
+  "done",
+  "cancelled"
+];
+var TASK_BOARD_TERMINAL_STATUSES = ["done", "cancelled"];
+var TASK_BOARD_STATUS_COLUMNS = TASK_BOARD_STATUSES.map((status) => ({
+  key: status,
+  statuses: [status],
+  terminal: TASK_BOARD_TERMINAL_STATUSES.includes(status),
+  toggleOnly: false
+}));
+var PLATFORM_DEFAULT_MERGE_POLICY = Object.freeze({
+  allowAgentMerge: false,
+  requireGreenGate: true,
+  requireHumanApproval: true,
+  allowedMergeMethods: ["squash"],
+  protectedBranches: ["main", "master", "develop", "stage"]
+});
+var MERGE_APPROVAL_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var TOOL_GRANT_SCOPE_PRECEDENCE = Object.freeze([
+  "tenant",
+  "organization",
+  "work",
+  "agent"
+]);
+var PLATFORM_DEFAULT_TOOL_GRANT = Object.freeze({
+  allow: Object.freeze(["*"]),
+  deny: Object.freeze([])
+});
+var AGENT_INIT_SCRIPT_MAX_BYTES = 16 * 1024;
+var INGEST_EVENT_PAYLOAD_MAX_BYTES = 32 * 1024;
+var VERSION = "1.0.0";
+var GTM_SKILLS = [
+  // ── research ────────────────────────────────────────────────────────
+  {
+    slug: "lead-research",
+    title: "Lead research",
+    description: "Build a candidate lead list from seed criteria and public sources, recording a supporting source for every contact.",
+    stage: "research",
+    tags: ["gtm", "sales", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "icp", description: "Ideal-customer description: segment, size, geography, role titles." },
+      { key: "seed_sources", description: "Seed lists, domains, or saved searches to start from." },
+      { key: "max_leads", description: "Hard cap on how many candidates this run may collect." }
+    ],
+    outputs: [
+      { key: "contacts", description: "Candidate contacts with name, company, title, and a source reference." }
+    ],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Build a candidate lead list from the supplied criteria and seed sources.",
+      "",
+      "## Rules",
+      "- NEVER invent a contact detail. An email address, phone number, or title is recorded only",
+      "  when a source supports it; otherwise leave the field empty.",
+      "- Record `source` on every contact \u2014 the URL or seed list the entry came from. A contact",
+      "  without a source is not a lead, it is a guess.",
+      "- Respect `max_leads` exactly. Stop collecting when the cap is reached and say how many",
+      "  candidates were left unexamined.",
+      "- De-duplicate by email when present, otherwise by (company, name).",
+      "- Exclude anyone who has asked not to be contacted, and any source that forbids collection.",
+      "",
+      "## Output",
+      "Write `contacts`. Each entry carries `name`, and any of `email`, `company`, `title`,",
+      "`source`, `notes` that a source supports. Report the counts examined, kept, and dropped,",
+      "with the reason for each drop category."
+    ].join("\n")
+  },
+  {
+    slug: "competitor-watch",
+    title: "Competitor watch",
+    description: "Monitor a watchlist of companies across public sources and emit dated, source-linked change signals.",
+    stage: "research",
+    tags: ["gtm", "marketing", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "watchlist", description: "Companies to monitor: name, website, public repositories." },
+      { key: "focus_areas", description: "What to watch: pricing, features, positioning, hiring." },
+      { key: "since", description: "Only report changes observed after this date." }
+    ],
+    outputs: [{ key: "signals", description: "Dated observations with a source URL and the focus area they hit." }],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Monitor the watchlist across public sources and report what changed.",
+      "",
+      "## Rules",
+      "- Public sources only: published pages, public announcements, public repositories.",
+      "- Every signal carries a source URL and an observation date. No date or no URL means the",
+      "  signal is not reportable.",
+      "- Separate FACT (what the source says) from ANALYSIS (what you infer). Never blend them in",
+      "  the same sentence.",
+      "- Report only changes since `since`. If a focus area produced nothing, say so explicitly \u2014",
+      "  an empty period is a finding, not a gap to fill.",
+      "- Do not speculate about unannounced plans, internal metrics, or private information.",
+      "",
+      "## Output",
+      "Write `signals`. Each entry carries `title`, `url`, `publishedDate`, the focus area, and a",
+      "one-line factual summary."
+    ].join("\n")
+  },
+  {
+    slug: "news-signal-detection",
+    title: "News signal detection",
+    description: "Scan configured topics for newsworthy events and rank them by relevance to the campaign, discarding noise.",
+    stage: "research",
+    tags: ["gtm", "marketing", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "topics", description: "Topics, keywords, or accounts to scan." },
+      { key: "lookback_days", description: "How far back the scan reaches." },
+      { key: "relevance_threshold", description: "Minimum relevance (0-1) an item must clear to be kept." }
+    ],
+    outputs: [{ key: "signals", description: "Relevance-ranked news items with source URL and publish date." }],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Scan the configured topics and keep only what is genuinely newsworthy for this campaign.",
+      "",
+      "## Rules",
+      "- Score each candidate 0-1 for relevance to the campaign brief and drop anything below",
+      "  `relevance_threshold`. State the score and the one-line reason for every item you keep.",
+      "- Prefer primary sources over aggregators; when both exist, link the primary.",
+      "- Collapse duplicate coverage of the same event into one signal with the best source.",
+      "- Nothing older than `lookback_days`. Undated items are dropped, not guessed at.",
+      "- Never restate a headline as fact when the source hedges it \u2014 carry the hedge through.",
+      "",
+      "## Output",
+      "Write `signals` ordered by descending relevance, each with `title`, `url`, `publishedDate`,",
+      "the relevance score, and the reason it matters here."
+    ].join("\n")
+  },
+  // ── qualify ─────────────────────────────────────────────────────────
+  {
+    slug: "lead-scoring",
+    title: "Lead scoring",
+    description: "Score contacts 0-100 against a declarative weight table and attach an explainable reason per point awarded.",
+    stage: "qualify",
+    tags: ["gtm", "sales", "scoring"],
+    version: VERSION,
+    inputs: [
+      { key: "contacts", description: "Candidate contacts to score." },
+      { key: "score_weights", description: "Weight table: signal name \u2192 points awarded." }
+    ],
+    outputs: [
+      { key: "scored_contacts", description: "Contacts with `score` (0-100) and `scoreReasons` per contact." }
+    ],
+    allowedTools: [],
+    body: [
+      "Score every contact against the supplied weight table.",
+      "",
+      "## Rules",
+      "- The weight table is the whole model. Award points ONLY for signals it names; never invent",
+      "  a bonus, and never award points for a signal the contact data does not actually support.",
+      "- Clamp the final score to 0-100. Record one `scoreReasons` line per point awarded, in the",
+      "  form `<signal> +<points>`, so any score can be re-derived by hand.",
+      "- A missing field is worth zero points, never an assumed value.",
+      "- Scoring is deterministic: the same contact and the same weight table must always produce",
+      "  the same score. Do not break ties with judgement calls \u2014 leave ties tied.",
+      "",
+      "## Output",
+      "Write `scored_contacts` sorted by descending score, then report the score distribution and",
+      "the three signals that moved the list most."
+    ].join("\n")
+  },
+  {
+    slug: "risk-filter",
+    title: "Risk filter",
+    description: "Flag low-quality or unsafe contacts against a risk weight table and exclude those at or above the threshold.",
+    stage: "qualify",
+    tags: ["gtm", "sales", "safety"],
+    version: VERSION,
+    inputs: [
+      { key: "scored_contacts", description: "Contacts already carrying a priority score." },
+      { key: "risk_weights", description: "Risk weight table: risk signal \u2192 points." },
+      { key: "risk_threshold", description: "Risk score at or above which a contact is excluded." }
+    ],
+    outputs: [
+      {
+        key: "scored_contacts",
+        description: "The same contacts, now carrying `riskScore`, `riskReasons`, and an excluded flag."
+      }
+    ],
+    allowedTools: [],
+    body: [
+      "Assess each scored contact for risk and mark \u2014 never silently delete \u2014 the excluded ones.",
+      "",
+      "## Rules",
+      "- Apply the risk weight table exactly as given; record one `riskReasons` line per point.",
+      "- Contacts at or above `risk_threshold` are EXCLUDED from outbound, but they stay in the",
+      "  data set with their reasons attached so a human can overturn the call.",
+      '- Never drop a contact without a recorded reason. "Looked wrong" is not a reason.',
+      "- Risk is about deliverability and safety (unverifiable identity, throwaway domains,",
+      "  do-not-contact signals) \u2014 it is not a second opinion on fit. Fit is `lead-scoring`.",
+      "",
+      "## Output",
+      "Write the enriched `scored_contacts` and report how many were excluded, grouped by the",
+      "dominant risk reason."
+    ].join("\n")
+  },
+  // ── draft ───────────────────────────────────────────────────────────
+  {
+    slug: "outreach-personalization",
+    title: "Outreach personalization",
+    description: "Write one 80-120 word personalized outbound draft per qualified contact, grounded only in known facts.",
+    stage: "draft",
+    tags: ["gtm", "sales", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "scored_contacts", description: "Qualified, non-excluded contacts to write for." },
+      { key: "campaign_brief", description: "Offer, proof points, and the single ask." },
+      { key: "tone", description: "Configured tone for the campaign." }
+    ],
+    outputs: [{ key: "drafts", description: "One draft per contact with `ref`, `channel`, `subject`, `body`." }],
+    allowedTools: [],
+    body: [
+      "Write one outbound draft per qualified contact.",
+      "",
+      "## Rules",
+      "- HARD CONSTRAINT: drafts only. Nothing is sent, scheduled, or queued for delivery here.",
+      '- 80-120 words in the body. One ask. No multi-part asks, no "quick question" openers that',
+      "  the rest of the message contradicts.",
+      "- Personalize ONLY from fields and signals actually present on the contact. If there is no",
+      "  personalization material, write the generic version and say so \u2014 a fabricated detail is",
+      "  worse than a generic opener.",
+      "- Write a subject line only for channels that carry one.",
+      "- No invented metrics, customer names, or mutual connections. Ever.",
+      "",
+      "## Output",
+      "Write `drafts`, ordered by descending contact score so the review gate sees the best",
+      "candidates first. Each draft carries a stable `ref` used later by review and the action log."
+    ].join("\n")
+  },
+  {
+    slug: "newsletter-drafting",
+    title: "Newsletter drafting",
+    description: "Turn briefs, notes, and collected signals into a scannable newsletter issue with one clear call to action.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "content", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "campaign_brief", description: "Issue theme, audience, and the call to action." },
+      { key: "signals", description: "Collected source material for the issue." },
+      { key: "tone", description: "Configured editorial tone." }
+    ],
+    outputs: [{ key: "drafts", description: "A single newsletter draft: subject line plus sectioned body." }],
+    allowedTools: ["content-extractor"],
+    body: [
+      "Draft one newsletter issue from the brief and the collected material.",
+      "",
+      "## Rules",
+      "- Draft-first: the issue is produced for human review. Never send or schedule it.",
+      "- Structure: subject line, one-sentence hook, 3-5 short sections, one call to action.",
+      "  Scannable beats comprehensive.",
+      "- Every claim traces to the brief, the knowledge base, or a supplied signal. Link the",
+      "  source when the section rests on one.",
+      "- Never invent metrics, quotes, or customer names.",
+      "- When the source material is thin, say so and list what extra input would raise quality",
+      "  rather than padding the issue.",
+      "",
+      "## Output",
+      "Write `drafts` with a single entry: `subject` plus the sectioned `body`."
+    ].join("\n")
+  },
+  {
+    slug: "social-scheduling",
+    title: "Social scheduling",
+    description: "Plan a channel-fit social calendar and stage each post for review, respecting cadence and angle variety.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "social", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "campaign_brief", description: "Campaign themes, channels, and cadence." },
+      { key: "signals", description: "Source material and trends to build posts from." },
+      { key: "cadence", description: "Posts per channel per period." }
+    ],
+    outputs: [
+      { key: "drafts", description: "Channel-fit post drafts, each with its planned slot in the calendar." }
+    ],
+    allowedTools: [],
+    body: [
+      "Plan the social calendar for the cadence window and draft each post.",
+      "",
+      "## Rules",
+      "- Draft-first: posts are STAGED for review. Never publish, never schedule to a live channel.",
+      "- Fit each draft to its channel: length, hashtag conventions, and link placement differ and",
+      "  a cross-posted body is a tell.",
+      "- Do not repeat the same angle inside one cadence window. Track the angle per slot and vary",
+      "  it deliberately.",
+      "- Build only from the brief, the content Works, and supplied signals. Never invent product",
+      "  claims or engagement numbers.",
+      "- Respect `cadence` exactly \u2014 proposing more slots than the operator configured is not",
+      "  ambition, it is a spam risk.",
+      "",
+      "## Output",
+      "Write `drafts` with the planned slot (channel + relative day) on each entry, plus a compact",
+      "calendar view of the window."
+    ].join("\n")
+  },
+  {
+    slug: "digest-compilation",
+    title: "Digest compilation",
+    description: "Compile collected signals into a recurring digest that separates facts from analysis and highlights change.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "reporting", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "signals", description: "Signals collected this period." },
+      { key: "previous_digest", description: "The prior issue, used to compute what changed." },
+      { key: "focus_areas", description: "Sections the digest must cover." }
+    ],
+    outputs: [{ key: "drafts", description: "A digest draft: sections, change highlights, and a trend view." }],
+    allowedTools: [],
+    body: [
+      "Compile the period digest from the collected signals.",
+      "",
+      "## Rules",
+      "- One section per focus area, in the configured order, every issue. A stable shape is what",
+      "  makes a recurring digest readable.",
+      "- Every section splits FACTS (sourced, dated, linked) from ANALYSIS (your interpretation),",
+      "  under those labels.",
+      "- Lead with what CHANGED since `previous_digest`. Unchanged areas get one line, not a",
+      "  restatement of last issue.",
+      "- No fabrication and no padding: if a focus area produced no signal this period, write",
+      "  exactly that.",
+      "- Close with a short trend view over the recent periods \u2014 direction, not prophecy.",
+      "",
+      "## Output",
+      "Write `drafts` with a single digest entry for review."
+    ].join("\n")
+  },
+  // ── act ─────────────────────────────────────────────────────────────
+  {
+    slug: "crm-sync-hygiene",
+    title: "CRM sync hygiene",
+    description: "Prepare reviewed records for a customer-record sync: normalized fields, no duplicates, no destructive overwrites.",
+    stage: "act",
+    tags: ["gtm", "sales", "operations"],
+    version: VERSION,
+    inputs: [
+      { key: "approved_drafts", description: "Records cleared by the review gate." },
+      { key: "field_map", description: "Local field \u2192 destination field mapping." }
+    ],
+    outputs: [
+      { key: "action_log", description: "Prepared record writes with the field diff and the reason for each." }
+    ],
+    allowedTools: ["connector"],
+    body: [
+      "Prepare reviewed records for the destination system without losing data.",
+      "",
+      "## Rules",
+      "- Only records that passed the review gate are eligible. Nothing else, no exceptions.",
+      "- NEVER overwrite a populated destination field with an empty local value. Blank does not",
+      '  mean "clear it", it means "we do not know".',
+      "- Match before you create: search by the destination key (email, then domain + name) and",
+      "  update the existing record rather than minting a duplicate.",
+      "- Normalize on the way out \u2014 casing, phone format, domain form \u2014 per `field_map`.",
+      "- Record every intended write in `action_log` with its field-level diff BEFORE it is",
+      "  applied, so the change is auditable and reversible.",
+      "",
+      "## Output",
+      "Write `action_log` with one entry per record, status `prepared` or `skipped`, and the",
+      "reason for every skip."
