@ever-works/contracts 1.0.0 → 1.0.1

package/dist/index.cjs

@@ -16,7 +16,8 @@ var USER_SELECTABLE_WORK_KINDS = [
   "blog",
   "directory",
   "awesome-repo",
-  "repo"
+  "repo",
+  "app"
 ];
 var WORK_KINDS = [...USER_SELECTABLE_WORK_KINDS, "company", "campaign", "default"];
 var WORK_KIND_SET = new Set(WORK_KINDS);
@@ -41,6 +42,9 @@ function isUserSelectableWorkKind(value) {
 function isRepositoryWorkKind(value) {
   return normalizeWorkKind(value) === "repo";
 }
+function isAppWorkKind(value) {
+  return normalizeWorkKind(value) === "app";
+}
 
 // src/domain/goal-kind.ts
 var GOAL_KINDS = ["metric", "delivery"];
@@ -196,6 +200,8 @@ var DIRECTORY_CAPABILITIES = {
   sourceValidation: true,
   deploy: true,
   kb: true,
+  builds: false,
+  appEnvironment: false,
   metrics: ["total-items", "categories", "comparisons", "generation-status", "days-active"],
   repos: { data: true, work: true, website: true }
 };
@@ -213,6 +219,8 @@ var WORK_KIND_CAPABILITIES = {
     sourceValidation: true,
     deploy: true,
     kb: true,
+    builds: false,
+    appEnvironment: false,
     metrics: ["total-items", "categories", "tags", "generation-status", "days-active"],
     repos: { data: true, work: true, website: true }
   },
@@ -225,6 +233,8 @@ var WORK_KIND_CAPABILITIES = {
     sourceValidation: false,
     deploy: true,
     kb: true,
+    builds: false,
+    appEnvironment: false,
     metrics: ["posts", "page-views", "registered-users", "deploy-status", "days-active"],
     repos: { data: true, work: true, website: true }
   },
@@ -237,6 +247,8 @@ var WORK_KIND_CAPABILITIES = {
     sourceValidation: false,
     deploy: true,
     kb: true,
+    builds: false,
+    appEnvironment: false,
     metrics: ["page-views", "registered-users", "sessions", "deploy-status", "generation-status"],
     repos: { data: true, work: true, website: true }
   },
@@ -249,6 +261,8 @@ var WORK_KIND_CAPABILITIES = {
     sourceValidation: false,
     deploy: true,
     kb: true,
+    builds: false,
+    appEnvironment: false,
     metrics: ["page-views", "conversions", "deploy-status", "days-active"],
     repos: { data: true, work: true, website: true }
   },
@@ -272,6 +286,8 @@ var WORK_KIND_CAPABILITIES = {
     sourceValidation: false,
     deploy: false,
     kb: true,
+    builds: false,
+    appEnvironment: false,
     metrics: ["agents", "open-tasks", "days-active"],
     repos: { data: true, work: false, website: false }
   },
@@ -286,6 +302,8 @@ var WORK_KIND_CAPABILITIES = {
     sourceValidation: false,
     deploy: false,
     kb: true,
+    builds: false,
+    appEnvironment: false,
     metrics: ["works-owned", "team-members", "agents", "open-tasks", "days-active"],
     repos: { data: true, work: true, website: false }
   },
@@ -305,8 +323,40 @@ var WORK_KIND_CAPABILITIES = {
     sourceValidation: false,
     deploy: false,
     kb: true,
+    builds: false,
+    appEnvironment: false,
     metrics: ["agents", "open-tasks", "conversions", "days-active"],
     repos: { data: true, work: true, website: false }
+  },
+  // An App Work wraps code the platform did not generate (README D1): the
+  // repository the member pasted, forked or copied IS its Work Repository,
+  // so the persisted `website` role is on and the `data` role — which holds
+  // a Work's generated data — is off. Nothing item-shaped applies: no
+  // items, taxonomy, comparisons, community-PR intake, import/export or
+  // source validation, and no generated site to render.
+  //
+  // `deploy` is ON where `repo` refuses it, which is the whole point of the
+  // kind: the second contract invariant this entry replaces is "a kind
+  // deploys only with a repository to deploy" — an App Work deploys the
+  // Work Repository without ever having generated one.
+  //
+  // `builds` and `appEnvironment` (Resolution R-7) are true HERE ONLY — the
+  // two flags exist so APW-05's Builds surface and APW-07's App env /
+  // dependencies surfaces can hang off the registry instead of off
+  // `kind === 'app'` inline tests, exactly as `deploy` does.
+  app: {
+    items: { enabled: false, labelKey: "items" },
+    taxonomy: false,
+    comparisons: false,
+    communityPr: false,
+    itemImportExport: false,
+    sourceValidation: false,
+    deploy: true,
+    kb: true,
+    builds: true,
+    appEnvironment: true,
+    metrics: ["agents", "open-tasks", "deploy-status", "days-active"],
+    repos: { data: false, work: false, website: true }
   }
 };
 function getWorkCapabilities(kind) {
@@ -316,6 +366,3119 @@ function workKindHasItems(kind) {
   return getWorkCapabilities(kind).items.enabled;
 }
 
+// src/apps/app-dependencies.ts
+var APP_DEPENDENCY_KINDS = ["postgres", "redis", "objectStorage", "smtp"];
+var APP_DEPENDENCY_TARGETS = ["your-cluster", "ever-works-apps"];
+var APP_DEPENDENCY_STATUSES = [
+  "pending",
+  "awaiting_config",
+  "provisioning",
+  "ready",
+  "degraded",
+  "failed",
+  "kept",
+  "deleting",
+  "deleted"
+];
+var APP_DEPENDENCY_INACTIVE_STATUSES = ["kept", "deleted"];
+var APP_DEPENDENCY_BACKUP_POLICIES = ["none", "operator", "provider", "managed"];
+var APP_DEPENDENCY_BACKUP_STATES = [
+  "none",
+  "not_configured",
+  "healthy",
+  "overdue",
+  "failing",
+  "external",
+  "unknown"
+];
+var APP_DEPENDENCY_REASONS = [
+  "noDefaultStorageClass",
+  "clusterUnreachable",
+  "smtpConnectFailed",
+  "smtpTlsFailed",
+  "smtpAuthRefused",
+  "bucketUnreadable",
+  "volumeNotReady",
+  "extensionUnavailable",
+  "platformServerRefused",
+  "deadlineExceeded",
+  "namespaceNotOwned",
+  "namespaceBaselineMissing",
+  "clusterPermissionMissing",
+  "operatorNamespaceUnknown",
+  "volumeExpansionUnsupported",
+  "sizeShrinkRefused",
+  "relayIneligible",
+  "relaySuspended",
+  "providerNotSupported",
+  "dependencyNotDeclared",
+  "confirmationMismatch",
+  "deleteInProgress",
+  "notGenerated",
+  "notAppWork",
+  // APW07-G28 — the last two of APW-06's four `unavailable` codes, in the
+  // port's own order (`target_none`, `target_not_checked`, then the two that
+  // already had a member: `namespace_owned_elsewhere` → `namespaceNotOwned`,
+  // `cluster_unreachable` → `clusterUnreachable`).
+  "targetNone",
+  "targetNotChecked"
+];
+var APP_DEPENDENCY_STATUS_REASONS = [
+  "noDefaultStorageClass",
+  "clusterUnreachable",
+  "smtpConnectFailed",
+  "smtpTlsFailed",
+  "smtpAuthRefused",
+  "bucketUnreadable",
+  "volumeNotReady",
+  "extensionUnavailable",
+  "platformServerRefused",
+  "deadlineExceeded",
+  "namespaceNotOwned",
+  "namespaceBaselineMissing",
+  "clusterPermissionMissing",
+  "operatorNamespaceUnknown",
+  "relayIneligible",
+  "relaySuspended",
+  // APW07-G28: the port's `target_none` / `target_not_checked`.
+  "targetNone",
+  "targetNotChecked"
+];
+var APP_DEPENDENCY_ERROR_CODES = [
+  "volumeExpansionUnsupported",
+  "sizeShrinkRefused",
+  "providerNotSupported",
+  "dependencyNotDeclared",
+  "confirmationMismatch",
+  "deleteInProgress",
+  "notGenerated",
+  "notAppWork"
+];
+var APP_DEPENDENCY_REASON_MESSAGE_LEAVES = {
+  noDefaultStorageClass: "noDefaultStorageClass",
+  clusterUnreachable: "clusterUnreachable",
+  smtpConnectFailed: "smtpConnectFailed",
+  smtpTlsFailed: "smtpTlsFailed",
+  smtpAuthRefused: "smtpAuthRefused",
+  bucketUnreadable: "bucketUnreadable",
+  volumeNotReady: "volumeNotReady",
+  extensionUnavailable: "extensionUnavailable",
+  platformServerRefused: "platformServerRefused",
+  deadlineExceeded: "deadlineExceeded",
+  namespaceNotOwned: "namespaceNotOwned",
+  namespaceBaselineMissing: "namespaceBaselineMissing",
+  clusterPermissionMissing: "clusterPermissionMissing",
+  operatorNamespaceUnknown: "operatorNamespaceUnknown",
+  volumeExpansionUnsupported: "volumeExpansionUnsupported",
+  sizeShrinkRefused: "sizeShrinkRefused",
+  relayIneligible: "relayIneligible",
+  relaySuspended: "relaySuspended",
+  providerNotSupported: "providerNotSupported",
+  dependencyNotDeclared: "dependencyNotDeclared",
+  confirmationMismatch: "confirmationMismatch",
+  deleteInProgress: "deleteInProgress",
+  notGenerated: "notGenerated",
+  notAppWork: "notAppWork",
+  // APW07-G28 — no new copy subtree: the two port preconditions get one leaf
+  // each, exactly like every other reason, and T2's spec pins them against
+  // `apps/web/messages/en.json`.
+  targetNone: "targetNone",
+  targetNotChecked: "targetNotChecked"
+};
+var APP_DEPENDENCY_REASON_MESSAGE_KEY_PREFIX = "dashboard.workDetail.appDependencies.reasons";
+var APP_DEPENDENCY_STATUS_MESSAGE_LEAVES = {
+  pending: "pending",
+  awaiting_config: "awaitingConfig",
+  provisioning: "provisioning",
+  ready: "ready",
+  degraded: "degraded",
+  failed: "failed",
+  kept: "kept",
+  deleting: "deleting",
+  deleted: "deleted"
+};
+var APP_DEPENDENCY_STATUS_MESSAGE_KEY_PREFIX = "dashboard.workDetail.appDependencies.status";
+var APP_DEPENDENCY_BACKUP_STATE_MESSAGE_LEAVES = {
+  none: "none",
+  not_configured: "notConfigured",
+  healthy: "healthy",
+  overdue: "overdue",
+  failing: "failing",
+  external: "external",
+  unknown: "unknown"
+};
+var APP_DEPENDENCY_BACKUP_STATE_MESSAGE_KEY_PREFIX = "dashboard.workDetail.appDependencies.backup";
+function appDependencyReasonMessageKey(reason) {
+  return `${APP_DEPENDENCY_REASON_MESSAGE_KEY_PREFIX}.${APP_DEPENDENCY_REASON_MESSAGE_LEAVES[reason]}`;
+}
+function appDependencyStatusMessageKey(status) {
+  return `${APP_DEPENDENCY_STATUS_MESSAGE_KEY_PREFIX}.${APP_DEPENDENCY_STATUS_MESSAGE_LEAVES[status]}`;
+}
+function appDependencyBackupStateMessageKey(state) {
+  return `${APP_DEPENDENCY_BACKUP_STATE_MESSAGE_KEY_PREFIX}.${APP_DEPENDENCY_BACKUP_STATE_MESSAGE_LEAVES[state]}`;
+}
+function isAppDependencyReason(value) {
+  return APP_DEPENDENCY_REASONS.includes(value);
+}
+var APP_DEPENDENCY_PROVIDER_IDS = [
+  "k8s-inline-postgres",
+  "k8s-inline-redis",
+  "k8s-inline-minio",
+  "smtp-external",
+  "s3-external",
+  "platform-smtp-relay",
+  "managed-postgres",
+  "managed-redis",
+  "managed-object-storage",
+  "managed-smtp"
+];
+var APP_DEPENDENCY_OUTPUTS = {
+  postgres: { url: true, directUrl: true, host: false, port: false, database: false, user: false, password: true },
+  redis: { url: true, host: false, port: false, password: true },
+  objectStorage: { endpoint: false, region: false, accessKeyId: true, secretAccessKey: true, "bucket.*": false },
+  smtp: { host: false, port: false, user: false, password: true, from: false, secure: false }
+};
+var APP_DEPENDENCY_OUTPUT_NAMES = {
+  postgres: ["url", "directUrl", "host", "port", "database", "user", "password"],
+  redis: ["url", "host", "port", "password"],
+  objectStorage: ["endpoint", "region", "accessKeyId", "secretAccessKey", "bucket.*"],
+  smtp: ["host", "port", "user", "password", "from", "secure"]
+};
+var APP_DEPENDENCY_BUCKET_OUTPUT_PATTERN = "bucket.*";
+var APP_DEPENDENCY_BUCKET_OUTPUT_PREFIX = "bucket.";
+function appDependencyOutputNames(kind) {
+  return APP_DEPENDENCY_OUTPUT_NAMES[kind];
+}
+function isAppDependencyOutputSecret(kind, output) {
+  const flags = APP_DEPENDENCY_OUTPUTS[kind];
+  return flags[output] ?? true;
+}
+var APP_DEPENDENCY_TOKEN_SCHEME = "ew-dep://";
+function appDependencyToken(kind, output) {
+  return `${APP_DEPENDENCY_TOKEN_SCHEME}${kind}/${output}`;
+}
+function parseAppDependencyToken(text) {
+  if (!text.startsWith(APP_DEPENDENCY_TOKEN_SCHEME)) return null;
+  const rest = text.slice(APP_DEPENDENCY_TOKEN_SCHEME.length);
+  const separator = rest.indexOf("/");
+  if (separator <= 0 || separator === rest.length - 1) return null;
+  const kind = rest.slice(0, separator);
+  const output = rest.slice(separator + 1);
+  if (!APP_DEPENDENCY_KINDS.includes(kind)) return null;
+  if (output.includes("/")) return null;
+  return { kind, output };
+}
+var APP_DEPENDENCY_TOKEN_UNKNOWN_CODE = "DEPENDENCY_TOKEN_UNKNOWN";
+var APP_DEPENDENCY_READY_DEADLINE_MS = {
+  postgres: 6e5,
+  redis: 3e5,
+  objectStorage: 6e5,
+  smtp: 3e4
+};
+var APP_DEPENDENCY_EXTERNAL_TEST_MS = 3e4;
+var APP_DEPENDENCY_DEFAULT_SIZE_GIB = { postgres: 10, objectStorage: 20, redis: 1 };
+var APP_DEPENDENCY_TRANSIENT_ATTEMPTS = 3;
+var APP_DEPENDENCY_RETRY_DELAY_MS = 3e5;
+var APP_DEPENDENCY_REFRESH_AFTER_MS = 9e5;
+var APP_DEPENDENCY_BACKUP_OVERDUE_MS = 26 * 36e5;
+var APP_DEPENDENCY_RELAY_DAILY_LIMIT = 200;
+var APP_DEPENDENCY_MANAGED = {
+  pgRoleConnectionLimit: 20,
+  pgDatabaseConnectionLimit: 25,
+  pgStatementTimeoutMs: 6e4,
+  pgIdleInTransactionTimeoutMs: 6e4,
+  bucketQuotaGiB: 10,
+  redisMaxMemoryMiB: 256,
+  backupMaxAgeMs: 864e5
+};
+var APP_DEPENDENCY_POSTGRES_DEFAULT_PORT = 5432;
+var APP_DEPENDENCY_ZONE_BUCKET_PREFIX = "aw-";
+var APP_DEPENDENCY_ZONE_BUCKET_NAME_SHAPE = "aw-<hex12>-<name>";
+var APP_DEPENDENCY_ZONE_REDIS_MAX_MEMORY_MIB = 256;
+var APP_DEPENDENCY_RELAY_LIMITS = {
+  perAccountPerDay: 1e3,
+  perOrganizationPerDay: 5e3,
+  suspendBounceRate: 0.05
+};
+var APP_DEPENDENCY_ENV_VARS = {
+  /** R-30 kill switch for dependency provisioning and the mail relay. */
+  depsEnabled: "EVER_WORKS_APP_DEPS_ENABLED",
+  /** R-30 kill switch for the relay alone. */
+  mailRelayEnabled: "EVER_WORKS_APP_MAIL_RELAY_ENABLED",
+  /** Comma-separated CIDRs that get past the public-endpoint guard (APW07-G09). */
+  privateAllowlist: "EVER_WORKS_APP_DEPENDENCY_PRIVATE_ALLOWLIST",
+  relayDailyLimitPerAccount: "EVER_WORKS_APP_RELAY_DAILY_LIMIT_PER_ACCOUNT",
+  relayDailyLimitPerOrganization: "EVER_WORKS_APP_RELAY_DAILY_LIMIT_PER_ORGANIZATION",
+  relaySuspendBounceRate: "EVER_WORKS_APP_RELAY_SUSPEND_BOUNCE_RATE",
+  /** Per-App-Work daily relay cap override — CONTRACTS §7A:669. */
+  mailMaxPerDay: "EVER_WORKS_APP_MAIL_MAX_PER_DAY"
+};
+function isAppDependencyBackupOverdue(lastBackupAt, now) {
+  if (!lastBackupAt) return false;
+  const last = Date.parse(lastBackupAt);
+  if (Number.isNaN(last)) return false;
+  return now - last > APP_DEPENDENCY_BACKUP_OVERDUE_MS;
+}
+function appDependencyReadyDeadlineMs(kind) {
+  return APP_DEPENDENCY_READY_DEADLINE_MS[kind];
+}
+function appDependencyDefaultSizeGiB(kind) {
+  return kind in APP_DEPENDENCY_DEFAULT_SIZE_GIB ? APP_DEPENDENCY_DEFAULT_SIZE_GIB[kind] : null;
+}
+function isAppDependencySizeChangeAllowed(previousGiB, nextGiB) {
+  if (previousGiB !== null && nextGiB < previousGiB) return { allowed: false, refusal: "dependencySizeShrink" };
+  return { allowed: true };
+}
+function canDeleteAppDependencyData(input) {
+  return input.hasEditAccess && input.confirmSlug !== null && input.confirmSlug === input.workSlug;
+}
+function appDependencyBlocksDeploy(kind, required) {
+  return kind === "smtp" ? required : true;
+}
+
+// src/apps/app-env.ts
+var APP_ENV_ORIGINS = ["generated", "derived", "prompted", "user", "default"];
+var APP_ENV_STORED_ORIGINS = ["generated", "prompted", "user", "derived"];
+var APP_ENV_PHASES = ["build", "runtime", "both"];
+var APP_ENV_GENERATOR_KINDS = ["base64", "hex", "chars", "uuid", "keypair"];
+var APP_ENV_ALPHABETS = {
+  alnum: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
+  "alnum-symbols": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#%+,-.:=?@^_~",
+  "hex-lower": "0123456789abcdef",
+  base64url: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+};
+var APP_ENV_KEYPAIR_TYPES = ["ed25519", "ec-p256", "rsa-2048", "rsa-4096"];
+var APP_ENV_KEYPAIR_FORMATS = ["pem", "base64url-raw", "pkcs12"];
+var APP_ENV_KEYPAIR_RAW_TYPES = ["ed25519", "ec-p256"];
+var APP_ENV_KEYPAIR_DEFAULT_FORMAT = "pem";
