@ever-works/activepieces-plugin 1.0.12 → 1.0.14

package/dist/index.js

@@ -458,6 +458,13 @@ var TASK_BOARD_STATUS_COLUMNS = TASK_BOARD_STATUSES.map((status) => ({
   terminal: TASK_BOARD_TERMINAL_STATUSES.includes(status),
   toggleOnly: false
 }));
+var TASK_RESERVED_LABELS = Object.freeze([
+  "awaiting-owner",
+  "app-provision",
+  "release:promotion",
+  "release:revert"
+]);
+var TASK_RESERVED_LABEL_PREFIXES = Object.freeze(["release:", "provision-attempt-", "fleet:"]);
 var PLATFORM_DEFAULT_MERGE_POLICY = Object.freeze({
   allowAgentMerge: false,
   requireGreenGate: true,
@@ -1088,26 +1095,10 @@ var FLEET_AGENT_CREDENTIAL_FAMILIES = [
 var FLEET_AGENT_CREDENTIAL_ENV_NAMES = FLEET_AGENT_CREDENTIAL_FAMILIES.flatMap(
   (family) => family.envNames
 );
-var FLEET_RUN_ENV_FILE_MAX_CONTENT_BYTES = 32 * 1024;
-var FLEET_RUN_ENV_FILES_MAX_TOTAL_BYTES = 256 * 1024;
-var FLEET_JOB_MAX_PAYLOAD_BYTES = 256 * 1024;
-var FLEET_JOB_MAX_RESULT_BYTES = 256 * 1024;
-var FLEET_JOB_DEFAULT_QUEUED_MAX_AGE_SEC = Object.freeze({
-  "agent-task": 24 * 60 * 60,
-  "acceptance-checks": 2 * 60 * 60,
-  "browser-check": 2 * 60 * 60,
-  // A live view nobody claimed is abandoned by the session service after
-  // 40 seconds, which cancels its job there and then. The queue SLA is only
-  // the backstop behind that, so it deliberately does not undercut the
-  // shortest existing default (the fallback an unknown kind fails closed to).
-  "computer-session": 2 * 60 * 60
-});
-var FLEET_JOB_MAX_QUEUED_MAX_AGE_SEC = 7 * 24 * 60 * 60;
-var FLEET_AGENT_EXECUTION_MAX_INSTRUCTIONS_BYTES = 160 * 1024;
-var FLEET_AGENT_TASK_TIMELINE_MAX_BYTES = 48 * 1024;
-var FLEET_AGENT_TASK_TRANSCRIPT_MAX_BYTES = 64 * 1024;
-var FLEET_AGENT_TASK_QUESTION_MAX_FILE_BYTES = 64 * 1024;
-var FLEET_AGENT_TASK_QUESTION_MAX_CONTEXT_BYTES = 6 * 1024;
+var FLEET_CHECKOUT_LISTED_REFRESH_MS = 5 * 6e4;
+var FLEET_CHECKOUT_RECONCILE_MS = 10 * 6e4;
+var FLEET_CHECKOUT_CREATING_STALE_MS = 10 * 6e4;
+var FLEET_CHECKOUT_BIN_PURGE_AFTER_MS = 30 * 24 * 60 * 6e4;
 var FLEET_LINK_MAX_FRAME_BYTES = 16 * 1024 * 1024;
 var FLEET_LINK_FRAME_HEADER_BYTES = 9;
 var FLEET_LINK_MAX_PAYLOAD_BYTES = FLEET_LINK_MAX_FRAME_BYTES - FLEET_LINK_FRAME_HEADER_BYTES;
@@ -1163,9 +1154,106 @@ var FLEET_LINK_CONTROL_TYPES = [
   "operation.done",
   "operation.cancel"
 ];
+var FLEET_FILES_LIMITS = {
+  /** Largest `DATA` frame of a files stream. */
+  chunkBytes: 64 * 1024,
+  /** Unacknowledged bytes a sender may have in flight (the link's credit window). */
+  windowBytes: 8 * 1024 * 1024,
+  /** Bytes one operation may move. */
+  maxOpBytes: 2 * 1024 * 1024 * 1024,
+  /** Entries one operation may carry, and one listing may show. */
+  maxEntries: 5e3,
+  /** Transfers running at once on one computer. */
+  maxConcurrentPerNode: 2,
+  /** Transfers one person runs at once. */
+  maxConcurrentPerUser: 4
+};
+var FLEET_FILES_MAX_BYTES_RECORD = FLEET_FILES_LIMITS.chunkBytes - 5;
+var FLEET_FILES_TRANSFER_RETENTION_MS = 10 * 6e4;
+var FLEET_FILES_LIST_AUDIT_WINDOW_MS = 15 * 6e4;
+var FLEET_CREDENTIAL_FILE_PATTERNS = [
+  ".env",
+  ".env.*",
+  "*.pem",
+  "*.key",
+  "*.p12",
+  "*.pfx",
+  "*.jks",
+  "*.keystore",
+  "*.kdbx",
+  "id_rsa*",
+  "id_dsa*",
+  "id_ecdsa*",
+  "id_ed25519*",
+  "*.ppk",
+  ".netrc",
+  ".npmrc",
+  ".pypirc",
+  "credentials",
+  "credentials.json",
+  "service-account*.json",
+  ".aws/credentials",
+  "*.gpg",
+  "*.asc",
+  ".docker/config.json",
+  "kubeconfig",
+  ".kube/config"
+];
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i");
+}
+var CREDENTIAL_NAME_MATCHERS = FLEET_CREDENTIAL_FILE_PATTERNS.filter((pattern) => !pattern.includes("/")).map(
+  globToRegExp
+);
+var CREDENTIAL_PATH_MATCHERS = FLEET_CREDENTIAL_FILE_PATTERNS.filter((pattern) => pattern.includes("/")).map(
+  (pattern) => ({ segments: pattern.split("/").length, matcher: globToRegExp(pattern) })
+);
+var MAX_HEADER_JSON_BYTES = 16 * 1024;
+var FLEET_RUN_ENV_FILE_MAX_CONTENT_BYTES = 32 * 1024;
+var FLEET_RUN_ENV_FILES_MAX_TOTAL_BYTES = 256 * 1024;
+var FLEET_JOB_MAX_PAYLOAD_BYTES = 256 * 1024;
+var FLEET_JOB_MAX_RESULT_BYTES = 256 * 1024;
+var FLEET_JOB_DEFAULT_QUEUED_MAX_AGE_SEC = Object.freeze({
+  "agent-task": 24 * 60 * 60,
+  "acceptance-checks": 2 * 60 * 60,
+  "browser-check": 2 * 60 * 60,
+  // A live view nobody claimed is abandoned by the session service after
+  // 40 seconds, which cancels its job there and then. The queue SLA is only
+  // the backstop behind that, so it deliberately does not undercut the
+  // shortest existing default (the fallback an unknown kind fails closed to).