+    ].join("\n")
+  },
+  // ── follow-up ───────────────────────────────────────────────────────
+  {
+    slug: "follow-up-cadence",
+    title: "Follow-up cadence",
+    description: "Schedule timed re-engagement for quiet threads, with strict caps and an unconditional stop on any reply.",
+    stage: "follow-up",
+    tags: ["gtm", "sales", "cadence"],
+    version: VERSION,
+    inputs: [
+      { key: "action_log", description: "What was prepared, for whom, and when." },
+      { key: "reply_state", description: "Which threads have received a reply." },
+      { key: "cadence", description: "Follow-up spacing and the maximum number of touches." }
+    ],
+    outputs: [
+      { key: "follow_up_queue", description: "Queued follow-ups with a due offset and the rationale for each." }
+    ],
+    allowedTools: [],
+    body: [
+      "Queue follow-ups for threads that have gone quiet.",
+      "",
+      "## Rules",
+      "- HARD STOP on any reply, bounce, or opt-out: that thread leaves the cadence immediately and",
+      "  permanently. This overrides every other rule here.",
+      "- Never exceed the configured maximum touches per contact, and never shorten the configured",
+      "  spacing to fit more in.",
+      "- Each follow-up must add something \u2014 a new angle, a new proof point, a genuine deadline.",
+      '  "Bumping this to the top of your inbox" is not a follow-up.',
+      "- Follow-ups are drafts like any other outbound: they re-enter the review gate before",
+      "  anything is prepared for delivery.",
+      "",
+      "## Output",
+      "Write `follow_up_queue` with `draftRef`, `channel`, `dueAfterDays`, and the rationale."
+    ].join("\n")
+  },
+  {
+    slug: "reply-detection",
+    title: "Reply detection",
+    description: "Classify inbound replies into interested / not-now / decline / opt-out and route each to the right next step.",
+    stage: "follow-up",
+    tags: ["gtm", "sales", "classification"],
+    version: VERSION,
+    inputs: [
+      { key: "inbound_messages", description: "Replies received against prepared outbound." },
+      { key: "action_log", description: "The outbound each reply responds to." }
+    ],
+    outputs: [
+      { key: "reply_state", description: "Per-thread classification, confidence, and the routing decision." }
+    ],
+    allowedTools: ["connector"],
+    body: [
+      "Classify each inbound reply and decide what happens to its thread.",
+      "",
+      "## Classes",
+      "`interested` \xB7 `not_now` \xB7 `decline` \xB7 `opt_out` \xB7 `auto_reply` \xB7 `unclear`",
+      "",
+      "## Rules",
+      "- `opt_out` and `decline` stop the cadence permanently. When in doubt between `opt_out` and",
+      "  anything else, choose `opt_out` \u2014 the cost of a wrong stop is far below the cost of a",
+      "  wrong send.",
+      "- `auto_reply` (out-of-office, autoresponder) does NOT count as a reply for cadence",
+      "  purposes, but it does update the contact record if it names a new owner.",
+      "- Use `unclear` rather than guessing; unclear threads route to a human, they do not route",
+      "  to the next touch.",
+      "- Record a confidence value and the phrase that drove the classification.",
+      "",
+      "## Output",
+      "Write `reply_state` with the class, confidence, evidence phrase, and routing decision per",
+      "thread."
+    ].join("\n")
+  },
+  // ── enrich ──────────────────────────────────────────────────────────
+  {
+    slug: "contact-enrichment",
+    title: "Contact enrichment",
+    description: "Backfill missing contact and account fields from verifiable sources, recording the evidence for each fill.",
+    stage: "enrich",
+    tags: ["gtm", "sales", "data"],
+    version: VERSION,
+    inputs: [
+      { key: "contacts", description: "Contacts with gaps to fill." },
+      { key: "enrichment_fields", description: "Which fields this run is allowed to fill." }
+    ],
+    outputs: [
+      { key: "enriched_contacts", description: "Contacts with filled fields and a source note per filled field." }
+    ],
+    allowedTools: ["search", "content-extractor", "connector"],
+    body: [
+      "Fill the requested gaps on each contact \u2014 and only those gaps.",
+      "",
+      "## Rules",
+      "- Evidence-bound: a field is filled ONLY when a source supports it, and the source goes in",
+      "  the contact notes alongside the value. No source, no fill.",
+      "- NEVER guess or pattern-generate an email address. Constructing `first.last@domain` because",
+      "  it usually works is fabrication, and it is the single most damaging thing this Skill can do.",
+      "- Never overwrite an existing non-empty value. Enrichment fills gaps; corrections are a",
+      "  human decision.",
+      "- Only touch fields named in `enrichment_fields`.",
+      "- When two sources disagree, leave the field empty and flag the conflict.",
+      "",
+      "## Output",
+      "Write `enriched_contacts` and report fill rate per field plus every conflict flagged."
+    ].join("\n")
+  },
+  // ── measure ─────────────────────────────────────────────────────────
+  {
+    slug: "seo-audit",
+    title: "Search-visibility audit",
+    description: "Audit a site or content Work for search visibility and return a prioritized, evidence-cited fix list.",
+    stage: "measure",
+    tags: ["gtm", "marketing", "seo", "audit"],
+    version: VERSION,
+    inputs: [
+      { key: "pages", description: "Pages or posts in scope, with their current metadata and headings." },
+      { key: "target_keywords", description: "Keywords or topics the Work is meant to rank for." },
+      { key: "previous_audit", description: "The prior audit, used to report movement and regressions." }
+    ],
+    outputs: [
+      { key: "campaign_report", description: "Prioritized findings with page reference, impact, and fix." }
+    ],
+    allowedTools: ["content-extractor", "search"],
+    body: [
+      "Audit the in-scope pages for search visibility and propose fixes.",
+      "",
+      "## What to check",
+      "Title and description metadata \xB7 heading structure and hierarchy \xB7 internal linking and",
+      "orphan pages \xB7 keyword coverage against `target_keywords` and the gaps between them \xB7",
+      "duplicate or thin content \xB7 canonical and indexability signals.",
+      "",
+      "## Rules",
+      "- Every finding cites the specific page or setting it applies to and states the expected",
+      "  impact. A finding without a page reference is an opinion.",
+      "- Return a prioritized top 5-10, quick wins first \u2014 not an exhaustive dump.",
+      "- Propose changes as reviewable edits or tasks. Never modify published pages directly.",
+      "- When `previous_audit` is present, report movement honestly, INCLUDING regressions. A",
+      "  clean report that hides a regression is worse than no report.",
+      "- No traffic or ranking projections. Estimate effort and impact qualitatively instead.",
+      "",
+      "## Output",
+      "Write `campaign_report` with the prioritized findings and the movement summary."
+    ].join("\n")
+  },
+  {
+    slug: "campaign-reporting",
+    title: "Campaign reporting",
+    description: "Summarize a campaign period into counted totals, honest insights, and concrete hints for the next cycle.",
+    stage: "measure",
+    tags: ["gtm", "reporting"],
+    version: VERSION,
+    inputs: [
+      { key: "action_log", description: "What the campaign prepared and skipped." },
+      { key: "reply_state", description: "How recipients responded." },
+      { key: "scored_contacts", description: "The qualified population the period worked from." }
+    ],
+    outputs: [{ key: "campaign_report", description: "Totals, insights, and next-cycle variant hints." }],
+    allowedTools: [],
+    body: [
+      "Report the campaign period and close the loop into the next one.",
+      "",
+      "## Rules",
+      "- Totals are COUNTED from the supplied data, never estimated: contacts, qualified, excluded,",
+      "  drafts, approved, prepared, follow-ups queued.",
+      "- State the denominator on every rate. A percentage without its base is not a metric.",
+      "- Below roughly 30 observations, report counts and refuse to draw a conclusion \u2014 small",
+      "  samples produce confident nonsense.",
+      "- Insights must be falsifiable and tied to a number in the totals.",
+      "- End with `nextVariantHints`: concrete, testable changes for the next draft cycle, one per",
+      "  line. This is the loop closing \u2014 a report that ends at description wasted the period.",
+      "",
+      "## Output",
+      "Write `campaign_report` with `summary`, `totals`, `insights`, and `nextVariantHints`."
+    ].join("\n")
+  },
+  {
+    slug: "engagement-analysis",
+    title: "Engagement analysis",
+    description: "Compare engagement across variants, channels, and segments, and say which differences are real.",
+    stage: "measure",
+    tags: ["gtm", "marketing", "reporting"],
+    version: VERSION,
+    inputs: [
+      { key: "engagement_events", description: "Per-item engagement observations for the period." },
+      { key: "drafts", description: "The variants the events belong to." },
+      { key: "comparison_window", description: "Prior period to compare against." }
+    ],
+    outputs: [
+      { key: "campaign_report", description: "Per-variant and per-segment engagement with a confidence call." }
+    ],
+    allowedTools: ["metrics"],
+    body: [
+      "Analyze engagement and report what actually differs.",
+      "",
+      "## Rules",
+      "- Compare like with like: same channel, same audience segment, comparable send window.",
+      "  Cross-channel comparisons need an explicit caveat.",
+      "- Report absolute counts alongside every rate.",
+      "- Say plainly when a difference is within noise. Declaring a winner on a handful of",
+      "  observations is the most common way this analysis misleads a campaign for months.",
+      "- Separate what changed (observation) from why (hypothesis), and label hypotheses as such.",
+      "- Surface the losing variants too \u2014 a variant that consistently underperforms is the",
+      "  cheapest thing to stop doing.",
+      "",
+      "## Output",
+      "Write `campaign_report` with the per-variant table, the segment breakdown, and an explicit",
+      "confidence statement per comparison."
+    ].join("\n")
+  }
+];
+var GTM_SKILL_SLUGS = GTM_SKILLS.map((skill) => skill.slug);
+var GTM_SKILL_BY_SLUG = new Map(
+  GTM_SKILLS.map((skill) => [skill.slug, skill])
+);
+var SKILL_READINESS_STATES = [
+  "ready",
+  "needs_setup",
+  "missing_requirements",
+  "blocked_by_access",
+  "unknown",
+  "check_failed"
+];
+var SKILL_CARD_STATES = [...SKILL_READINESS_STATES, "disabled", "needs_review"];
+var SKILL_READINESS_FILTERS = [...SKILL_CARD_STATES, "attention"];
+var FLEET_AGENT_CREDENTIAL_FAMILIES = [
+  {
+    cli: "claude-code",
+    // CLAUDE_CODE_OAUTH_TOKEN (a Claude plan) before ANTHROPIC_API_KEY
+    // (per-token Console billing) — deliberately the REVERSE of the CLI's
+    // own precedence, so the cheaper credential wins rather than the one
+    // that silently spends money.
+    envNames: ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"]
+  },
+  {
+    cli: "codex",
+    // CODEX_ACCESS_TOKEN draws the ChatGPT workspace entitlement;
+    // OPENAI_API_KEY is per-token platform billing.
+    envNames: ["CODEX_ACCESS_TOKEN", "OPENAI_API_KEY"]
+  }
+];
+var FLEET_AGENT_CREDENTIAL_ENV_NAMES = FLEET_AGENT_CREDENTIAL_FAMILIES.flatMap(
+  (family) => family.envNames
+);
+var FLEET_RUN_ENV_FILE_MAX_CONTENT_BYTES = 32 * 1024;
+var FLEET_RUN_ENV_FILES_MAX_TOTAL_BYTES = 256 * 1024;
+var FLEET_JOB_MAX_PAYLOAD_BYTES = 256 * 1024;
+var FLEET_JOB_MAX_RESULT_BYTES = 256 * 1024;
+var FLEET_JOB_DEFAULT_QUEUED_MAX_AGE_SEC = Object.freeze({
+  "agent-task": 24 * 60 * 60,
+  "acceptance-checks": 2 * 60 * 60,
+  "browser-check": 2 * 60 * 60,
+  // A live view nobody claimed is abandoned by the session service after
+  // 40 seconds, which cancels its job there and then. The queue SLA is only
+  // the backstop behind that, so it deliberately does not undercut the
+  // shortest existing default (the fallback an unknown kind fails closed to).
+  "computer-session": 2 * 60 * 60
+});
+var FLEET_JOB_MAX_QUEUED_MAX_AGE_SEC = 7 * 24 * 60 * 60;
+var FLEET_AGENT_EXECUTION_MAX_INSTRUCTIONS_BYTES = 160 * 1024;
+var FLEET_AGENT_TASK_TIMELINE_MAX_BYTES = 48 * 1024;
+var FLEET_AGENT_TASK_TRANSCRIPT_MAX_BYTES = 64 * 1024;
+var FLEET_AGENT_TASK_QUESTION_MAX_FILE_BYTES = 64 * 1024;
+var FLEET_AGENT_TASK_QUESTION_MAX_CONTEXT_BYTES = 6 * 1024;
+var FLEET_NODE_MAX_MEMORY_MB = 1024 * 1024;
+var FLEET_MAX_DAILY_COST_CEILING_CENTS = 1e5 * 100;
+var FLEET_MAX_DISK_FREE_BYTES = 2 ** 60;
+var FLEET_DEFAULT_ENROLLMENT_TOKEN_TTL_MS = 15 * 6e4;
+var FLEET_DEFAULT_NODE_OFFLINE_AFTER_MS = 5 * 6e4;
+var FLEET_DEFAULT_NODE_OFFLINE_NOTICE_AFTER_MS = 30 * 6e4;
+var FLEET_DEFAULT_CREDENTIAL_ROTATION_OVERLAP_MS = 15 * 6e4;
+var FLEET_MAX_CREDENTIAL_ROTATION_OVERLAP_MS = 24 * 60 * 6e4;
+var EMAIL_INBOX_DEFAULT_DAILY_CAP = 100;
+var EMAIL_INBOX_BURST_SENDS = 10;
+var EMAIL_INBOX_BURST_RECIPIENTS = 20;
+var EMAIL_WORKSPACE_DAILY_CAP = 500;
+var EMAIL_WORKSPACE_MONTHLY_CAP = 1e4;
+var EMAIL_MAX_RECIPIENTS_PER_MESSAGE = 50;
+var EMAIL_SEND_CAP_RECOMMENDED_DEFAULTS = Object.freeze({
+  inboxDailySends: EMAIL_INBOX_DEFAULT_DAILY_CAP,
+  inboxBurstSends: EMAIL_INBOX_BURST_SENDS,
+  inboxBurstRecipients: EMAIL_INBOX_BURST_RECIPIENTS,
+  recipientsPerMessage: EMAIL_MAX_RECIPIENTS_PER_MESSAGE,
+  workspaceDailySends: EMAIL_WORKSPACE_DAILY_CAP,
+  workspaceMonthlySends: EMAIL_WORKSPACE_MONTHLY_CAP
+});
+var EMAIL_DAY_WINDOW_MS = 24 * 60 * 60 * 1e3;
+var EMAIL_MONTH_WINDOW_MS = 30 * EMAIL_DAY_WINDOW_MS;
+var EMAIL_INBOX_CAP_FIELDS = [
+  "inboxDailySends",
+  "inboxBurstSends",
+  "inboxBurstRecipients",
+  "recipientsPerMessage"
+];
+var EMAIL_SEND_CAP_FIELDS = [
+  ...EMAIL_INBOX_CAP_FIELDS,
+  "workspaceDailySends",
+  "workspaceMonthlySends"
+];
+var INBOX_CAP_FIELD_SET = new Set(EMAIL_INBOX_CAP_FIELDS);
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
+var PROMOTION_GATE_DECISION_GRACE_MS = 20 * 60 * 1e3;
+var RELEASE_VERIFY_ATTEMPT_INTERVAL_MS = 10 * 60 * 1e3;
+var RELEASE_VERIFY_BUDGET_MS = 8 * 60 * 60 * 1e3;
+var MAX_CONVERSATION_BODY_BYTES = 16 * 1024;
+var CONNECTION_CREDENTIAL_ERROR_CODES = Object.freeze([
+  "credential_rejected",
+  "credential_missing",
+  "https_required"
+]);
+var CONNECTION_HEALTH_WARNING_CODES = Object.freeze([
+  "insecure_transport"
+]);
+var BACKUP_TRIM_POLICIES = Object.freeze({
+  activity: Object.freeze({ field: "createdAt", defaultDays: 365, fullHistoryDays: 1095 }),
+  runLogs: Object.freeze({ field: "createdAt", defaultDays: 90, fullHistoryDays: 1095 }),
+  terminalTranscripts: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  notifications: Object.freeze({ field: "createdAt", defaultDays: 180, fullHistoryDays: 1095 }),
+  // `occurredAt`, not `createdAt`: `PluginUsageEvent` names its
+  // `@CreateDateColumn` `occurredAt` and has no `createdAt` at all. The trim
+  // resolver fails OPEN on an unknown column, so the wrong name here did not
+  // error — it silently exported every plugin usage event for the lifetime
+  // of the workspace, from the archive's single largest history table, while
+  // the docs page published a 180-day window.