+var APP_ENV_NAME_PATTERN = "^[A-Z_][A-Z0-9_]{0,127}$";
+var APP_ENV_DEP_PASSWORD_TOKEN_PREFIX = "DEP_";
+var APP_ENV_DEP_PASSWORD_TOKEN_SUFFIX = "_PASSWORD";
+var APP_ENV_RESERVED_PREFIX = "EVER_WORKS_";
+var APP_ENV_PUBLIC_PREFIXES = [
+  "NEXT_PUBLIC_",
+  "VITE_",
+  "PUBLIC_",
+  "REACT_APP_",
+  "NUXT_PUBLIC_",
+  "EXPO_PUBLIC_"
+];
+var APP_ENV_PUBLIC_HALF_SUFFIX = "_PUBLIC";
+var APP_ENV_ROTATE_MODES = ["never"];
+var APP_ENV_VALUE_MAX_BYTES = 65536;
+var APP_ENV_TOTAL_MAX_BYTES = 1048576;
+var APP_ENV_MAX_STORED = 300;
+var APP_ENV_PUBLIC_HALF_MAX_BYTES = 16384;
+var APP_ENV_PATTERN_BUDGET_MS = 50;
+var APP_ENV_DOTENV_MAX_BYTES = 65536;
+var APP_ENV_DOTENV_MAX_LINES = 500;
+var APP_ENV_GENERATE_SLA_MS = 6e4;
+var APP_ENV_ROTATIONS_PER_HOUR = 10;
+var APP_ENV_PUTS_PER_MINUTE = 30;
+var APP_ENV_TEMPLATE_MAX_DEPTH = 10;
+var APP_ENV_CHARS_MIN_LENGTH = 16;
+var APP_ENV_CHARS_MAX_LENGTH = 256;
+var APP_ENV_BASE64_MIN_BYTES = 16;
+var APP_ENV_BASE64_MAX_BYTES = 128;
+var APP_ENV_UUID_LENGTH = 36;
+var APP_ENV_REDACT_MIN_CHARS = 6;
+function appEnvGeneratorFingerprint(generate) {
+  if (generate.kind === "keypair") {
+    const keypair = generate.keypair;
+    const type = keypair?.type ?? "ed25519";
+    const format = keypair?.format ?? APP_ENV_KEYPAIR_DEFAULT_FORMAT;
+    const suffix = format === "pkcs12" && keypair?.passwordEnv ? `:${keypair.passwordEnv}` : "";
+    return `keypair:${type}:${format}${suffix}`;
+  }
+  if (generate.kind === "uuid") return "uuid";
+  if (generate.kind === "chars")
+    return `chars:${generate.length ?? APP_ENV_CHARS_MIN_LENGTH}:${generate.alphabet ?? "alnum"}`;
+  return `${generate.kind}:${generate.bytes ?? APP_ENV_BASE64_MIN_BYTES}`;
+}
+function appEnvStoredFingerprint(version) {
+  return `v${version}`;
+}
+function appEnvDependencyFingerprint(outputsVersion) {
+  return `d${outputsVersion}`;
+}
+function appEnvTemplateFingerprint(text, placeholders) {
+  const sorted = placeholders.map((entry) => [entry.placeholder, entry.fingerprint]).sort((left, right) => {
+    if (left[0] !== right[0]) return left[0] < right[0] ? -1 : 1;
+    if (left[1] !== right[1]) return left[1] < right[1] ? -1 : 1;
+    return 0;
+  });
+  return `t${sorted.map(([placeholder, fingerprint]) => `${text}\0${placeholder}\0${fingerprint}`).join("
")}`;
+}
+function appEnvPublicHalfName(name) {
+  return `${name}${APP_ENV_PUBLIC_HALF_SUFFIX}`;
+}
+function appEnvDependencyPasswordToken(kind) {
+  return `${APP_ENV_DEP_PASSWORD_TOKEN_PREFIX}${kind.toUpperCase()}${APP_ENV_DEP_PASSWORD_TOKEN_SUFFIX}`;
+}
+function appEnvKeypairFormatSupported(type, format, passwordEnv) {
+  if (format === "base64url-raw") return APP_ENV_KEYPAIR_RAW_TYPES.includes(type);
+  if (format === "pkcs12") return passwordEnv !== void 0 && passwordEnv.length > 0;
+  return true;
+}
+function hasAppEnvPublicPrefix(name) {
+  return APP_ENV_PUBLIC_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+var APP_ENV_VALIDATION_REFUSAL_CODES = [
+  "invalidName",
+  "reservedName",
+  "valueTooLarge",
+  "controlCharacter",
+  "lengthMismatch",
+  "tooShort",
+  "tooLong",
+  "patternMismatch"
+];
+var APP_ENV_IMPORT_OUTCOMES = ["set", "created", "skipped", "refused"];
+var APP_ENV_API_ERROR_CODES = [
+  "generatedValueUseRotate",
+  "neverRotateNotAcknowledged",
+  "rotateConfirmationMismatch",
+  "secureStorageUnavailable",
+  "tooManyValues",
+  "valuesTooLarge",
+  "malformedLine",
+  "rotateRateLimited"
+];
+var APP_ENV_ERROR_CODES = [...APP_ENV_VALIDATION_REFUSAL_CODES, ...APP_ENV_API_ERROR_CODES];
+var APP_ENV_ERROR_MESSAGE_LEAVES = {
+  invalidName: "invalidName",
+  reservedName: "reservedName",
+  valueTooLarge: "valueTooLarge",
+  controlCharacter: "controlCharacter",
+  lengthMismatch: "lengthMismatch",
+  tooShort: "tooShort",
+  tooLong: "tooLong",
+  patternMismatch: "patternMismatch",
+  generatedValueUseRotate: "generatedValueUseRotate",
+  neverRotateNotAcknowledged: "neverRotateNotAcknowledged",
+  rotateConfirmationMismatch: "rotateConfirmationMismatch",
+  secureStorageUnavailable: "secureStorageUnavailable",
+  tooManyValues: "tooManyValues",
+  valuesTooLarge: "valuesTooLarge",
+  malformedLine: "malformedLine",
+  rotateRateLimited: "rotateRateLimited"
+};
+var APP_ENV_ERROR_MESSAGE_KEY_PREFIX = "dashboard.workDetail.appEnv.errors";
+function appEnvErrorMessageKey(code) {
+  return `${APP_ENV_ERROR_MESSAGE_KEY_PREFIX}.${APP_ENV_ERROR_MESSAGE_LEAVES[code]}`;
+}
+var APP_ENV_UNRESOLVED_REASONS = [
+  /** A required `prompt` entry has no stored value — plan §2.2:119. */
+  "missingRequired",
+  /** A `from: domains.primary.*` entry with no primary domain — plan §2.2:121. */
+  "noPrimaryDomain",
+  /** A build-phase `deps.<kind>.<out>` with no build service of that kind — plan §2.2:122, FR-22. */
+  "noBuildService",
+  /** A runtime `deps.<kind>.<out>` whose row is not `ready` — plan §2.2:122. */
+  "dependencyNotReady",
+  /** `platform.smtp.*` / `components.*.internalUrl` are not available at build — plan §2.2:123–124. */
+  "notAvailableAtBuild",
+  /** `platform.smtp.*` with no relay selected — plan §2.2:123. */
+  "relayNotSelected",
+  /** A template that cannot be resolved, failing closed — plan §4.6.1:449. */
+  "templateUnresolvable"
+];
+var APP_ENV_RESOLUTION_TARGETS = ["cluster", "runner"];
+var APP_ENV_DECLARED_SOURCES = ["generate", "from", "template", "prompt", "value"];
+var APP_ENV_RECIPE_SOURCES = ["generate", "literal", "template", "prompted", "derived"];
+var APP_ENV_RECIPE_TOKEN_KINDS = ["gen", "prompted", "dep"];
+var APP_ENV_RUNNER_RECIPE_ENDPOINTS = {
+  postgres: { host: "postgres", port: 5432, user: "ever-works-build", database: "app" },
+  redis: { host: "redis", port: 6379, password: "" },
+  objectStorage: { host: "object-storage", port: 9e3, accessKeyId: "ever-works-build" }
+};
+var APP_ENV_BUILD_SERVICE_OUTPUTS = {
+  postgres: { host: "127.0.0.1", port: 5432, region: null, from: null },
+  redis: { host: "127.0.0.1", port: 6379, region: null, from: null },
+  objectStorage: { host: "127.0.0.1", port: 9e3, region: "us-east-1", from: null },
+  smtp: { host: "127.0.0.1", port: 1025, region: null, from: "build@example.invalid" }
+};
+var APP_ENV_BUILD_SERVICE_OBJECT_STORAGE_REGION = "us-east-1";
+var APP_ENV_BUILD_SERVICE_SMTP_FROM = "build@example.invalid";
+var APP_ENV_BUILD_SERVICE_VALUE_FLAG = "fromBuildService";
+
+// src/apps/app-launcher.ts
+var APP_LAUNCHER_ENVIRONMENTS = ["production", "stage", "develop"];
+var APP_LAUNCHER_ITEM_KINDS = ["platform", "work"];
+var APP_LAUNCHER_SECTIONS = ["pinned", "platforms", "works"];
+var APP_LAUNCHER_WORK_CHIPS = ["deploying", "lastDeployFailed"];
+var APP_LAUNCHER_MANAGE_STATES = ["listed", "notLive", "exposureOff"];
+var APP_LAUNCHER_PLATFORM_STATUSES = ["available", "beta"];
+var APP_LAUNCHER_REJECTION_REASONS = ["unknownItem", "cannotHideCurrent"];
+var APP_LAUNCHER_EMPTY_ACTIONS = ["createAppWork", "goToWorks"];
+var APP_LAUNCHER_PIN_LIMIT = 6;
+var APP_LAUNCHER_MAX_ITEMS_RESPONSE = 200;
+var APP_LAUNCHER_MAX_CHANGES_PER_SAVE = 200;
+var APP_LAUNCHER_MAX_PREFERENCE_ROWS = 500;
+var APP_LAUNCHER_PANEL_PLATFORMS_MAX = 12;
+var APP_LAUNCHER_PANEL_WORKS_MAX = 24;
+var APP_LAUNCHER_CATALOG_MAX_ENTRIES = 24;
+var APP_LAUNCHER_ICON_MAX_BYTES = 16384;
+var APP_LAUNCHER_CLIENT_CACHE_MS = 5 * 6e4;
+var APP_LAUNCHER_NAME_MAX_LENGTH = 100;
+var APP_LAUNCHER_DESCRIPTION_MAX_LENGTH = 80;
+var APP_LAUNCHER_FILTER_MAX_LENGTH = APP_LAUNCHER_NAME_MAX_LENGTH;
+function isAppLauncherEnvironment(value) {
+  return typeof value === "string" && APP_LAUNCHER_ENVIRONMENTS.includes(value);
+}
+function appLauncherPinLimitExceeded(pinnedCount) {
+  if (!Number.isInteger(pinnedCount) || pinnedCount < 0) {
+    return true;
+  }
+  return pinnedCount > APP_LAUNCHER_PIN_LIMIT;
+}
+
+// src/apps/app-license.types.ts
+var LICENSE_CLASSES = ["green", "amber", "red", "unknown"];
+var LICENSE_CLASS_RANK = {
+  green: 0,
+  amber: 1,
+  unknown: 2,
+  red: 3
+};
+var LICENSE_SOURCES = ["detected", "blueprint", "user"];
+var LICENSE_REGISTRY_SOURCES = ["live", "last_good", "snapshot"];
+var MANAGED_HOSTING_REASONS = [
+  "licenseNotGreen",
+  "upstreamAgreementMissing",
+  "entryDisallows",
+  "blueprintNotVerified",
+  "managedTierDisabled"
+];
+var MANAGED_HOSTING_AVAILABILITIES = ["available", ...MANAGED_HOSTING_REASONS];
+var BLUEPRINT_MATCH_SOURCES = ["manifest", "alias", "fork", "probe", "explicit", "file"];
+var LICENSE_HOSTING_DECISIONS = ["allowed", "attestationRequired"];
+var LICENSE_TEXT_MATCH_THRESHOLD = 0.9;
+var LICENSE_MAX_FILE_READS = 12;
+var LICENSE_MIXED_DIR_NAMES = ["ee", "enterprise", "premium", "commercial"];
+var LICENSE_MIXED_MAX_DEPTH = 4;
+var LICENSE_EVIDENCE_MAX = 20;
+var LICENSE_TREE_MAX_ENTRIES = 1e5;
+var LICENSE_HEADER_SCAN_BYTES = 2048;
+var LICENSE_ATTEST_PER_MIN = 10;
+var APPS_MANAGED_REQUIRES_VERIFIED = true;
+
+// src/apps/app-source.ts
+var APP_SOURCE_REPOSITORY_TYPES = ["app_link", "app_fork", "app_private_copy"];
+var APP_WORK_REPOSITORY_ROLE = "website";
+var APP_REPOSITORY_MODES = ["link", "fork", "private-copy"];
+var APP_SOURCE_REPOSITORY_TYPE_BY_MODE = {
+  link: "app_link",
+  fork: "app_fork",
+  "private-copy": "app_private_copy"
+};
+var APP_SOURCE_REPOSITORY_NAME_SUFFIXES = { app: "-app", default: "-website" };
+var APP_SOURCE_SPEC_FILE = ".works/works.yml";
+var APP_SOURCE_SPEC_VERSION = 2;
+var APP_SOURCE_SPEC_KIND = "app";
+var APP_DEPLOY_TARGET_CHOICES = ["none", "your-cluster", "ever-works-apps"];
+var APP_SOURCE_REASON_CODES = [
+  "invalid_url",
+  "provider_not_connected",
+  "insufficient_scope",
+  "not_found",
+  "sso_authorization_required",
+  "oauth_app_restricted",
+  "empty_repository",
+  "no_push_access",
+  "archived",
+  "forking_disabled",
+  "own_repository",
+  "target_owner_unavailable",
+  "target_owner_forbidden",
+  "too_large_for_private_copy",
+  "uses_lfs",
+  "copy_name_unavailable",
+  "in_use_by_another_account",
+  "app_work_exists",
+  "create_in_progress",
+  "rate_limited",
+  "managed_hosting_unavailable",
+  "cluster_target_unavailable",
+  "app_works_disabled",
+  "blueprint_mismatch"
+];
+function isAppSourceReasonCode(value) {
+  return typeof value === "string" && APP_SOURCE_REASON_CODES.includes(value);
+}
+var APP_SOURCE_BLUEPRINT_STATUSES = ["matched", "none", "unavailable"];
+var APP_SOURCE_BLUEPRINT_MATCH_SOURCES = ["manifest", "alias", "fork", "probe", "explicit"];
+var APP_SOURCE_LICENSE_CLASSES = ["green", "amber", "red", "unknown"];
+var APP_SOURCE_LICENSE_SOURCES = ["detected", "blueprint", "user"];
+function firstReason(candidates) {
+  for (const [matches, reason] of candidates) {
+    if (matches) {
+      return reason;
+    }
+  }
+  return void 0;
+}
+function resolveAppRepositoryModes(factsInput) {
+  const linkReason = firstReason([
+    [!factsInput.canPush, "no_push_access"],
+    [factsInput.archived, "archived"],
+    [factsInput.isInUseByAnotherAccount, "in_use_by_another_account"]
+  ]);
+  const forkReason = firstReason([
+    [!factsInput.allowForking, "forking_disabled"],
+    [factsInput.empty, "empty_repository"],
+    [factsInput.isOwnRepository, "own_repository"]
+  ]);
+  const sizeKnown = typeof factsInput.sizeKb === "number" && Number.isFinite(factsInput.sizeKb) && factsInput.sizeKb >= 0;
+  const copyReason = firstReason([
+    [!sizeKnown || factsInput.sizeKb > APP_PRIVATE_COPY_MAX_SIZE_KB, "too_large_for_private_copy"],
+    [factsInput.usesLfs, "uses_lfs"],
+    [factsInput.visibility === "private" && !factsInput.allowForking, "forking_disabled"]
+  ]);
+  const modes = {
+    link: linkReason ? { available: false, reason: linkReason } : { available: true },
+    fork: forkReason ? { available: false, reason: forkReason } : { available: true },
+    "private-copy": copyReason ? { available: false, reason: copyReason } : { available: true }
+  };
+  let defaultMode = null;
+  if (modes.link.available && factsInput.canPush && !factsInput.isFork) {
+    defaultMode = "link";
+  } else if (modes.fork.available && (!factsInput.canPush || factsInput.isFork)) {
+    defaultMode = "fork";
+  } else if (modes.link.available) {
+    defaultMode = "link";
+  }
+  return { modes, defaultMode };
+}
+var APP_INSPECT_MAX_PROVIDER_CALLS = 15;
+var APP_INSPECT_FIXED_PROVIDER_CALLS = 5;
+var APP_INSPECT_OWNER_MIN_CALLS_REMAINING = 3;
+function canStartTargetOwnerScan(callsRemaining) {
+  return Number.isFinite(callsRemaining) && callsRemaining >= APP_INSPECT_OWNER_MIN_CALLS_REMAINING;
+}
+var APP_INSPECT_P95_BUDGET_MS = 8e3;
+var APP_INSPECT_CACHE_TTL_MS = 6e4;
+var APP_INSPECT_RATE_LIMIT_PER_MINUTE = 30;
+var APP_TARGET_OWNER_SCAN_LIMIT_P1 = 30;
+var APP_TARGET_OWNER_SCAN_LIMIT_P2 = 200;
+var APP_PRIVATE_COPY_MAX_SIZE_KB = 512e3;
+var APP_PRIVATE_COPY_NAME_ATTEMPTS = 5;
+var APP_CREATE_LOCK_TTL_MS = 12e4;
+var APP_CREATE_IDEMPOTENCY_WINDOW_MS = 6e5;
+var APP_CREATE_RESPONSE_BUDGET_MS = 1e4;
+var APP_REPOSITORY_URL_MAX_LENGTH = 400;
+function appRepositoryUrlLengthExceeded(repositoryUrl) {
+  return typeof repositoryUrl !== "string" || repositoryUrl.length > APP_REPOSITORY_URL_MAX_LENGTH;
+}
+
+// src/apps/app-runtime.ts
+var APP_DEPLOY_TARGETS = APP_DEPLOY_TARGET_CHOICES;
+var APP_DEPLOY_PURPOSES = ["deploy", "verification"];
+var APP_DEPLOY_PHASES = [
+  "prepare",
+  "pre-deploy-jobs",
+  "rollout",
+  "first-deploy-jobs",
+  "in-cluster-smoke",
+  "publish",
+  "public-smoke",
+  "post-deploy-jobs",
+  "cron",
+  "rollback",
+  "done"
+];
+var APP_DEPLOY_OUTCOMES = [
+  "succeeded",
+  "succeeded-with-warnings",
+  "failed",
+  "rolled-back",
+  "cancelled",
+  "rollback-failed"
+];
+var APP_CANCEL_REASONS = ["user", "quarantined", "app_work_deleting"];
+var APP_DEPLOYMENT_STATES = [
+  "INITIALIZING",
+  "QUEUED",
+  "BUILDING",
+  "DEPLOYING",
+  "VERIFYING",
+  "READY",
+  "ERROR",
+  "CANCELED",
+  "TIMEOUT",
+  "ROLLED_BACK",
+  "SUPERSEDED"
+];
+var APP_DEPLOYMENT_TERMINAL_STATES = [
+  "READY",
+  "ERROR",
+  "CANCELED",
+  "TIMEOUT",
+  "ROLLED_BACK",
+  "SUPERSEDED"
+];
+var APP_DEPLOYMENT_DISPLAY_STATES = [
+  "queued",
+  "deploying",
+  "checking",
+  "live",
+  "live-with-warnings",
+  "failed",
+  "rolled-back",
+  "cancelled",
+  "cancelled-quarantined",
+  "skipped"
+];
+var APP_RUNTIME_STATES = [
+  "not-deployed",
+  "live",
+  "degraded",
+  "down",
+  "unreachable",
+  "paused",
+  "deleting"
+];
+var APP_RUNTIME_HEALTH = ["unknown", "healthy", "degraded", "down", "unreachable"];
+var APP_PRECONDITION_CODES = [
+  "spec_invalid",
+  "license_blocks_target",
+  "license_attestation_missing",
+  "env_required_unset",
+  "dependency_not_ready",
+  "no_green_build",
+  "no_green_build_for_head",
+  "build_image_missing",
+  "nothing_to_deploy",
+  "image_not_pinned",
+  "image_not_found",
+  "image_private_unsupported",
+  "image_unresolvable",
+  "primary_domain_missing",
+  "target_none",
+  "target_not_checked",
+  "cluster_changed_unconfirmed",
+  "managed_disabled",
+  "managed_scope_unverified_blueprint",
+  "quota_exceeded",
+  "managed_ineligible",
+  "managed_sandbox_unavailable",
+  "app_work_deleting",
+  "paused",
+  "deploy_in_progress",
+  "cron_auth_env_unset",
+  "job_auth_env_unset",
+  "volume_replicas",
+  "volume_shrink",
+  "privileged_port",
+  "cron_too_frequent",
+  "managed_root_forbidden",
+  "image_user_unverifiable",
+  "worker_not_isolated",
+  "env_source_unavailable",
+  "pull_credential_unavailable",
+  "namespace_foreign",
+  "verification_namespace_forbidden"
+];
+var APP_PRECONDITION_STATES = {
+  spec_invalid: APP_RUNTIME_STATES,