+  "computer-session": 2 * 60 * 60,
+  // An Agent session (FL-04 P2). Like the live view it does not undercut the
+  // shortest existing default (the fallback an unknown kind fails closed to):
+  // the session sweeper ends one still waiting after ten minutes, and this
+  // queue SLA is only the backstop behind it.
+  "agent-session": 2 * 60 * 60,
+  // Virtual computers (FL-16). The plan proposed an hour for a create and ten
+  // minutes for a control; like the live view and the Agent session they do
+  // NOT undercut the shortest existing default (the fallback an unknown kind
+  // fails closed to), so an older reader's "unknown kind" answer is unchanged.
+  // A control the owner no longer wants is cancelled with its child's row.
+  "vm-create": 2 * 60 * 60,
+  "vm-control": 2 * 60 * 60
+});
+var FLEET_JOB_MAX_QUEUED_MAX_AGE_SEC = 7 * 24 * 60 * 60;
+var FLEET_AGENT_EXECUTION_MAX_INSTRUCTIONS_BYTES = 160 * 1024;
+var FLEET_AGENT_TASK_TIMELINE_MAX_BYTES = 48 * 1024;
+var FLEET_AGENT_TASK_TRANSCRIPT_MAX_BYTES = 64 * 1024;
+var FLEET_AGENT_TASK_QUESTION_MAX_FILE_BYTES = 64 * 1024;
+var FLEET_AGENT_TASK_QUESTION_MAX_CONTEXT_BYTES = 6 * 1024;
 var CONTROL_TYPES = new Set(FLEET_LINK_CONTROL_TYPES);
 var KIND_JSON = FLEET_LINK_FRAME_KINDS.JSON;
 var utf8Encoder = new TextEncoder();
+var FLEET_LINK_VIEWER_SLOW_BUFFER_BYTES = 8 * 1024 * 1024;
+var FLEET_LINK_VIEWER_MAX_BUFFER_BYTES = 32 * 1024 * 1024;
+var FLEET_LINK_VIEWER_FRAME_KINDS = [FLEET_LINK_FRAME_KINDS.ACK];
+var FLEET_MACHINE_OPERATION_MAX_MS = 60 * 6e4;
+var FLEET_LOGS_FOLLOW_BYTES_PER_SEC = 1024 * 1024;
+var FLEET_LOGS_PENDING_MAX_BYTES = 1024 * 1024;
+var FLEET_LOGS_MAX_FRAME_BYTES = 64 * 1024;
+var FLEET_LOGS_MAX_LINE_CHARS = 16 * 1024;
+var FLEET_LOGS_FILE_SCAN_MAX_BYTES = 8 * 1024 * 1024;
 var FLEET_MODEL_USAGE_LIMIT_FALLBACK_MS = 60 * 60 * 1e3;
 var FLEET_MODEL_USAGE_LIMIT_MIN_MS = 60 * 1e3;
 var FLEET_MODEL_USAGE_LIMIT_MAX_MS = 8 * 24 * 60 * 60 * 1e3;
@@ -1184,6 +1272,51 @@ var FLEET_HEALTH_DISK_CRITICAL_MARGIN_BYTES = 1024 ** 3;
 var FLEET_HEALTH_MAX_MIB = 2 ** 40;
 var FLEET_HEALTH_MAX_UPTIME_SEC = 100 * 365 * 24 * 60 * 60;
 var FLEET_HEALTH_BYTES_PER_MIB = 1024 * 1024;
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS2 = 24 * HOUR_MS;
+var FLEET_HEALTH_RANGE_MS = {
+  "1h": HOUR_MS,
+  "24h": DAY_MS2,
+  "7d": 7 * DAY_MS2,
+  "90d": 90 * DAY_MS2
+};
+var FLEET_WAKE_RATE_WINDOW_MS = 5 * 6e4;
+var FLEET_PORT_PROBE_BODY_CAP = 64 * 1024;
+var FLEET_PORT_PREVIEW_MAX_MS = 60 * 6e4;
+var FLEET_PORT_TUNNEL_IDLE_MS = 10 * 6e4;
+var FLEET_PORT_TUNNEL_HARD_MS = 60 * 6e4;
+var FLEET_PORT_TUNNEL_CHUNK_BYTES = 64 * 1024;
+var FLEET_PORT_TUNNEL_MAX_HEADER_BYTES = 64 * 1024;
+var FLEET_WELL_KNOWN_PORTS = Object.freeze({
+  21: "ftp",
+  22: "ssh",
+  25: "smtp",
+  53: "dns",
+  110: "pop3",
+  143: "imap",
+  389: "ldap",
+  1433: "mssql",
+  1521: "oracle",
+  2375: "docker",
+  2376: "docker",
+  2379: "etcd",
+  3306: "mysql",
+  3389: "rdp",
+  4222: "nats",
+  5432: "postgres",
+  5672: "amqp",
+  5900: "vnc",
+  6379: "redis",
+  6443: "kubernetes",
+  7687: "neo4j",
+  9042: "cassandra",
+  9092: "kafka",
+  9200: "elasticsearch",
+  11211: "memcached",
+  15672: "rabbitmq",
+  27017: "mongo"
+});
 var FLEET_RUN_TOKEN_ROUTES = Object.freeze([
   // Works — reads, plus the settings update (its merge / check / command
   // fields are refused for run tokens by the Works controller).
@@ -1267,6 +1400,12 @@ var FLEET_RUN_TOKEN_ROUTES = Object.freeze([
   { method: "GET", pathPattern: "/api/fleet/runner-status" },
   { method: "GET", pathPattern: "/api/fleet/execution-preferences" },
   { method: "GET", pathPattern: "/api/fleet/agents/{agentId}/node-affinity" },
+  // Session git & actions (FL-06 FR-18): an Agent session asks the platform to
+  // open or update the pull request of ITS OWN checkout. The route refuses a
+  // checkout that is not the token's session's, and the Agent's "may open pull
+  // requests" permission applies; it never merges anything.
+  { method: "GET", pathPattern: "/api/fleet/checkouts/{id}/pull-request" },
+  { method: "POST", pathPattern: "/api/fleet/checkouts/{id}/pull-request" },
   // Agents — reads, plus cancel and pause (the safe direction).