+  pluginUsageEvents: Object.freeze({ field: "occurredAt", defaultDays: 180, fullHistoryDays: 1095 }),
+  deliveryLogs: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  // `firedAt`, for the same reason: `InboundTriggerFire`'s creation
+  // timestamp is `firedAt` and it has no `createdAt`, so the declared
+  // 90-day window was never applied to `data/schedules/trigger-fires.jsonl`
+  // and the `schedules` domain reported `complete` where the docs promise a
+  // trim.
+  triggerFires: Object.freeze({ field: "firedAt", defaultDays: 90, fullHistoryDays: 1095 }),
+  retrievalTrail: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  fleetJobs: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 })
+});
+var BACKUP_DOMAINS = Object.freeze([
+  Object.freeze({
+    key: "account",
+    restorability: "restorable",
+    collectorId: "account",
+    dataDir: "account"
+  }),
+  Object.freeze({
+    key: "organizations",
+    restorability: "restorable",
+    collectorId: "organizations",
+    dataDir: "organizations"
+  }),
+  Object.freeze({
+    key: "agents",
+    restorability: "restorable",
+    collectorId: "agents",
+    dataDir: "agents"
+  }),
+  Object.freeze({
+    key: "missions",
+    restorability: "restorable",
+    collectorId: "missions",
+    dataDir: "missions"
+  }),
+  Object.freeze({
+    key: "tasks",
+    restorability: "restorable",
+    collectorId: "tasks",
+    dataDir: "tasks"
+  }),
+  Object.freeze({
+    key: "works",
+    restorability: "restorable",
+    collectorId: "works",
+    dataDir: "works"
+  }),
+  Object.freeze({
+    key: "knowledge",
+    restorability: "restorable",
+    collectorId: "knowledge",
+    dataDir: "knowledge"
+  }),
+  Object.freeze({
+    key: "schedules",
+    restorability: "restorable",
+    collectorId: "schedules",
+    dataDir: "schedules"
+  }),
+  Object.freeze({
+    key: "runs",
+    restorability: "record-only",
+    collectorId: "runs",
+    dataDir: "runs"
+  }),
+  Object.freeze({
+    key: "decisions",
+    restorability: "record-only",
+    collectorId: "decisions",
+    dataDir: "decisions"
+  }),
+  Object.freeze({
+    key: "communication",
+    restorability: "partly-restorable",
+    collectorId: "communication",
+    dataDir: "communication"
+  }),
+  Object.freeze({
+    key: "connections",
+    restorability: "restorable",
+    collectorId: "connections",
+    dataDir: "connections"
+  }),
+  Object.freeze({
+    key: "fleet",
+    restorability: "partly-restorable",
+    collectorId: "fleet",
+    dataDir: "fleet"
+  }),
+  Object.freeze({
+    key: "billing",
+    restorability: "record-only",
+    collectorId: "billing",
+    dataDir: "billing"
+  }),
+  Object.freeze({
+    key: "activity",
+    restorability: "record-only",
+    collectorId: "activity",
+    dataDir: "activity",
+    trim: BACKUP_TRIM_POLICIES.activity
+  })
+]);
+var BACKUP_DOMAIN_KEYS = Object.freeze(BACKUP_DOMAINS.map((domain) => domain.key));
+var BACKUP_DOMAIN_COUNT = BACKUP_DOMAINS.length;
+var BACKUP_EXCLUSIONS = Object.freeze([
+  Object.freeze({
+    code: "auth_tokens",
+    summary: "Password hashes, password-reset tokens, magic-link tokens and email-verification tokens."
+  }),
+  Object.freeze({
+    code: "sessions",
+    summary: "Sessions, refresh tokens, and third-party auth provider access and refresh tokens."
+  }),
+  Object.freeze({
+    code: "api_key_material",
+    summary: "API key material. Keys appear as name, prefix, created date and active flag only."
+  }),
+  Object.freeze({
+    code: "stored_credentials",
+    summary: "Every stored credential, in plaintext or ciphertext \u2014 plugin secrets, connection headers, deployment secrets, webhook and trigger signing secrets, and encrypted runtime credentials. Only the names of the fields that were set are exported."
+  }),
+  Object.freeze({
+    code: "node_enrolment_secrets",
+    summary: "Node enrolment and heartbeat secrets."
+  }),
+  Object.freeze({
+    code: "payment_identifiers",
+    summary: "Payment-provider customer, subscription, payment-method and meter identifiers."
+  }),
+  Object.freeze({
+    code: "platform_admin_flag",
+    summary: "The platform-administrator flag."
+  }),
+  Object.freeze({
+    code: "vector_embeddings",
+    summary: "Vector embeddings and their coordinates, because they are derived and regenerate on demand."
+  }),
+  Object.freeze({
+    code: "internal_caches",
+    summary: "Internal caches and the delivery outbox."
+  })
+]);
+var BACKUP_DEFAULT_LIMITS = Object.freeze({
+  /** Ready archives kept for this long before their bytes are deleted. */
+  retentionDays: 14,
+  /** The record outlives its bytes by this long, so history stays legible. */
+  recordRetentionDays: 90,
+  /** Ready outcomes allowed per rolling 24 hours. Failures do not count. */
+  dailyAllowance: 3,
+  /** Rows the history list shows before "Show all". */
+  historyPageSize: 20,
+  /** Hard ceiling on a single history page. */
+  historyPageLimit: 50,
+  /** Bytes of one uploaded file that may be carried (200 MiB). */
+  maxFileBytes: 200 * 1024 * 1024,
+  /** Bytes of uploaded files in total (2 GiB). */
+  maxAttachmentBytes: 2 * 1024 * 1024 * 1024,
+  /** Bytes the finished archive may not exceed with a streaming backend (5 GiB). */
+  maxArchiveBytes: 5 * 1024 * 1024 * 1024,
+  /**
+   * The ceiling when the active storage backend cannot accept a stream and
+   * the archive has to be handed over as one buffer (512 MiB). A backend
+   * without streaming is a smaller limit, never a wrong result.
+   */
+  maxBufferedArchiveBytes: 512 * 1024 * 1024,
+  /** A manifest larger than this is refused by the check without being read (8 MiB). */
+  maxManifestBytes: 8 * 1024 * 1024,
+  /** Minutes a download link stays valid before the client re-mints it. */
+  downloadLinkTtlMinutes: 15,
+  /** Minutes without a heartbeat before a running backup is called stalled. */
+  stallMinutes: 10,
+  /** Minutes a queued backup may wait before it is called stalled. */
+  queuedStallMinutes: 15,
+  /** Minutes a backup may run before it is stopped. */
+  timeoutMinutes: 60,
+  /** Retries a single domain gets before it is marked failed and the archive finishes without it. */
+  domainRetries: 2,
+  /** Retries a storage write gets before the backup fails as `storage_unavailable`. */
+  storageRetries: 3
+});
+var HOUR_MS = 60 * 60 * 1e3;
+var MINUTE_MS = 60 * 1e3;
+var ACTION_CATEGORIES = Object.freeze([
+  "read.internal",
+  "read.external",
+  "write.internal",
+  "write.destructive",
+  "message.internal",
+  "message.external",
+  "publish.external",
+  "spend.metered",
+  "spend.commitment",
+  "access.grant",
+  "machine.run",
+  "machine.admin",
+  "agent.fanout"
+]);
+var LADDERED_CATEGORIES = Object.freeze(
+  ACTION_CATEGORIES.filter((c) => c !== "read.internal")
+);
+var DRAFTABLE_CATEGORIES = Object.freeze([
+  "write.internal",
+  "write.destructive",
+  "message.external",
+  "publish.external",
+  "machine.run",
+  "machine.admin"
+]);
+var ACTION_CATEGORY_CEILING = Object.freeze({
+  "read.external": "auto",
+  "write.internal": "auto",
+  "write.destructive": "ask",
+  "message.internal": "auto",
+  "message.external": "ask",
+  "publish.external": "ask",
+  "spend.metered": "auto",
+  "spend.commitment": "off",
+  "access.grant": "ask",
+  "machine.run": "auto",
+  "machine.admin": "ask",
+  "agent.fanout": "auto"
+});
+var ACTION_CATEGORY_DEFAULT = Object.freeze({
+  "read.external": "auto",
+  "write.internal": "auto",
+  "write.destructive": "ask",
+  "message.internal": "auto",
+  "message.external": "draft",
+  "publish.external": "ask",
+  "spend.metered": "auto",
+  "spend.commitment": "off",
+  "access.grant": "ask",
+  "machine.run": "ask",
+  "machine.admin": "ask",
+  "agent.fanout": "ask"
+});
+var ACTION_CATEGORY_RESTRICTIVENESS = Object.freeze([
+  "spend.commitment",
+  "access.grant",
+  "machine.admin",
+  "publish.external",
+  "message.external",
+  "write.destructive",
+  "machine.run",
+  "agent.fanout",
+  "spend.metered",
+  "write.internal",
+  "message.internal",
+  "read.external",
+  "read.internal"
+]);
+var ACTION_CATEGORY_I18N_KEY = Object.freeze({
+  "read.internal": "readInternal",
+  "read.external": "readExternal",
+  "write.internal": "writeInternal",
+  "write.destructive": "writeDestructive",
+  "message.internal": "messageInternal",
+  "message.external": "messageExternal",
+  "publish.external": "publishExternal",
+  "spend.metered": "spendMetered",
+  "spend.commitment": "spendCommitment",
+  "access.grant": "accessGrant",
+  "machine.run": "machineRun",
+  "machine.admin": "machineAdmin",
+  "agent.fanout": "agentFanout"
+});
+var TRUST_RUNG_ORDER = Object.freeze([
+  "off",
+  "draft",
+  "ask",
+  "auto"
+]);
+var SAFETY_RAIL_ORDER = Object.freeze([
+  "platform-stop",
+  "workspace-pause",
+  "scope-pause",
+  "grants",
+  "ladder",
+  "caps",
+  "rules"
+]);
+var SAFETY_REASON_CODES = Object.freeze([
+  "platform-stopped",
+  "workspace-paused",
+  "scope-paused",
+  "rung-off",
+  "rung-held",
+  "ceiling-refused",
+  "cap-reached",
+  "grant-denied",
+  "rule-blocked",
+  "policy-refused",
+  "unclassified-action",
+  "instruction-widening-attempt",
+  "non-human-actor",
+  "safe-mode"
+]);
+var SAFETY_ALLOW = Object.freeze({
+  decision: "allow",
+  railId: null,
+  category: null,
+  rung: null,
+  reasonCode: null,
+  summary: null
+});
+var AUTONOMY_GRANT_SCOPE_PRECEDENCE = Object.freeze([
+  "workspace",
+  "agent"
+]);
+var RAIL_REFUSAL_SUBJECT_TYPES = Object.freeze([
+  "run",
+  "agent",
+  "mission",
+  "task",
+  "schedule",
+  "trigger"
+]);
+var WORKSPACE_RUNNING = Object.freeze({
+  paused: false,
+  unverified: false,
+  reason: null,
+  pausedByUserId: null,
+  pausedAt: null,
+  refusedStarts: 0,
+  cleanlyStopped: 0
+});
+var WORKSPACE_PAUSED_UNVERIFIED = Object.freeze({
+  paused: true,
+  unverified: true,
+  reason: null,
+  pausedByUserId: null,
+  pausedAt: null,
+  refusedStarts: 0,
+  cleanlyStopped: 0
+});
+var READINESS_BLOCKERS = Object.freeze([
+  "at-ceiling",
+  "too-few-decisions",
+  "approval-rate",
+  "withdrawn",
+  "other-refusals"
+]);
+var EVER_STATS_KEY_HEADER = CONSTANTS.stats_headers.key;
+var EVER_STATS_SIGNATURE_HEADER = CONSTANTS.stats_headers.signature;
+var EVER_STATS_KEY_ID_HEADER = CONSTANTS.stats_headers.key_id;
+var EVER_STATS_SIGNATURE_PREFIX = CONSTANTS.stats_signature_prefix;
+var EVER_STATS_MAX_BODY_BYTES = CONSTANTS.stats.max_bytes;
+var DOMAIN_EVENT_CATALOG = [
+  // EW-P2-6 — `org:write` (and the app) create Organizations.