+  license_blocks_target: APP_RUNTIME_STATES,
+  license_attestation_missing: APP_RUNTIME_STATES,
+  env_required_unset: APP_RUNTIME_STATES,
+  dependency_not_ready: APP_RUNTIME_STATES,
+  no_green_build: APP_RUNTIME_STATES,
+  no_green_build_for_head: APP_RUNTIME_STATES,
+  build_image_missing: APP_RUNTIME_STATES,
+  nothing_to_deploy: APP_RUNTIME_STATES,
+  image_not_pinned: APP_RUNTIME_STATES,
+  image_not_found: APP_RUNTIME_STATES,
+  image_private_unsupported: APP_RUNTIME_STATES,
+  image_unresolvable: APP_RUNTIME_STATES,
+  primary_domain_missing: APP_RUNTIME_STATES,
+  target_none: APP_RUNTIME_STATES,
+  target_not_checked: APP_RUNTIME_STATES,
+  cluster_changed_unconfirmed: APP_RUNTIME_STATES,
+  managed_disabled: APP_RUNTIME_STATES,
+  managed_scope_unverified_blueprint: APP_RUNTIME_STATES,
+  quota_exceeded: APP_RUNTIME_STATES,
+  managed_ineligible: APP_RUNTIME_STATES,
+  managed_sandbox_unavailable: APP_RUNTIME_STATES,
+  app_work_deleting: ["deleting"],
+  paused: ["paused"],
+  deploy_in_progress: APP_RUNTIME_STATES,
+  cron_auth_env_unset: APP_RUNTIME_STATES,
+  job_auth_env_unset: APP_RUNTIME_STATES,
+  volume_replicas: APP_RUNTIME_STATES,
+  volume_shrink: APP_RUNTIME_STATES,
+  privileged_port: APP_RUNTIME_STATES,
+  cron_too_frequent: APP_RUNTIME_STATES,
+  managed_root_forbidden: APP_RUNTIME_STATES,
+  image_user_unverifiable: APP_RUNTIME_STATES,
+  worker_not_isolated: APP_RUNTIME_STATES,
+  env_source_unavailable: APP_RUNTIME_STATES,
+  pull_credential_unavailable: APP_RUNTIME_STATES,
+  namespace_foreign: APP_RUNTIME_STATES,
+  verification_namespace_forbidden: APP_RUNTIME_STATES
+};
+var APP_PRECONDITION_MESSAGE_LEAVES = {
+  spec_invalid: "specInvalid",
+  license_blocks_target: "licenseBlocksTarget",
+  license_attestation_missing: "licenseAttestationMissing",
+  env_required_unset: "envRequiredUnset",
+  dependency_not_ready: "dependencyNotReady",
+  no_green_build: "noGreenBuild",
+  no_green_build_for_head: "noGreenBuildForHead",
+  build_image_missing: "buildImageMissing",
+  nothing_to_deploy: "nothingToDeploy",
+  image_not_pinned: "imageNotPinned",
+  image_not_found: "imageNotFound",
+  image_private_unsupported: "imagePrivateUnsupported",
+  image_unresolvable: "imageUnresolvable",
+  primary_domain_missing: "primaryDomainMissing",
+  target_none: "targetNone",
+  target_not_checked: "targetNotChecked",
+  cluster_changed_unconfirmed: "clusterChangedUnconfirmed",
+  managed_disabled: "managedDisabled",
+  managed_scope_unverified_blueprint: "managedScopeUnverifiedBlueprint",
+  quota_exceeded: "quotaExceeded",
+  managed_ineligible: "managedIneligible",
+  managed_sandbox_unavailable: "managedSandboxUnavailable",
+  app_work_deleting: "appWorkDeleting",
+  paused: "paused",
+  deploy_in_progress: "deployInProgress",
+  cron_auth_env_unset: "cronAuthEnvUnset",
+  job_auth_env_unset: "jobAuthEnvUnset",
+  volume_replicas: "volumeReplicas",
+  volume_shrink: "volumeShrink",
+  privileged_port: "privilegedPort",
+  cron_too_frequent: "cronTooFrequent",
+  managed_root_forbidden: "managedRootForbidden",
+  image_user_unverifiable: "imageUserUnverifiable",
+  worker_not_isolated: "workerNotIsolated",
+  env_source_unavailable: "envSourceUnavailable",
+  pull_credential_unavailable: "pullCredentialUnavailable",
+  namespace_foreign: "namespaceForeign",
+  verification_namespace_forbidden: "verificationNamespaceForbidden"
+};
+var APP_FAILURE_CODES = [
+  "crash_loop",
+  "oom_killed",
+  "image_pull",
+  "create_container_config",
+  "rollout_timeout",
+  "job_failed",
+  "smoke_failed",
+  "publish_failed",
+  "rollback_failed",
+  "cluster_unreachable",
+  "worker_failed",
+  "isolation_not_enforced",
+  "managed_root_forbidden",
+  "image_user_unverifiable",
+  "deadline_exceeded",
+  "image_not_found",
+  "image_private_unsupported",
+  "image_unresolvable"
+];
+var APP_FAILURE_MESSAGE_LEAVES = {
+  crash_loop: "crashLoop",
+  oom_killed: "oomKilled",
+  image_pull: "imagePull",
+  create_container_config: null,
+  rollout_timeout: "rolloutTimeout",
+  job_failed: "jobFailed",
+  smoke_failed: "smokeFailed",
+  publish_failed: "publishFailed",
+  rollback_failed: "rollbackFailed",
+  cluster_unreachable: null,
+  worker_failed: null,
+  isolation_not_enforced: null,
+  managed_root_forbidden: "imageRunsAsRoot",
+  image_user_unverifiable: "imageUserUnverifiable",
+  deadline_exceeded: null,
+  image_not_found: "imageNotFound",
+  image_private_unsupported: "imagePrivateUnsupported",
+  image_unresolvable: "imageUnresolvable"
+};
+var APP_FAILURE_CODES_WITHOUT_MESSAGE_LEAF = [
+  "create_container_config",
+  "cluster_unreachable",
+  "worker_failed",
+  "isolation_not_enforced",
+  "deadline_exceeded"
+];
+var APP_FAILURE_LEAVES_WITHOUT_FAILURE_CODE = ["imageNotPinned"];
+var APP_DEPLOY_REQUEST_BUDGET_MS = 2e3;
+var APP_PREPARE_TIMEOUT_S = 120;
+var APP_JOB_TIMEOUT_DEFAULT_S = 600;
+var APP_ROLLOUT_EXTRA_S = 120;
+var APP_ROLLOUT_MIN_S = 300;
+var APP_ROLLOUT_MAX_S = 2400;
+var APP_ROLLOUT_POLL_S = 5;
+var APP_ROLLOUT_RESTARTS_FAIL = 3;
+var APP_ROLLOUT_STUCK_POD_S = 180;
+var APP_WORKER_STABLE_S = 30;
+var APP_SMOKE_IN_CLUSTER_WINDOW_S = 120;
+var APP_SMOKE_RETRY_S = 10;
+var APP_SMOKE_PUBLIC_FIRST_WINDOW_S = 600;
+var APP_SMOKE_PUBLIC_WINDOW_S = 180;
+var APP_SMOKE_BODY_BYTES = 1048576;
+var APP_SMOKE_FOUND_CHARS = 200;
+var APP_PUBLISH_TIMEOUT_S = 60;
+var APP_DEPLOY_MAX_DURATION_S = 7200;
+var APP_ENV_SECRETS_KEPT = 3;
+var APP_ROLLBACK_CANDIDATES = 20;
+var APP_JOB_RUNS_KEPT = 3;
+var APP_JOB_TTL_S = 86400;
+var APP_TMP_SIZE_MI = 256;
+var APP_PAUSE_TIMEOUT_S = 120;
+var APP_REMOVE_TIMEOUT_S = 300;
+var APP_HEALTH_POLL_S = 60;
+var APP_HEALTH_BATCH = 500;
+var APP_HEALTH_POLL_TIMEOUT_S = 20;
+var APP_HEALTH_CLUSTER_CONCURRENCY = 5;
+var APP_HEALTH_FAILS_TO_NOTIFY = 5;
+var APP_HEALTH_PASSES_TO_RECOVER = 3;
+var APP_HEALTH_UNREACHABLE_POLLS = 10;
+var APP_HEALTH_NOTIFY_DEDUPE_H = 6;
+var APP_STATUS_STALE_S = 180;
+var APP_STATUS_REFRESH_MIN_S = 15;
+var APP_CERT_NOTIFY_AFTER_MIN = 30;
+var APP_LOG_LINES_DEFAULT = 200;
+var APP_LOG_LINES_MAX = 500;
+var APP_LOG_BYTES_MAX = 262144;
+var APP_LOG_CACHE_S = 300;
+var APP_LOG_REDACT_MIN_CHARS = 8;
+var APP_CLUSTER_CHECK_TIMEOUT_S = 30;
+var APP_CLUSTER_DIAL_TIMEOUT_S = 10;
+var APP_ISOLATION_PROBE_TIMEOUT_S = 3;
+var APP_DOMAIN_RECONCILE_S = 60;
+var APP_MANAGED_MAX_PER_USER_DEFAULT = 3;
+var APP_MANAGED_CRON_MIN_INTERVAL_MIN = 5;
+var APP_SUBDOMAIN_LABEL_MIN = 3;
+var APP_PREVIEWS_MAX = 3;
+var APP_PREVIEW_CLOSE_REMOVE_MIN = 10;
+var APP_PREVIEW_IDLE_H = 72;
+var APP_DEPLOY_LOCK_STALE_S = APP_DEPLOY_MAX_DURATION_S + 60;
+function probeToleranceSeconds(probe) {
+  const period = Number.isFinite(probe.periodSeconds) ? Math.max(0, probe.periodSeconds) : 0;
+  const threshold = Number.isFinite(probe.failureThreshold) ? Math.max(0, probe.failureThreshold) : 0;
+  const tolerance = period * threshold;
+  return Number.isFinite(tolerance) ? tolerance : 0;
+}
+function appComponentDeadlineSeconds(input) {
+  const total = probeToleranceSeconds(input.startup) + probeToleranceSeconds(input.readiness) + APP_ROLLOUT_EXTRA_S;
+  return Math.min(APP_ROLLOUT_MAX_S, Math.max(APP_ROLLOUT_MIN_S, total));
+}
+
+// src/apps/app-spec-issues.ts
+var APP_SPEC_FILE_MAX_BYTES = 262144;
+var APP_SPEC_MAX_ISSUES = 200;
+var APP_SPEC_YAML_MAX_ALIASES = 100;
+var APP_SPEC_MAX_DEPTH = 12;
+var APP_SPEC_SUGGESTION_MAX_DISTANCE = 2;
+var APP_SPEC_SEVERITIES = ["error", "warning"];
+var APP_SPEC_VALIDATION_STATUSES = [
+  "valid",
+  "valid_with_warnings",
+  "invalid",
+  "missing",
+  "unreadable"
+];
+var APP_SPEC_VALIDATION_MODES = ["draft", "data-repository", "blueprint"];
+var APP_SPEC_ISSUE_CODES = [
+  // Structural (schema.md §23:538-543)
+  "yaml_syntax",
+  "file_too_large",
+  "yaml_alias_limit",
+  "duplicate_key",
+  "kind_mismatch",
+  "required",
+  "invalid_type",
+  "invalid_enum",
+  "out_of_range",
+  "pattern",
+  "unknown_field",
+  "unknown_field_newer_version",
+  "blueprint_mode_forbidden_key",
+  "pattern_unsupported",
+  "prompt_example_secret",
+  "generated_not_secret",
+  "worker_port_forbidden",
+  "worker_probe_without_port",
+  "http_job_requires_web_component",
+  "public_bucket_undeclared",
+  "extension_unavailable",
+  "cron_invalid",
+  "reference_syntax",
+  "template_cycle",
+  "template_too_deep",
+  "blueprint_repo_outside_org",
+  // Rule codes (schema.md §22:455-481, R1 → R27)
+  "web_component_needs_port",
+  "strategy_requires_components",
+  "components_require_strategy",
+  "primary_component_invalid",
+  "duplicate_name",
+  "reference_unresolved",
+  "secret_reference_not_secret",
+  "phase_mismatch",
+  "env_source_count",
+  "literal_secret_value",
+  "generate_validate_conflict",
+  "literal_secret_in_build_args",
+  "secret_build_arg",
+  "upstream_pr_approval_required",
+  "upstream_forbidden_for_link",
+  "upstream_sync_requires_upstream",
+  "upstream_prs_require_fork",
+  "component_ref_unknown",
+  "auth_env_not_secret",
+  "limit_below_request",
+  "volume_replicas",
+  "image_not_pinned",
+  "advisory_check",
+  "schedule_too_frequent",
+  "path_outside_repository",
+  "reserved_env_name",
+  "license_declared_mismatch",
+  "keypair_format_unsupported",
+  "keypair_password_invalid",
+  "sourceOfferMissing",
+  // Server-only rules (schema.md §22:483-488)
+  "source_relation_mismatch",
+  "blueprint_unknown",
+  "build_strategy_unavailable",
+  "dependency_unavailable",
+  "tracked_branch_missing"
+];
+
+// src/apps/app-spec.types.ts
+var APP_SPEC_VERSION = 1;
+var APP_SPEC_EVALUATE_COALESCE_MS = 5e3;
+var APP_SPEC_LAZY_HEAD_CHECK_MS = 6e4;
+var APP_SPEC_DRAFT_VALIDATE_PER_MIN = 30;
+var APP_SPEC_REFRESH_PER_MIN = 6;
+var APP_SPEC_MAX_PROTECTED_PATHS = 50;
+var APP_SPEC_MAX_REQUIRE_HUMAN_MERGE_PATHS = 50;
+var APP_SPEC_PUBLIC_KEY_SUFFIX = "_PUBLIC";
+var APP_SPEC_SOURCE_RELATIONS = ["fork", "private-copy", "link"];
+var APP_SPEC_BUILD_STRATEGIES = ["dockerfile", "image", "auto", "none"];
+var APP_SPEC_COMPONENT_ROLES = ["web", "worker"];
+var APP_SPEC_PROBE_KINDS = ["startup", "readiness", "liveness"];
+var APP_SPEC_ENV_PHASES = ["runtime", "build", "both"];
+var APP_SPEC_GENERATE_KINDS = ["base64", "hex", "chars", "uuid", "keypair"];
+var APP_SPEC_GENERATE_ALPHABETS = ["alnum", "alnum-symbols", "hex-lower", "base64url"];
+var APP_SPEC_GENERATE_ROTATIONS = ["never"];
+var APP_SPEC_KEYPAIR_TYPES = ["ed25519", "ec-p256", "rsa-2048", "rsa-4096"];
+var APP_SPEC_KEYPAIR_FORMATS = ["pem", "base64url-raw", "pkcs12"];
+var APP_SPEC_JOB_WHENS = ["pre-deploy", "first-deploy", "post-deploy"];
+var APP_SPEC_HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var APP_SPEC_HTTP_AUTH_SCHEMES = ["bearer", "raw"];
+var APP_SPEC_CRON_CONCURRENCIES = ["forbid", "allow"];
+var APP_SPEC_DOMAIN_CHANGES = ["restart", "rebuild"];
+var APP_SPEC_SMOKE_HTTP_METHODS = ["GET", "HEAD", "POST"];
+var APP_SPEC_SMOKE_WHENS = ["always", "first-deploy"];
+var APP_SPEC_UPSTREAM_SYNC_MODES = ["merge"];
+var APP_SPEC_POSTGRES_VERSIONS = ["14", "15", "16", "17"];
+var APP_SPEC_REDIS_VERSIONS = ["7"];
+var APP_SPEC_REDIS_MAXMEMORY_POLICIES = [
+  "noeviction",
+  "allkeys-lru",
+  "volatile-lru",
+  "allkeys-lfu",
+  "volatile-lfu"
+];
+var APP_SPEC_EVALUATION_TRIGGERS = [
+  "created",
+  "push",
+  "pr_merged",
+  "manual",
+  "lazy",
+  "blueprint_applied",
+  "build"
+];
+var APP_SPEC_BLOCK_DEFAULTS = {
+  // §8 display
+  "display.protectedPaths": [],
+  // §9 build
+  "build.dockerfile": "Dockerfile",
+  "build.context": ".",
+  "build.args": [],
+  "build.services": [],
+  "build.resources.cpu": 2,
+  "build.resources.memory": "7Gi",
+  "build.resources.timeoutMinutes": 60,
+  // §10 components
+  "components[].replicas": 1,
+  "components[].writableRootFilesystem": false,
+  "components[].probes.startup.periodSeconds": 10,
+  "components[].probes.startup.timeoutSeconds": 5,
+  "components[].probes.startup.initialDelaySeconds": 0,
+  "components[].probes.startup.failureThreshold": 30,
+  "components[].probes.readiness.periodSeconds": 10,
+  "components[].probes.readiness.timeoutSeconds": 5,
+  "components[].probes.readiness.initialDelaySeconds": 0,
+  "components[].probes.readiness.failureThreshold": 3,
+  "components[].probes.liveness.periodSeconds": 10,
+  "components[].probes.liveness.timeoutSeconds": 5,
+  "components[].probes.liveness.initialDelaySeconds": 0,
+  "components[].probes.liveness.failureThreshold": 3,
+  "components[].resources.cpu": "250m",
+  "components[].resources.memory": "512Mi",
+  "components[].volumes": [],
+  "components[].volumes[].backup": true,
+  // §11 dependencies
+  "dependencies.postgres.version": "16",
+  "dependencies.postgres.directUrl": false,
+  "dependencies.postgres.extensions": [],
+  "dependencies.redis.version": "7",
+  "dependencies.redis.maxmemoryPolicy": "noeviction",
+  "dependencies.redis.persistence": false,
+  "dependencies.objectStorage.publicBuckets": [],
+  "dependencies.smtp.required": false,
+  // §12 env
+  "env[].secret": false,
+  "env[].phase": "runtime",
+  "env[].generate.bytes": 32,
+  "env[].generate.length": 32,
+  "env[].generate.alphabet": "alnum",
+  "env[].generate.keypair.type": "ed25519",
+  "env[].generate.keypair.format": "pem",
+  "env[].generate.rotate": "never",
+  "env[].prompt.required": true,
+  // §13 jobs
+  "jobs[].http.method": "POST",
+  "jobs[].http.authScheme": "bearer",
+  "jobs[].http.expect.status": [200, 201, 204],
+  "jobs[].timeoutSeconds": 600,
+  "jobs[].retries": 0,
+  // §14 cron
+  "cron[].http.method": "POST",
+  "cron[].http.authScheme": "bearer",
+  "cron[].http.expect.status": [200, 201, 204],
+  "cron[].timeoutSeconds": 300,
+  "cron[].concurrency": "forbid",
+  // §15 domains
+  "domains.publicUrlEnv": [],
+  "domains.onChange": "restart",
+  "domains.needsHairpin": false,
+  // §16 smoke
+  "smoke[].http.method": "GET",
+  "smoke[].expect.status": [200],
+  "smoke[].expect.bodyContains": [],
+  "smoke[].expect.bodyNotContains": [],
+  "smoke[].expect.maxLatencyMs": 1e4,
+  "smoke[].when": "always",
+  // §17 checks
+  "checks[].required": true,
+  "checks[].timeoutSeconds": 1800,
+  // §18 agents
+  "agents.instructionFiles": [],
+  "agents.maxPullRequestChangedLines": 500,
+  "agents.maxPullRequestChangedFiles": 50,
+  "agents.requireHumanMergePaths": [],
+  // §19 upstreamSync
+  "upstreamSync.enabled": true,
+  "upstreamSync.schedule": "0 6 * * 1",
+  "upstreamSync.mode": "merge",
+  // §20 upstreamPullRequests, provisioning
+  "upstreamPullRequests.enabled": false,
+  "upstreamPullRequests.requireApproval": true,
+  "upstreamPullRequests.maxOpen": 3,
+  "provisioning.autoReprovision": false
+};
+var APP_SPEC_EXTENSION_KEY_PREFIX = "x-";
+var APP_SPEC_SOURCE_ONLY_KEYS = ["kind", "appSpecVersion", "source"];
+function isSourceOnlyAppSpec(spec) {
+  if (typeof spec !== "object" || spec === null || Array.isArray(spec)) {
+    return false;
+  }
+  const allowed = APP_SPEC_SOURCE_ONLY_KEYS;
+  for (const key of Object.keys(spec)) {
+    if (key.startsWith(APP_SPEC_EXTENSION_KEY_PREFIX)) {
+      continue;
+    }
+    if (!allowed.includes(key)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// src/apps/app-upstream.ts
+var APP_READINESS_STATES = ["preparing", "ready", "timed_out", "failed", "waiting_for_setup_pr"];
+var APP_SYNC_RESULTS = [
+  "up_to_date",
+  "fast_forwarded",
+  "pull_request_opened",
+  "pull_request_updated",
+  "conflict",
+  "skipped",
+  "paused",
+  "failed"
+];
+var APP_SYNC_REASONS = [