   { method: "GET", pathPattern: "/api/agents" },
   { method: "GET", pathPattern: "/api/agents/{id}" },
@@ -1289,6 +1428,783 @@ var FLEET_RUN_TOKEN_ROUTE_SHAPES = FLEET_RUN_TOKEN_ROUTES.map((route) => ({
   method: route.method.toUpperCase(),
   shape: splitSegments(route.pathPattern).map((part) => /^\{[^}]+\}$/.test(part) ? "*" : part.toLowerCase())
 }));
+var FLEET_SESSION_STATES = ["starting", "working", "needs_you", "done", "idle", "ended"];
+var FLEET_SESSION_LIVE_STATES = FLEET_SESSION_STATES.filter(
+  (state) => state !== "ended"
+);
+var FLEET_SESSION_SLOW_VIEWER_BYTES = 1024 * 1024;
+var FLEET_SESSION_DAEMON_IDLE_EXIT_MS = 5 * 6e4;
+var FLEET_SESSION_LAST_SCREEN_MAX_CHARS = 256 * 1024;
+var FLEET_AGENT_SESSION_QUEUED_TIMEOUT_MS = 10 * 6e4;
+var FLEET_PR_ENRICHMENT_RECENT_MS = 7 * 24 * 60 * 6e4;
+var FLEET_GIT_LINE_STALE_MS = 5 * 6e4;
+var FLEET_SESSION_IDLE_AFTER_MS = 30 * 6e4;
+var FLEET_SESSION_DECISION_STALE_MS = 24 * 60 * 6e4;
+var FLEET_SESSION_HOOK_BODY_MAX_BYTES = 64 * 1024;
+var FLEET_SESSION_HOOK_SPOOL_MAX_BYTES = 5 * 1024 * 1024;
+var FLEET_SESSION_HOOK_SPOOL_MAX_AGE_MS = 7 * 24 * 60 * 6e4;
+var FLEET_COMMAND_MAX_OUTPUT_BYTES = 10 * 1024 * 1024;
+var FLEET_COMMAND_STORED_EDGE_BYTES = 64 * 1024;
+var FLEET_COMMAND_DATA_CHUNK_BYTES = 64 * 1024;
+var FLEET_COMMAND_MAX_LENGTH = 8 * 1024;
+var FLEET_SCHEDULE_PROMPT_MAX_BYTES = 16 * 1024;
+var FLEET_SCHEDULE_BREAKER_UNDO_MS = 15 * 6e4;
+var MAX_SEARCH_DAYS = 366 * 8 + 1;
+function row(input) {
+  const rest = input.name.slice("fleet_".length);
+  const cut = rest.indexOf("_");
+  const family = cut === -1 ? rest : rest.slice(0, cut);
+  const verb = cut === -1 ? "" : rest.slice(cut + 1);
+  return Object.freeze({ ...input, family, verb });
+}
+function read(name, permissionFamily, owner, flag, status, extra = {}) {
+  return row({
+    name,
+    readOnly: true,
+    category: "read.internal",
+    permissionFamily,
+    owner,
+    phase: "P1",
+    flag,
+    status,
+    ...extra
+  });
+}
+function act(name, permissionFamily, owner, flag, status, annotation, extra = {}) {
+  return row({ name, permissionFamily, owner, phase: "P2", flag, status, ...annotation, ...extra });
+}
+var plain = (category, destructive = false) => ({
+  destructive,
+  confirmationClass: "plain",
+  category
+});
+var confirm = (category, destructive = true) => ({
+  destructive,
+  confirmationClass: "confirm",
+  category
+});
+var typed = (category) => ({
+  destructive: true,
+  confirmationClass: "confirm-destructive",
+  category
+});
+var GET = (path) => ({ method: "GET", path });
+var POST = (path) => ({ method: "POST", path });
+var PATCH = (path) => ({ method: "PATCH", path });
+var DELETE = (path) => ({ method: "DELETE", path });
+var FLEET_TOOL_CATALOGUE = Object.freeze([
+  // ── status (FL-19) ──
+  read("fleet_status", "view", "FL-19", "FLEET_ENABLED", "live", {
+    route: GET("/api/fleet/status"),
+    cli: "fleet status"
+  }),
+  // ── nodes (FL-19, FL-03, FL-15) ──
+  read("fleet_nodes_list", "view", "FL-19", "FLEET_ENABLED", "live", {
+    route: GET("/api/fleet/nodes"),
+    cli: "fleet nodes list"
+  }),
+  read("fleet_nodes_get", "view", "FL-19", "FLEET_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}"),
+    cli: "fleet nodes get"
+  }),
+  read("fleet_nodes_health", "view", "FL-03", "FLEET_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/health"),
+    cli: "fleet nodes health"
+  }),
+  read("fleet_nodes_needs_a_look", "view", "FL-03", "FLEET_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/needs-a-look"),
+    cli: "fleet nodes needs-a-look"
+  }),
+  read("fleet_nodes_git_identity_get", "view", "FL-15", "FLEET_CHECKOUTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/git/identity"),
+    cli: "fleet nodes git-identity"
+  }),
+  act("fleet_nodes_wake", "machines", "FL-03", "FLEET_ENABLED", "live", plain("machine.admin"), {
+    route: POST("/api/fleet/nodes/{id}/wake"),
+    cli: "fleet nodes wake"
+  }),
+  act(
+    "fleet_nodes_git_identity_set",
+    "commands",
+    "FL-15",
+    "FLEET_CHECKOUTS_ENABLED",
+    "live",
+    confirm("machine.admin", false),
+    { route: POST("/api/fleet/nodes/{id}/git/identity"), cli: "fleet nodes git-identity --set" }
+  ),
+  // ── sessions (FL-04, FL-05, FL-06) ──
+  read("fleet_sessions_list", "sessions", "FL-04", "FLEET_SESSIONS_ENABLED", "live", {
+    route: GET("/api/fleet/sessions"),
+    cli: "fleet sessions list"
+  }),
+  read("fleet_sessions_read", "sessions", "FL-04", "FLEET_SESSIONS_ENABLED", "live", {
+    route: GET("/api/fleet/sessions/{id}"),
+    cli: "fleet sessions read"
+  }),
+  read("fleet_sessions_question", "sessions", "FL-05", "FLEET_SESSIONS_ENABLED", "live", {
+    route: GET("/api/fleet/sessions/{id}"),
+    cli: "fleet sessions question"
+  }),
+  read("fleet_sessions_actions_list", "sessions", "FL-06", "FLEET_SESSIONS_ENABLED", "planned", {
+    route: GET("/api/fleet/sessions/{id}/actions"),
+    cli: "fleet sessions actions"
+  }),
+  act("fleet_sessions_start", "sessions", "FL-04", "FLEET_SESSIONS_ENABLED", "live", plain("machine.run"), {
+    route: POST("/api/fleet/nodes/{id}/sessions"),
+    cli: "fleet sessions start"
+  }),
+  act("fleet_sessions_send", "sessions", "FL-04", "FLEET_SESSIONS_ENABLED", "live", plain("machine.run")),
+  act("fleet_sessions_answer", "sessions", "FL-05", "FLEET_SESSIONS_ENABLED", "live", confirm("machine.run", false), {
+    route: POST("/api/fleet/sessions/{id}/answer"),
+    cli: "fleet sessions answer",
+    confirmationNote: "questions only; a permission prompt is answered by a person (CONTRACTS R-32)"
+  }),
+  act("fleet_sessions_rename", "sessions", "FL-04", "FLEET_SESSIONS_ENABLED", "live", plain("write.internal"), {
+    route: PATCH("/api/fleet/sessions/{id}"),
+    cli: "fleet sessions rename"
+  }),
+  act("fleet_sessions_end", "sessions", "FL-04", "FLEET_SESSIONS_ENABLED", "live", confirm("machine.run"), {
+    route: POST("/api/fleet/sessions/{id}/end"),
+    cli: "fleet sessions end"
+  }),
+  act("fleet_sessions_action", "sessions", "FL-06", "FLEET_SESSIONS_ENABLED", "planned", plain("machine.run"), {
+    route: POST("/api/fleet/sessions/{id}/actions"),
+    cli: "fleet sessions action"
+  }),
+  // ── desktop (FL-07, FL-11 paste) ──
+  read("fleet_desktop_screenshot", "desktop", "FL-07", "FLEET_DESKTOP_ENABLED", "planned", {
+    route: GET("/api/fleet/nodes/{id}/desktop/screenshot"),
+    cli: "fleet desktop screenshot"