+  { type: "organization.created", domain: "organization", aggregateType: "organization", phase: "P2" },
+  { type: "organization.updated", domain: "organization", aggregateType: "organization", phase: "P1" },
+  {
+    type: "organization.member.added",
+    domain: "organization",
+    aggregateType: "organization",
+    phase: "P1",
+    child: "member"
+  },
+  {
+    type: "organization.member.updated",
+    domain: "organization",
+    aggregateType: "organization",
+    phase: "P1",
+    child: "member"
+  },
+  {
+    type: "organization.member.removed",
+    domain: "organization",
+    aggregateType: "organization",
+    phase: "P1",
+    child: "member"
+  },
+  { type: "agent.created", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "agent.updated", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "agent.status_changed", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "agent.archived", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "agent.deleted", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "team.created", domain: "teams", aggregateType: "team", phase: "P1" },
+  { type: "team.updated", domain: "teams", aggregateType: "team", phase: "P1" },
+  { type: "team.deleted", domain: "teams", aggregateType: "team", phase: "P1" },
+  { type: "team.member.added", domain: "teams", aggregateType: "team", phase: "P1", child: "member" },
+  { type: "team.member.updated", domain: "teams", aggregateType: "team", phase: "P1", child: "member" },
+  { type: "team.member.removed", domain: "teams", aggregateType: "team", phase: "P1", child: "member" },
+  { type: "team.resource.added", domain: "teams", aggregateType: "team", phase: "P1", child: "resource" },
+  { type: "team.resource.removed", domain: "teams", aggregateType: "team", phase: "P1", child: "resource" },
+  { type: "work.created", domain: "works", aggregateType: "work", phase: "P1" },
+  { type: "work.updated", domain: "works", aggregateType: "work", phase: "P1" },
+  { type: "work.archived", domain: "works", aggregateType: "work", phase: "P1" },
+  { type: "work.deleted", domain: "works", aggregateType: "work", phase: "P1" },
+  { type: "work.member.added", domain: "works", aggregateType: "work", phase: "P1", child: "member" },
+  { type: "work.member.updated", domain: "works", aggregateType: "work", phase: "P1", child: "member" },
+  { type: "work.member.removed", domain: "works", aggregateType: "work", phase: "P1", child: "member" },
+  { type: "mission.created", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.updated", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.status_changed", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.deleted", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.goal.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.goal.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.work.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
+  { type: "mission.work.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
+  { type: "goal.created", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.updated", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.status_changed", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.archived", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.unarchived", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.deleted", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.progress_changed", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "idea.created", domain: "ideas", aggregateType: "idea", phase: "P2" },
+  { type: "idea.updated", domain: "ideas", aggregateType: "idea", phase: "P2" },
+  { type: "idea.status_changed", domain: "ideas", aggregateType: "idea", phase: "P2" },
+  { type: "idea.deleted", domain: "ideas", aggregateType: "idea", phase: "P2" },
+  { type: "task.created", domain: "tasks", aggregateType: "task", phase: "P1" },
+  { type: "task.updated", domain: "tasks", aggregateType: "task", phase: "P1" },
+  { type: "task.transitioned", domain: "tasks", aggregateType: "task", phase: "P1" },
+  { type: "task.deleted", domain: "tasks", aggregateType: "task", phase: "P1" },
+  { type: "task.assignee.added", domain: "tasks", aggregateType: "task", phase: "P1", child: "assignee" },
+  { type: "task.assignee.removed", domain: "tasks", aggregateType: "task", phase: "P1", child: "assignee" },
+  { type: "task.watcher.added", domain: "tasks", aggregateType: "task", phase: "P1", child: "watcher" },
+  { type: "task.watcher.removed", domain: "tasks", aggregateType: "task", phase: "P1", child: "watcher" },
+  { type: "task.block.added", domain: "tasks", aggregateType: "task", phase: "P1", child: "block" },
+  { type: "task.block.removed", domain: "tasks", aggregateType: "task", phase: "P1", child: "block" },
+  { type: "task.relation.added", domain: "tasks", aggregateType: "task", phase: "P1", child: "relation" },
+  { type: "task.relation.removed", domain: "tasks", aggregateType: "task", phase: "P1", child: "relation" },
+  { type: "task.comment.created", domain: "tasks", aggregateType: "task", phase: "P1", child: "comment" },
+  { type: "task.comment.updated", domain: "tasks", aggregateType: "task", phase: "P1", child: "comment" },
+  { type: "task.comment.deleted", domain: "tasks", aggregateType: "task", phase: "P1", child: "comment" },
+  { type: "task.attachment.added", domain: "tasks", aggregateType: "task", phase: "P3", child: "attachment" },
+  { type: "task.attachment.removed", domain: "tasks", aggregateType: "task", phase: "P3", child: "attachment" },
+  { type: "task.runtime_updated", domain: "tasks", aggregateType: "task", phase: "P1", optIn: true },
+  { type: "inbox.item.created", domain: "inbox", aggregateType: "inbox_item", phase: "P3" },
+  { type: "inbox.item.answered", domain: "inbox", aggregateType: "inbox_item", phase: "P3" },
+  { type: "inbox.item.state_changed", domain: "inbox", aggregateType: "inbox_item", phase: "P3" },
+  { type: "inbox.item.deleted", domain: "inbox", aggregateType: "inbox_item", phase: "P3" },
+  { type: "kb.document.created", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.updated", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.moved", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.archived", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.unarchived", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.deleted", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.review_changed", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.folder.created", domain: "kb", aggregateType: "kb_folder", phase: "P3" },
+  { type: "kb.folder.updated", domain: "kb", aggregateType: "kb_folder", phase: "P3" },
+  { type: "kb.folder.deleted", domain: "kb", aggregateType: "kb_folder", phase: "P3" },
+  { type: "email.message.received", domain: "email", aggregateType: "email_message", phase: "P4" },
+  { type: "email.message.sent", domain: "email", aggregateType: "email_message", phase: "P4" },
+  { type: "email.message.status_changed", domain: "email", aggregateType: "email_message", phase: "P4" },
+  { type: "task.visibility_changed", domain: "visibility", aggregateType: "task", phase: "P1" },
+  { type: "agent.visibility_changed", domain: "visibility", aggregateType: "agent", phase: "P1" },
+  { type: "goal.visibility_changed", domain: "visibility", aggregateType: "goal", phase: "P2" },
+  { type: "mission.visibility_changed", domain: "visibility", aggregateType: "mission", phase: "P2" },
+  { type: "idea.visibility_changed", domain: "visibility", aggregateType: "idea", phase: "P2" }
+];
+var DOMAIN_EVENT_TYPES = DOMAIN_EVENT_CATALOG.map((entry) => entry.type);
+var CATALOG_BY_TYPE = new Map(
+  DOMAIN_EVENT_CATALOG.map((entry) => [entry.type, entry])
+);
+var RECIPIENT_SCOPED_EVENT_DOMAINS = {
+  inbox: "inbox:read",
+  email: "email:read"
+};
+var RECIPIENT_EVENT_SCOPES = Object.values(RECIPIENT_SCOPED_EVENT_DOMAINS);
+var INTEGRATION_SCOPES = [
+  "org:read",
+  "org:write",
+  "members:read",
+  "members:write",
+  "agents:read",
+  "teams:read",
+  "teams:write",
+  "works:read",
+  "works:write",
+  "missions:read",
+  "missions:write",
+  "goals:read",
+  "goals:write",
+  "ideas:read",
+  "ideas:write",
+  "tasks:read",
+  "tasks:write",
+  "inbox:read",
+  "inbox:write",
+  "kb:read",
+  "kb:write",
+  "email:read",
+  "email:write",
+  "events:read",
+  "webhooks:manage",
+  "links:write"
+];
+var INTEGRATION_OPT_IN_SCOPES = ["org:write", "email:write"];
+var EVER_GAUZY_PRESET_SCOPES = INTEGRATION_SCOPES.filter(
+  (scope) => !INTEGRATION_OPT_IN_SCOPES.includes(scope)
+);
+
+// ../../plugin/dist/index.js
+var DEFAULT_DIFF_MAX_BYTES = 256 * 1024;
+var HARD_DIFF_MAX_BYTES = 1024 * 1024;
+var PLUGIN_CAPABILITIES = {
+  AI_PROVIDER: "ai-provider",
+  SEARCH: "search",
+  SCREENSHOT: "screenshot",
+  CONTENT_EXTRACTOR: "content-extractor",
+  DATA_SOURCE: "data-source",
+  PIPELINE: "pipeline",
+  PIPELINE_MODIFIER: "pipeline-modifier",
+  CODE_EDIT: "code-edit",
+  FORM_SCHEMA_PROVIDER: "form-schema-provider",
+  DEPLOYMENT: "deployment",
+  GIT_PROVIDER: "git-provider",
+  OAUTH: "oauth",
+  DEVICE_AUTH: "device-auth",
+  PROMPT_PROVIDER: "prompt-provider",
+  // EW-637 — pluggable object storage. `put-object` + `get-object` are the
+  // floor; `presigned-put` is opt-in for backends that can hand the
+  // browser a direct-upload URL (S3, MinIO).
+  STORAGE: "storage",
+  PUT_OBJECT: "put-object",
+  GET_OBJECT: "get-object",
+  PRESIGNED_PUT: "presigned-put",
+  // Agents/Skills/Tasks PR #1017 — Phase 8 (ADR-012). Plugin
+  // category for Skill catalog providers. "Ever Works Skills" is
+  // the first-party default; community plugins implement the same
+  // `ISkillsProviderPlugin` contract to surface other catalogs.
+  SKILLS_PROVIDER: "skills-provider",
+  // Agents/Skills/Tasks PR #1017 — Phase 11 (ADR-013). Plugin
+  // category for external task trackers. "Ever Works Task Tracker"
+  // is the first-party default. Community plugins (Linear / Jira /
+  // GitHub Issues) implement the same contract.
+  TASK_TRACKER: "task-tracker",
+  // Notifications v2 (EW-650) — Email Providers. Plugins MAY declare
+  // `EMAIL_OUTBOUND`, `EMAIL_INBOUND`, or both. See
+  // `capabilities/email-provider.interface.ts` for the contract.
+  EMAIL_OUTBOUND: "email-outbound",
+  EMAIL_INBOUND: "email-inbound",
+  // Notifications v2 (sibling of EW-650) — Notification Channels.
+  // Plugins declare `NOTIFICATION_CHANNEL` (umbrella) plus the
+  // channel-specific constant for plugin discovery + UI grouping.
+  // See `capabilities/notification-channel.interface.ts`.
+  NOTIFICATION_CHANNEL: "notification-channel",
+  NOTIFICATION_CHANNEL_DISCORD: "notification-channel-discord",
+  NOTIFICATION_CHANNEL_SLACK: "notification-channel-slack",
+  NOTIFICATION_CHANNEL_TELEGRAM: "notification-channel-telegram",
+  NOTIFICATION_CHANNEL_WHATSAPP: "notification-channel-whatsapp",
+  NOTIFICATION_CHANNEL_NOVU: "notification-channel-novu",
+  // Connectors ("Connector fabric") — first-party BIDIRECTIONAL
+  // communication-channel plugins. Each connector declares `CONNECTOR`
+  // (umbrella, for discovery/grouping) plus its `CONNECTOR_<provider>`
+  // constant. Superset of the outbound-only notification channels; see
+  // `capabilities/connector.interface.ts`.
+  CONNECTOR: "connector",
+  CONNECTOR_SLACK: "connector-slack",
+  CONNECTOR_DISCORD: "connector-discord",
+  CONNECTOR_WHATSAPP: "connector-whatsapp",
+  CONNECTOR_LINEAR: "connector-linear",
+  CONNECTOR_NOTION: "connector-notion",
+  CONNECTOR_MICROSOFT_365: "connector-microsoft-365",
+  // CRM / enrichment connectors — first-party native connectors over
+  // the vendors' own Node SDKs. Outbound writes CRM records/notes,
+  // the event-source leg streams record changes into the ingest spine.
+  CONNECTOR_HUBSPOT: "connector-hubspot",
+  CONNECTOR_PIPEDRIVE: "connector-pipedrive",
+  // Social connectors — public-timeline surfaces. Outbound publishes a
+  // post; the event-source leg streams mentions/replies + the account's
+  // own timeline into the ingest spine.
+  CONNECTOR_BLUESKY: "connector-bluesky",
+  CONNECTOR_MASTODON: "connector-mastodon",
+  // Pluggable persistent memory for AI coding / generation agents.
+  // First-party implementation: `@ever-works/agentmemory-plugin`
+  // (talks to the `agentmemory` standalone Node server on :3111 —
+  // runs locally OR hosted via a configurable `baseUrl` + bearer
+  // token). Community plugins (mem0, zep, langmem) implement the
+  // same `IAgentMemoryPlugin` contract.
+  AGENT_MEMORY: "agent-memory",
+  // Goals feature PR-7 — read-only metrics collectors. First-party
+  // providers: `custom-http` (GET-only, SSRF-guarded) and `stripe`
+  // (official SDK; balance + income windows). See
+  // `capabilities/metrics-provider.interface.ts` for the contract.
+  METRICS_PROVIDER: "metrics-provider",
+  // Streaming-terminal session hosts (Wave 1 M5). First-party:
+  // pty-local (node-pty in the executing job-runtime worker, with a
+  // child_process pipe floor). Future: pty-ssh (user's own box),
+  // k8s-exec. See capabilities/terminal-stream.interface.ts.
+  TERMINAL_STREAM: "terminal-stream",
+  // Isolated git working contexts for agent Tasks (Wave 2).
+  WORKSPACE: "workspace",
+  // Headless browser drivers (audit item G22). navigate / extract /
+  // screenshot / act, headless by default, behind a default-deny
+  // navigation allowlist re-checked on every redirect hop. First-party:
+  // `browser-automation` (Playwright). See
+  // capabilities/browser-automation.interface.ts.
+  BROWSER_AUTOMATION: "browser-automation",
+  // Event-ingest spine (Wave 6) — plugins that pull/push normalized
+  // external events into the platform ingest pipeline. See
+  // capabilities/event-source.interface.ts.
+  EVENT_SOURCE: "event-source",
+  // Capability & playbook catalogue (AW-21) — plugins that supply Playbook
+  // catalogue entries (packaged outcomes: trigger, steps, required
+  // capabilities, artefacts, escalation points). Consumed only through
+  // PlaybookCatalogFacadeService. See
+  // capabilities/playbook-provider.interface.ts.
+  PLAYBOOK_PROVIDER: "playbook-provider",
+  // AW-15 — optional access-level declaration ("Read only" / "Read and
+  // write") mapped onto the tool-grant lattice. Declared alongside a
+  // provider's main capability; see
+  // capabilities/connection-scopes.interface.ts.
+  CONNECTION_SCOPES: "connection-scopes",
+  // App Works (APW-07 T3) — App dependency providers: the `k8s` plugin serves
+  // the three in-cluster ids, `app-dependencies-external` the external ones,
+  // and P2's `apps-tier-dependencies` the managed ones. Consumed only through
+  // `AppDependencyFacadeService`; see
+  // capabilities/app-dependency.interface.ts.
+  APP_DEPENDENCY: "app-dependency",
+  // App Works (APW-05 T2) — producing a container image from a commit. The
+  // `github-actions-build` plugin declares it (`IBuildPlugin`, `buildKind
+  // 'github-actions'`), and P3's `apps-builder` declares the same capability
+  // with the other `buildKind`. Consumed only through `BuildFacadeService`
+  // (APW-05 T16); see `capabilities/build.interface.ts`. Resolution R-13 keeps
+  // `build` a CAPABILITY while the strategy (`dockerfile` / `image` / `auto` /
+  // `none`) stays the App spec's own choice.
+  BUILD: "build",
+  // App Works (APW-12 T4) — the Ever ID relying-party capability. The
+  // `oidc-identity` plugin declares it (APW-12 T5/T6), and it is consumed only
+  // through `IdentityProviderFacadeService` (APW-12 plan §4.4); see
+  // `capabilities/identity-provider.interface.ts`. Appended after `build`, and
+  // landed in the same change as the `identity` category in
+  // `plugin-manifest.types.ts` — a plugin contract with no category to be
+  // discovered under is a manifest the loader rejects.
+  IDENTITY_PROVIDER: "identity-provider",
+  // App Works (APW-10 T2) — the managed hosting tier's zone capability. The
+  // `ever-works-apps` plugin declares it together with `deployment`
+  // (plan §5.2:602) and is consumed only through `AppsTierFacadeService`
+  // (APW-10 plan §5.3:655); see `capabilities/apps-tier.interface.ts`.
+  // Appended after `identity-provider`, and appended **last** on purpose:
+  // every existing constant keeps its value and its position, because the
+  // capability list is an append-only surface — a member that moves silently
+  // changes what a persisted manifest means. Deliberately NOT paired with a
+  // new category: the tier's plugin is a `deployment` plugin, so
+  // `PLUGIN_CATEGORIES` is untouched and every exhaustive map over it in
+  // `apps/web` stays total.
+  APPS_TIER: "apps-tier",
+  // Domain events (EW-P1-1) — plugins that follow the durable domain event
+  // outbox (`task.updated`, `team.member.added`, …) through the relay, at
+  // least once, with a per-plugin cursor. See
+  // `capabilities/domain-event-subscriber.interface.ts`. Appended last, so
+  // every existing constant keeps its value and its position; no category is
+  // added (a subscriber plugin keeps the category of what it otherwise is).