+  "up_to_date",
+  "fast_forwarded",
+  "pull_request_opened",
+  "pull_request_updated",
+  "pull_request_merged",
+  "pull_request_closed",
+  "conflict",
+  "held_for_workflow_review",
+  "skipped_rate_limited",
+  "skipped_budget",
+  "license_worse",
+  "disabled_by_spec",
+  "paused",
+  "provider_unsupported",
+  "failed"
+];
+var APP_READINESS_FAILURE_REASONS = [
+  "access_revoked",
+  "dispatch_unavailable",
+  "copy_refused",
+  "too_large",
+  "provider_unsupported",
+  "timed_out",
+  "setup_pull_request_closed",
+  "handler_failed",
+  "blueprint_apply_failed",
+  "data_repository_missing"
+];
+var APP_UPSTREAM_WARNING_CODES = [
+  "upstreamArchived",
+  "upstreamUnavailable",
+  "forkMissing",
+  "privateCopyMissing",
+  "rateLimited",
+  "defaultBranchRenamed",
+  "privateCopyTooLarge",
+  "historyRewritten",
+  "needsAdmin",
+  "appPermissionMissing",
+  "notReady",
+  "workflowsGated"
+];
+var APP_UPSTREAM_STATUSES = ["available", "archived", "unavailable", "none", "unknown"];
+var APP_ACTIONS_STATES = [
+  "pending",
+  "clean",
+  "needs_admin",
+  "permission_missing",
+  "failed",
+  "not_applicable"
+];
+var APP_FORK_READINESS_REASONS = ["initial", "retry", "redispatch", "setup_merged"];
+var APP_FORK_READINESS_POLL_DELAYS_MS = [2e3, 4e3, 8e3, 15e3];
+var APP_FORK_READINESS_POLL_INTERVAL_MS = 15e3;
+var APP_FORK_READINESS_TIMEOUT_MS = 9e5;
+var APP_FORK_READINESS_READY_LATENCY_MS = 3e4;
+var APP_FORK_READINESS_MANUAL_RETRIES_PER_HOUR = 3;
+var APP_FORK_READINESS_MAX_REDISPATCH = 3;
+var APP_FORK_READINESS_IDLE_MS = 6e5;
+var APP_FORK_READINESS_TIMEOUT_OVERRIDE_MIN_MS = 5e3;
+var APP_FORK_READINESS_TIMEOUT_ENV = "EVER_WORKS_APP_FORK_READINESS_TIMEOUT_MS";
+var APP_SETUP_PR_CHECK_ON_VIEW_MIN_INTERVAL_MS = 6e4;
+var APP_SETUP_PR_CHECK_BATCH = 50;
+var APP_UPSTREAM_SYNC_DEFAULT_SCHEDULE = "0 6 * * 1";
+var APP_UPSTREAM_SYNC_MIN_INTERVAL_MS = 36e5;
+var APP_UPSTREAM_SYNC_JITTER_MAX_MS = 3e5;
+var APP_UPSTREAM_SYNC_MANUAL_PER_HOUR = 6;
+var APP_UPSTREAM_SYNC_ACK_BUDGET_MS = 2e3;
+var APP_UPSTREAM_SYNC_LOCK_TTL_MS = 18e5;
+var APP_UPSTREAM_SYNC_DISPATCH_CRON = "*/10 * * * *";
+var APP_UPSTREAM_SYNC_DISPATCH_BATCH = 50;
+var APP_UPSTREAM_SYNC_MAX_PROVIDER_CALLS = 20;
+var APP_UPSTREAM_SYNC_BRANCH = "ever-works/upstream-sync";
+var APP_UPSTREAM_CONFLICT_LABEL_PREFIX = "app-upstream-conflict:";
+var APP_UPSTREAM_CONFLICT_MAX_PATHS = 50;
+var APP_ACTIONS_HYGIENE_MAX_WORKFLOWS = 100;
+var APP_RATE_LIMIT_MIN_REMAINING = 300;
+var APP_RATE_LIMIT_RESET_GRACE_MS = 6e4;
+var APP_RATE_LIMIT_BACKOFF_BASE_MS = 6e4;
+var APP_RATE_LIMIT_BACKOFF_MAX_MS = 36e5;
+var APP_RATE_LIMITED_PERSISTENT_AFTER = 3;
+var APP_DIVERGENCE_TTL_MS = 6e5;
+var APP_DIVERGENCE_DAILY_MS = 864e5;
+var APP_BEHIND_EVENT_STEP = 25;
+var APP_UPSTREAM_UNAVAILABLE_RECHECK_MS = 864e5;
+var APP_LICENSE_EVALUATION_REASONS = ["upstream_synced", "upstream_merged", "blueprint_applied"];
+function appManualSyncAllowed(manualSyncsThisHour) {
+  return Number.isFinite(manualSyncsThisHour) && manualSyncsThisHour >= 0 && manualSyncsThisHour < APP_UPSTREAM_SYNC_MANUAL_PER_HOUR;
+}
+function appRateLimitAllowsSync(remainingRequests) {
+  return Number.isFinite(remainingRequests) && remainingRequests >= APP_RATE_LIMIT_MIN_REMAINING;
+}
+
+// src/apps/apps-catalog.types.ts
+var APPS_CATALOG_CACHE_TTL_MS = 36e5;
+var APPS_CATALOG_FAILURE_TTL_MS = 3e4;
+var APPS_CATALOG_FETCH_TIMEOUT_MS = 8e3;
+var APPS_CATALOG_MANIFEST_MAX_BYTES = 2097152;
+var APPS_CATALOG_MAX_ENTRIES = 1e3;
+var APPS_CATALOG_REGISTRY_MAX_BYTES = 262144;
+var APPS_CATALOG_LAST_GOOD_REGISTRY_MS = 7 * 864e5;
+var APPS_CATALOG_PAGE_SIZE = 24;
+var APPS_CATALOG_PAGE_SIZE_MAX = 100;
+var APPS_CATALOG_SEARCH_MIN_CHARS = 2;
+var APPS_CATALOG_README_MAX_BYTES = 65536;
+var APPS_CATALOG_PUBLIC_PER_MIN = 120;
+var APPS_CATALOG_FANOUT_PER_RUN = 500;
+var APPS_CATALOG_REFRESH_CRON = "23 * * * *";
+var BLUEPRINT_RESOLVE_HIT_TTL_MS = 36e5;
+var BLUEPRINT_RESOLVE_MISS_TTL_MS = 6e5;
+var BLUEPRINT_PROBE_MAX_READS = 3;
+var BLUEPRINT_ALTERNATIVES_MAX = 5;
+var BLUEPRINT_OVERLAY_MAX_FILES = 50;
+var BLUEPRINT_OVERLAY_FILE_MAX_BYTES = 1048576;
+var BLUEPRINT_OVERLAY_TOTAL_MAX_BYTES = 5242880;
+var BLUEPRINT_APPLY_RETRIES = 3;
+var BLUEPRINT_APPLY_PER_HOUR = 5;
+var APPS_CATALOG_CATEGORIES = [
+  "analytics",
+  "communication",
+  "content",
+  "crm",
+  "developer-tools",
+  "finance",
+  "forms",
+  "knowledge",
+  "marketing",
+  "productivity",
+  "project-management",
+  "scheduling",
+  "security",
+  "support",
+  "other"
+];
+var APPS_CATALOG_ENTRY_STATUSES = ["production", "beta", "placeholder"];
+var APPS_CATALOG_VERIFICATION_STATUSES = ["candidate", "verified", "at-risk", "not-verified"];
+var APPS_CATALOG_ENTRY_LICENSE_CLASSES = ["green", "amber"];
+var BLUEPRINT_RESOLUTION_REASONS = ["notListed", "lookupFailed", "refMismatch", "blueprintNotFound"];
+
+// src/apps/apps-limits.ts
+var APP_REPOSITORY_STAGES = ["private-copy", "provisioning", "build", "sandbox"];
+var APP_REPOSITORY_STAGE_REFUSAL_CODES = [
+  "too_large_for_private_copy",
+  "uses_lfs",
+  "repository-too-large"
+];
+var APP_REPOSITORY_STAGE_LIMITS = {
+  "private-copy": {
+    maxSizeKb: APP_PRIVATE_COPY_MAX_SIZE_KB,
+    fetchesLfs: false,
+    refusalCodes: ["too_large_for_private_copy", "uses_lfs"]
+  },
+  provisioning: {
+    maxSizeKb: 3 * 1024 * 1024,
+    refusalCodes: ["repository-too-large"]
+  },
+  build: {
+    refusalCodes: []
+  },
+  sandbox: {
+    refusalCodes: []
+  }
+};
+var APP_REPOSITORY_STAGES_WITHOUT_SPEC_LIMIT = ["build", "sandbox"];
+function firstRefusingRepositoryStage(input) {
+  const stages = input.stages ?? APP_REPOSITORY_STAGES;
+  const sizeKnown = typeof input.sizeKb === "number" && Number.isFinite(input.sizeKb) && input.sizeKb >= 0;
+  for (const stage of stages) {
+    const limit = APP_REPOSITORY_STAGE_LIMITS[stage];
+    if (stage === "private-copy" && input.usesLfs === true) {
+      return stage;
+    }
+    if (limit.maxSizeKb === void 0) {
+      continue;
+    }
+    if (!sizeKnown || input.sizeKb > limit.maxSizeKb) {
+      return stage;
+    }
+  }
+  return null;
+}
+var APP_QUOTA_SCOPES = ["member", "org"];
+var APP_WORK_QUOTA_CAPS = {
+  /** Active App Works per member / organization (CONTRACTS.md:658). */
+  activeAppWorks: { member: 25, org: 200, env: "EVER_WORKS_APPS_MAX_ACTIVE" },
+  /** Creates per day (CONTRACTS.md:659). */
+  createsPerDay: { member: 20, org: 100, env: "EVER_WORKS_APPS_MAX_CREATES_PER_DAY" },
+  /** Private copies held, each already bounded by the 500 MB of APW-01 FR-20 (CONTRACTS.md:660). */
+  privateCopies: { member: 10, org: 50, env: "EVER_WORKS_APPS_MAX_PRIVATE_COPIES" }
+};
+function appWorkQuotaAllows(cap, currentCount) {
+  return Number.isFinite(cap) && cap > 0 && Number.isFinite(currentCount) && currentCount < cap;
+}
+
+// src/apps/apps-tier.ts
+var LAUNCH_GATE_ITEM_IDS = [
+  "LG-01",
+  "LG-02",
+  "LG-03",
+  "LG-04",
+  "LG-05",
+  "LG-06",
+  "LG-07",
+  "LG-08",
+  "LG-09",
+  "LG-10",
+  "LG-11",
+  "LG-12",
+  "LG-13",
+  "LG-14",
+  "LG-15",
+  "LG-16",
+  "LG-17",
+  "LG-18",
+  "LG-19",
+  "LG-20",
+  "LG-21",
+  "LG-22",
+  "LG-23",
+  "LG-24",
+  "LG-25"
+];
+var LAUNCH_GATE_KINDS = ["automated", "attested", "both"];
+var LAUNCH_GATE_PHASES = ["P2", "P3"];
+var LAUNCH_GATE_OUTCOMES = ["passed", "failed", "inconclusive", "error"];
+var LAUNCH_GATE_ITEMS = [
+  { id: "LG-01", title: "Dedicated capacity", kind: "attested", phase: "P2" },
+  { id: "LG-02", title: "Network segmentation", kind: "both", phase: "P2" },
+  { id: "LG-03", title: "Separate egress identity", kind: "both", phase: "P2" },
+  { id: "LG-04", title: "Sandboxed runtime, enforced", kind: "automated", phase: "P2" },
+  { id: "LG-05", title: "Restricted pod security by default", kind: "automated", phase: "P2" },
+  { id: "LG-06", title: "Default-deny networking", kind: "automated", phase: "P2" },
+  { id: "LG-07", title: "Egress deny list", kind: "automated", phase: "P2" },
+  { id: "LG-08", title: "Mail and mining ports blocked", kind: "automated", phase: "P2" },
+  { id: "LG-09", title: "Quotas and limits", kind: "automated", phase: "P2" },
+  { id: "LG-10", title: "One namespace per App Work", kind: "automated", phase: "P2" },
+  { id: "LG-11", title: "No platform credentials in tenants", kind: "automated", phase: "P2" },
+  { id: "LG-12", title: "Platform credential is narrow", kind: "automated", phase: "P2" },
+  { id: "LG-13", title: "Image supply chain", kind: "automated", phase: "P2" },
+  { id: "LG-14", title: "Tenant-only data servers", kind: "both", phase: "P2" },
+  { id: "LG-15", title: "User-apps domain", kind: "both", phase: "P2" },
+  { id: "LG-16", title: "Separate edge", kind: "both", phase: "P2" },
+  { id: "LG-17", title: "Custom hostnames", kind: "automated", phase: "P2" },
+  { id: "LG-18", title: "Tenant quarantine drill", kind: "automated", phase: "P2" },
+  { id: "LG-19", title: "Abuse controls", kind: "both", phase: "P2" },
+  { id: "LG-20", title: "Metering flowing", kind: "automated", phase: "P2" },
+  { id: "LG-21", title: "Audit trail", kind: "both", phase: "P2" },
+  { id: "LG-22", title: "Policies from Git, no drift", kind: "automated", phase: "P2" },
+  { id: "LG-23", title: "Controller healthy", kind: "automated", phase: "P2" },
+  { id: "LG-24", title: "Sandboxed in-zone builds", kind: "both", phase: "P3" },
+  { id: "LG-25", title: "Build limits", kind: "automated", phase: "P3" }
+];
+function launchGateItemsForPhase(phase) {
+  return LAUNCH_GATE_ITEMS.filter((item) => item.phase === phase);
+}
+var APPS_TIER_PROBE_REASON_CODES = [
+  "PHASE_NOT_ENABLED",
+  "misconfigured",
+  "PRIVATE_RANGE_REACHABLE",
+  "PLATFORM_ENDPOINT_REACHABLE",
+  "CONTROL_UNREACHABLE",
+  "EGRESS_IDENTITY_SHARED",
+  "SANDBOX_KERNEL_NOT_DETECTED",
+  "UNSANDBOXED_POD_ADMITTED",
+  "PRIVILEGED_POD_ADMITTED",
+  "CROSS_TENANT_REACHABLE",
+  "DIRECT_POD_INGRESS_REACHABLE",
+  "METADATA_REACHABLE",
+  "CONTROL_PLANE_REACHABLE",
+  "MAIL_PORT_OPEN",
+  "MINING_PORT_OPEN",
+  "QUOTA_MISMATCH",
+  "LOADBALANCER_ADMITTED",
+  "OVER_QUOTA_ADMITTED",
+  "NAMESPACE_SHARED",
+  "NAMESPACE_FIELD_ACCEPTED",
+  "SA_TOKEN_PRESENT",
+  "PLANTED_CREDENTIAL_ADMITTED",
+  "CREDENTIAL_TOO_BROAD",
+  "UNSIGNED_IMAGE_ADMITTED",
+  "FOREIGN_IMAGE_ADMITTED",
+  "VULNERABLE_IMAGE_PROMOTED",
+  "CROSS_TENANT_DB_REACHABLE",
+  "CONNECTION_LIMIT_NOT_ENFORCED",
+  "STATEMENT_TIMEOUT_NOT_ENFORCED",
+  "APEX_UNDER_PLATFORM_DOMAIN",
+  "APEX_NOT_ON_PSL",
+  "PSL_UNREACHABLE",
+  "CANARY_TLS_INVALID",
+  "CANARY_UNREACHABLE",
+  "CUSTOM_HOSTNAME_NOT_ACTIVE",
+  "UNREGISTERED_HOST_ADMITTED",
+  "QUARANTINE_ISOLATION_SLOW",
+  "QUARANTINE_SCALE_SLOW",
+  "QUARANTINE_EDGE_SLOW",
+  "QUARANTINE_NOT_ISOLATING",
+  "RELEASE_SLOW",
+  "MARKER_LOST",
+  "BANDWIDTH_LIMIT_MISSING",
+  "SENSOR_SILENT",
+  "SIGNAL_NOT_IMPORTED",
+  "USAGE_REPORT_STALE",
+  "USAGE_IMPORT_STALE",
+  "AUDIT_ROWS_MISSING",
+  "POLICY_DRIFT",
+  "POLICY_MANIFEST_MISSING",
+  "HEARTBEAT_STALE",
+  "CONTROLLER_TOO_OLD",
+  "BUILD_UNSANDBOXED",
+  "BUILD_EGRESS_OPEN",
+  "BUILD_PUSH_CROSS_TENANT",
+  "BUILD_CAP_NOT_ENFORCED"
+];
+var APPS_TIER_STATES = ["closed", "open-verified-blueprints", "open-any"];
+var APPS_TIER_SCOPES = ["verified-blueprints", "any"];
+var APPS_TIER_CLOSED_REASON_CODES = [
+  /** The operator ceiling `EVER_WORKS_APPS_MANAGED_ENABLED` is off — plan §5.4:682. */
+  "CEILING_OFF",
+  /** An operator closed the tier — plan §5.4:683. */
+  "CLOSED_BY_OPERATOR",
+  /** `open-any` was asked for while `EVER_WORKS_APPS_MAX_SCOPE` forbids it — plan §5.4:685. */
+  "SCOPE_NOT_ALLOWED",
+  /** No finished gate run exists — plan §5.4:689. */
+  "NO_RUN",
+  /** The newest run is not green for the scope — plan §5.4:690. */
+  "RUN_NOT_GREEN",
+  /** The newest green run is older than the maximum age — plan §5.4:691. */
+  "RUN_STALE",
+  /** An attested item has no current attestation — plan §5.4:692. */
+  "NOT_ATTESTED",
+  /** An attestation expired — plan §5.4:692. */
+  "ATTESTATION_EXPIRED",
+  /** The controller heartbeat is missing or older than 120 s — plan §5.4:694. */
+  "CONTROLLER_STALE",
+  /** The controller version is below the platform's minimum — plan §5.4:695. */
+  "CONTROLLER_TOO_OLD"
+];
+var APPS_TIER_AUTO_REOPENABLE_REASON_CODES = ["RUN_STALE", "CONTROLLER_STALE"];
+var APPS_TIER_POLICY_DEFAULT_SCOPE = "verified-blueprints";
+function isSemverLessThan(left, right) {
+  const parse = (version) => {
+    const withoutPrefix = version.replace(/^v/, "");
+    const [core, ...rest] = withoutPrefix.split("-");
+    return {
+      parts: core.split(".").map((part) => Number.parseInt(part, 10) || 0),
+      prerelease: rest.length > 0 ? rest.join("-") : null
+    };
+  };
+  const a = parse(left);
+  const b = parse(right);
+  for (let index = 0; index < Math.max(a.parts.length, b.parts.length); index += 1) {
+    const difference = (a.parts[index] ?? 0) - (b.parts[index] ?? 0);
+    if (difference !== 0) return difference < 0;
+  }
+  if (a.prerelease === null && b.prerelease === null) return false;
+  if (a.prerelease !== null && b.prerelease === null) return true;
+  if (a.prerelease === null && b.prerelease !== null) return false;
+  return (a.prerelease ?? "") < (b.prerelease ?? "");
+}
+function evaluateAppsTierPolicyState(input) {
+  const closed = (scope2, reasons2) => ({
+    open: false,
+    scope: scope2,
+    reasons: reasons2,
+    autoReopenable: false
+  });
+  if (!input.ceilingEnabled) return closed(APPS_TIER_POLICY_DEFAULT_SCOPE, ["CEILING_OFF"]);
+  if (input.lastEvent === null) return closed(APPS_TIER_POLICY_DEFAULT_SCOPE, ["CLOSED_BY_OPERATOR"]);
+  if (input.lastEvent.state === "closed") {
+    return closed(
+      APPS_TIER_POLICY_DEFAULT_SCOPE,
+      input.lastEvent.automatic ? input.lastEvent.reasonCodes : ["CLOSED_BY_OPERATOR"]
+    );
+  }
+  const scope = input.lastEvent.state === "open-any" ? "any" : "verified-blueprints";
+  if (scope === "any" && input.maxScope !== "any") return closed(scope, ["SCOPE_NOT_ALLOWED"]);
+  const maxAgeMs = Math.min(input.gateMaxAgeHours, GATE_MAX_AGE_HOURS) * 36e5;
+  const reasons = [];
+  const run = input.latestRun;
+  if (run === null) {
+    reasons.push("NO_RUN");
+  } else if (run.status !== "green" || run.coversScope !== "any" && run.coversScope !== scope) {
+    reasons.push("RUN_NOT_GREEN");
+  } else if (input.now - run.finishedAtEpochMs > maxAgeMs) {
+    reasons.push("RUN_STALE");
+  }
+  reasons.push(...input.attestationReasons);
+  if (input.controllerRenewedAtEpochMs === null || input.now - input.controllerRenewedAtEpochMs > HEARTBEAT_MAX_AGE_MS) {
+    reasons.push("CONTROLLER_STALE");
+  }
+  if (isSemverLessThan(input.controllerVersion, input.controllerMinVersion)) reasons.push("CONTROLLER_TOO_OLD");
+  if (reasons.length === 0) return { open: true, scope, reasons, autoReopenable: false };
+  return {
+    open: false,
+    scope,
+    reasons,
+    autoReopenable: reasons.every(
+      (reason) => APPS_TIER_AUTO_REOPENABLE_REASON_CODES.includes(reason)
+    )
+  };
+}
+var APPS_TIER_ELIGIBILITY_REASONS = [
+  "emailUnverified",
+  "planRequired",
+  "ownerQuarantined",
+  "capReached",
+  "tierClosed"
+];
+var APPS_TIER_ELIGIBILITY_DISABLED_REASONS = ["tierClosed"];
+var APPS_TIER_QUARANTINE_CATEGORIES = ["abuse", "security", "billing", "legal", "pause-all", "drill"];
+var APPS_TIER_QUARANTINE_SOURCES = ["operator", "detector", "self-check"];
+var APPS_TIER_BILLING_QUARANTINE_CATEGORY = "billing";
+var APPS_TIER_PAUSE_ALL_CATEGORY = "security";