+  }),
+  read("fleet_desktop_displays", "desktop", "FL-07", "FLEET_DESKTOP_ENABLED", "planned", {
+    route: GET("/api/fleet/nodes/{id}/desktop/displays"),
+    cli: "fleet desktop displays"
+  }),
+  read("fleet_desktop_recordings_list", "desktop", "FL-07", "FLEET_DESKTOP_ENABLED", "planned", {
+    route: GET("/api/fleet/nodes/{id}/desktop/recordings"),
+    cli: "fleet desktop recordings"
+  }),
+  act("fleet_desktop_input", "desktop", "FL-07", "FLEET_DESKTOP_ENABLED", "planned", plain("machine.admin", true), {
+    route: POST("/api/fleet/nodes/{id}/desktop/input"),
+    cli: "fleet desktop input"
+  }),
+  act("fleet_desktop_set_display", "desktop", "FL-07", "FLEET_DESKTOP_ENABLED", "planned", plain("machine.admin"), {
+    route: POST("/api/fleet/nodes/{id}/desktop/displays"),
+    cli: "fleet desktop set-display"
+  }),
+  act("fleet_desktop_display_add", "desktop", "FL-07", "FLEET_DESKTOP_ENABLED", "planned", confirm("machine.admin"), {
+    phase: "P3",
+    route: POST("/api/fleet/nodes/{id}/desktop/displays/virtual"),
+    cli: "fleet desktop display-add"
+  }),
+  act(
+    "fleet_desktop_display_remove",
+    "desktop",
+    "FL-07",
+    "FLEET_DESKTOP_ENABLED",
+    "planned",
+    confirm("machine.admin"),
+    {
+      phase: "P3",
+      route: DELETE("/api/fleet/nodes/{id}/desktop/displays/virtual/{displayId}"),
+      cli: "fleet desktop display-remove"
+    }
+  ),
+  act(
+    "fleet_desktop_paste",
+    "desktop",
+    "FL-11",
+    "FLEET_MACHINE_FACTS_ENABLED",
+    "planned",
+    plain("machine.admin", true),
+    {
+      route: POST("/api/fleet/nodes/{id}/desktop/paste"),
+      cli: "fleet desktop paste",
+      confirmationNote: "denied unless a tool grant allows it (AW-15)"
+    }
+  ),
+  // ── logs (FL-08) ──
+  read("fleet_logs_sources", "logs", "FL-08", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/logs/sources"),
+    cli: "fleet logs sources"
+  }),
+  read("fleet_logs_read", "logs", "FL-08", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: POST("/api/fleet/nodes/{id}/logs/read"),
+    cli: "fleet logs read"
+  }),
+  // ── services (FL-09) ──
+  read("fleet_services_list", "services", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/services"),
+    cli: "fleet services list"
+  }),
+  act("fleet_services_action", "services", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "live", confirm("machine.admin"), {
+    route: POST("/api/fleet/nodes/{id}/services/{name}/{action}"),
+    cli: "fleet services action",
+    waitable: true,
+    confirmationNote: "confirm; blast-radius when the node warns it could cut the machine off"
+  }),
+  // ── processes (FL-09) ──
+  read("fleet_processes_list", "processes", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/processes"),
+    cli: "fleet processes list"
+  }),
+  act(
+    "fleet_processes_signal",
+    "processes",
+    "FL-09",
+    "FLEET_MACHINE_FACTS_ENABLED",
+    "live",
+    confirm("machine.admin"),
+    { route: POST("/api/fleet/nodes/{id}/processes/{pid}/signal"), cli: "fleet processes signal" }
+  ),
+  // ── docker (FL-09) ──
+  read("fleet_docker_containers_list", "docker", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/docker/containers"),
+    cli: "fleet docker containers"
+  }),
+  read("fleet_docker_images_list", "docker", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/docker/images"),
+    cli: "fleet docker images"
+  }),
+  read("fleet_docker_compose_list", "docker", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/docker/compose"),
+    cli: "fleet docker compose"
+  }),
+  read("fleet_docker_compose_describe", "docker", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    cli: "fleet docker compose-describe"
+  }),
+  act(
+    "fleet_docker_container_action",
+    "docker",
+    "FL-09",
+    "FLEET_MACHINE_FACTS_ENABLED",
+    "live",
+    confirm("machine.admin"),
+    {
+      route: POST("/api/fleet/nodes/{id}/docker/containers/{cid}/{action}"),
+      cli: "fleet docker container",
+      waitable: true,
+      confirmationNote: "confirm; remove is confirm-destructive"
+    }
+  ),
+  act("fleet_docker_run", "docker", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "live", confirm("machine.admin", false), {
+    route: POST("/api/fleet/nodes/{id}/docker/containers"),
+    cli: "fleet docker run",
+    waitable: true,
+    alwaysHeld: true,
+    confirmationNote: "an Agent proposes a run; a person types any secret values"
+  }),
+  act(
+    "fleet_docker_image_action",
+    "docker",
+    "FL-09",
+    "FLEET_MACHINE_FACTS_ENABLED",
+    "live",
+    confirm("machine.admin"),
+    {
+      route: POST("/api/fleet/nodes/{id}/docker/images/{iid}/{action}"),
+      cli: "fleet docker image",
+      waitable: true,
+      confirmationNote: "pull is plain and not destructive; remove and prune confirm"
+    }
+  ),
+  act(
+    "fleet_docker_compose_action",
+    "docker",
+    "FL-09",
+    "FLEET_MACHINE_FACTS_ENABLED",
+    "live",
+    confirm("machine.admin"),
+    {
+      route: POST("/api/fleet/nodes/{id}/docker/compose/{project}/{action}"),
+      cli: "fleet docker compose-action",
+      waitable: true,
+      confirmationNote: "destructive for down"
+    }
+  ),
+  act("fleet_docker_exec", "docker", "FL-09", "FLEET_MACHINE_FACTS_ENABLED", "planned", plain("machine.run"), {
+    phase: "P3",
+    cli: "fleet docker exec"
+  }),
+  // ── ports (FL-10) ──
+  read("fleet_ports_list", "view", "FL-10", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/ports"),
+    cli: "fleet ports list"
+  }),
+  act("fleet_ports_open", "ports", "FL-10", "FLEET_MACHINE_FACTS_ENABLED", "live", plain("machine.run"), {
+    route: POST("/api/fleet/nodes/{id}/ports/{port}/open"),
+    cli: "fleet ports open"
+  }),
+  act("fleet_ports_preview_open", "ports", "FL-10", "FLEET_PORT_TUNNEL_ENABLED", "live", plain("machine.run"), {
+    route: POST("/api/fleet/nodes/{id}/ports/{port}/preview"),
+    cli: "fleet ports preview"
+  }),
+  act("fleet_ports_preview_close", "ports", "FL-10", "FLEET_PORT_TUNNEL_ENABLED", "live", plain("machine.run"), {
+    route: DELETE("/api/fleet/nodes/{id}/ports/{port}/preview"),
+    cli: "fleet ports preview-close"
+  }),
+  // ── files (FL-11) ──
+  // P1 (FL-11 lane log decision 15): the roots read joins the family, and the list's route is the
+  // one FL-11 built (`…/files/list` — `…/files` is the family's prefix, not a route).