+  DOMAIN_EVENT_SUBSCRIBER: "domain-event-subscriber"
+};
+var ALL_PLUGIN_CAPABILITIES = Object.values(PLUGIN_CAPABILITIES);
+function initializePipelineState(stepDefinitions) {
+  const steps = /* @__PURE__ */ new Map();
+  for (const def of stepDefinitions) {
+    steps.set(def.id, { definition: def, status: "pending" });
+  }
+  return {
+    steps,
+    completedSteps: [],
+    failedSteps: [],
+    isRunning: true,
+    isCancelled: false,
+    startedAt: Date.now()
+  };
+}
+function updatePipelineStepState(state, stepId, status, error) {
+  const existing = state.steps.get(stepId);
+  if (!existing) return state;
+  const now = Date.now();
+  const isTerminal = status === "completed" || status === "failed" || status === "skipped";
+  const updated = {
+    ...existing,
+    status,
+    startedAt: status === "running" ? now : existing.startedAt,
+    completedAt: isTerminal ? now : existing.completedAt,
+    error: error ?? existing.error
+  };
+  const steps = new Map(state.steps);
+  steps.set(stepId, updated);
+  const completedSteps = status === "completed" || status === "skipped" ? [...state.completedSteps, stepId] : state.completedSteps;
+  const failedSteps = status === "failed" ? [...state.failedSteps, stepId] : state.failedSteps;
+  return {
+    ...state,
+    steps,
+    currentStep: status === "running" ? stepId : state.currentStep === stepId ? void 0 : state.currentStep,
+    completedSteps,
+    failedSteps
+  };
+}
+function reportPipelineProgress(onProgress, totalSteps, stepIndex, percent, stepName, message, itemsProcessed) {
+  onProgress?.({
+    percent,
+    currentStepIndex: stepIndex,
+    totalSteps,
+    currentStepName: stepName,
+    message,
+    itemsProcessed
+  });
+}
+function reportPipelineItemProgress(onProgress, totalSteps, newItemCount, targetItems, stepIndex, stepName = "Generate Items") {
+  const ratio = newItemCount / Math.max(targetItems, 1);
+  const percent = Math.min(30 + Math.round(ratio * 53), 83);
+  onProgress?.({
+    percent,
+    currentStepIndex: stepIndex,
+    totalSteps,
+    currentStepName: stepName,
+    message: `${newItemCount} items generated`,
+    itemsProcessed: newItemCount
+  });
+}
+async function resolveScopedSettings(context, userId, workId) {
+  if (!context) return {};
+  try {
+    const [userSettings, workSettings] = await Promise.all([
+      context.getSettings("user", userId),
+      context.getSettings("work", workId)
+    ]);
+    const merged = { ...userSettings };
+    for (const key in workSettings) {
+      if (workSettings[key] !== void 0 && workSettings[key] !== null) {
+        merged[key] = workSettings[key];
+      }
+    }
+    return merged;
+  } catch (err) {
+    const isAuthError = err instanceof Error && (/unauthorized|forbidden|access denied/i.test(err.message) || "status" in err && err.status === 401 || "status" in err && err.status === 403 || "statusCode" in err && err.statusCode === 401 || "statusCode" in err && err.statusCode === 403);
+    if (isAuthError) {
+      throw err;
+    }
+    context.logger?.warn(
+      `resolveScopedSettings: failed to load settings for user=${userId} work=${workId}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return {};
+  }
+}
+function buildPipelineMetrics(startTime, duration, itemCount, custom) {
+  return {
+    startTime,
+    duration,
+    itemsProcessed: itemCount,
+    steps: {},
+    ...custom ? { custom } : {}
+  };
+}
+function finalizePipelineState(state) {
+  return {
+    ...state,
+    isRunning: false,
+    isCancelled: false,
+    currentStep: void 0,
+    completedAt: Date.now()
+  };
+}
+function buildPipelineErrorResult(state, error, startTime, totalSteps, initializeState2) {
+  let currentState = state ?? initializeState2();
+  for (const [stepId, stepState] of currentState.steps) {
+    if (stepState.status === "running") {
+      currentState = updatePipelineStepState(currentState, stepId, "failed", error.message);
+      break;
+    }
+  }
+  currentState = {
+    ...currentState,
+    isRunning: false,
+    isCancelled: false,
+    currentStep: void 0,
+    completedAt: Date.now()
+  };
+  return {
+    state: currentState,
+    result: buildErrorPipelineResult(error, {
+      outputs: createEmptyPipelineOutputs(),
+      duration: Date.now() - startTime,
+      stepsCompleted: currentState.completedSteps.length,
+      totalSteps,
+      failedStep: currentState.failedSteps[currentState.failedSteps.length - 1],
+      state: currentState
+    })
+  };
+}
+function buildPipelineCancelledResult(state, startTime, totalSteps, initializeState2) {
+  const currentState = {
+    ...state ?? initializeState2(),
+    isRunning: false,
+    isCancelled: true,
+    currentStep: void 0,
+    completedAt: Date.now()
+  };
+  return {
+    state: currentState,
+    result: buildCancelledPipelineResult({
+      outputs: createEmptyPipelineOutputs(),
+      duration: Date.now() - startTime,
+      stepsCompleted: currentState.completedSteps.length,
+      totalSteps,
+      state: currentState
+    })
+  };
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function createPipelineRuntimeHelpers(options) {
+  const initializeState2 = () => initializePipelineState(options.stepDefinitions);
+  const updateStepState2 = (state, stepId, status, error) => updatePipelineStepState(state, stepId, status, error);
+  const reportProgress2 = (onProgress, stepIndex, percent, stepName, message, itemsProcessed) => {
+    reportPipelineProgress(onProgress, options.totalSteps, stepIndex, percent, stepName, message, itemsProcessed);
+  };
+  const reportItemProgress = (onProgress, newItemCount, targetItems, stepIndex, stepName = options.itemProgressStepName ?? "Generate Items") => {
+    reportPipelineItemProgress(onProgress, options.totalSteps, newItemCount, targetItems, stepIndex, stepName);
+  };
+  const buildMetrics2 = (startTime, duration, itemCount, custom) => buildPipelineMetrics(startTime, duration, itemCount, custom);
+  const finalizeCompletedState2 = (state) => finalizePipelineState(state);
+  const buildErrorResult2 = (state, error, startTime) => buildPipelineErrorResult(state, error, startTime, options.totalSteps, initializeState2);
+  const buildCancelledResult2 = (state, startTime) => buildPipelineCancelledResult(state, startTime, options.totalSteps, initializeState2);
+  return {
+    initializeState: initializeState2,
+    updateStepState: updateStepState2,
+    reportProgress: reportProgress2,
+    reportItemProgress,
+    resolveSettings: resolveScopedSettings,
+    buildMetrics: buildMetrics2,
+    finalizeCompletedState: finalizeCompletedState2,
+    buildErrorResult: buildErrorResult2,
+    buildCancelledResult: buildCancelledResult2,
+    delay
+  };
+}
+var ITEM_SCHEMA_PROMPT_TEXT = `
+Each item must be a JSON file with the following structure:
+
+{
+  "name": "string (required) - The item's canonical display name",
+  "description": "string (required) - A concise, informative summary of the item and its relevance to the work topic (2-4 sentences). Generate from page content if not directly available.",
+  "source_url": "string (required) - The most direct, canonical URL for the item itself (homepage or official page). Must be real and working. Never use blog posts or articles *about* the item.",
+  "category": "string (required) - ONE primary category based on the item's core function (e.g., 'Monitoring', 'CI/CD', 'Data Visualization')",
+  "tags": ["string"] - 1-3 specific, descriptive tags (e.g., "open-source", "real-time", "cloud-native"),
+  "featured": boolean - Whether this is a notable/featured item (optional, default false),
+  "slug": "string - URL-friendly identifier (optional, auto-generated from name if omitted)",
+  "brand": "string - At most one brand/company name per item (optional)",
+  "brand_logo_url": "string - Canonical logo URL from official domain, prefer SVG/PNG (optional)",
+  "images": ["string"] - Multiple high-quality image URLs (screenshots, product imagery) from official sources (optional),
+  "markdown": "string - Detailed product/service information in markdown: features, pricing, use cases (see Markdown Rules below). Do not repeat category, tags, or other metadata fields."
+}
+
+Required fields: name, description, source_url, category
+
+### Example
+
+\`\`\`json
+{
+  "name": "Prometheus",
+  "description": "Open-source monitoring and alerting toolkit designed for reliability and scalability, widely adopted in cloud-native environments.",
+  "source_url": "https://prometheus.io",
+  "category": "Monitoring",
+  "tags": ["open-source", "metrics", "cloud-native"],
+  "featured": false,
+  "brand": "Cloud Native Computing Foundation",
+  "brand_logo_url": "https://www.cncf.io/wp-content/uploads/2022/07/cncf-color-bg.svg",
+  "images": ["https://prometheus.io/assets/architecture.png"],
+  "markdown": "## Overview\\n\\nPrometheus is an open-source systems monitoring and alerting toolkit originally built at SoundCloud.\\n\\n## Features\\n\\n- Multi-dimensional data model with time series data identified by metric name and key/value pairs\\n- PromQL, a flexible query language\\n- No reliance on distributed storage; single server nodes are autonomous\\n- Time series collection via a pull model over HTTP\\n- Targets discovered via service discovery or static configuration\\n\\n## Pricing\\n\\nFree and open-source under the Apache 2.0 license."
+}
+\`\`\`
+`.trim();
+function createEmptyPipelineOutputs() {
+  return {
+    items: [],
+    categories: [],
+    tags: [],
+    collections: [],
+    brands: []
+  };
+}
+function buildSuccessPipelineResult(outputs, base) {
+  return {
+    success: true,
+    outputs,
+    duration: base.duration,
+    stepsCompleted: base.stepsCompleted,
+    totalSteps: base.totalSteps,
+    state: base.state,
+    metrics: base.metrics,
+    warnings: base.warnings
+  };
+}
+function buildErrorPipelineResult(error, base) {
+  return {
+    success: false,
+    outputs: base.outputs ?? createEmptyPipelineOutputs(),
+    duration: base.duration,
+    stepsCompleted: base.stepsCompleted,
+    totalSteps: base.totalSteps,
+    state: base.state,
+    metrics: base.metrics,
+    warnings: base.warnings,
+    error,
+    failedStep: base.failedStep
+  };
+}
+function buildCancelledPipelineResult(base) {
+  return buildErrorPipelineResult("Pipeline cancelled", base);
+}
+
+// src/types.ts
+var ACTIVEPIECES_STEP_IDS = [
+  "validate-activepieces",
+  "prepare-payload",
+  "execute-flow",
+  "collect-results",
+  "capture-screenshots",
+  "cleanup"
+];
+var DEFAULT_BASE_URL = "https://cloud.activepieces.com/api/v1";
+var DEFAULT_TARGET_ITEMS = 50;
+var TERMINAL_FLOW_RUN_STATUSES = [
+  "SUCCEEDED",
+  "FAILED",
+  "TIMED_OUT",
+  "INTERNAL_ERROR",
+  "QUOTA_EXCEEDED",
+  "STOPPED",
+  "MEMORY_LIMIT_EXCEEDED"
+];
+
+// src/steps.ts
+var STEP_DEFINITIONS = [
+  {
+    id: "validate-activepieces",
+    name: "Validate Activepieces Connection",
+    description: "Verify API key and check that the Activepieces flow is enabled",
+    position: { type: "first" },
+    dependencies: [],
+    optional: false,
+    parallelizable: false,
+    estimatedDuration: 3
+  },
+  {
+    id: "prepare-payload",
+    name: "Prepare Flow Payload",
+    description: "Build input payload from work context, existing items, and config",
+    position: { type: "after", stepId: "validate-activepieces" },
+    dependencies: [{ stepId: "validate-activepieces", required: true }],
+    optional: false,
+    parallelizable: false,
+    estimatedDuration: 2
+  },
+  {
+    id: "execute-flow",
+    name: "Execute Activepieces Flow",
+    description: "Trigger the Activepieces flow webhook (sync or async with polling)",
+    position: { type: "after", stepId: "prepare-payload" },
+    dependencies: [{ stepId: "prepare-payload", required: true }],
+    optional: false,
+    parallelizable: false,
+    estimatedDuration: 120
+  },
+  {
+    id: "collect-results",
+    name: "Collect & Validate Results",
+    description: "Parse Activepieces flow output, validate items, and deduplicate",
+    position: { type: "after", stepId: "execute-flow" },
+    dependencies: [{ stepId: "execute-flow", required: true }],
+    optional: false,
+    parallelizable: false,
+    estimatedDuration: 5
+  },
+  {
+    id: "capture-screenshots",
+    name: "Capture Screenshots",
+    description: "Capture screenshots for generated items",
+    position: { type: "after", stepId: "collect-results" },
+    dependencies: [{ stepId: "collect-results", required: true }],
+    optional: true,
+    parallelizable: false,
+    estimatedDuration: 30
+  },
+  {
+    id: "cleanup",
+    name: "Cleanup",
+    description: "Release resources and clear temporary data",
+    position: { type: "last" },
+    dependencies: [{ stepId: "capture-screenshots", required: false }],
+    optional: true,
+    parallelizable: false,
+    estimatedDuration: 1
+  }
+];
+
+// src/utils/activepieces-client.ts
+var ASYNC_POLL_INTERVAL_MS = 2e3;
+var ActivepiecesClient = class {
+  constructor(options) {
+    this.apiKey = options.apiKey;
+    this.baseUrl = stripTrailingSlash(options.baseUrl);
+    this.logger = options.logger;
+  }
+  /** Lightweight ping that hits the flows list to verify auth + reachability. */
+  async ping(projectId) {
+    const query = { limit: 1 };
+    if (projectId) query.projectId = projectId;
+    await this.request("/flows", { method: "GET", query });
+  }
+  /** Fetches a flow by id and ensures it is enabled. */
+  async validateFlow(flowId) {
+    const flow = await this.request(`/flows/${encodeURIComponent(flowId)}`, {
+      method: "GET"
+    });
+    if (!flow || typeof flow !== "object") {
+      throw new Error(`Activepieces flow "${flowId}" returned an unexpected response`);
+    }
+    if (flow.status && flow.status !== "ENABLED") {
+      throw new Error(
+        `Activepieces flow "${flowId}" is not enabled (status: ${flow.status}). Enable the flow from the Activepieces dashboard before triggering it.`
+      );
+    }
+    if (!flow.publishedVersionId) {
+      this.logger.warn(
+        `Activepieces flow "${flowId}" has no published version. Publish the flow before invoking it; the webhook trigger will fail otherwise.`
+      );
+    }
+    return flow;
+  }
+  /** Fetches a single flow run by id via `GET /flow-runs/{id}`. */
+  async getFlowRun(runId, signal) {
+    return this.request(`/flow-runs/${encodeURIComponent(runId)}`, {
+      method: "GET",
+      signal
+    });
+  }
+  /**
+   * Returns the most recent flow run for a flow (used for async-mode polling).
+   * Activepieces requires `projectId` on the list endpoint.
+   */
+  async findLatestRunForFlow(flowId, projectId, options = {}) {
+    const query = {
+      projectId,
+      flowId,
+      limit: 1
+    };
+    if (options.createdAfter) query.createdAfter = options.createdAfter;
+    const response = await this.request("/flow-runs", {
+      method: "GET",
+      query,
+      signal: options.signal
+    });
+    return Array.isArray(response?.data) && response.data.length > 0 ? response.data[0] : void 0;
+  }
+  /**
+   * Triggers an Activepieces flow webhook with the prepared payload.
+   *
+   * **Sync mode** (`/sync`): Activepieces holds the request open until the flow's
+   * Response action fires; the response body is returned as the flow output.