+var APPS_TIER_PAUSE_ALL_CONFIRMATION = "PAUSE ALL";
+var APPS_TIER_SIGNAL_KINDS = ["runtime", "mining", "mail", "bandwidth", "report"];
+var APPS_TIER_SIGNAL_SEVERITIES = ["low", "medium", "high"];
+var APPS_TIER_API_GROUP = "hosting.ever.works";
+var APPS_TIER_API_VERSION = "v1alpha1";
+var APPS_TIER_CONTROL_NAMESPACE_DEFAULT = "ever-works-apps-control";
+var APPS_TIER_WORK_NAME_PREFIX = "w-";
+var APPS_TIER_TENANT_NAMESPACE_PREFIX = "ewa-";
+var APPS_TIER_WORK_OWNER_LABEL = "hosting.ever.works/owner";
+var APPS_TIER_WORK_CANARY_LABEL = "hosting.ever.works/canary";
+var APPS_TIER_QUARANTINED_LABEL = "hosting.ever.works/quarantined";
+var APPS_TIER_TENANT_LABEL = "hosting.ever.works/tenant";
+var APPS_TIER_WORK_ID_LABEL = "hosting.ever.works/work-id";
+var APPS_TIER_ALLOWED_HOSTS_ANNOTATION = "hosting.ever.works/allowed-hosts";
+var APPS_TIER_RETAINED_UNTIL_LABEL = "hosting.ever.works/retained-until";
+var APPS_TIER_RUN_JOB_ANNOTATION = "hosting.ever.works/run-job";
+var APPS_TIER_WORK_DESIRED_STATES = ["running", "paused", "quarantined", "removed"];
+var APPS_TIER_WORK_PHASES = [
+  "Pending",
+  "Promoting",
+  "Provisioning",
+  "Ready",
+  "Degraded",
+  "Paused",
+  "Quarantined",
+  "Refused",
+  "Failed",
+  "Removed"
+];
+var APPS_TIER_DEPLOY_PHASES = [
+  "prepare",
+  "pre-deploy-jobs",
+  "rollout",
+  "first-deploy-jobs",
+  "in-cluster-smoke",
+  "publish",
+  "public-smoke",
+  "post-deploy-jobs",
+  "cron",
+  "done"
+];
+var APPS_TIER_COMPONENT_ROLES = ["web", "worker"];
+var APPS_TIER_JOB_PHASES = ["pre-deploy", "first-deploy", "post-deploy"];
+var APPS_TIER_JOB_STATUSES = ["succeeded", "failed", "timeout", "running"];
+var APPS_TIER_SMOKE_SCOPES = ["in-cluster", "public"];
+var APPS_TIER_SMOKE_STATUSES = ["passed", "failed", "skipped"];
+var APPS_TIER_DEPENDENCY_PHASES = ["pending", "ready", "failed", "released"];
+var APPS_TIER_WORK_REFUSAL_CODES = [
+  "SPEC_LIMIT_EXCEEDED",
+  "NAMESPACE_FIELD_FORBIDDEN",
+  "QUOTA_PROFILE_UNKNOWN",
+  "PLATFORM_CREDENTIAL_IN_ENV",
+  "IMAGE_NOT_DIGEST_PINNED",
+  "IMAGE_SCAN_BLOCKED",
+  "IMAGE_UNSIGNED",
+  "IMAGE_OUTSIDE_TENANT_REGISTRY",
+  "HOST_NOT_VERIFIED",
+  "HOST_CLAIMED",
+  "SEALED_PAYLOAD_INVALID",
+  "CRON_TOO_FREQUENT",
+  /** An `ew-dep://` token the zone cannot resolve — CONTRACTS §3:371. */
+  "DEPENDENCY_TOKEN_UNKNOWN",
+  /** The zone cannot prove the isolation the Work requires — plan §3.1:277–280. */
+  "ISOLATION_NOT_ENFORCED"
+];
+var APPS_TIER_WORK_DEGRADED_REASONS = ["IMAGE_RUNS_AS_ROOT", "QUOTA_EXCEEDED"];
+var APPS_TIER_MAX_COMPONENTS = 8;
+var APPS_TIER_MAX_JOBS = 10;
+var APPS_TIER_MAX_CRON = 10;
+var APPS_TIER_MAX_SMOKE = 20;
+var APPS_TIER_MAX_HOSTS = 20;
+var APPS_TIER_MAX_ENV_NAMES = 200;
+var APPS_TIER_MAX_COMPONENT_VOLUMES = 4;
+var APPS_TIER_MAX_COMPONENT_REPLICAS = 10;
+var APPS_TIER_MAX_IMAGES = 8;
+var APPS_TIER_MAX_JOB_TIMEOUT_SECONDS = 3600;
+var APPS_TIER_MAX_SEALED_ENV_BYTES = 262144;
+var APPS_TIER_MAX_WORK_BYTES = 524288;
+var APPS_TIER_MIN_CRON_INTERVAL_MS = 3e5;
+var APPS_TIER_MAX_PULL_CREDENTIAL_BYTES = 8192;
+var PULL_CREDENTIAL_MAX_MS = 9e5;
+var APPS_TIER_QUOTA_PROFILES = {
+  starter: {
+    name: "starter",
+    cpuRequest: 1,
+    cpuLimit: 2,
+    memoryRequestGiB: 2,
+    memoryLimitGiB: 4,
+    pods: 10,
+    volumes: 4,
+    volumeTotalGiB: 10,
+    bandwidthOutMbps: 20,
+    bandwidthInMbps: 50,
+    monthlyEgressGiB: 100,
+    loadBalancers: 0,
+    nodePorts: 0
+  },
+  standard: {
+    name: "standard",
+    cpuRequest: 2,
+    cpuLimit: 4,
+    memoryRequestGiB: 4,
+    memoryLimitGiB: 8,
+    pods: 20,
+    volumes: 8,
+    volumeTotalGiB: 50,
+    bandwidthOutMbps: 50,
+    bandwidthInMbps: 100,
+    monthlyEgressGiB: 500,
+    loadBalancers: 0,
+    nodePorts: 0
+  }
+};
+var APPS_TIER_QUOTA_CEILINGS = {
+  cpu: 16,
+  memoryGiB: 32,
+  pods: 100,
+  storageGiB: 500
+};
+var APPS_TIER_QUOTA_PROFILE_NAMES = ["starter", "standard"];
+function resolveAppsTierQuotaProfile(name) {
+  const profiles = APPS_TIER_QUOTA_PROFILES;
+  return profiles[name] ?? null;
+}
+function clampAppsTierQuotaProfile(profile) {
+  const clamped = [];
+  const reduce = (current, ceiling, field) => {
+    if (current <= ceiling) return current;
+    clamped.push(field);
+    return ceiling;
+  };
+  return {
+    profile: {
+      ...profile,
+      cpuRequest: reduce(profile.cpuRequest, APPS_TIER_QUOTA_CEILINGS.cpu, "cpuRequest"),
+      cpuLimit: reduce(profile.cpuLimit, APPS_TIER_QUOTA_CEILINGS.cpu, "cpuLimit"),
+      memoryRequestGiB: reduce(profile.memoryRequestGiB, APPS_TIER_QUOTA_CEILINGS.memoryGiB, "memoryRequestGiB"),
+      memoryLimitGiB: reduce(profile.memoryLimitGiB, APPS_TIER_QUOTA_CEILINGS.memoryGiB, "memoryLimitGiB"),
+      pods: reduce(profile.pods, APPS_TIER_QUOTA_CEILINGS.pods, "pods"),
+      volumeTotalGiB: reduce(profile.volumeTotalGiB, APPS_TIER_QUOTA_CEILINGS.storageGiB, "volumeTotalGiB")
+    },
+    clamped
+  };
+}
+var GATE_MAX_AGE_HOURS = 24;
+var SELF_CHECK_BUDGET_MS = 9e5;
+var PROBE_CONNECT_TIMEOUT_MS = 3e3;
+var PROBE_ATTEMPTS = 2;
+var SELF_CHECK_INTERVAL_HOURS = 6;
+var ATTESTATION_TTL_DAYS = 90;
+var ATTESTATION_NOTICE_DAYS = [14, 1];
+var HEARTBEAT_MAX_AGE_MS = 12e4;
+var GATE_WATCH_INTERVAL_MIN = 5;
+var QUARANTINE_ISOLATE_MS = 15e3;
+var QUARANTINE_SCALE_MS = 6e4;
+var QUARANTINE_EDGE_MS = 12e4;
+var RELEASE_RESTORE_MS = 18e4;
+var DETECTOR_QUARANTINE_MS = 6e4;
+var IMAGE_ALLOWANCE_MAX_DAYS = 30;
+var REMOVED_DATA_RETENTION_DAYS = 30;
+var APPS_TIER_SELF_CHECK_RUN_RETENTION_DAYS = 180;
+var APPS_TIER_SELF_CHECK_RUN_RETENTION_COUNT = 500;
+var APPS_TIER_ZONE_AUDIT_RETENTION_DAYS = 90;
+var APPS_TIER_USAGE_FRESHNESS_MS = 72e5;
+var APPS_TIER_EGRESS_NOTICE_SHARE = 0.8;
+var APPS_TIER_EGRESS_THROTTLE_MBPS = 2;
+var APPS_TIER_BILLING_GRACE_DAYS = 7;
+var APPS_TIER_MINING_CPU_SHARE = 0.9;
+var APPS_TIER_MINING_CPU_WINDOW_MS = 18e5;
+var APPS_TIER_MINING_REFUSED_CONNECTIONS = 10;
+var APPS_TIER_MINING_MEDIUM_WINDOW_MS = 216e5;
+var APPS_TIER_MAIL_REFUSED_ATTEMPTS_PER_HOUR = 50;
+var APPS_TIER_SIGNAL_SUMMARY_MAX_CHARS = 500;
+var APPS_TIER_QUARANTINE_REASON_MIN_CHARS = 10;
+var APPS_TIER_ATTESTATION_EVIDENCE_MIN_CHARS = 20;
+var APPS_TIER_ATTESTATION_EVIDENCE_MAX_CHARS = 2e3;
+var APPS_TIER_ATTESTATION_EVIDENCE_REFERENCE_MAX_CHARS = 500;
+var APPS_TIER_HEARTBEAT_STALE_MS = 216e5;
+var APPS_TIER_PRICEBOOK_VERSION = 2;
+var APPS_TIER_PRICE_GROUP = "hosting";
+var APPS_TIER_PRICE_KEYS = {
+  cpuCoreHour: "hosting.cpu_core_hour",
+  memoryGiBHour: "hosting.memory_gib_hour",
+  egressGiB: "hosting.egress_gib",
+  storageGiBMonth: "hosting.storage_gib_month",
+  buildMinute: "hosting.build_minute",
+  dependencyStorageGiBHour: "hosting.dependency_storage_gib_hour",
+  dependencyBackupGiBHour: "hosting.dependency_backup_gib_hour",
+  relayMessages: "relay.messages"
+};
+var APPS_TIER_PRICE_UNITS = {
+  cpuCoreSecondsPerUnit: 3600,
+  memoryMiBHoursPerUnit: 1024,
+  egressMiBPerUnit: 1024,
+  storageGiBHoursPerUnit: 720
+};
+var APPS_TIER_USAGE_UNITS = [
+  "cpuCoreSeconds",
+  "memoryMiBHours",
+  "egressMiB",
+  "storageGiBHours",
+  "buildMinutes",
+  "dependencyStorageGiBHours",
+  "dependencyBackupGiBHours"
+];
+function appsTierReceiptIdempotencyKey(workId, day) {
+  return `apps-tier:${workId}:${day}`;
+}
+var APPS_TIER_METERING_IMPORT_CRON = "7 * * * *";
+var APPS_TIER_DAILY_RECEIPTS_CRON = "15 0 * * *";
+var APPS_TIER_EDGE_TLS_MODE = "edge";
+var APPS_TIER_MANAGED_ENABLED_ENV_VAR = "EVER_WORKS_APPS_MANAGED_ENABLED";
+var APPS_TIER_MAX_SCOPE_ENV_VAR = "EVER_WORKS_APPS_MAX_SCOPE";
+var APPS_TIER_GATE_MAX_AGE_HOURS_ENV_VAR = "EVER_WORKS_APPS_GATE_MAX_AGE_HOURS";
+var APPS_TIER_CONTROLLER_MIN_VERSION_ENV_VAR = "EVER_WORKS_APPS_CONTROLLER_MIN_VERSION";
+var APPS_TIER_CONTROL_KUBECONFIG_ENV_VAR = "EVER_WORKS_APPS_CONTROL_KUBECONFIG";
+var APPS_TIER_MAX_PER_USER_ENV_VAR = "EVER_WORKS_APPS_MAX_PER_USER";
+var APPS_TIER_PUBLIC_KEY_CONFIG_MAP = "ever-works-apps-controller-public-key";
+var APPS_TIER_ZONE_INFO_CONFIG_MAP = "ever-works-apps-zone-info";
+var APPS_TIER_SEAL_AAD_PREFIX = "hosting.ever.works/v1alpha1";
+var APPS_TIER_ACTIVITY_ACTION_TYPE = "app_tier";
+var APPS_TIER_EVENT_NAMES = [
+  "app.tier.quarantined",
+  "app.tier.released",
+  "app.tier.deploy_refused",
+  "app.tier.egress_threshold",
+  "app.tier.usage_daily"
+];
+var APPS_TIER_NOTIFICATION_IDS = [
+  "app_tier_usage_80",
+  "app_tier_quarantined",
+  "app_tier_egress",
+  "app_attestation_expiry"
+];
+var APPS_TIER_OPEN_REFUSED_CODE = "apps_tier_open_refused";
+var APPS_TIER_QUOTA_CEILING_EXCEEDED_CODE = "quota_ceiling_exceeded";
+
+// src/apps/builds.ts
+var APP_BUILD_STATUSES = ["queued", "running", "succeeded", "failed", "cancelled", "blocked"];
+var APP_BUILD_TRIGGERS = ["push", "pull_request", "manual", "verification"];
+var APP_BUILD_DEPLOYABLE_TRIGGERS = ["push", "manual"];
+var APP_BUILD_FAILURE_CLASSES = [
+  "outOfMemory",
+  "diskFull",
+  "dockerfileError",
+  "dependencyDownloadFailed",
+  "registryPushDenied",
+  "missingBuildValue",
+  "secretInImage",
+  "timeout",
+  "workflowInvalid",
+  "digestMismatch",
+  "verificationFailed",
+  "egressBlocked",
+  "lost",
+  "unknown"
+];
+var APP_BUILD_BLOCKED_REASONS = [
+  "workflowPending",
+  "workflowEditedByHand",
+  "workflowWriteFailed",
+  "actionsDisabled",
+  "missingBuildValues",
+  "runnerTooSmall",
+  "tooManyBuildValues",
+  "buildValueTooLarge",
+  "secretLimitReached",
+  "strategyNotSupported",
+  "specInvalid",
+  "gitConnectionMissing",
+  "repositoryUnavailable",
+  "managedConcurrencyLimit",
+  "buildValueNameReserved",
+  "buildServicePortRequired",
+  "verificationDependencyUnsupported"
+];
+var APP_BUILD_NOT_DEPLOYABLE_REASONS = [
+  "notSucceeded",
+  "pullRequest",
+  "verification",
+  "specInvalid",
+  "staleInputs",
+  "secretCheckFailed",
+  "digestUnconfirmed",
+  "criticalVulnerability",
+  "unsigned"
+];
+var APP_BUILD_CANCEL_REASONS = ["user", "superseded"];
+var APP_BUILD_SECRET_CHECK_RESULTS = ["passed", "failed", "not_needed"];
+var APP_BUILD_RUNNER_CLASSES = ["github-public", "github-private", "github-larger", "apps-builder"];
+var APP_BUILD_SYNC_ORIGINS = ["none", "upstreamSync"];
+var APP_BUILD_SIGNATURE_STATES = ["signed", "unsigned", "foreign"];
+var APP_BUILD_WORKFLOW_STATES = ["none", "committed", "pullRequestOpen", "editedByHand"];
+var APP_BUILD_PREPARE_WORKFLOW_STATES = [
+  "unchanged",
+  "committed",
+  "pullRequestOpened",
+  "pullRequestUpdated",
+  "editedByHand"
+];
+var APP_BUILD_WEBHOOK_STATES = ["none", "installed", "skipped", "permissionMissing"];
+var APP_BUILD_STRATEGIES = ["dockerfile", "image", "auto", "none"];
+var APP_BUILD_KINDS = ["github-actions", "apps-builder"];
+var APP_BUILD_EVENT_NAMES = [
+  "app.build.queued",
+  "app.build.started",
+  "app.build.succeeded",
+  "app.build.failed",
+  "app.build.cancelled"
+];
+var APP_BUILD_ACTIVITY_ACTION_TYPE = "app_build";
+var APP_BUILD_STATUS_EVENT_MAP = {
+  queued: "app.build.queued",
+  running: "app.build.started",
+  succeeded: "app.build.succeeded",
+  failed: "app.build.failed",
+  cancelled: "app.build.cancelled",
+  blocked: null
+};
+function appBuildEventNameForStatus(status) {
+  return APP_BUILD_STATUS_EVENT_MAP[status];
+}
+var APP_BUILD_WORKFLOW_PATH = ".github/workflows/ever-works-build.yml";
+var APP_BUILD_WORKFLOW_BRANCH = "ever-works/build-workflow";
+var APP_BUILD_SECRET_PREFIX = "EW_";
+var APP_BUILD_IMAGE_NAME = "ever-works-app";
+var APP_BUILD_GENERATOR_VERSION = 1;
+var APP_BUILD_MAX_VALUES = 50;
+var APP_BUILD_SECRET_MAX_BYTES = 48e3;
+var APP_BUILD_SECRET_CHECK_MIN_CHARS = 8;
+var APP_BUILD_REBUILD_DEDUPE_MS = 1e4;
+var APP_BUILD_REBUILDS_PER_HOUR = 10;
+var APP_BUILD_ENV_SYNC_SLA_MS = 6e4;
+var APP_BUILD_POLL_AFTER_SILENCE_MS = 9e4;
+var APP_BUILD_SWEEP_BATCH = 200;
+var APP_BUILD_ADOPT_WINDOW_MS = 3e5;
+var APP_BUILD_LOST_GRACE_MINUTES = 30;
+var APP_BUILD_RESULT_MAX_BYTES = 8192;
+var APP_BUILD_LOG_TAIL_BYTES = 2097152;
+var APP_BUILD_EXCERPT_MAX_LINES = 20;
+var APP_BUILD_EXCERPT_MAX_LINE_CHARS = 300;
+var APP_BUILD_RUNNER_HEADROOM_GIB = 2;
+var APP_BUILD_RUNNERS = {
+  githubPublic: { label: "ubuntu-latest", vcpu: 4, memoryGiB: 16, runnerClass: "github-public" },
+  githubPrivate: { label: "ubuntu-latest", vcpu: 2, memoryGiB: 7, runnerClass: "github-private" }
+};
+var APP_BUILD_VERIFY_TIMEOUT_MINUTES = 30;
+var APP_BUILD_VERIFY_MEMORY_GIB = 12;
+var APP_BUILD_VERIFY_PLAN_MAX_CHARS = 6e4;
+var APP_BUILD_PULL_TOKEN_EXPIRY_WARN_DAYS = 14;
+var APP_BUILD_LIST_PAGE_SIZE = 20;
+var APP_BUILD_LIST_MAX_PAGE_SIZE = 100;
+var APP_BUILD_MANAGED_DEFAULTS = {
+  vcpu: 4,
+  memoryGiB: 12,
+  diskGiB: 30,
+  timeoutMinutes: 60
+};
+var APP_BUILD_MANAGED_MAXIMUMS = { vcpu: 16, memoryGiB: 64, timeoutMinutes: 180 };
+var APP_BUILD_MANAGED_CONCURRENCY = { perAppWork: 1, perAccount: 3 };
+var APP_BUILD_CHECKS_JOB_ID = "checks";
+var APP_BUILD_CHECK_NAME_PREFIX = "Ever Works check: ";
+var APP_BUILD_CHECKS_MAX = 20;
+var APP_BUILD_CHECKS_MAX_PARALLEL = 5;
+var APP_BUILD_VERIFY_PROMPTED_SECRET = "EW_VERIFY__PROMPTED";
+var APP_BUILD_VERIFY_PLAN_INPUT = "ew_verify_plan";
+var APP_BUILD_RESULT_ARTIFACT_NAME = "ever-works-build-result";
+var APP_BUILD_RESULT_ARTIFACT_FILE = "ever-works-build-result.json";
+var APP_BUILD_RESULT_ARTIFACT_RETENTION_DAYS = 7;
+var APP_BUILD_BRANCH_SLUG_MAX_CHARS = 100;
+var APP_BUILD_SETTING_RECLAIM_DISK = "reclaimDisk";
+var APP_BUILD_SETTING_ATTESTATIONS = "attestations";
+var APP_BUILD_SETTING_ALLOW_VALUES_ON_PULL_REQUESTS = "allowBuildValuesOnPullRequests";
+var APP_BUILD_SETTING_VERIFICATION_PROMPTED_REQUIRES_APPROVAL = "verificationPromptedValuesRequireApproval";
+var APP_BUILD_RESTRICTED_VALUE_LITERAL = "ew-restricted";
+var APP_BUILD_WEBHOOK_EVENT = "workflow_run";
+var APP_BUILD_SWEEP_CRON = "*/2 * * * *";
+var BUILD_SERVICE_HOST = "127.0.0.1";
+var BUILD_SERVICE_HEALTH_KINDS = { command: "command", http: "http", waitLoop: "waitLoop" };
+var BUILD_SERVICE_DEFAULTS = {
+  postgres: {
+    imagePrefixes: ["postgres"],
+    env: { POSTGRES_USER: "ever-works-build", POSTGRES_PASSWORD: "ever-works-build", POSTGRES_DB: "app" },
+    containerPort: 5432,
+    health: { kind: "command", command: "pg_isready -U <user> -d <db>" }
+  },
+  redis: {
+    imagePrefixes: ["redis"],
+    env: {},
+    containerPort: 6379,
+    health: { kind: "command", command: "redis-cli ping" }
+  },
+  minio: {
+    imagePrefixes: ["minio"],
+    env: { MINIO_ROOT_USER: "ever-works-build", MINIO_ROOT_PASSWORD: "ever-works-build" },
+    containerPort: 9e3,
+    health: { kind: "http", path: "/minio/health/live" }
+  },
+  smtp: {
+    imagePrefixes: [],
+    env: {},
+    containerPort: 1025,
+    health: { kind: "waitLoop", seconds: 60 }
+  }
+};
+var BUILD_SERVICE_KINDS = ["postgres", "redis", "minio", "smtp"];
+function resolveBuildServiceKind(image) {
+  for (const kind of BUILD_SERVICE_KINDS) {
+    const prefixes = BUILD_SERVICE_DEFAULTS[kind].imagePrefixes;
+    for (const prefix of prefixes) {
+      if (image.startsWith(prefix)) return kind;
+    }
+  }
+  return null;
+}
+function resolveBuildServiceEnv(kind, declared) {
+  const merged = { ...BUILD_SERVICE_DEFAULTS[kind].env };
+  for (const entry of declared ?? []) {
+    merged[entry.name] = entry.value;
+  }
+  return merged;
+}
+function resolveBuildServicePort(image, declaredPort) {
+  const kind = resolveBuildServiceKind(image);
+  if (kind === null) {
+    return declaredPort === void 0 ? null : `${declaredPort}:${declaredPort}`;
+  }