+  read("fleet_files_roots", "files", "FL-11", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/files/roots"),
+    cli: "fleet files roots"
+  }),
+  read("fleet_files_list", "files", "FL-11", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/files/list"),
+    cli: "fleet files list"
+  }),
+  read("fleet_files_stat", "files", "FL-11", "FLEET_MACHINE_FACTS_ENABLED", "live", {
+    route: GET("/api/fleet/nodes/{id}/files/stat"),
+    cli: "fleet files stat"
+  }),
+  read("fleet_files_read", "files", "FL-11", "FLEET_MACHINE_FACTS_ENABLED", "planned", {
+    route: GET("/api/fleet/nodes/{id}/files/download"),
+    cli: "fleet files get"
+  }),
+  act("fleet_files_write", "files", "FL-11", "FLEET_MACHINE_FACTS_ENABLED", "planned", confirm("machine.admin"), {
+    route: POST("/api/fleet/nodes/{id}/files/upload"),
+    cli: "fleet files put"
+  }),
+  act("fleet_files_copy", "files", "FL-11", "FLEET_MACHINE_FACTS_ENABLED", "live", confirm("machine.admin"), {
+    route: POST("/api/fleet/nodes/{id}/files/copy"),
+    cli: "fleet files cp",
+    // FL-11 P2 (lane log decision 18): an Agent's copy is held for a person, like its delete.
+    alwaysHeld: true
+  }),
+  act("fleet_files_delete", "files", "FL-11", "FLEET_MACHINE_FACTS_ENABLED", "live", typed("write.destructive"), {
+    route: POST("/api/fleet/nodes/{id}/files/delete"),
+    cli: "fleet files rm",
+    alwaysHeld: true
+  }),
+  // ── commands (FL-12) ──
+  read("fleet_commands_list", "commands", "FL-12", "FLEET_COMMANDS_ENABLED", "live", {
+    route: GET("/api/fleet/commands"),
+    cli: "fleet commands list"
+  }),
+  read("fleet_commands_get", "commands", "FL-12", "FLEET_COMMANDS_ENABLED", "live", {
+    route: GET("/api/fleet/commands/{id}"),
+    cli: "fleet commands get"
+  }),
+  act("fleet_commands_run", "commands", "FL-12", "FLEET_COMMANDS_ENABLED", "live", confirm("machine.run"), {
+    route: POST("/api/fleet/commands"),
+    cli: "fleet commands run",
+    alwaysHeld: true
+  }),
+  act("fleet_commands_cancel", "commands", "FL-12", "FLEET_COMMANDS_ENABLED", "live", plain("machine.run"), {
+    route: POST("/api/fleet/commands/{id}/cancel"),
+    cli: "fleet commands cancel"
+  }),
+  // ── schedules (FL-13 P2: live — `apps/api/src/fleet/schedules/fleet-schedules.controller.ts`) ──
+  read("fleet_schedules_list", "schedules", "FL-13", "FLEET_COMMANDS_ENABLED", "live", {
+    route: GET("/api/fleet/schedules"),
+    cli: "fleet schedules list"
+  }),
+  read("fleet_schedules_get", "schedules", "FL-13", "FLEET_COMMANDS_ENABLED", "live", {
+    route: GET("/api/fleet/schedules/{id}"),
+    cli: "fleet schedules get"
+  }),
+  read("fleet_schedules_runs", "schedules", "FL-13", "FLEET_COMMANDS_ENABLED", "live", {
+    route: GET("/api/fleet/schedules/{id}/runs"),
+    cli: "fleet schedules runs"
+  }),
+  act("fleet_schedules_create", "schedules", "FL-13", "FLEET_COMMANDS_ENABLED", "live", confirm("agent.fanout"), {
+    route: POST("/api/fleet/schedules"),
+    cli: "fleet schedules create"
+  }),
+  act("fleet_schedules_update", "schedules", "FL-13", "FLEET_COMMANDS_ENABLED", "live", confirm("agent.fanout"), {
+    route: PATCH("/api/fleet/schedules/{id}"),
+    cli: "fleet schedules update"
+  }),
+  act(
+    "fleet_schedules_delete",
+    "schedules",
+    "FL-13",
+    "FLEET_COMMANDS_ENABLED",
+    "live",
+    confirm("write.destructive"),
+    { route: DELETE("/api/fleet/schedules/{id}"), cli: "fleet schedules delete" }
+  ),
+  act("fleet_schedules_run", "schedules", "FL-13", "FLEET_COMMANDS_ENABLED", "live", confirm("machine.run"), {
+    route: POST("/api/fleet/schedules/{id}/run"),
+    cli: "fleet schedules run"
+  }),
+  act("fleet_schedules_pause", "schedules", "FL-13", "FLEET_COMMANDS_ENABLED", "live", plain("agent.fanout"), {
+    route: POST("/api/fleet/schedules/{id}/pause"),
+    cli: "fleet schedules pause"
+  }),
+  act("fleet_schedules_resume", "schedules", "FL-13", "FLEET_COMMANDS_ENABLED", "live", plain("agent.fanout"), {
+    route: POST("/api/fleet/schedules/{id}/resume"),
+    cli: "fleet schedules resume"
+  }),
+  // ── checkouts (FL-14, FL-06) ──
+  read("fleet_checkouts_list", "checkouts", "FL-14", "FLEET_CHECKOUTS_ENABLED", "live", {
+    route: GET("/api/fleet/checkouts"),
+    cli: "fleet checkouts list"
+  }),
+  read("fleet_checkouts_get", "checkouts", "FL-14", "FLEET_CHECKOUTS_ENABLED", "live", {
+    route: GET("/api/fleet/checkouts/{id}"),
+    cli: "fleet checkouts get"
+  }),
+  read("fleet_checkouts_changes", "checkouts", "FL-06", "FLEET_CHECKOUTS_ENABLED", "planned", {
+    route: GET("/api/fleet/checkouts/{id}/changes"),
+    cli: "fleet checkouts changes"
+  }),