+   *
+   * **Async mode**: the webhook returns immediately. The client then polls
+   * `GET /flow-runs?flowId=...&projectId=...` until the run reaches a terminal
+   * status, and finally fetches the full run via `GET /flow-runs/{id}`.
+   * Async mode requires `settings.projectId` to be configured.
+   */
+  async executeFlow(flowId, input, settings, onProgress, signal) {
+    if (signal?.aborted) throw new Error("Pipeline execution was cancelled");
+    if (settings.webhookMode === "async" && !settings.projectId) {
+      throw new Error(
+        "Async mode requires a Default Project ID in plugin settings so the latest flow run can be polled."
+      );
+    }
+    const startTime = Date.now();
+    const path = webhookPath(flowId, settings.webhookMode);
+    this.logger.log(`Triggering Activepieces webhook ${path} (mode=${settings.webhookMode})`);
+    onProgress?.(1, "running");
+    const triggerStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const response = await this.request(path, {
+      method: "POST",
+      body: input,
+      signal,
+      timeoutMs: settings.timeoutMs,
+      // Webhook endpoints are public per-flow URLs and do not need the platform token.
+      // Sending the bearer is harmless for cloud, but self-hosted gateways may reject it,
+      // so we only forward the API key on platform endpoints.
+      includeAuth: false
+    });
+    if (settings.webhookMode === "async") {
+      const run2 = await this.pollUntilTerminal(
+        flowId,
+        settings.projectId,
+        triggerStartedAt,
+        settings.timeoutMs,
+        onProgress,
+        signal
+      );
+      onProgress?.(1, "completed");
+      return {
+        output: run2.steps ?? {},
+        flowRunId: run2.id,
+        flowDuration: Date.now() - startTime,
+        run: run2
+      };
+    }
+    onProgress?.(1, "completed");
+    const flowDuration = Date.now() - startTime;
+    const flowRunId = extractFlowRunId(response);
+    let run;
+    if (flowRunId) {
+      try {
+        run = await this.getFlowRun(flowRunId, signal);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : "unknown error";
+        this.logger.warn(`Could not fetch run record for "${flowRunId}": ${reason}`);
+      }
+    }
+    return {
+      output: response,
+      flowRunId,
+      flowDuration,
+      run
+    };
+  }
+  async pollUntilTerminal(flowId, projectId, createdAfter, timeoutMs, onProgress, signal) {
+    const deadline = Date.now() + timeoutMs;
+    let attempt = 0;
+    let lastSeenRunId;
+    while (Date.now() < deadline) {
+      if (signal?.aborted) throw new Error("Pipeline execution was cancelled");
+      attempt += 1;
+      const run = await this.findLatestRunForFlow(flowId, projectId, { createdAfter, signal });
+      if (run) {
+        lastSeenRunId = run.id;
+        onProgress?.(attempt, run.status);
+        if (TERMINAL_FLOW_RUN_STATUSES.includes(run.status)) {
+          return await this.getFlowRun(run.id, signal);
+        }
+      } else {
+        onProgress?.(attempt, "queued");
+      }
+      await sleep(ASYNC_POLL_INTERVAL_MS, signal);
+    }
+    throw new Error(
+      `Activepieces flow "${flowId}" did not finish within ${Math.round(timeoutMs / 1e3)}s` + (lastSeenRunId ? ` (last run: ${lastSeenRunId})` : "")
+    );
+  }
+  async request(path, options = {}) {
+    const url = buildUrl(this.baseUrl, path, options.query);
+    const headers = {
+      Accept: "application/json"
+    };
+    if (options.includeAuth !== false) {
+      headers["Authorization"] = `Bearer ${this.apiKey}`;
+    }
+    let body;
+    if (options.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(options.body);
+    }
+    const controller = new AbortController();
+    const timeoutHandle = options.timeoutMs ? setTimeout(() => controller.abort(new Error("Request timed out")), options.timeoutMs) : void 0;
+    const onAbort = () => controller.abort(options.signal?.reason ?? new Error("Aborted"));
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+      const response = await fetch(url, {
+        method: options.method ?? "GET",
+        headers,
+        body,
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        throw await buildHttpError(response, url);
+      }
+      const text = await response.text();
+      if (!text) return void 0;
+      try {
+        return JSON.parse(text);
+      } catch {
+        return text;
+      }
+    } catch (error) {
+      if (isAbortError(error)) {
+        if (options.signal?.aborted) {
+          throw new Error("Pipeline execution was cancelled");
+        }
+        throw new Error(`Activepieces request timed out: ${path}`);
+      }
+      throw error;
+    } finally {
+      if (timeoutHandle) clearTimeout(timeoutHandle);
+      options.signal?.removeEventListener("abort", onAbort);
+    }
+  }
+};
+function stripTrailingSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+function buildUrl(baseUrl, path, query) {
+  const url = new URL(`${baseUrl}${path.startsWith("/") ? path : `/${path}`}`);
+  if (query) {
+    for (const [key, value] of Object.entries(query)) {
+      if (value === void 0) continue;
+      url.searchParams.set(key, String(value));
+    }
+  }
+  return url.toString();
+}
+function webhookPath(flowId, mode) {
+  const encoded = encodeURIComponent(flowId);
+  return mode === "sync" ? `/webhooks/${encoded}/sync` : `/webhooks/${encoded}`;
+}
+function extractFlowRunId(response) {
+  if (!response || typeof response !== "object") return void 0;
+  const obj = response;
+  for (const key of ["runId", "flowRunId"]) {
+    const value = obj[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+}
+async function buildHttpError(response, url) {
+  let detail = "";
+  try {
+    const text = await response.text();
+    if (text) detail = text.length > 500 ? text.slice(0, 500) + "..." : text;
+  } catch {
+  }
+  const baseMessage = `Activepieces request failed (${response.status} ${response.statusText}) for ${url}`;
+  if (response.status === 401) {
+    return new Error("Invalid Activepieces API key. Please update your API key in plugin settings.");
+  }
+  if (response.status === 403) {
+    return new Error(
+      "Activepieces API key does not have permission to access this resource. Check that the key belongs to the correct project."
+    );
+  }
+  if (response.status === 404) {
+    return new Error(
+      "Activepieces resource not found. Verify the flow ID, project ID, and that the flow is published."
+    );
+  }
+  if (response.status === 429) {
+    return new Error("Activepieces rate limit exceeded. Please wait and try again.");
+  }
+  if (response.status >= 500) {
+    return new Error(
+      `${baseMessage}. The Activepieces server returned an error.${detail ? ` Detail: ${detail}` : ""}`
+    );
+  }
+  return new Error(`${baseMessage}${detail ? ` \u2014 ${detail}` : ""}`);
+}
+function isAbortError(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = error.name;
+  return name === "AbortError" || name === "TimeoutError";
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("Pipeline execution was cancelled"));
+      return;
+    }
+    const handle = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(handle);
+      reject(new Error("Pipeline execution was cancelled"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// ../../plugin/dist/helpers/ssrf-guard.js
+import { isIP } from "net";
+function isSafeWebhookUrl(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    return false;
+  }
+  let host = url.hostname.toLowerCase();
+  if (host.startsWith("[") && host.endsWith("]")) {
+    host = host.slice(1, -1);
+  }
+  if (CLOUD_METADATA_HOSTNAMES.has(host)) {
+    return false;
+  }
+  const ipKind = isIP(host);
+  if (ipKind === 4 && isPrivateIPv4(host)) return false;
+  if (ipKind === 6 && isPrivateIPv6(host)) return false;
+  return true;
+}
+var CLOUD_METADATA_HOSTNAMES = /* @__PURE__ */ new Set([
+  // GCP
+  "metadata.google.internal",
+  "metadata.goog",
+  // AWS
+  "instance-data",
+  "instance-data.ec2.internal",
+  // Azure
+  "metadata.azure.internal"
+]);
+function isPrivateIPv4(ip) {
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return false;
+  const [a, b] = parts;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 0) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function isPrivateIPv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  const firstHextet = lower.split(":", 1)[0];
+  if (/^[0-9a-f]{1,4}$/.test(firstHextet)) {
+    const group0 = parseInt(firstHextet, 16);
+    if ((group0 & 65472) === 65152) return true;
+  }
+  if (lower.startsWith("::ffff:")) {
+    const v4 = lower.slice("::ffff:".length);
+    if (isIP(v4) === 4) return isPrivateIPv4(v4);
+  }
+  return false;
+}
+
+// src/utils/payload-builder.ts
+function assertSafeGithubRepoUrl(rawUrl) {
+  const trimmed = rawUrl.trim();
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error("Data repository URL is not a valid URL.");
+  }
+  if (parsed.protocol !== "https:" || parsed.hostname.toLowerCase() !== "github.com") {
+    throw new Error("Data repository URL must be an https://github.com/... repository URL.");
+  }
+  if (!isSafeWebhookUrl(trimmed)) {
+    throw new Error("Data repository URL is not safe to forward (SSRF guard blocked the destination host).");
+  }
+  return trimmed;
+}
+function buildFlowPayload(options) {
+  const { work, request, existing, config } = options;
+  const payload = {
+    metadata: {
+      workId: work.id,
+      workName: work.name,
+      workSlug: work.slug,
+      workDescription: work.description,
+      prompt: request.prompt,
+      generationMethod: request.generationMethod,
+      targetItems: config.target_items ?? DEFAULT_TARGET_ITEMS
+    }
+  };
+  if (config.pass_existing_items !== false && existing.items.length > 0) {
+    payload.existingSummary = {
+      totalItems: existing.items.length,
+      categories: existing.categories.map((c) => c.name),
+      tags: existing.tags.map((t) => t.name),
+      sampleItems: existing.items.slice(0, 20).map((item) => ({
+        name: item.name,
+        url: item.source_url
+      }))
+    };
+  }
+  if (config.pass_repo_access && config.repo_url) {
+    const repoUrl = assertSafeGithubRepoUrl(String(config.repo_url));
+    payload.dataSource = {
+      type: "github-repo",
+      repoUrl,
+      accessToken: config.repo_access_token,
+      branch: config.repo_branch || "data",
+      path: "items/"
+    };
+  }
+  if (config.flow_params && typeof config.flow_params === "object") {
+    payload.flowParams = config.flow_params;
+  }
+  return payload;
+}
+
+// src/utils/result-parser.ts
+function parseActivepiecesOutput(raw) {
+  if (!raw || typeof raw !== "object" && typeof raw !== "string") {
+    throw new Error("Activepieces flow returned empty or non-object output");
+  }
+  const output = normalizeOutput(raw);
+  const items = parseItems(output.items ?? []);
+  if (items.length === 0) {
+    throw new Error(
+      "Activepieces flow returned a valid response but with no usable items. Ensure the flow ends with a Return Response action that emits { items: [...] }. Inspect the flow run logs in the Activepieces dashboard."
+    );
+  }
+  const categories = parseCategories(output.categories, items);
+  const tags = parseTags(output.tags, items);
+  const brands = parseBrands(output.brands, items);
+  return { items, categories, tags, brands };
+}
+function normalizeOutput(raw) {
+  if (typeof raw === "string") {
+    const parsed = tryParse(raw);
+    if (parsed !== null && typeof parsed === "object") {
+      return normalizeOutput(parsed);
+    }
+    const preview = raw.length > 200 ? raw.slice(0, 200) + "..." : raw;
+    throw new Error(
+      `Activepieces flow returned a string that is not valid JSON. Ensure the Return Response action emits a JSON object with { items: [...] }. Received: ${preview}`
+    );
+  }
+  if (Array.isArray(raw)) {
+    return { items: raw };
+  }
+  const obj = raw;
+  if ("items" in obj) {
+    const items = Array.isArray(obj.items) ? obj.items : [];
+    return {
+      items,
+      categories: obj.categories,
+      tags: obj.tags,
+      brands: obj.brands
+    };
+  }
+  for (const key of ["body", "output", "result", "data", "response", "value"]) {
+    if (obj[key] != null && obj[key] !== "") {
+      return normalizeOutput(obj[key]);
+    }
+  }
+  if (typeof obj.message === "string") {
+    const parsed = tryParse(obj.message);
+    if (parsed !== null && typeof parsed === "object") {
+      return normalizeOutput(parsed);
+    }
+  }
+  throw new Error(
+    `Activepieces flow output does not contain an "items" array. Expected format: { items: [...] } or a direct array of items. Received keys: ${Object.keys(obj).join(", ")}`
+  );
+}
+function tryParse(str) {
+  try {
+    return JSON.parse(str);
+  } catch {
+    return null;
+  }
+}
+function sanitizeItemUrl(rawUrl) {
+  if (typeof rawUrl !== "string" || rawUrl.trim() === "") return "";
+  const trimmed = rawUrl.trim();
+  return isSafeWebhookUrl(trimmed) ? trimmed : "";
+}
+function parseItems(rawItems) {
+  const items = [];
+  for (const raw of rawItems) {
+    if (!raw || typeof raw !== "object") continue;
+    if (!raw.name || typeof raw.name !== "string") continue;
+    const rawSourceUrl = typeof raw.url === "string" ? raw.url : typeof raw.source_url === "string" ? raw.source_url : "";
+    const item = {
+      name: raw.name.trim(),
+      description: typeof raw.description === "string" ? raw.description.trim() : "",
+      source_url: sanitizeItemUrl(rawSourceUrl),
+      markdown: typeof raw.content === "string" ? raw.content : void 0,
+      category: typeof raw.category === "string" ? raw.category.trim() : "",
+      tags: Array.isArray(raw.tags) ? raw.tags.filter((t) => typeof t === "string") : [],
+      brand: typeof raw.brand === "string" ? raw.brand.trim() : void 0,
+      images: Array.isArray(raw.images) ? raw.images.filter((i) => typeof i === "string").map((i) => sanitizeItemUrl(i)).filter((i) => i !== "") : void 0
+    };
+    items.push(item);
+  }
+  return items;
+}
+function parseCategories(rawCategories, items) {
+  const categoryNames = /* @__PURE__ */ new Set();
+  if (Array.isArray(rawCategories)) {
+    for (const cat of rawCategories) {
+      if (cat && typeof cat.name === "string" && cat.name.trim()) {
+        categoryNames.add(cat.name.trim());
+      }
+    }
+  }
+  for (const item of items) {
+    if (typeof item.category === "string" && item.category) {
+      categoryNames.add(item.category);
+    } else if (Array.isArray(item.category)) {
+      for (const c of item.category) {
+        if (typeof c === "string" && c.trim()) categoryNames.add(c.trim());
+      }
+    }
+  }
+  return Array.from(categoryNames).map((name) => {
+    const explicit = rawCategories?.find((c) => c.name === name);
+    return {
+      id: name.toLowerCase().replace(/\s+/g, "-"),
+      name,
+      description: explicit?.description
+    };
+  });
+}
+function parseTags(rawTags, items) {
+  const tagNames = /* @__PURE__ */ new Set();
+  if (Array.isArray(rawTags)) {
+    for (const tag of rawTags) {
+      if (tag && typeof tag.name === "string" && tag.name.trim()) {
+        tagNames.add(tag.name.trim());
+      }
+    }
+  }
+  for (const item of items) {
+    if (Array.isArray(item.tags)) {
+      for (const t of item.tags) {
+        if (typeof t === "string") tagNames.add(t);
+      }
+    }
+  }
+  return Array.from(tagNames).map((name) => ({
+    id: name.toLowerCase().replace(/\s+/g, "-"),
+    name
+  }));
+}
+function parseBrands(rawBrands, items) {
+  const brandNames = /* @__PURE__ */ new Set();
+  if (Array.isArray(rawBrands)) {
+    for (const brand of rawBrands) {
+      if (brand && typeof brand.name === "string" && brand.name.trim()) {
+        brandNames.add(brand.name.trim());
+      }
+    }
+  }
+  for (const item of items) {
+    if (item.brand) {
+      if (typeof item.brand === "string") {
+        brandNames.add(item.brand);
+      } else if (typeof item.brand === "object" && item.brand.name) {
+        brandNames.add(item.brand.name);
+      }
+    }
+  }
+  return Array.from(brandNames).map((name) => {
+    const explicit = rawBrands?.find((b) => b.name === name);
+    return {
+      id: name.toLowerCase().replace(/\s+/g, "-"),
+      name,
+      website: explicit?.url
+    };
+  });
+}
+function deduplicateItems(newItems, existingItemNames) {
+  const existingSet = new Set(existingItemNames.map((n) => n.toLowerCase().trim()));
+  return newItems.filter((item) => !existingSet.has(item.name.toLowerCase().trim()));
+}
+
+// src/utils/pipeline-helpers.ts
+var runtime = createPipelineRuntimeHelpers({
+  stepDefinitions: STEP_DEFINITIONS,
+  totalSteps: ACTIVEPIECES_STEP_IDS.length
+});
+var initializeState = runtime.initializeState;
+var updateStepState = runtime.updateStepState;
+var reportProgress = runtime.reportProgress;
+var resolveSettings = runtime.resolveSettings;