+  return `${declaredPort ?? BUILD_SERVICE_DEFAULTS[kind].containerPort}:${BUILD_SERVICE_DEFAULTS[kind].containerPort}`;
+}
+function evaluateBuildServicePort(service) {
+  const published = resolveBuildServicePort(service.image, service.port);
+  return published === null ? { ok: false, blockedReason: "buildServicePortRequired" } : { ok: true, published };
+}
+function appBuildRunnerCapacity(runner) {
+  return { vcpu: runner.vcpu, memoryGiB: runner.memoryGiB - APP_BUILD_RUNNER_HEADROOM_GIB };
+}
+function evaluateBuildRunnerFit(runner, declaredMemoryGiB) {
+  const capacity = appBuildRunnerCapacity(runner);
+  if (declaredMemoryGiB === void 0 || declaredMemoryGiB <= capacity.memoryGiB) return { fits: true };
+  return { fits: false, blockedReason: "runnerTooSmall", maxMemoryGiB: capacity.memoryGiB };
+}
+function appBuildCheckName(name) {
+  return `${APP_BUILD_CHECK_NAME_PREFIX}${name}`;
+}
+function isAppBuildCheckJobName(jobName) {
+  return jobName.startsWith(APP_BUILD_CHECK_NAME_PREFIX);
+}
+var SHA256_ROUND_CONSTANTS = [
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+];
+var SHA256_INITIAL_HASH = [
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+];
+function rotateRight32(value, bits) {
+  return (value >>> bits | value << 32 - bits) >>> 0;
+}
+function toHexWords(words) {
+  let hex = "";
+  for (const word of words) hex += word.toString(16).padStart(8, "0");
+  return hex;
+}
+function sha256Hex(text) {
+  const message = new TextEncoder().encode(text);
+  const bitLength = message.length * 8;
+  const paddedLength = Math.ceil((message.length + 9) / 64) * 64;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(message);
+  padded[message.length] = 128;
+  const high = Math.floor(bitLength / 4294967296);
+  const low = bitLength >>> 0;
+  padded[paddedLength - 8] = high >>> 24 & 255;
+  padded[paddedLength - 7] = high >>> 16 & 255;
+  padded[paddedLength - 6] = high >>> 8 & 255;
+  padded[paddedLength - 5] = high & 255;
+  padded[paddedLength - 4] = low >>> 24 & 255;
+  padded[paddedLength - 3] = low >>> 16 & 255;
+  padded[paddedLength - 2] = low >>> 8 & 255;
+  padded[paddedLength - 1] = low & 255;
+  const schedule = new Uint32Array(64);
+  const hash = new Uint32Array(SHA256_INITIAL_HASH);
+  for (let offset = 0; offset < paddedLength; offset += 64) {
+    for (let index = 0; index < 16; index += 1) {
+      const at = offset + index * 4;
+      schedule[index] = (padded[at] << 24 | padded[at + 1] << 16 | padded[at + 2] << 8 | padded[at + 3]) >>> 0;
+    }
+    for (let index = 16; index < 64; index += 1) {
+      const w15 = schedule[index - 15];
+      const w2 = schedule[index - 2];
+      const sigma0 = (rotateRight32(w15, 7) ^ rotateRight32(w15, 18) ^ w15 >>> 3) >>> 0;
+      const sigma1 = (rotateRight32(w2, 17) ^ rotateRight32(w2, 19) ^ w2 >>> 10) >>> 0;
+      schedule[index] = schedule[index - 16] + sigma0 + schedule[index - 7] + sigma1 >>> 0;
+    }
+    let a = hash[0];
+    let b = hash[1];
+    let c = hash[2];
+    let d = hash[3];
+    let e = hash[4];
+    let f = hash[5];
+    let g = hash[6];
+    let h = hash[7];
+    for (let index = 0; index < 64; index += 1) {
+      const sum1 = (rotateRight32(e, 6) ^ rotateRight32(e, 11) ^ rotateRight32(e, 25)) >>> 0;
+      const choose = (e & f ^ ~e & g) >>> 0;
+      const temp1 = h + sum1 + choose + SHA256_ROUND_CONSTANTS[index] + schedule[index] >>> 0;
+      const sum0 = (rotateRight32(a, 2) ^ rotateRight32(a, 13) ^ rotateRight32(a, 22)) >>> 0;
+      const majority = (a & b ^ a & c ^ b & c) >>> 0;
+      const temp2 = sum0 + majority >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    hash[0] = hash[0] + a >>> 0;
+    hash[1] = hash[1] + b >>> 0;
+    hash[2] = hash[2] + c >>> 0;
+    hash[3] = hash[3] + d >>> 0;
+    hash[4] = hash[4] + e >>> 0;
+    hash[5] = hash[5] + f >>> 0;
+    hash[6] = hash[6] + g >>> 0;
+    hash[7] = hash[7] + h >>> 0;
+  }
+  return toHexWords([hash[0], hash[1], hash[2], hash[3], hash[4], hash[5], hash[6], hash[7]]);
+}
+function computeBuildInputsHash(values) {
+  for (const value of values) {
+    if (value.name.includes("\0") || value.name.includes("
")) {
+      throw new Error("computeBuildInputsHash: an env name may not contain U+0000 or U+0001");
+    }
+    if (value.fingerprint.includes("\0") || value.fingerprint.includes("
")) {
+      throw new Error("computeBuildInputsHash: a fingerprint may not contain U+0000 or U+0001");
+    }
+  }
+  const canonical = values.map((value) => [value.name, value.fingerprint]).sort((left, right) => {
+    if (left[0] !== right[0]) return left[0] < right[0] ? -1 : 1;
+    if (left[1] !== right[1]) return left[1] < right[1] ? -1 : 1;
+    return 0;
+  }).map(([name, fingerprint]) => `${name}\0${fingerprint}`).join("
");
+  return sha256Hex(canonical);
+}
+function buildFailureExcerpt(lines, endAtLine) {
+  const end = endAtLine === void 0 ? lines.length : Math.min(endAtLine + 1, lines.length);
+  const start = Math.max(0, end - APP_BUILD_EXCERPT_MAX_LINES);
+  return lines.slice(start, end).map((line) => line.slice(0, APP_BUILD_EXCERPT_MAX_LINE_CHARS));
+}
+function evaluateBuildDeployability(input) {
+  const notDeployable = (reason) => ({ deployable: false, notDeployableReason: reason });
+  if (input.status !== "succeeded") return notDeployable("notSucceeded");
+  if (input.trigger === "verification") return notDeployable("verification");
+  if (input.trigger !== "push" && input.trigger !== "manual") return notDeployable("pullRequest");
+  if (input.branch !== input.trackedBranch) return notDeployable("pullRequest");
+  if (input.specValidAtCommit !== true) return notDeployable("specInvalid");
+  if (input.secretsSyncedAtEpochMs === null || input.startedAtEpochMs === null) return notDeployable("staleInputs");
+  if (input.secretsSyncedAtEpochMs > input.startedAtEpochMs) return notDeployable("staleInputs");
+  if (input.buildInputsHash === null || input.buildInputsHash !== input.currentInputsHash) {
+    return notDeployable("staleInputs");
+  }
+  if (input.secretCheck !== "passed" && input.secretCheck !== "not_needed") return notDeployable("secretCheckFailed");
+  if (!input.digestConfirmed) return notDeployable("digestUnconfirmed");
+  if (input.buildKind === "apps-builder") {
+    if (input.signatureState !== "signed") return notDeployable("unsigned");
+    if (input.policy.blockFixableCritical && (input.scan?.fixableCritical ?? 0) > 0) {
+      return notDeployable("criticalVulnerability");
+    }
+  }
+  return { deployable: true, notDeployableReason: null };
+}
+var APP_BUILD_RUN_SOURCES = ["event", "poll"];
+var APP_BUILD_RUN_DISCOVERY_PER_PAGE = 20;
+var APP_BUILD_RUN_DISCOVERY_BATCH = 100;
+var APP_BUILD_FAILURE_COPY_EN = {
+  outOfMemory: {
+    title: "Ran out of memory",
+    suggestion: "Raise build.resources.memory (now {memory}) or lower the build's heap size. On this runner a build can use at most {max}."
+  },
+  diskFull: {
+    title: "Ran out of disk space",
+    suggestion: 'Turn on "Reclaim runner disk" in build settings, or shrink the build context with a .dockerignore file.'
+  },
+  dockerfileError: {
+    title: "The Dockerfile failed at step {step} of {total}",
+    suggestion: "The failing step was: {command}. Fix it in {dockerfile} and push, or ask an agent to fix it."
+  },
+  dependencyDownloadFailed: {
+    title: "Couldn't download dependencies",
+    suggestion: "A package or base image registry didn't answer. Rebuild in a few minutes; if it keeps failing, pin the versions you depend on."
+  },
+  registryPushDenied: {
+    title: "Couldn't push the image",
+    suggestion: "Allow workflows in this repository to write packages (Settings \u25B8 Actions \u25B8 General \u25B8 Workflow permissions), then rebuild."
+  },
+  missingBuildValue: {
+    title: "A build value is missing: {names}",
+    suggestion: "Set it in Settings \u25B8 Environment, then rebuild."
+  },
+  secretInImage: {
+    title: "A secret would have been published inside the image: {name}",
+    suggestion: "Use this value only in an earlier build stage, or pass it as a build secret mount. Nothing was pushed."
+  },
+  timeout: {
+    title: "Took longer than {minutes} minutes",
+    suggestion: "Raise build.resources.timeoutMinutes (maximum 180) or speed the build up with caching."
+  },
+  workflowInvalid: {
+    title: "The workflow file is invalid",
+    suggestion: "GitHub can't run the build workflow. Review the open pull request from Ever Works to restore it."
+  },
+  digestMismatch: {
+    title: "The pushed image could not be confirmed",
+    suggestion: "The registry reported a different image than the build did. Rebuild; nothing unconfirmed will be deployed."
+  },
+  verificationFailed: {
+    title: "The app didn't pass its smoke tests",
+    suggestion: "{failed} of {total} smoke tests failed. See the results below."
+  },
+  egressBlocked: {
+    title: "Network access was blocked",
+    suggestion: "The build tried to reach {hosts}, which aren't on the builder's allowed list. Get what you need from your source repository or an allowed registry, then rebuild."
+  },
+  lost: {
+    title: "Lost track of this build",
+    suggestion: "GitHub stopped answering about this build. Check it on GitHub."
+  },
+  unknown: {
+    title: "Something else went wrong",
+    suggestion: "Open the logs on GitHub, or ask an agent to look."
+  }
+};
+var APP_BUILD_BLOCKED_ACTIONS = [
+  "reviewPullRequest",
+  "turnOnActions",
+  "setValue",
+  "useLargerRunner",
+  "openRepositorySettings",
+  "reconnectGithub",
+  "rebuild",
+  "openEnvironment"
+];
+var APP_BUILD_BLOCKED_REASON_ACTIONS = {
+  workflowPending: "reviewPullRequest",
+  workflowEditedByHand: "reviewPullRequest",
+  workflowWriteFailed: "rebuild",
+  actionsDisabled: "turnOnActions",
+  missingBuildValues: "setValue",
+  runnerTooSmall: "useLargerRunner",
+  tooManyBuildValues: "openEnvironment",
+  buildValueTooLarge: "openEnvironment",
+  buildServicePortRequired: "openEnvironment",
+  verificationDependencyUnsupported: null,
+  strategyNotSupported: null,
+  specInvalid: null,
+  repositoryUnavailable: null,
+  managedConcurrencyLimit: null,
+  buildValueNameReserved: "openEnvironment",
+  secretLimitReached: "openRepositorySettings",
+  gitConnectionMissing: "reconnectGithub"
+};
+var APP_VERIFICATION_PLAN_VERSION = 1;
+var APP_BUILD_VERIFY_PLAN_MAX_COMPONENTS = 10;
+var APP_BUILD_VERIFY_PLAN_MAX_DEPENDENCIES = 3;
+var APP_BUILD_VERIFY_PLAN_MAX_JOBS = 10;
+var APP_BUILD_VERIFY_PLAN_MAX_SMOKE = 20;
+var APP_BUILD_VERIFY_PLAN_MAX_ENV_ENTRIES = 100;
+var APP_BUILD_VERIFICATION_RESULT_MAX_SMOKE = 50;
+var APP_VERIFICATION_JOB_PHASES = ["pre-deploy", "first-deploy"];
+var APP_MANIFEST_JOB_PHASES = ["pre-deploy", "first-deploy", "post-deploy"];
+var APP_VERIFICATION_PROBE_KINDS = ["http", "tcp"];
+var APP_HTTP_AUTH_SCHEMES = ["bearer", "raw"];
+var APP_VERIFICATION_HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"];
+var APP_VERIFICATION_SMOKE_WHENS = ["after-deploy", "after-jobs"];
+var APP_VERIFICATION_COMPONENT_ROLES = ["web", "worker"];
+var APP_VERIFICATION_DEPENDENCY_KINDS = ["postgres", "redis", "objectStorage"];
+var APP_VERIFICATION_DEPENDENCY_CONTAINERS = {
+  postgres: "ew-dep-postgres",
+  redis: "ew-dep-redis",
+  objectStorage: "ew-dep-object-storage"
+};
+
+// src/apps/ever-id.ts
+var EVER_ID_REGISTRATION_PROVIDER = "ever-id";
+var EVER_ID_SCOPES = { APPS_READ: "apps:read", SESSION_EXCHANGE: "ever-works:session" };
+var EVER_ID_DEFAULT_API_AUDIENCE = "ever-works";
+var EVER_ID_DEFAULT_DISPLAY_NAME = "Ever ID";
+var EVER_ID_SIGNING_ALGS = ["RS256", "ES256", "EdDSA"];
+var EVER_ID_QUERY_TOKEN_PARAMS = [
+  "access_token",
+  "id_token",
+  "logout_token",
+  "token",
+  "sessionToken",
+  "code_verifier"
+];
+var EVER_ID_DELEGATED_SCOPES = ["apps:read"];
+var EVER_ID_DELEGATED_AUTH_METHOD = "ever-id-delegated";
+var EVER_ID_LINKED_VIA = ["sign-up", "settings"];
+var EVER_ID_LIMITS = {
+  /** FR-9 — fresh random bytes per sign-in. */
+  stateBytes: 32,
+  /** FR-9 — fresh random bytes per sign-in. */
+  nonceBytes: 32,
+  /** FR-9 — the PKCE code verifier is 64 characters. */
+  codeVerifierLength: 64,
+  /** FR-9 — the transaction cookie lives 600 seconds. */
+  transactionTtlSeconds: 600,
+  /** FR-23 — a pending account creation expires after 600 seconds and is single-use. */
+  signUpPendingTtlSeconds: 600,
+  /** FR-26 — a pending connection expires after 300 seconds and is single-use. */
+  connectPendingTtlSeconds: 300,
+  /** FR-11 — `iat` may be no earlier than 600 seconds ago. */
+  idTokenMaxAgeSeconds: 600,
+  /** FR-25 — `auth_time` no older than 300 seconds plus the skew. */
+  connectMaxAuthAgeSeconds: 300,
+  /** FR-25 — connecting needs a session opened at most 12 hours ago. */
+  connectMaxSessionAgeSeconds: 43200,
+  /** FR-2 — the default clock-skew tolerance. */
+  defaultClockSkewSeconds: 60,
+  /** FR-2 — the highest clock-skew tolerance an administrator may configure. */
+  maxClockSkewSeconds: 120,
+  /** FR-13 — signing keys are cached for 600 seconds. */
+  jwksCacheSeconds: 600,
+  /** FR-13 — an unknown key id triggers at most one refresh per 30 seconds. */
+  jwksUnknownKidCooldownSeconds: 30,
+  /** FR-13 — cached keys stay usable for at most 21 600 seconds, then validation fails closed. */
+  jwksMaxStaleSeconds: 21600,
+  /** FR-14 — the discovery document is cached for 3 600 seconds. */
+  discoveryCacheSeconds: 3600,
+  /** FR-15 — calls to the provider time out after 5 seconds. */
+  outboundTimeoutMs: 5e3,
+  /** FR-33 — a sign-out notice's `iat` may be no older than 300 seconds. */
+  logoutTokenMaxAgeSeconds: 300,
+  /** FR-33 — a `jti` not seen in the last 600 seconds. */
+  replayWindowSeconds: 600,
+  /** FR-40 — an exchange token's `iat` may be no older than 300 seconds. */
+  exchangeTokenMaxAgeSeconds: 300,
+  /** FR-45 — a delegated token's lifetime (`exp` − `iat`) is at most 3 600 seconds. */
+  delegatedTokenMaxLifetimeSeconds: 3600,
+  /** FR-2 — 1–3 allowed issuers, so a provider move stays reversible (R-28). */
+  allowedIssuersMax: 3,
+  /** FR-2 — 0–5 local-client ids allowed to exchange for a session. */
+  localClientsMax: 5,
+  /** FR-31/FR-48 — at most 10 apps whose delegated reads are remembered. */
+  delegatedClientsMax: 10,
+  /** FR-48 — the Connected identities card lists apps seen in the last 30 days. */
+  delegatedClientsWindowDays: 30,
+  /** FR-5 — the availability answer is cached for 60 seconds. */
+  availabilityCacheSeconds: 60,
+  /** FR-31 — the names kept per delegated client. */
+  delegatedClientNamesMax: 10,
+  /** FR-41 — clients poll no faster than the interval the provider returns, at least 5 seconds. */
+  devicePollMinIntervalSeconds: 5,
+  /** FR-41 — add 5 seconds on every `slow_down`. */
+  devicePollSlowDownStepSeconds: 5,
+  /** FR-41 — a device code expires in at most 900 seconds. */
+  deviceCodeMaxLifetimeSeconds: 900
+};
+function isEverIdClockSkewAllowed(seconds) {
+  return Number.isInteger(seconds) && seconds >= 0 && seconds <= EVER_ID_LIMITS.maxClockSkewSeconds;
+}
+function isEverIdAllowedIssuerCountAllowed(count) {
+  return Number.isInteger(count) && count >= 1 && count <= EVER_ID_LIMITS.allowedIssuersMax;
+}
+var EVER_ID_WIRE_ERROR_CODES = [
+  "ever_id_disabled",
+  "provider_unavailable",
+  "transaction_invalid",
+  "email_not_verified",
+  "email_in_use",
+  "sign_up_not_allowed",
+  "subject_linked",
+  "user_has_issuer",
+  "reauth_required",
+  "session_required",