+  act("fleet_checkouts_create", "checkouts", "FL-14", "FLEET_CHECKOUTS_ENABLED", "live", plain("machine.run"), {
+    route: POST("/api/fleet/checkouts"),
+    cli: "fleet checkouts create",
+    waitable: true
+  }),
+  act("fleet_checkouts_sync", "checkouts", "FL-14", "FLEET_CHECKOUTS_ENABLED", "live", plain("machine.run"), {
+    route: POST("/api/fleet/checkouts/{id}/sync"),
+    cli: "fleet checkouts sync",
+    waitable: true,
+    confirmationNote: "plain for fetch; confirm for pull and push"
+  }),
+  act(
+    "fleet_checkouts_archive",
+    "checkouts",
+    "FL-14",
+    "FLEET_CHECKOUTS_ENABLED",
+    "live",
+    confirm("machine.run", false),
+    { route: POST("/api/fleet/checkouts/{id}/archive"), cli: "fleet checkouts archive" }
+  ),
+  act(
+    "fleet_checkouts_delete",
+    "checkouts",
+    "FL-14",
+    "FLEET_CHECKOUTS_ENABLED",
+    "live",
+    confirm("write.destructive"),
+    {
+      route: DELETE("/api/fleet/checkouts/{id}"),
+      cli: "fleet checkouts delete",
+      confirmationNote: "confirm; confirm-destructive when it has uncommitted changes"
+    }
+  ),
+  act(
+    "fleet_checkouts_open_pull_request",
+    "checkouts",
+    "FL-06",
+    "FLEET_CHECKOUTS_ENABLED",
+    "planned",
+    plain("publish.external"),
+    { route: POST("/api/fleet/checkouts/{id}/pull-request"), cli: "fleet checkouts pull-request" }
+  ),
+  // ── tasks (FL-15) ── the hand-off itself is `fleet_sessions_start` with `taskId`
+  read("fleet_tasks_handoff_options", "sessions", "FL-15", "FLEET_CHECKOUTS_ENABLED", "live", {
+    route: GET("/api/fleet/tasks/{taskId}/handoff-options"),
+    cli: "fleet tasks handoff-options"
+  }),
+  // ── virtual (FL-16) ── P1 shipped: Containers. A create, a stop and a destroy are held for
+  // the owner's approval by the Agent tools (`agent-fleet-virtual-tools.ts`).
+  read("fleet_virtual_list", "view", "FL-16", "FLEET_VIRTUAL_ENABLED", "live", {
+    phase: "P3",
+    route: GET("/api/fleet/nodes/{id}/virtual"),
+    cli: "fleet virtual list"
+  }),
+  read("fleet_virtual_options", "view", "FL-16", "FLEET_VIRTUAL_ENABLED", "live", {
+    phase: "P3",
+    route: GET("/api/fleet/nodes/{id}/virtual/options"),
+    cli: "fleet virtual options"
+  }),
+  act("fleet_virtual_create", "machines", "FL-16", "FLEET_VIRTUAL_ENABLED", "live", confirm("machine.admin"), {
+    phase: "P3",
+    route: POST("/api/fleet/nodes/{id}/virtual"),
+    cli: "fleet virtual create",
+    waitable: true,
+    alwaysHeld: true
+  }),
+  act("fleet_virtual_power", "machines", "FL-16", "FLEET_VIRTUAL_ENABLED", "live", confirm("machine.admin"), {
+    phase: "P3",
+    route: POST("/api/fleet/nodes/{id}/virtual/{childId}/power"),
+    cli: "fleet virtual power",
+    waitable: true,
+    confirmationNote: "plain to start; confirm to stop (an Agent's stop is held for the owner)"
+  }),
+  act("fleet_virtual_destroy", "machines", "FL-16", "FLEET_VIRTUAL_ENABLED", "live", typed("write.destructive"), {
+    phase: "P3",
+    route: POST("/api/fleet/nodes/{id}/virtual/{childId}/destroy"),
+    cli: "fleet virtual destroy",
+    waitable: true,
+    alwaysHeld: true
+  }),
+  // ── cloud (FL-17) ── P1 shipped: providers, create, power, destroy, usage. A create, a power
+  // change and a destroy are held for the owner's approval by the Agent tools
+  // (`agent-fleet-cloud-tools.ts`); the idle policy arrives with P2.
+  read("fleet_cloud_list", "view", "FL-17", "FLEET_CLOUD_ENABLED", "live", {
+    phase: "P3",
+    route: GET("/api/fleet/cloud"),
+    cli: "fleet cloud list"
+  }),
+  read("fleet_cloud_options", "view", "FL-17", "FLEET_CLOUD_ENABLED", "live", {
+    phase: "P3",
+    route: GET("/api/fleet/providers/{plugin}/options"),
+    cli: "fleet cloud options"
+  }),
+  read("fleet_cloud_usage", "view", "FL-17", "FLEET_CLOUD_ENABLED", "live", {
+    phase: "P3",
+    route: GET("/api/fleet/cloud/usage"),
+    cli: "fleet cloud usage"
+  }),
+  act("fleet_cloud_create", "machines", "FL-17", "FLEET_CLOUD_ENABLED", "live", confirm("spend.metered"), {
+    phase: "P3",
+    route: POST("/api/fleet/cloud"),
+    cli: "fleet cloud create",
+    waitable: true,
+    alwaysHeld: true,
+    confirmationNote: "confirm with the price (acknowledgedPriceCents); also machine.admin"
+  }),
+  act("fleet_cloud_power", "machines", "FL-17", "FLEET_CLOUD_ENABLED", "live", confirm("machine.admin"), {
+    phase: "P3",
+    route: POST("/api/fleet/cloud/{id}/power"),
+    cli: "fleet cloud power",
+    waitable: true,
+    alwaysHeld: true
+  }),
+  act("fleet_cloud_destroy", "machines", "FL-17", "FLEET_CLOUD_ENABLED", "live", typed("write.destructive"), {
+    phase: "P3",
+    // FL-17 plan §5 — `DELETE /api/fleet/cloud/{id}` answers the same (an alias).