+var finalizeCompletedState = runtime.finalizeCompletedState;
+var buildErrorResult = runtime.buildErrorResult;
+var buildCancelledResult = runtime.buildCancelledResult;
+function buildMetrics(startTime, duration, itemCount, flowMetrics) {
+  return runtime.buildMetrics(startTime, duration, itemCount, flowMetrics);
+}
+
+// src/form-schema.ts
+var REPO_ACCESS_CONDITION = { field: "pass_repo_access", operator: "eq", value: true };
+function getFormFields() {
+  return [
+    {
+      name: "flow_id",
+      type: "text",
+      label: "Activepieces Flow ID",
+      description: "Override the default flow for this generation (optional if set in plugin settings)",
+      placeholder: "e.g., 8h7g6f5e4d3c2b1a",
+      group: "flow"
+    },
+    {
+      name: "webhook_mode",
+      type: "select",
+      label: "Webhook Execution Mode",
+      description: "Sync waits for the flow to finish; async returns immediately and is not supported by this pipeline",
+      defaultValue: "sync",
+      options: [
+        { label: "Synchronous (recommended)", value: "sync" },
+        { label: "Asynchronous", value: "async" }
+      ],
+      group: "flow"
+    },
+    {
+      name: "target_items",
+      type: "number",
+      label: "Target Items",
+      description: "Target number of new items to generate",
+      defaultValue: DEFAULT_TARGET_ITEMS,
+      validation: { min: 1, max: 500 },
+      group: "flow"
+    },
+    {
+      name: "flow_timeout",
+      type: "number",
+      label: "Flow Timeout (minutes)",
+      description: "Maximum time to wait for the Activepieces flow to complete",
+      defaultValue: 60,
+      validation: { min: 1, max: 120 },
+      group: "flow"
+    },
+    {
+      name: "pass_existing_items",
+      type: "boolean",
+      label: "Pass Existing Items Summary",
+      description: "Include a summary of existing work items in flow input for deduplication",
+      defaultValue: true,
+      group: "data"
+    },
+    {
+      name: "pass_repo_access",
+      type: "boolean",
+      label: "Pass Data Repository Access",
+      description: "Grant the Activepieces flow read access to the work data repository. \u26A0 The repository URL and access token are sent in the webhook payload and become visible to every step of your flow and to the Activepieces run logs.",
+      defaultValue: false,
+      group: "data"
+    },
+    {
+      name: "repo_url",
+      type: "text",
+      label: "Data Repository URL",
+      description: "GitHub repository URL containing work data",
+      placeholder: "e.g., https://github.com/org/repo",
+      group: "data",
+      showIf: REPO_ACCESS_CONDITION,
+      requiredIf: REPO_ACCESS_CONDITION
+    },
+    {
+      name: "repo_access_token",
+      type: "password",
+      label: "Repository Access Token",
+      description: "Read-only token for the data repository. \u26A0 This token is forwarded to Activepieces in the webhook body and persists in the flow run logs and dashboard. Use a fine-grained, short-lived, read-only token scoped to this repository only \u2014 never a classic PAT with broad scopes.",
+      placeholder: "ghp_... (fine-grained, read-only)",
+      group: "data",
+      showIf: REPO_ACCESS_CONDITION,
+      requiredIf: REPO_ACCESS_CONDITION
+    },
+    {
+      name: "repo_branch",
+      type: "text",
+      label: "Repository Branch",
+      description: "Branch to read from",
+      defaultValue: "data",
+      group: "data",
+      showIf: REPO_ACCESS_CONDITION
+    },
+    {
+      name: "capture_screenshots",
+      type: "boolean",
+      label: "Capture Screenshots",
+      description: "Take screenshots for generated items (requires a screenshot plugin)",
+      defaultValue: false,
+      group: "features"
+    },
+    {
+      name: "flow_params",
+      type: "json",
+      label: "Custom Flow Parameters",
+      description: "Additional key-value parameters to pass to the Activepieces flow",
+      defaultValue: {},
+      group: "advanced"
+    }
+  ];
+}
+function getFormGroups() {
+  return [
+    {
+      name: "flow",
+      title: "Flow Configuration",
+      description: "Configure which Activepieces flow to execute and how many items to generate",
+      order: 0
+    },
+    {
+      name: "data",
+      title: "Data Passing",
+      description: "Configure how data is passed to the Activepieces flow",
+      order: 1,
+      collapsible: true,
+      collapsed: false
+    },
+    {
+      name: "features",
+      title: "Features",
+      description: "Optional generation features",
+      order: 2,
+      collapsible: true,
+      collapsed: true
+    },
+    {
+      name: "advanced",
+      title: "Advanced",
+      description: "Advanced flow parameters",
+      order: 3,
+      collapsible: true,
+      collapsed: true
+    }
+  ];
+}
+function validateFormInput(values) {
+  if (values.pass_repo_access) {
+    if (!values.repo_url || typeof values.repo_url !== "string" || values.repo_url.trim() === "") {
+      return {
+        valid: false,
+        errors: [{ path: "repo_url", message: "Repository URL is required when repository access is enabled" }]
+      };
+    }
+    let parsedRepoUrl = null;
+    try {
+      parsedRepoUrl = new URL(values.repo_url.trim());
+    } catch {
+      parsedRepoUrl = null;
+    }
+    if (!parsedRepoUrl || parsedRepoUrl.protocol !== "https:" || parsedRepoUrl.hostname.toLowerCase() !== "github.com") {
+      return {
+        valid: false,
+        errors: [{ path: "repo_url", message: "Repository URL must be an https://github.com/... URL" }]
+      };
+    }
+    if (!values.repo_access_token || typeof values.repo_access_token !== "string" || values.repo_access_token.trim() === "") {
+      return {
+        valid: false,
+        errors: [
+          {
+            path: "repo_access_token",
+            message: "Repository access token is required when repository access is enabled"
+          }
+        ]
+      };
+    }
+  }
+  return { valid: true };
+}
+function getDefaultValues(fields) {
+  const defaults = {};
+  for (const field of fields) {
+    if (field.defaultValue !== void 0) {
+      defaults[field.name] = field.defaultValue;
+    }
+  }
+  return defaults;
+}
+
+// src/readme.ts
+var README = [
+  "## What is the Activepieces Automation plugin?",
+  "",
+  "This plugin delegates work generation steps to an [Activepieces](https://www.activepieces.com) flow.",
+  "Activepieces is the AI-first, open-source automation platform for every team.",
+  "Instead of running the built-in generation pipeline, you build your own automated flow in Activepieces and this plugin triggers it during the appropriate generation stage.",
+  "",
+  "## Why use it?",
+  "",
+  "- **Full control** \u2014 design your own generation logic visually in Activepieces",
+  "- **Custom data sources** \u2014 connect to any of Activepieces 280+ pieces (APIs, databases, scrapers)",
+  "- **Flexible AI models** \u2014 call any AI provider via Activepieces actions",
+  "- **Sync execution** \u2014 webhook trigger waits synchronously for flow output",
+  "- **Deduplication** \u2014 existing work items are summarized and passed to the flow to avoid duplicates",
+  "",
+  "## How it works",
+  "",
+  "1. **Validate** \u2014 checks your API key against the Activepieces API and verifies the target flow is enabled",
+  "2. **Prepare Payload** \u2014 builds the input with work metadata, existing items summary, and custom parameters",
+  "3. **Execute Flow** \u2014 calls the Activepieces flow webhook (synchronously by default) with the payload",
+  "4. **Collect Results** \u2014 parses the flow output into structured work items with categories, tags, and brands",
+  "5. **Capture Screenshots** \u2014 optionally captures screenshots for generated items using the configured screenshot provider",
+  "6. **Cleanup** \u2014 releases resources",
+  "",
+  "## API integration",
+  "",
+  "The plugin talks to the Activepieces REST API directly (no SDK):",
+  "",
+  "- **Auth**: `Authorization: Bearer <API_KEY>` (generated from the Platform Dashboard)",
+  "- **Base URL**: `https://cloud.activepieces.com/api/v1` (configurable for self-hosted)",
+  "- **Flows**: `GET /flows/{id}` to validate the flow",
+  "- **Webhook trigger**: `POST /webhooks/{flowId}/sync` (sync mode) or `POST /webhooks/{flowId}` (async)",
+  "- **Flow runs**: `GET /flow-runs` to inspect recent executions",
+  "",
+  "## Data passing strategies",
+  "",
+  "- **Inline summary** (default) \u2014 work metadata and a sample of existing items are sent in the webhook payload",
+  "- **GitHub repository** \u2014 pass a repo URL and access token so the flow can read the full dataset directly",
+  "",
+  "## Security",
+  "",
+  "\u26A0 **Repository access tokens are forwarded to Activepieces in the webhook body**, not in the platform Authorization header.",
+  "That means anything you put under `dataSource` becomes visible to:",
+  "",
+  "- every action and branch downstream of the Webhook trigger in your flow (via `{{trigger.body.dataSource.accessToken}}`)",
+  "- the Activepieces flow run inspector and dashboard",
+  "- any logging, AI prompt, or HTTP request your flow performs that interpolates the trigger body",
+  "",
+  "If you enable **Pass Data Repository Access**:",
+  "",
+  "- Use a [GitHub fine-grained personal access token](https://github.com/settings/tokens?type=beta) scoped to *only* the data repository, with **Contents: Read-only** and the shortest expiration you can tolerate.",
+  "- Do **not** use a classic PAT, an org-admin token, or any token with `repo` write scope.",
+  "- Rotate the token after a generation run if your threat model requires it.",
+  "- Audit your Activepieces flow to ensure no step logs the trigger body verbatim or sends it to a third-party.",
+  "",
+  "When this option is enabled, the plugin emits a warning to the pipeline logs at the prepare-payload step so the operator has an audit trail.",
+  "",
+  "## Flow input & output",
+  "",
+  "Your Activepieces flow must start with a **Webhook trigger** so it can be invoked by this plugin.",
+  "The webhook trigger receives the JSON payload as the trigger output, accessible in subsequent steps.",
+  "",
+  "<details>",
+  "<summary><strong>Input your flow receives</strong></summary>",
+  "",
+  "```json",
+  "{",
+  '  "metadata": {',
+  '    "workId": "dir-123",',
+  '    "workName": "Best AI Tools",',
+  '    "workSlug": "best-ai-tools",',
+  '    "workDescription": "A curated list of the best AI tools",',
+  '    "prompt": "Find the best AI writing tools",',
+  '    "generationMethod": "create-update",',
+  '    "targetItems": 50',
+  "  },",
+  '  "existingSummary": {',
+  '    "totalItems": 10,',
+  '    "categories": ["Writing", "Image Generation"],',
+  '    "tags": ["free", "open-source"],',
+  '    "sampleItems": [',
+  '      { "name": "ChatGPT", "url": "https://chat.openai.com" }',
+  "    ]",
+  "  },",
+  '  "flowParams": {}',
+  "}",
+  "```",
+  "",
+  "- `existingSummary` is optional \u2014 absent if the work is empty or the user disabled it",
+  "- `flowParams` contains any custom key-value pairs passed from the Advanced form section",
+  "- `metadata.targetItems` is the number of new items the user wants",
+  "",
+  "</details>",
+  "",
+  "<details>",
+  "<summary><strong>Output your flow must return</strong></summary>",
+  "",
+  "End your flow with a **Return Response** action that returns a JSON object with an `items` array:",
+  "",
+  "```json",
+  "{",
+  '  "items": [',
+  "    {",
+  '      "name": "Tool Name",',
+  '      "description": "A concise description (1-3 sentences)",',
+  '      "url": "https://example.com",',
+  '      "category": "Category Name",',
+  '      "tags": ["tag1", "tag2"],',
+  '      "content": "Optional longer markdown content",',
+  '      "brand": "Optional brand name",',
+  '      "images": ["https://example.com/screenshot.png"]',
+  "    }",
+  "  ]",
+  "}",
+  "```",
+  "",
+  "**Required fields:** `name`, `description`, `url`, `category`, `tags`",
+  "",
+  "**Optional fields:** `content` (stored as markdown), `brand`, `images`",
+  "",
+  "</details>",
+  "",
+  "## Getting started",
+  "",
+  "1. Build a flow in [Activepieces](https://www.activepieces.com) starting with a **Webhook trigger**",
+  "2. Add steps to fetch and shape data, then end with a **Return Response** action",
+  "3. Generate an API key from the Activepieces Platform Dashboard",
+  "4. Enable this plugin and enter your API key, base URL, and project ID in plugin settings",
+  "5. When generating a work, select Activepieces as the pipeline and provide the flow ID"
+].join("\n");
+
+// src/activepieces.plugin.ts
+var ActivepiecesPlugin = class {
+  constructor() {
+    this.id = "activepieces";
+    this.name = "Activepieces Automation";
+    this.version = "1.0.0";
+    this.category = "pipeline";
+    this.capabilities = ["pipeline", "form-schema-provider"];
+    this.configurationMode = "user-required";
+    this.handledConfigFields = ["*"];
+    this.settingsSchema = {
+      type: "object",
+      properties: {
+        apiKey: {
+          type: "string",
+          title: "Activepieces API Key",
+          description: "API key generated from your Activepieces Platform Dashboard (Platform or Enterprise edition required)",
+          "x-secret": true,
+          "x-scope": "user",
+          "x-envVar": "ACTIVEPIECES_API_KEY"
+        },
+        baseUrl: {
+          type: "string",
+          title: "Activepieces API Base URL",
+          description: "Custom Activepieces instance API base URL (leave empty for Activepieces Cloud)",
+          default: DEFAULT_BASE_URL,
+          "x-scope": "user"
+        },
+        projectId: {
+          type: "string",
+          title: "Default Project ID",
+          description: "Activepieces project ID \u2014 required to list flows and inspect runs",
+          "x-scope": "user"
+        },
+        defaultFlowId: {
+          type: "string",
+          title: "Default Flow ID",
+          description: "Default Activepieces flow to invoke when not specified in the generator form",
+          "x-scope": "user"
+        }
+      },
+      required: ["apiKey"]
+    };
+    this.context = null;
+    this._lastState = null;
+    this._lastAbortController = null;
+  }
+  // ── IPlugin lifecycle ──────────────────────────────────────────────
+  async onLoad(context) {
+    this.context = context;
+    context.logger.log("Activepieces Automation plugin loaded");
+  }
+  async onUnload() {
+    await this.cancel();
+    this.context = null;
+  }
+  async healthCheck() {
+    return {
+      status: "healthy",
+      message: "Activepieces Automation plugin is ready",
+      checkedAt: Date.now()
+    };
+  }
+  async isAvailable(settings) {
+    const resolved = settings || {};
+    const apiKey = resolved.apiKey;
+    return !!apiKey && apiKey.trim().length > 0;
+  }
+  async validateSettings(settings) {
+    const apiKey = settings.apiKey;
+    if (!apiKey || apiKey.trim() === "") {
+      return { valid: false, errors: [{ path: "apiKey", message: "Activepieces API key is required" }] };
+    }
+    return { valid: true };
+  }
+  async validateConnection(rawSettings) {
+    const settings = this.flattenSettings(rawSettings);
+    const apiKey = settings.apiKey;
+    if (!apiKey) {
+      return { success: false, message: "Activepieces API key is required" };
+    }
+    try {
+      const baseUrl = resolveSafeBaseUrl(settings.baseUrl);
+      const client = new ActivepiecesClient({
+        apiKey,
+        baseUrl,
+        logger: this.context?.logger ?? console
+      });
+      const projectId = settings.projectId;
+      const flowId = settings.defaultFlowId;
+      if (flowId) {
+        const flow = await client.validateFlow(flowId);
+        return {
+          success: true,
+          message: `Connected to Activepieces. Flow "${flow.id}" is ${flow.status ?? "available"}.`
+        };
+      }
+      await client.ping(projectId);
+      return { success: true, message: "Connected to Activepieces successfully." };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Connection validation failed";
+      return { success: false, message };
+    }
+  }
+  getManifest() {
+    return {
+      id: this.id,
+      name: this.name,
+      version: this.version,
+      description: "Pipeline plugin that delegates work generation steps to Activepieces flows",
+      category: this.category,
+      capabilities: [...this.capabilities],
+      author: { name: "Ever Works Team" },
+      license: "AGPL-3.0",
+      builtIn: true,
+      autoEnable: false,
+      visibility: "public",
+      selectableProviderCategories: ["screenshot"],
+      uiHints: {
+        includeInOnboarding: true,
+        onboardingPriority: 3,
+        completionFields: ["apiKey", "defaultFlowId"],
+        onboardingDescription: "Connect Activepieces to delegate work generation steps to AI-first automation flows."