+  "last_sign_in_method",
+  "not_connected",
+  "account_disabled",
+  "ever_id_signed_out",
+  "token_in_query",
+  "insufficient_scope"
+];
+var EVER_ID_ERROR_CODE_WIRE_VALUES = {
+  everIdDisabled: "ever_id_disabled",
+  providerUnavailable: "provider_unavailable",
+  transactionInvalid: "transaction_invalid",
+  emailNotVerified: "email_not_verified",
+  emailInUse: "email_in_use",
+  signUpNotAllowed: "sign_up_not_allowed",
+  subjectLinked: "subject_linked",
+  userHasIssuer: "user_has_issuer",
+  reauthRequired: "reauth_required",
+  sessionRequired: "session_required",
+  lastSignInMethod: "last_sign_in_method",
+  notConnected: "not_connected",
+  accountDisabled: "account_disabled",
+  everIdSignedOut: "ever_id_signed_out",
+  tokenInQuery: "token_in_query",
+  insufficientScope: "insufficient_scope"
+};
+
+// src/apps/tenant-postgres-ddl.ts
+var TENANT_POSTGRES_DATABASE_PREFIX = "awd_";
+var TENANT_POSTGRES_ROLE_PREFIX = "awr_";
+var TENANT_POSTGRES_PASSWORD_PATTERN = "^[0-9a-f]{32}$";
+var TENANT_POSTGRES_ROLE_CONNECTION_LIMIT = APP_DEPENDENCY_MANAGED.pgRoleConnectionLimit;
+var TENANT_POSTGRES_DATABASE_CONNECTION_LIMIT = APP_DEPENDENCY_MANAGED.pgDatabaseConnectionLimit;
+var TENANT_POSTGRES_STATEMENT_TIMEOUT_MS = APP_DEPENDENCY_MANAGED.pgStatementTimeoutMs;
+var TENANT_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS = APP_DEPENDENCY_MANAGED.pgIdleInTransactionTimeoutMs;
+var TENANT_POSTGRES_ROLE_ATTRIBUTES = [
+  "LOGIN",
+  "NOSUPERUSER",
+  "NOCREATEDB",
+  "NOCREATEROLE",
+  "NOREPLICATION",
+  "NOBYPASSRLS"
+];
+var TENANT_POSTGRES_DEFAULT_PORT = APP_DEPENDENCY_POSTGRES_DEFAULT_PORT;
+var TENANT_POSTGRES_DDL_REFUSALS = [
+  "identifierInvalid",
+  "passwordInvalid",
+  "connectionLimitInvalid",
+  "timeoutInvalid"
+];
+var TENANT_POSTGRES_IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]{0,62}$/;
+function quoteTenantPostgresIdentifier(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+function quoteTenantPostgresLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function buildTenantPostgresDdl(input) {
+  if (!TENANT_POSTGRES_IDENTIFIER_PATTERN.test(input.dbName)) return { ok: false, refusal: "identifierInvalid" };
+  if (!TENANT_POSTGRES_IDENTIFIER_PATTERN.test(input.roleName)) return { ok: false, refusal: "identifierInvalid" };
+  if (!new RegExp(TENANT_POSTGRES_PASSWORD_PATTERN).test(input.password))
+    return { ok: false, refusal: "passwordInvalid" };
+  const roleLimit = input.roleConnectionLimit ?? TENANT_POSTGRES_ROLE_CONNECTION_LIMIT;
+  const databaseLimit = input.databaseConnectionLimit ?? TENANT_POSTGRES_DATABASE_CONNECTION_LIMIT;
+  const statementTimeoutMs = input.statementTimeoutMs ?? TENANT_POSTGRES_STATEMENT_TIMEOUT_MS;
+  const idleTimeoutMs = input.idleInTransactionTimeoutMs ?? TENANT_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS;
+  if (!Number.isSafeInteger(roleLimit) || roleLimit < 1) return { ok: false, refusal: "connectionLimitInvalid" };
+  if (!Number.isSafeInteger(databaseLimit) || databaseLimit < 1)
+    return { ok: false, refusal: "connectionLimitInvalid" };
+  if (!Number.isSafeInteger(statementTimeoutMs) || statementTimeoutMs < 1)
+    return { ok: false, refusal: "timeoutInvalid" };
+  if (!Number.isSafeInteger(idleTimeoutMs) || idleTimeoutMs < 1) return { ok: false, refusal: "timeoutInvalid" };
+  const db = quoteTenantPostgresIdentifier(input.dbName);
+  const role = quoteTenantPostgresIdentifier(input.roleName);
+  const password = quoteTenantPostgresLiteral(input.password);
+  const attributes = TENANT_POSTGRES_ROLE_ATTRIBUTES.join(" ");
+  const server = [
+    input.roleExists ? `ALTER ROLE ${role} WITH ${attributes} PASSWORD ${password} CONNECTION LIMIT ${roleLimit};` : `CREATE ROLE ${role} WITH ${attributes} PASSWORD ${password} CONNECTION LIMIT ${roleLimit};`,
+    `ALTER ROLE ${role} SET statement_timeout = ${quoteTenantPostgresLiteral(toPostgresSeconds(statementTimeoutMs))};`,
+    `ALTER ROLE ${role} SET idle_in_transaction_session_timeout = ${quoteTenantPostgresLiteral(
+      toPostgresSeconds(idleTimeoutMs)
+    )};`
+  ];
+  if (!input.databaseExists) {
+    server.push(`CREATE DATABASE ${db} OWNER ${role} CONNECTION LIMIT ${databaseLimit};`);
+  }
+  server.push(`REVOKE CONNECT, TEMPORARY ON DATABASE ${db} FROM PUBLIC;`);
+  server.push(`GRANT CONNECT, TEMPORARY ON DATABASE ${db} TO ${role};`);
+  const database = [`REVOKE ALL ON SCHEMA public FROM PUBLIC;`, `ALTER SCHEMA public OWNER TO ${role};`];
+  for (const extension of input.extensions ?? []) {
+    if (!TENANT_POSTGRES_IDENTIFIER_PATTERN.test(extension)) return { ok: false, refusal: "identifierInvalid" };
+    database.push(`CREATE EXTENSION IF NOT EXISTS ${quoteTenantPostgresIdentifier(extension)};`);
+  }
+  return {
+    ok: true,
+    plan: {
+      server,
+      database,
+      statements: [...server, ...database],
+      createsDatabase: !input.databaseExists,
+      altersRole: input.roleExists
+    }
+  };
+}
+function toPostgresSeconds(milliseconds) {
+  return `${milliseconds / 1e3}s`;
+}
+function normaliseDataServerEndpoint(host, port) {
+  let normalisedHost = host.trim().toLowerCase();
+  if (normalisedHost.startsWith("[") && normalisedHost.endsWith("]")) {
+    normalisedHost = normalisedHost.slice(1, -1);
+  }
+  if (normalisedHost.length === 0) return null;
+  if (port !== void 0 && (!Number.isSafeInteger(port) || port < 1 || port > 65535)) return null;
+  return { host: normalisedHost, port: port ?? TENANT_POSTGRES_DEFAULT_PORT };
+}
+function parseDataServerUrl(url) {
+  const trimmed = url.trim();
+  if (trimmed.length === 0) return null;
+  const schemeAt = trimmed.indexOf("://");
+  if (schemeAt >= 0) {
+    const rest = trimmed.slice(schemeAt + 3);
+    const authority = rest.split(/[/?#]/, 1)[0] ?? "";
+    const withoutUserInfo = authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority;
+    if (withoutUserInfo.startsWith("[")) {
+      const closing = withoutUserInfo.indexOf("]");
+      if (closing < 0) return null;
+      const host2 = withoutUserInfo.slice(1, closing);
+      const tail = withoutUserInfo.slice(closing + 1);
+      if (tail.length === 0) return normaliseDataServerEndpoint(host2);
+      if (!tail.startsWith(":")) return null;
+      return normaliseDataServerEndpoint(host2, Number(tail.slice(1)));
+    }
+    const separator2 = withoutUserInfo.lastIndexOf(":");
+    if (separator2 < 0) return normaliseDataServerEndpoint(withoutUserInfo);
+    const host = withoutUserInfo.slice(0, separator2);
+    const portText = withoutUserInfo.slice(separator2 + 1);
+    return normaliseDataServerEndpoint(host, portText.length === 0 ? void 0 : Number(portText));
+  }
+  if (trimmed.startsWith("[")) {
+    const closing = trimmed.indexOf("]");
+    if (closing < 0) return null;
+    const host = trimmed.slice(1, closing);
+    const tail = trimmed.slice(closing + 1);
+    if (tail.length === 0) return normaliseDataServerEndpoint(host);
+    if (!tail.startsWith(":")) return null;
+    return normaliseDataServerEndpoint(host, Number(tail.slice(1)));
+  }
+  const separator = trimmed.lastIndexOf(":");
+  if (separator < 0) return normaliseDataServerEndpoint(trimmed);
+  return normaliseDataServerEndpoint(trimmed.slice(0, separator), Number(trimmed.slice(separator + 1)));
+}
+function isPlatformDataServer(candidate, platformEndpoints) {
+  const parsed = parseDataServerUrl(candidate);
+  if (parsed === null) return false;
+  return platformEndpoints.some((endpoint) => {
+    const normalised = normaliseDataServerEndpoint(endpoint.host, endpoint.port);
+    return normalised !== null && normalised.host === parsed.host && normalised.port === parsed.port;
+  });
+}
+function platformDataServerEndpoints(set) {
+  return [set.platform, set.sharedWorks];
+}
+
+// src/apps/work-app-spec.dto.ts
+function buildAppSpecLineLink(links, line) {
+  const base = links.file.base;
+  const anchor = links.lineAnchor;
+  if (typeof line !== "number" || !Number.isInteger(line) || line < 1 || !anchor || !anchor.includes("{line}")) {
+    return base;
+  }
+  return `${base}${anchor.replace("{line}", String(line))}`;
+}
+var APP_BLUEPRINT_APPLY_STATUSES = ["applying", "applied", "failed"];
+
+// src/apps/app-provisioning.ts
+var APP_PROVISIONING_STATUSES = [
+  "queued",
+  "running",
+  "needs_input",
+  "succeeded",
+  "merged",
+  "failed",
+  "cancelled"
+];
+var APP_PROVISIONING_STEPS = [
+  "repository",
+  "analysis",
+  "proposal",
+  "validate",
+  "build",
+  "boot",
+  "smoke",
+  "evidence"
+];
+var APP_PROVISIONING_STEP_STATES = ["pending", "running", "passed", "failed", "blocked", "skipped"];
+var APP_PROVISIONING_FAILURE_REASONS = [
+  "no-isolated-runtime",
+  "repository-not-ready",
+  "repository-too-large",
+  "not-runnable",
+  "token-cap",
+  "runner-minute-cap",
+  "deadline",
+  "could-not-verify",
+  "no-answer",
+  "verification-infrastructure",
+  // Appended — see the module docstring's correction 1.
+  "private-repository"
+];
+var APP_PROVISIONING_QUESTION_REASONS = [
+  "attempts-spent",
+  "repeated-failure",
+  "missing-required-value",
+  "runner-capacity",
+  "token-cap",
+  "runner-minute-cap",
+  "multiple-apps",
+  "agent-asked",
+  "safety-rail"
+  // R-17: a rail refused or held an action (grants, ladder, caps, rules)
+];
+var APP_PROVISIONING_PARK_REASONS = [
+  "kill-switch",
+  "agent-paused",
+  "workspace-paused",
+  "scope-paused"
+];
+var APP_PROVISIONING_DETECTION_SOURCES = [
+  "app-spec",
+  "compose",
+  "dockerfile",
+  "helm",
+  "descriptor-hint",
+  "auto"
+  // R-13 zero-config build; the builder is the build plugin's choice
+];
+var APP_PROVISION_LIMITS = {
+  attemptsDefault: 3,
+  attemptsMin: 1,
+  attemptsMax: 5,
+  attemptsPerAnswer: 2,
+  questionsMax: 3,
+  attemptsCeiling: 9,
+  optionsMax: 4,
+  tokenCapDefault: 3e6,
+  tokenCapMin: 5e5,
+  tokenCapMax: 1e7,
+  runnerMinuteCapDefault: 240,
+  runnerMinuteCapMin: 60,
+  runnerMinuteCapMax: 600,
+  /** Two starts of the same App Work inside this window yield one row (§4 "Start semantics"). */
+  startDedupeMs: 1e4,
+  analysisRunMs: 45 * 6e4,
+  iterateRunMs: 30 * 6e4,
+  forkWaitMs: 30 * 6e4,
+  activeDeadlineMs: 8 * 36e5,
+  /**
+   * Verification-Build reservation: `min(headSpec.build.resources.timeoutMinutes, buildMinutesMax)
+   * + runnerBootMinutesMax` — 90 minutes at the defaults, and the number §6.4 compares against the cap.
+   */
+  buildMinutesMax: 60,
+  jobSecondsMax: 900,
+  startupSecondsMax: 900,
+  smokeRequestMs: 3e4,
+  smokeTotalMs: 3e5,
+  runnerBootMinutesMax: 30,
+  runnerBootMemoryGiB: 12,
+  buildMemoryGiBMax: 14,
+  namespaceTtlMinutes: 90,
+  repoMaxBytes: 3 * 1024 ** 3,
+  diffMaxFiles: 12,
+  diffMaxLines: 3e3,
+  fileMaxBytes: 128 * 1024,
+  outputMaxBytes: 512 * 1024,
+  reportMaxChars: 4e4,
+  instructionFileMaxBytes: 32 * 1024,
+  logTailLines: 200,
+  logTailBytes: 16 * 1024,
+  evidenceCommentMaxChars: 6e4,
+  chatMessagesMax: 12,
+  questionReminderMs: 72 * 36e5,
+  questionExpiryMs: 14 * 864e5,
+  activePerUser: 3,
+  activePerOrg: 10,
+  startsPerHour: 10,
+  pollMs: 5e3,
+  infraRetries: 3,
+  infraRetryWindowMs: 30 * 6e4,
+  suggestionsPer30Days: 5,
+  autoReprovisionPerSync: 1,
+  autoReprovisionPer7Days: 2,
+  clusterProbeMs: 1e4,
+  podPendingInfraMs: 10 * 6e4
+};
+var APP_PROVISION_WRITABLE_PATHS = [".works/works.yml", ".works/overlay/**"];
+var APP_PROVISION_PRESERVED_SPEC_FIELDS = [
+  "source",
+  "blueprint",
+  "license",
+  "display.protectedPaths",
+  "upstreamSync",
+  "upstreamPullRequests",
+  "provisioning"
+];
+var APP_PROVISIONING_QUESTION_REASON_I18N_KEY = {
+  "attempts-spent": "attemptsSpent",
+  "repeated-failure": "repeatedFailure",
+  "missing-required-value": "missingRequiredValue",
+  "runner-capacity": "runnerCapacity",
+  "token-cap": "tokenCap",
+  "runner-minute-cap": "runnerMinuteCap",
+  "multiple-apps": "multipleApps",
+  "agent-asked": "agentAsked",
+  "safety-rail": "safetyRail"
+};
+var APP_PROVISIONING_FAILURE_REASON_I18N_KEY = {
+  "no-isolated-runtime": "noIsolatedRuntime",
+  "repository-not-ready": "repositoryNotReady",
+  "repository-too-large": "repositoryTooLarge",
+  "not-runnable": "notRunnable",
+  "token-cap": "tokenCap",
+  "runner-minute-cap": "runnerMinuteCap",
+  deadline: "deadline",
+  "could-not-verify": "couldNotVerify",
+  "no-answer": "noAnswer",
+  "verification-infrastructure": "verificationInfrastructure",
+  "private-repository": "privateRepository"
+};
+var APP_PROVISIONING_QUEUED_REASON_I18N_KEY = {
+  "user-limit": "userLimit",
+  "org-limit": "orgLimit"
+};
+var APP_PROVISIONING_OPTION_I18N_KEY = {
+  retry: "retry",
+  optional: "optional",
+  "verify-on-cluster": "verifyOnCluster",
+  "accept-build-only": "acceptBuildOnly",
+  "raise-cap": "raiseCap",
+  choose: "choose",
+  stop: "stop",
+  "retry-after-setting": "retryAfterSetting"
+};
+
+// src/apps/app-provisioning-copy.ts
+var APP_PROVISION_COPY_PARAMS = [
+  "repo",
+  "attempts",
+  "variable",
+  "step",
+  "reason",
+  "candidate",
+  "candidates",
+  "pr",
+  "n",
+  "budget",
+  "detail",
+  "tokens",
+  "minutes"
+];
+var APP_PROVISION_REASON_TEXT_NO_ISOLATED_RUNTIME = "no isolated sandbox is available.";
+var APP_PROVISION_REASON_TEXT_REPOSITORY_NOT_READY = "the repository was not ready after 30 minutes.";
+var APP_PROVISION_REASON_TEXT_REPOSITORY_TOO_LARGE = "the repository is larger than 3 GiB.";
+var APP_PROVISION_REASON_TEXT_NOT_RUNNABLE = "this repository is not something that can run as a service.";
+var APP_PROVISION_REASON_TEXT_TOKEN_CAP = "the token cap was reached.";
+var APP_PROVISION_REASON_TEXT_RUNNER_MINUTE_CAP = "the runner-minute cap was reached.";
+var APP_PROVISION_REASON_TEXT_DEADLINE = "it ran for more than 8 hours.";
+var APP_PROVISION_REASON_TEXT_COULD_NOT_VERIFY = "it could not be verified after {attempts} attempts.";
+var APP_PROVISION_REASON_TEXT_NO_ANSWER = "the question went unanswered for 14 days.";
+var APP_PROVISION_REASON_TEXT_VERIFICATION_INFRASTRUCTURE = "builds are not available for this repository.";
+var APP_PROVISION_REASON_TEXT_PRIVATE_REPOSITORY = "private repositories can't be provisioned yet.";
+var APP_PROVISION_REASON_TEXTS = {
+  "no-isolated-runtime": APP_PROVISION_REASON_TEXT_NO_ISOLATED_RUNTIME,
+  "repository-not-ready": APP_PROVISION_REASON_TEXT_REPOSITORY_NOT_READY,
+  "repository-too-large": APP_PROVISION_REASON_TEXT_REPOSITORY_TOO_LARGE,
+  "not-runnable": APP_PROVISION_REASON_TEXT_NOT_RUNNABLE,
+  "token-cap": APP_PROVISION_REASON_TEXT_TOKEN_CAP,
+  "runner-minute-cap": APP_PROVISION_REASON_TEXT_RUNNER_MINUTE_CAP,
+  deadline: APP_PROVISION_REASON_TEXT_DEADLINE,
+  "could-not-verify": APP_PROVISION_REASON_TEXT_COULD_NOT_VERIFY,
+  "no-answer": APP_PROVISION_REASON_TEXT_NO_ANSWER,
+  "verification-infrastructure": APP_PROVISION_REASON_TEXT_VERIFICATION_INFRASTRUCTURE,
+  "private-repository": APP_PROVISION_REASON_TEXT_PRIVATE_REPOSITORY
+};
+var APP_PROVISION_QUESTION_SUBJECT_PREFIX = "Provisioning {repo}: ";
+var APP_PROVISION_QUESTION_SUBJECT_ATTEMPTS_SPENT = "the app could not be verified in {attempts} attempts.";
+var APP_PROVISION_QUESTION_SUBJECT_REPEATED_FAILURE = "the same failure happened twice.";
+var APP_PROVISION_QUESTION_SUBJECT_MISSING_REQUIRED_VALUE = "the app will not start without {variable}.";
+var APP_PROVISION_QUESTION_SUBJECT_RUNNER_CAPACITY = "this app cannot boot in the build runner.";
+var APP_PROVISION_QUESTION_SUBJECT_TOKEN_CAP = "the token cap was reached.";