+    route: POST("/api/fleet/cloud/{id}/destroy"),
+    cli: "fleet cloud destroy",
+    waitable: true,
+    alwaysHeld: true
+  }),
+  act("fleet_cloud_idle_policy", "machines", "FL-17", "FLEET_CLOUD_ENABLED", "planned", plain("machine.admin"), {
+    phase: "P3",
+    route: PATCH("/api/fleet/cloud/{id}/idle-policy"),
+    cli: "fleet cloud idle-policy"
+  }),
+  // ── runners (FL-18) ──
+  read("fleet_runners_list", "view", "FL-18", "FLEET_ACTIONS_RUNNERS_ENABLED", "planned", {
+    phase: "P3",
+    route: GET("/api/fleet/nodes/{id}/runners"),
+    cli: "fleet runners list"
+  }),
+  read("fleet_runners_jobs", "view", "FL-18", "FLEET_ACTIONS_RUNNERS_ENABLED", "planned", {
+    phase: "P3",
+    route: GET("/api/fleet/runners/jobs"),
+    cli: "fleet runners jobs"
+  }),
+  act(
+    "fleet_runners_install",
+    "machines",
+    "FL-18",
+    "FLEET_ACTIONS_RUNNERS_ENABLED",
+    "planned",
+    confirm("machine.admin"),
+    { phase: "P3", route: POST("/api/fleet/nodes/{id}/runners"), cli: "fleet runners install", waitable: true }
+  ),
+  act(
+    "fleet_runners_action",
+    "machines",
+    "FL-18",
+    "FLEET_ACTIONS_RUNNERS_ENABLED",
+    "planned",
+    confirm("machine.admin"),
+    {
+      phase: "P3",
+      route: POST("/api/fleet/nodes/{id}/runners/{runnerId}/{action}"),
+      cli: "fleet runners action",
+      waitable: true,
+      confirmationNote: "plain to start; confirm to stop and restart"
+    }
+  ),
+  act(
+    "fleet_runners_remove",
+    "machines",
+    "FL-18",
+    "FLEET_ACTIONS_RUNNERS_ENABLED",
+    "planned",
+    typed("write.destructive"),
+    { phase: "P3", route: DELETE("/api/fleet/nodes/{id}/runners/{runnerId}"), cli: "fleet runners remove" }
+  ),
+  act(
+    "fleet_runners_cancel_run",
+    "machines",
+    "FL-18",
+    "FLEET_ACTIONS_RUNNERS_ENABLED",
+    "planned",
+    confirm("machine.admin"),
+    { phase: "P3", route: POST("/api/fleet/runners/jobs/{jobId}/cancel"), cli: "fleet runners cancel-run" }
+  ),
+  // ── usage (FL-20) ──
+  read("fleet_usage_get", "view", "FL-20", "FLEET_USAGE_SCAN_ENABLED", "planned", {
+    route: GET("/api/fleet/usage"),
+    cli: "fleet usage"
+  }),
+  // ── operations (FL-02, FL-19) ──
+  read("fleet_operations_get", "view", "FL-02", "FLEET_NODE_LINK_ENABLED", "live", {
+    route: GET("/api/fleet/operations/{id}"),
+    cli: "fleet operations get"
+  }),
+  read("fleet_operations_list", "view", "FL-19", "FLEET_NODE_LINK_ENABLED", "live", {
+    route: GET("/api/fleet/operations"),
+    cli: "fleet operations list"
+  }),
+  act("fleet_operations_cancel", "view", "FL-02", "FLEET_NODE_LINK_ENABLED", "live", plain("machine.run"), {
+    route: DELETE("/api/fleet/operations/{id}"),
+    cli: "fleet operations cancel"
+  })
+]);
+var BY_NAME = new Map(
+  FLEET_TOOL_CATALOGUE.map((entry) => [entry.name, entry])
+);
+var FLEET_TOOL_COPY = Object.freeze({
+  noCredential: (agent) => `Tools never carry a credential. ${agent} acts through the platform; the platform asks the computer.`,
+  rungOff: (category, agent) => `'${category}' is Off for ${agent} \u2014 raise it on ${agent}'s Safety tab`,
+  grantDenied: (tool, scope) => `${tool} is denied by a tool grant at ${scope} scope`,
+  audience: (computer, audience, family) => `ask the owner of ${computer} to allow ${audience}: ${family}`,
+  confirm: () => "call again with confirm: true",
+  confirmName: (name) => `type the exact name: ${name}`,
+  acknowledge: () => "call again with confirm: true and acknowledgeBlastRadius: true",
+  killSwitch: () => "clear it under Settings \u2192 Fleet",
+  permissionPromptHuman: () => "permission prompts are answered by people"
+});
+var FLEET_TOOL_CATEGORY_LABELS = Object.freeze({
+  "read.internal": "Read inside the workspace",
+  "write.internal": "Change things inside the workspace",
+  "write.destructive": "Delete things",
+  "publish.external": "Publish outside the workspace",
+  "spend.metered": "Spend credits",
+  "machine.run": "Run commands on a computer",
+  "machine.admin": "Change a computer",
+  "agent.fanout": "Hire agents and set schedules"
+});
+var FLEET_HELD_ACTION_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var FLEET_TOOL_FAMILY_CONSENT = Object.freeze({
+  view: null,
+  sessions: "work",
+  desktop: "attend",
+  logs: "manage",
+  services: "manage",
+  docker: "manage",
+  processes: "manage",
+  ports: "manage",
+  files: "manage",
+  commands: "manage",
+  schedules: "manage",
+  checkouts: "manage",
+  machines: "manage"
+});
+var FLEET_CLI_EXIT = Object.freeze({ ok: 0, failed: 1, usage: 2, timeout: 124 });
+var FLEET_TOOL_FORBIDDEN_PATH_PREFIXES = Object.freeze([
+  "/api/fleet/enroll",
+  "/api/fleet/heartbeat",
+  "/api/fleet/jobs",
+  "/api/fleet/rotate-credential",
+  "/api/fleet/link-token",
+  "/api/fleet/nodes/enrollment-token",
+  "/api/fleet/enrollment-tokens",
+  "/api/internal/fleet"
+]);
+var FLEET_TOOL_FORBIDDEN_PATH_FRAGMENTS = Object.freeze([