+      },
+      readme: README,
+      homepage: "https://www.activepieces.com/docs/endpoints/overview",
+      icon: {
+        type: "url",
+        value: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/webp/activepieces.webp"
+      }
+    };
+  }
+  // ── IFormSchemaProvider ─────────────────────────────────────────────
+  getFormFields() {
+    return getFormFields();
+  }
+  getFormGroups() {
+    return getFormGroups();
+  }
+  validateFormInput(values) {
+    return validateFormInput(values);
+  }
+  getDefaultValues() {
+    return getDefaultValues(this.getFormFields());
+  }
+  // ── IPipelinePlugin ─────────────────────────────────────────────────
+  getStepDefinitions() {
+    return STEP_DEFINITIONS;
+  }
+  async execute(work, request, existing, options, onProgress) {
+    const startTime = Date.now();
+    const abortController = new AbortController();
+    if (options?.signal) {
+      if (options.signal.aborted) {
+        abortController.abort();
+      } else {
+        options.signal.addEventListener("abort", () => abortController.abort(), { once: true });
+      }
+    }
+    const signal = abortController.signal;
+    let state = initializeState();
+    this._lastState = state;
+    this._lastAbortController = abortController;
+    const setState = (stepId, status, error) => {
+      state = updateStepState(state, stepId, status, error);
+      this._lastState = state;
+    };
+    const handleError = (error) => {
+      const { result, state: s } = buildErrorResult(state, error, startTime);
+      state = s;
+      this._lastState = state;
+      return result;
+    };
+    const handleCancel = () => {
+      const { result, state: s } = buildCancelledResult(state, startTime);
+      state = s;
+      this._lastState = state;
+      return result;
+    };
+    const logger = this.context?.logger ?? console;
+    const userId = work.user?.id;
+    if (!userId) {
+      return handleError(new Error("User ID is required"));
+    }
+    try {
+      const pluginSettings = await resolveSettings(this.context, userId, work.id);
+      const config = request.config || {};
+      const apSettings = this.resolveApSettings(pluginSettings, config);
+      const flowId = this.resolveFlowId(config, apSettings);
+      if (!flowId) {
+        return handleError(
+          new Error(
+            "No Activepieces flow ID provided. Set it in the generator form or in plugin settings (defaultFlowId)."
+          )
+        );
+      }
+      const apClient = new ActivepiecesClient({
+        apiKey: apSettings.apiKey,
+        baseUrl: apSettings.baseUrl,
+        logger
+      });
+      setState("validate-activepieces", "running");
+      reportProgress(onProgress, 0, 5, "Validate Activepieces Connection");
+      await apClient.validateFlow(flowId);
+      setState("validate-activepieces", "completed");
+      if (signal.aborted) return handleCancel();
+      setState("prepare-payload", "running");
+      reportProgress(onProgress, 1, 10, "Prepare Flow Payload");
+      const payload = buildFlowPayload({ work, request, existing, config });
+      logger.log(
+        `Payload prepared: ${payload.metadata.targetItems} target items, ${payload.existingSummary?.totalItems ?? 0} existing items, dataSource=${payload.dataSource?.type ?? "none"}`
+      );
+      if (payload.dataSource?.accessToken) {
+        logger.warn(
+          "Activepieces payload contains a repository access token. This token will be visible in the Activepieces flow run logs and dashboard, and to every downstream step of your flow. Use a fine-grained, short-lived, read-only token scoped to this repository only."
+        );
+      }
+      setState("prepare-payload", "completed");
+      if (signal.aborted) return handleCancel();
+      setState("execute-flow", "running");
+      reportProgress(onProgress, 2, 15, "Execute Activepieces Flow", `Triggering flow "${flowId}"...`);
+      const execResult = await apClient.executeFlow(
+        flowId,
+        payload,
+        apSettings,
+        (attempt, status) => {
+          const percent = Math.min(15 + Math.round(attempt / 60 * 55), 70);
+          reportProgress(
+            onProgress,
+            2,
+            percent,
+            "Execute Activepieces Flow",
+            `Flow ${status} (poll #${attempt})...`
+          );
+        },
+        signal
+      );
+      logger.log(
+        `Activepieces flow completed. duration: ${execResult.flowDuration ?? "unknown"}ms` + (execResult.flowRunId ? `, runId: ${execResult.flowRunId}` : "") + (execResult.run?.status ? `, status: ${execResult.run.status}` : "")
+      );
+      if (execResult.run?.status && execResult.run.status !== "SUCCEEDED") {
+        const failedStep = execResult.run.failedStep?.displayName ?? execResult.run.failedStep?.name;
+        const reason = failedStep ? `failed at step "${failedStep}" (status: ${execResult.run.status})` : `did not succeed (status: ${execResult.run.status})`;
+        if (apSettings.webhookMode === "async") {
+          throw new Error(`Activepieces flow run ${reason}. Inspect the run in the Activepieces dashboard.`);
+        }
+        logger.warn(
+          `Activepieces sync flow returned a body but the run record ${reason}. Proceeding with the response body \u2014 verify the items below are correct.`
+        );
+      }
+      setState("execute-flow", "completed");
+      if (signal.aborted) return handleCancel();
+      setState("collect-results", "running");
+      reportProgress(onProgress, 3, 75, "Collect & Validate Results");
+      logger.log(
+        `Raw Activepieces output type: ${typeof execResult.output}, value: ${redactedPreview(execResult.output)}`
+      );
+      const parsed = parseActivepiecesOutput(execResult.output);
+      const existingNames = existing.items.map((i) => i.name);
+      const items = deduplicateItems(parsed.items, existingNames);
+      logger.log(
+        `Collected ${parsed.items.length} items from Activepieces, ${parsed.items.length - items.length} duplicates removed, ${items.length} new items`
+      );
+      setState("collect-results", "completed");
+      const screenshotWarnings = await this.captureScreenshots(
+        setState,
+        request,
+        options?.execContext,
+        items,
+        { userId, workId: work.id },
+        signal,
+        onProgress,
+        logger
+      );
+      setState("cleanup", "running");
+      reportProgress(onProgress, 5, 95, "Cleanup");
+      setState("cleanup", "completed");
+      reportProgress(onProgress, 6, 100, "Complete");
+      const duration = Date.now() - startTime;
+      const flowMetrics = {
+        flowId,
+        flowRunId: execResult.flowRunId,
+        flowDuration: execResult.flowDuration,
+        webhookMode: apSettings.webhookMode,
+        runStatus: execResult.run?.status,
+        failedStepName: execResult.run?.failedStep?.name,
+        finishTime: execResult.run?.finishTime
+      };
+      state = finalizeCompletedState(state);
+      this._lastState = state;
+      return buildSuccessPipelineResult(
+        {
+          items,
+          categories: parsed.categories,
+          tags: parsed.tags,
+          brands: parsed.brands,
+          collections: []
+        },
+        {
+          metrics: buildMetrics(startTime, duration, items.length, flowMetrics),
+          duration,
+          stepsCompleted: state.completedSteps.length,
+          totalSteps: ACTIVEPIECES_STEP_IDS.length,
+          state,
+          warnings: screenshotWarnings.length > 0 ? screenshotWarnings : void 0
+        }
+      );
+    } catch (error) {
+      const err = error instanceof Error ? error : new Error(String(error));
+      logger.error(`Activepieces pipeline failed: ${err.message}`);
+      return handleError(err);
+    } finally {
+      if (this._lastAbortController === abortController) {
+        this._lastAbortController = null;
+      }
+    }
+  }
+  async cancel() {
+    this._lastAbortController?.abort();
+  }
+  getState() {
+    return this._lastState;
+  }
+  // ── Private helpers ────────────────────────────────────────────────
+  resolveApSettings(pluginSettings, config) {
+    const apiKey = pluginSettings.apiKey;
+    if (!apiKey) {
+      throw new Error("Activepieces API key is not configured. Please set it in plugin settings.");
+    }
+    const timeoutMinutes = Math.min(Math.max(1, Number(config.flow_timeout) || 60), 120);
+    const webhookMode = normalizeWebhookMode(config.webhook_mode);
+    return {
+      apiKey,
+      // Security (SSRF): see resolveSafeBaseUrl — reject internal/metadata hosts before
+      // the tenant-supplied baseUrl reaches the API-key-bearing client.
+      baseUrl: resolveSafeBaseUrl(pluginSettings.baseUrl),
+      projectId: pluginSettings.projectId,
+      defaultFlowId: pluginSettings.defaultFlowId,
+      webhookMode,
+      timeoutMs: timeoutMinutes * 60 * 1e3
+    };
+  }
+  resolveFlowId(config, settings) {
+    const fromConfig = config.flow_id;
+    if (fromConfig && fromConfig.trim()) return fromConfig.trim();
+    return settings.defaultFlowId;
+  }
+  async captureScreenshots(setState, request, execContext, items, facadeOptions, signal, onProgress, logger) {
+    const shouldCapture = (request.config || {}).capture_screenshots === true;
+    const screenshotFacade = execContext?.screenshotFacade;
+    if (!shouldCapture || items.length === 0 || signal.aborted || !screenshotFacade) {
+      setState("capture-screenshots", "skipped");
+      return [];
+    }
+    if (!screenshotFacade.isAvailable()) {
+      setState("capture-screenshots", "skipped");
+      return ["Screenshot provider is not configured. Enable a screenshot plugin to capture item images."];
+    }
+    setState("capture-screenshots", "running");
+    reportProgress(onProgress, 4, 80, "Capture Screenshots");
+    const errors = [];
+    const itemsNeedingImages = items.filter(
+      (item) => item.source_url && (!item.images || item.images.length === 0)
+    );
+    for (const item of itemsNeedingImages) {
+      if (signal.aborted) break;
+      if (typeof item.source_url !== "string" || !isSafeWebhookUrl(item.source_url)) {
+        logger.warn(`Skipping screenshot for "${item.name}": source_url failed SSRF guard`);
+        errors.push(`source_url for "${item.name}" is not a safe URL`);
+        continue;
+      }
+      try {
+        const result = await screenshotFacade.getSmartImage(
+          { url: item.source_url, itemName: item.name },
+          facadeOptions
+        );
+        if (result.primaryImage) {
+          item.images = [result.primaryImage, ...item.images || []];
+        }
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : "Unknown error";
+        logger.warn(`Failed to capture image for ${item.name}: ${reason}`);
+        errors.push(reason);
+      }
+    }
+    setState(
+      "capture-screenshots",
+      errors.length > 0 && errors.length === itemsNeedingImages.length ? "failed" : "completed"
+    );
+    if (errors.length > 0) {
+      const providerName = await screenshotFacade.getActiveProviderName?.(facadeOptions);
+      const label = providerName ? `Screenshot capture (${providerName})` : "Screenshot capture";
+      const unique = [...new Set(errors)];
+      return [`${label} failed for ${errors.length} item(s): ${unique.join("; ")}`];
+    }
+    return [];
+  }
+  /**
+   * Flatten a ResolvedSettings map into plain key->value pairs.
+   */
+  flattenSettings(settings) {
+    const flat = {};
+    for (const [key, entry] of Object.entries(settings)) {
+      if (entry && typeof entry === "object" && "value" in entry) {
+        flat[key] = entry.value;
+      } else {
+        flat[key] = entry;
+      }
+    }
+    return flat;
+  }
+};
+function resolveSafeBaseUrl(rawBaseUrl) {
+  const baseUrl = typeof rawBaseUrl === "string" && rawBaseUrl.trim() !== "" ? rawBaseUrl.trim() : DEFAULT_BASE_URL;
+  if (!isSafeWebhookUrl(baseUrl)) {
+    throw new Error("Activepieces API base URL is not safe to call (SSRF guard blocked the destination host).");
+  }
+  return baseUrl;
+}
+var WEBHOOK_MODES = ["sync", "async"];
+function normalizeWebhookMode(value) {
+  return typeof value === "string" && WEBHOOK_MODES.includes(value) ? value : "sync";
+}
+var SECRET_KEY_PATTERN = /(access[_-]?token|^token$|secret|api[_-]?key|password|authorization|bearer)/i;
+function redactSecrets(value, depth = 0) {
+  if (depth > 6 || value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map((entry) => redactSecrets(entry, depth + 1));
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    out[key] = SECRET_KEY_PATTERN.test(key) ? "[redacted]" : redactSecrets(entry, depth + 1);
+  }
+  return out;
+}
+function redactedPreview(value, maxLength = 500) {
+  try {
+    const s = JSON.stringify(redactSecrets(value));
+    if (s === void 0) return typeof value;
+    return s.length > maxLength ? `${s.slice(0, maxLength)}...` : s;
+  } catch {
+    return typeof value;
+  }
+}
+var activepieces_plugin_default = ActivepiecesPlugin;
+export {
+  ActivepiecesPlugin,
+  activepieces_plugin_default as default
+};
+/**
+ * One header finding of the licence scan (plan §2.6:324-325, FR-54): the
+ * `SPDX-License-Identifier:` / `@license` tag a file declares in its first
+ * `LICENSE_HEADER_SCAN_BYTES` bytes.
+ *
+ * **Gap, named rather than guessed:** plan §3.1:437 writes the column's third
+ * field as `headerFindings: …` without a shape. `path` is certain — it is the
+ * first field of the scan's input — and the detected identifier is the second
+ * fact the scan produces, so both are declared; anything further an
+ * implementation adds is additive.
+ */