+  "/attach-token",
+  "/credential",
+  "/rotate-credential"
+]);
+var FLEET_VIRTUAL_SYSTEMS = [
+  {
+    id: "windows-11",
+    kind: "vm",
+    label: "Windows 11",
+    family: "windows",
+    arch: ["x64"],
+    windowsEdition: "11",
+    approxDiskGiB: 64,
+    approxDownloadGiB: 6
+  },
+  {
+    id: "windows-10",
+    kind: "vm",
+    label: "Windows 10",
+    family: "windows",
+    arch: ["x64"],
+    windowsEdition: "10",
+    approxDiskGiB: 64,
+    approxDownloadGiB: 6
+  },
+  {
+    id: "windows-server-2025",
+    kind: "vm",
+    label: "Windows Server 2025",
+    family: "windows",
+    arch: ["x64"],
+    windowsEdition: "2025",
+    approxDiskGiB: 64,
+    approxDownloadGiB: 6
+  },
+  {
+    id: "windows-server-2022",
+    kind: "vm",
+    label: "Windows Server 2022",
+    family: "windows",
+    arch: ["x64"],
+    windowsEdition: "2022",
+    approxDiskGiB: 64,
+    approxDownloadGiB: 6
+  },
+  {
+    id: "ubuntu-26.04",
+    kind: "container",
+    label: "Ubuntu 26.04",
+    family: "ubuntu",
+    arch: ["x64", "arm64"],
+    approxDiskGiB: 3,
+    approxDownloadGiB: 0.5
+  },
+  {
+    id: "ubuntu-24.04",
+    kind: "container",
+    label: "Ubuntu 24.04",
+    family: "ubuntu",
+    arch: ["x64", "arm64"],
+    approxDiskGiB: 3,
+    approxDownloadGiB: 0.5
+  },
+  {
+    id: "debian-13",
+    kind: "container",
+    label: "Debian 13",
+    family: "debian",
+    arch: ["x64", "arm64"],
+    approxDiskGiB: 3,
+    approxDownloadGiB: 0.5
+  },
+  {
+    id: "fedora",
+    kind: "container",
+    label: "Fedora",
+    family: "fedora",
+    arch: ["x64", "arm64"],
+    approxDiskGiB: 3,
+    approxDownloadGiB: 0.6
+  },
+  {
+    id: "alpine",
+    kind: "container",
+    label: "Alpine",
+    family: "alpine",
+    arch: ["x64", "arm64"],
+    approxDiskGiB: 1,
+    approxDownloadGiB: 0.2
+  },
+  {
+    // Arch Linux publishes no official arm64 image (FR-6).
+    id: "arch",
+    kind: "container",
+    label: "Arch Linux",
+    family: "arch",
+    arch: ["x64"],
+    approxDiskGiB: 3,
+    approxDownloadGiB: 0.7
+  }
+];
+var FLEET_VIRTUAL_SYSTEM_IDS = FLEET_VIRTUAL_SYSTEMS.map((system) => system.id);
+var FLEET_VIRTUAL_ENROLL_TIMEOUT_MS = 20 * 60 * 1e3;
+var FLEET_CLOUD_OPTIONS_CACHE_MS = 10 * 60 * 1e3;
+var HOUR_MS2 = 60 * 60 * 1e3;
 var EMAIL_INBOX_DEFAULT_DAILY_CAP = 100;
 var EMAIL_INBOX_BURST_SENDS = 10;
 var EMAIL_INBOX_BURST_RECIPIENTS = 20;
@@ -1317,7 +2233,7 @@ var EMAIL_SEND_CAP_FIELDS = [
   "workspaceMonthlySends"
 ];
 var INBOX_CAP_FIELD_SET = new Set(EMAIL_INBOX_CAP_FIELDS);
-var DAY_MS2 = 24 * 60 * 60 * 1e3;
+var DAY_MS3 = 24 * 60 * 60 * 1e3;
 var PROMOTION_GATE_DECISION_GRACE_MS = 20 * 60 * 1e3;
 var RELEASE_VERIFY_ATTEMPT_INTERVAL_MS = 10 * 60 * 1e3;
 var RELEASE_VERIFY_BUDGET_MS = 8 * 60 * 60 * 1e3;
@@ -1523,8 +2439,8 @@ var BACKUP_DEFAULT_LIMITS = Object.freeze({
   /** Retries a storage write gets before the backup fails as `storage_unavailable`. */
   storageRetries: 3
 });
-var HOUR_MS = 60 * 60 * 1e3;
-var MINUTE_MS = 60 * 1e3;
+var HOUR_MS3 = 60 * 60 * 1e3;
+var MINUTE_MS2 = 60 * 1e3;
 var ACTION_CATEGORIES = Object.freeze([
   "read.internal",
   "read.external",
@@ -1831,13 +2747,16 @@ var INTEGRATION_SCOPES = [
   "events:read",
   "webhooks:manage",
   "links:write",
-  "merges:decide"
+  "merges:decide",
+  "decisions:individual"
 ];
 var INTEGRATION_MERGE_DECISION_SCOPE = "merges:decide";
+var INTEGRATION_INDIVIDUAL_DECISION_SCOPE = "decisions:individual";
 var INTEGRATION_OPT_IN_SCOPES = [
   "org:write",
   "email:write",
-  INTEGRATION_MERGE_DECISION_SCOPE
+  INTEGRATION_MERGE_DECISION_SCOPE,
+  INTEGRATION_INDIVIDUAL_DECISION_SCOPE
 ];
 var EVER_GAUZY_PRESET_SCOPES = INTEGRATION_SCOPES.filter(
   (scope) => !INTEGRATION_OPT_IN_SCOPES.includes(scope)
@@ -1995,7 +2914,16 @@ var PLUGIN_CAPABILITIES = {
   // `capabilities/domain-event-subscriber.interface.ts`. Appended last, so
   // every existing constant keeps its value and its position; no category is
   // added (a subscriber plugin keeps the category of what it otherwise is).
-  DOMAIN_EVENT_SUBSCRIBER: "domain-event-subscriber"
+  DOMAIN_EVENT_SUBSCRIBER: "domain-event-subscriber",
+  // Cloud computers (FL-17, CONTRACTS R-15) — plugins that create, power and
+  // destroy machines at a cloud provider on the owner's own account and say
+  // what they cost (`IMachineProviderPlugin`). The first plugin ships under
+  // `packages/plugins/`. Consumed only through
+  // `MachineProviderFacadeService`; see
+  // `capabilities/machine-provider.interface.ts`. Appended **last**, so every
+  // existing constant keeps its value and its position, and landed in the same
+  // change as the `machine-provider` category in `plugin-manifest.types.ts`.
+  MACHINE_PROVIDER: "machine-provider"
 };
 var ALL_PLUGIN_CAPABILITIES = Object.values(PLUGIN_CAPABILITIES);
 function initializePipelineState(stepDefinitions) {