+var APP_PROVISION_QUESTION_SUBJECT_RUNNER_MINUTE_CAP = "the runner-minute cap was reached.";
+var APP_PROVISION_QUESTION_SUBJECT_MULTIPLE_APPS = "this repository has more than one app.";
+var APP_PROVISION_QUESTION_SUBJECT_AGENT_ASKED = "the agent needs a decision.";
+var APP_PROVISION_QUESTION_SUBJECT_SAFETY_RAIL = "a safety rule stopped the run: {reason}.";
+var APP_PROVISION_QUESTION_SUBJECTS = {
+  "attempts-spent": APP_PROVISION_QUESTION_SUBJECT_ATTEMPTS_SPENT,
+  "repeated-failure": APP_PROVISION_QUESTION_SUBJECT_REPEATED_FAILURE,
+  "missing-required-value": APP_PROVISION_QUESTION_SUBJECT_MISSING_REQUIRED_VALUE,
+  "runner-capacity": APP_PROVISION_QUESTION_SUBJECT_RUNNER_CAPACITY,
+  "token-cap": APP_PROVISION_QUESTION_SUBJECT_TOKEN_CAP,
+  "runner-minute-cap": APP_PROVISION_QUESTION_SUBJECT_RUNNER_MINUTE_CAP,
+  "multiple-apps": APP_PROVISION_QUESTION_SUBJECT_MULTIPLE_APPS,
+  "agent-asked": APP_PROVISION_QUESTION_SUBJECT_AGENT_ASKED,
+  "safety-rail": APP_PROVISION_QUESTION_SUBJECT_SAFETY_RAIL
+};
+var APP_PROVISION_OPTION_RETRY = "Try again";
+var APP_PROVISION_OPTION_RETRY_AFTER_SETTING = "I set it on the App env page \u2014 try again";
+var APP_PROVISION_OPTION_OPTIONAL = "Treat it as optional";
+var APP_PROVISION_OPTION_VERIFY_ON_CLUSTER = "Verify on my cluster instead";
+var APP_PROVISION_OPTION_ACCEPT_BUILD_ONLY = "Build and check only";
+var APP_PROVISION_OPTION_RAISE_CAP_TOKENS = "Raise the cap by 1,000,000 tokens";
+var APP_PROVISION_OPTION_RAISE_CAP_MINUTES = "Raise the cap by 60 runner minutes";
+var APP_PROVISION_OPTION_CHOOSE = "Use {candidate}";
+var APP_PROVISION_OPTION_STOP = "Stop provisioning";
+var APP_PROVISION_OPTION_LABELS = {
+  retry: APP_PROVISION_OPTION_RETRY,
+  "retry-after-setting": APP_PROVISION_OPTION_RETRY_AFTER_SETTING,
+  optional: APP_PROVISION_OPTION_OPTIONAL,
+  "verify-on-cluster": APP_PROVISION_OPTION_VERIFY_ON_CLUSTER,
+  "accept-build-only": APP_PROVISION_OPTION_ACCEPT_BUILD_ONLY,
+  choose: APP_PROVISION_OPTION_CHOOSE,
+  stop: APP_PROVISION_OPTION_STOP
+};
+var APP_PROVISION_RAISE_CAP_LABELS = {
+  "token-cap": APP_PROVISION_OPTION_RAISE_CAP_TOKENS,
+  "runner-minute-cap": APP_PROVISION_OPTION_RAISE_CAP_MINUTES
+};
+var APP_PROVISION_CHAT_STARTED = "Started provisioning {repo}. I'll post here at each milestone.";
+var APP_PROVISION_CHAT_PROPOSED = "Opened pull request #{pr} with the App spec. Verifying now.";
+var APP_PROVISION_CHAT_ATTEMPT_RED = "Attempt {n} of {budget} failed at {step}: {detail}. Fixing it.";
+var APP_PROVISION_CHAT_SUCCEEDED = "Verified. Review and merge pull request #{pr}.";
+var APP_PROVISION_CHAT_NEEDS_INPUT = "I need a decision from you \u2014 it's in My Decisions.";
+var APP_PROVISION_CHAT_FAILED = "Provisioning stopped: {reason}.";
+var APP_PROVISION_CHAT_TEMPLATES = {
+  started: APP_PROVISION_CHAT_STARTED,
+  proposed: APP_PROVISION_CHAT_PROPOSED,
+  attemptRed: APP_PROVISION_CHAT_ATTEMPT_RED,
+  succeeded: APP_PROVISION_CHAT_SUCCEEDED,
+  needsInput: APP_PROVISION_CHAT_NEEDS_INPUT,
+  failed: APP_PROVISION_CHAT_FAILED
+};
+var APP_PROVISION_EVIDENCE_ATTEMPT = "Attempt";
+var APP_PROVISION_EVIDENCE_STEP = "Step";
+var APP_PROVISION_EVIDENCE_VERDICT = "Verdict";
+var APP_PROVISION_EVIDENCE_DURATION = "Duration";
+var APP_PROVISION_EVIDENCE_BUILD_LOG = "Build log";
+var APP_PROVISION_EVIDENCE_IMAGE_DIGEST = "Image digest";
+var APP_PROVISION_EVIDENCE_TARGET = "Target";
+var APP_PROVISION_EVIDENCE_SMOKE = "Smoke tests";
+var APP_PROVISION_EVIDENCE_SPEND = "Spend";
+var APP_PROVISION_EVIDENCE_HEADINGS = {
+  attempt: APP_PROVISION_EVIDENCE_ATTEMPT,
+  step: APP_PROVISION_EVIDENCE_STEP,
+  verdict: APP_PROVISION_EVIDENCE_VERDICT,
+  duration: APP_PROVISION_EVIDENCE_DURATION,
+  buildLog: APP_PROVISION_EVIDENCE_BUILD_LOG,
+  imageDigest: APP_PROVISION_EVIDENCE_IMAGE_DIGEST,
+  target: APP_PROVISION_EVIDENCE_TARGET,
+  smoke: APP_PROVISION_EVIDENCE_SMOKE,
+  spend: APP_PROVISION_EVIDENCE_SPEND
+};
+var APP_PROVISION_QUEUED_REASON_USER_LIMIT = "you already have 3 provisionings running.";
+var APP_PROVISION_QUEUED_REASON_ORG_LIMIT = "this workspace already has 10 provisionings running.";
+var APP_PROVISION_QUEUED_REASON_TEXTS = {
+  "user-limit": APP_PROVISION_QUEUED_REASON_USER_LIMIT,
+  "org-limit": APP_PROVISION_QUEUED_REASON_ORG_LIMIT
+};
+var APP_PROVISION_REMINDER_TITLE = "Still waiting on your answer";
+var APP_PROVISION_REMINDER_BODY = "Still waiting on your answer about {repo}. The provisioning keeps waiting and fails after 14 days without an answer.";
+var APP_PROVISION_COPY_TEMPLATES = [
+  {
+    name: "APP_PROVISION_REASON_TEXT_NO_ISOLATED_RUNTIME",
+    value: APP_PROVISION_REASON_TEXT_NO_ISOLATED_RUNTIME,
+    params: []
+  },
+  {
+    name: "APP_PROVISION_REASON_TEXT_REPOSITORY_NOT_READY",
+    value: APP_PROVISION_REASON_TEXT_REPOSITORY_NOT_READY,
+    params: []
+  },
+  {
+    name: "APP_PROVISION_REASON_TEXT_REPOSITORY_TOO_LARGE",
+    value: APP_PROVISION_REASON_TEXT_REPOSITORY_TOO_LARGE,
+    params: []
+  },
+  { name: "APP_PROVISION_REASON_TEXT_NOT_RUNNABLE", value: APP_PROVISION_REASON_TEXT_NOT_RUNNABLE, params: [] },
+  { name: "APP_PROVISION_REASON_TEXT_TOKEN_CAP", value: APP_PROVISION_REASON_TEXT_TOKEN_CAP, params: [] },
+  {
+    name: "APP_PROVISION_REASON_TEXT_RUNNER_MINUTE_CAP",
+    value: APP_PROVISION_REASON_TEXT_RUNNER_MINUTE_CAP,
+    params: []
+  },
+  { name: "APP_PROVISION_REASON_TEXT_DEADLINE", value: APP_PROVISION_REASON_TEXT_DEADLINE, params: [] },
+  {
+    name: "APP_PROVISION_REASON_TEXT_COULD_NOT_VERIFY",
+    value: APP_PROVISION_REASON_TEXT_COULD_NOT_VERIFY,
+    params: ["attempts"]
+  },
+  { name: "APP_PROVISION_REASON_TEXT_NO_ANSWER", value: APP_PROVISION_REASON_TEXT_NO_ANSWER, params: ["attempts"] },
+  {
+    name: "APP_PROVISION_REASON_TEXT_VERIFICATION_INFRASTRUCTURE",
+    value: APP_PROVISION_REASON_TEXT_VERIFICATION_INFRASTRUCTURE,
+    params: []
+  },
+  {
+    name: "APP_PROVISION_REASON_TEXT_PRIVATE_REPOSITORY",
+    value: APP_PROVISION_REASON_TEXT_PRIVATE_REPOSITORY,
+    params: []
+  },
+  { name: "APP_PROVISION_QUESTION_SUBJECT_PREFIX", value: APP_PROVISION_QUESTION_SUBJECT_PREFIX, params: ["repo"] },
+  {
+    name: "APP_PROVISION_QUESTION_SUBJECT_ATTEMPTS_SPENT",
+    value: APP_PROVISION_QUESTION_SUBJECT_ATTEMPTS_SPENT,
+    params: ["attempts"]
+  },
+  {
+    name: "APP_PROVISION_QUESTION_SUBJECT_REPEATED_FAILURE",
+    value: APP_PROVISION_QUESTION_SUBJECT_REPEATED_FAILURE,
+    params: []
+  },
+  {
+    name: "APP_PROVISION_QUESTION_SUBJECT_MISSING_REQUIRED_VALUE",
+    value: APP_PROVISION_QUESTION_SUBJECT_MISSING_REQUIRED_VALUE,
+    params: ["variable"]
+  },
+  {
+    name: "APP_PROVISION_QUESTION_SUBJECT_RUNNER_CAPACITY",
+    value: APP_PROVISION_QUESTION_SUBJECT_RUNNER_CAPACITY,
+    params: []
+  },
+  { name: "APP_PROVISION_QUESTION_SUBJECT_TOKEN_CAP", value: APP_PROVISION_QUESTION_SUBJECT_TOKEN_CAP, params: [] },
+  {
+    name: "APP_PROVISION_QUESTION_SUBJECT_RUNNER_MINUTE_CAP",
+    value: APP_PROVISION_QUESTION_SUBJECT_RUNNER_MINUTE_CAP,
+    params: []
+  },
+  {
+    name: "APP_PROVISION_QUESTION_SUBJECT_MULTIPLE_APPS",
+    value: APP_PROVISION_QUESTION_SUBJECT_MULTIPLE_APPS,
+    params: []
+  },
+  {
+    name: "APP_PROVISION_QUESTION_SUBJECT_AGENT_ASKED",
+    value: APP_PROVISION_QUESTION_SUBJECT_AGENT_ASKED,
+    params: []
+  },
+  {
+    name: "APP_PROVISION_QUESTION_SUBJECT_SAFETY_RAIL",
+    value: APP_PROVISION_QUESTION_SUBJECT_SAFETY_RAIL,
+    params: ["reason"]
+  },
+  { name: "APP_PROVISION_OPTION_RETRY", value: APP_PROVISION_OPTION_RETRY, params: [] },
+  { name: "APP_PROVISION_OPTION_RETRY_AFTER_SETTING", value: APP_PROVISION_OPTION_RETRY_AFTER_SETTING, params: [] },
+  { name: "APP_PROVISION_OPTION_OPTIONAL", value: APP_PROVISION_OPTION_OPTIONAL, params: [] },
+  { name: "APP_PROVISION_OPTION_VERIFY_ON_CLUSTER", value: APP_PROVISION_OPTION_VERIFY_ON_CLUSTER, params: [] },
+  { name: "APP_PROVISION_OPTION_ACCEPT_BUILD_ONLY", value: APP_PROVISION_OPTION_ACCEPT_BUILD_ONLY, params: [] },
+  { name: "APP_PROVISION_OPTION_RAISE_CAP_TOKENS", value: APP_PROVISION_OPTION_RAISE_CAP_TOKENS, params: [] },
+  { name: "APP_PROVISION_OPTION_RAISE_CAP_MINUTES", value: APP_PROVISION_OPTION_RAISE_CAP_MINUTES, params: [] },
+  { name: "APP_PROVISION_OPTION_CHOOSE", value: APP_PROVISION_OPTION_CHOOSE, params: ["candidate"] },
+  { name: "APP_PROVISION_OPTION_STOP", value: APP_PROVISION_OPTION_STOP, params: [] },
+  { name: "APP_PROVISION_CHAT_STARTED", value: APP_PROVISION_CHAT_STARTED, params: ["repo"] },
+  { name: "APP_PROVISION_CHAT_PROPOSED", value: APP_PROVISION_CHAT_PROPOSED, params: ["pr"] },
+  {
+    name: "APP_PROVISION_CHAT_ATTEMPT_RED",
+    value: APP_PROVISION_CHAT_ATTEMPT_RED,
+    params: ["n", "budget", "step", "detail"]
+  },
+  { name: "APP_PROVISION_CHAT_SUCCEEDED", value: APP_PROVISION_CHAT_SUCCEEDED, params: ["pr"] },
+  { name: "APP_PROVISION_CHAT_NEEDS_INPUT", value: APP_PROVISION_CHAT_NEEDS_INPUT, params: [] },
+  { name: "APP_PROVISION_CHAT_FAILED", value: APP_PROVISION_CHAT_FAILED, params: ["reason"] },
+  { name: "APP_PROVISION_EVIDENCE_ATTEMPT", value: APP_PROVISION_EVIDENCE_ATTEMPT, params: [] },
+  { name: "APP_PROVISION_EVIDENCE_STEP", value: APP_PROVISION_EVIDENCE_STEP, params: [] },
+  { name: "APP_PROVISION_EVIDENCE_VERDICT", value: APP_PROVISION_EVIDENCE_VERDICT, params: [] },
+  { name: "APP_PROVISION_EVIDENCE_DURATION", value: APP_PROVISION_EVIDENCE_DURATION, params: [] },
+  { name: "APP_PROVISION_EVIDENCE_BUILD_LOG", value: APP_PROVISION_EVIDENCE_BUILD_LOG, params: [] },
+  { name: "APP_PROVISION_EVIDENCE_IMAGE_DIGEST", value: APP_PROVISION_EVIDENCE_IMAGE_DIGEST, params: [] },
+  { name: "APP_PROVISION_EVIDENCE_TARGET", value: APP_PROVISION_EVIDENCE_TARGET, params: [] },
+  { name: "APP_PROVISION_EVIDENCE_SMOKE", value: APP_PROVISION_EVIDENCE_SMOKE, params: [] },
+  { name: "APP_PROVISION_EVIDENCE_SPEND", value: APP_PROVISION_EVIDENCE_SPEND, params: [] },
+  { name: "APP_PROVISION_QUEUED_REASON_USER_LIMIT", value: APP_PROVISION_QUEUED_REASON_USER_LIMIT, params: [] },
+  { name: "APP_PROVISION_QUEUED_REASON_ORG_LIMIT", value: APP_PROVISION_QUEUED_REASON_ORG_LIMIT, params: [] },
+  { name: "APP_PROVISION_REMINDER_TITLE", value: APP_PROVISION_REMINDER_TITLE, params: [] },
+  { name: "APP_PROVISION_REMINDER_BODY", value: APP_PROVISION_REMINDER_BODY, params: ["repo"] }
+];
+var PLACEHOLDER = /\{([a-zA-Z][a-zA-Z0-9]*)\}/g;
+function resolveAppProvisionCopy(template, values = {}) {
+  return template.replace(PLACEHOLDER, (placeholder, name) => {
+    const value = values[name];
+    return value === void 0 ? placeholder : String(value);
+  });
+}
+function appProvisionCopyPlaceholders(template) {
+  return [...template.matchAll(PLACEHOLDER)].map((match) => match[1]);
+}
+var OPTION_ORDER = {
+  "attempts-spent": ["retry", "stop"],
+  "repeated-failure": ["retry", "stop"],
+  "missing-required-value": ["retry-after-setting", "optional", "stop"],
+  "runner-capacity": ["verify-on-cluster", "accept-build-only", "stop"],
+  "token-cap": ["raise-cap", "stop"],
+  "runner-minute-cap": ["raise-cap", "stop"],
+  "multiple-apps": ["stop"],
+  "agent-asked": ["retry", "stop"],
+  "safety-rail": ["retry", "stop"]
+};
+var MAX_CANDIDATE_OPTIONS = APP_PROVISION_LIMITS.optionsMax - 1;
+function optionLabel(reason, id) {
+  if (id === "raise-cap") {
+    return reason === "runner-minute-cap" ? APP_PROVISION_OPTION_RAISE_CAP_MINUTES : APP_PROVISION_OPTION_RAISE_CAP_TOKENS;
+  }
+  return APP_PROVISION_OPTION_LABELS[id];
+}
+var appProvisionCopy = {
+  /**
+   * The composed Inbox subject: `Provisioning <repo>: <fragment>`
+   * (spec §6:511). `repo` and every fragment param travel in `values`.
+   */
+  questionSubject(reason, values = {}) {
+    return resolveAppProvisionCopy(
+      APP_PROVISION_QUESTION_SUBJECT_PREFIX + APP_PROVISION_QUESTION_SUBJECTS[reason],
+      values
+    );
+  },
+  /**
+   * The options for one question, in order, always ending with `stop`.
+   *
+   * `multiple-apps` offers one `choose:<n>` per candidate in
+   * `values.candidates` (a comma-separated list of names), capped so the total
+   * never exceeds `APP_PROVISION_LIMITS.optionsMax`.
+   */
+  questionOptions(reason, values = {}) {
+    const options = [];
+    if (reason === "multiple-apps") {
+      const candidates = String(values.candidates ?? "").split(",").map((candidate) => candidate.trim()).filter((candidate) => candidate.length > 0).slice(0, MAX_CANDIDATE_OPTIONS);
+      candidates.forEach((candidate, index) => {
+        options.push({
+          id: `choose:${index + 1}`,
+          i18nKey: APP_PROVISIONING_OPTION_I18N_KEY.choose,
+          label: resolveAppProvisionCopy(APP_PROVISION_OPTION_CHOOSE, { candidate }),
+          candidate: index + 1
+        });
+      });
+    }
+    for (const id of OPTION_ORDER[reason]) {
+      options.push({
+        id,
+        i18nKey: APP_PROVISIONING_OPTION_I18N_KEY[id],
+        label: resolveAppProvisionCopy(optionLabel(reason, id), values)
+      });
+    }
+    return options;
+  },
+  /** The failure text for the card's `Failed` headline (spec §6:485). */
+  reasonText(failureReason, values = {}) {
+    return resolveAppProvisionCopy(APP_PROVISION_REASON_TEXTS[failureReason], values);
+  },
+  /** The queued headline's reason clause, per `AppProvisioningView.queuedReason`. */
+  queuedReason(queuedReason) {
+    return APP_PROVISION_QUEUED_REASON_TEXTS[queuedReason];
+  },
+  /** The six chat milestones, resolved on call. */
+  chat: {
+    started: (values = {}) => resolveAppProvisionCopy(APP_PROVISION_CHAT_STARTED, values),
+    proposed: (values = {}) => resolveAppProvisionCopy(APP_PROVISION_CHAT_PROPOSED, values),
+    attemptRed: (values = {}) => resolveAppProvisionCopy(APP_PROVISION_CHAT_ATTEMPT_RED, values),
+    succeeded: (values = {}) => resolveAppProvisionCopy(APP_PROVISION_CHAT_SUCCEEDED, values),
+    needsInput: (values = {}) => resolveAppProvisionCopy(APP_PROVISION_CHAT_NEEDS_INPUT, values),
+    failed: (values = {}) => resolveAppProvisionCopy(APP_PROVISION_CHAT_FAILED, values)
+  },
+  /** The nine evidence-comment headings, by leaf. */
+  evidence: {
+    attempt: APP_PROVISION_EVIDENCE_ATTEMPT,
+    step: APP_PROVISION_EVIDENCE_STEP,
+    verdict: APP_PROVISION_EVIDENCE_VERDICT,
+    duration: APP_PROVISION_EVIDENCE_DURATION,
+    buildLog: APP_PROVISION_EVIDENCE_BUILD_LOG,
+    imageDigest: APP_PROVISION_EVIDENCE_IMAGE_DIGEST,
+    target: APP_PROVISION_EVIDENCE_TARGET,
+    smoke: APP_PROVISION_EVIDENCE_SMOKE,
+    spend: APP_PROVISION_EVIDENCE_SPEND
+  },
+  /** The 72-hour reminder (S20): title and body. */
+  reminder: {
+    title: APP_PROVISION_REMINDER_TITLE,
+    body: (values = {}) => resolveAppProvisionCopy(APP_PROVISION_REMINDER_BODY, values)
+  },
+  /**
+   * The i18n leaf for a question reason — the same lookup the card makes, so
+   * the server's English and the viewer's locale cannot diverge on WHICH
+   * string they mean.
+   */
+  reasonI18nKey(reason) {
+    return APP_PROVISIONING_QUESTION_REASON_I18N_KEY[reason];
+  },
+  /** The i18n leaf for a failure reason. */
+  failureI18nKey(failureReason) {
+    return APP_PROVISIONING_FAILURE_REASON_I18N_KEY[failureReason];
+  },
+  /** The i18n leaf for a queued reason. */
+  queuedI18nKey(queuedReason) {
+    return APP_PROVISIONING_QUEUED_REASON_I18N_KEY[queuedReason];
+  }
+};
+
 // src/github/index.ts
 function parseGitHubRepositoryUrl(input) {
   try {
@@ -5441,7 +8604,7 @@ var DEFAULT_CREDIT_SETTLEMENT_MODE = "provider_cost";
 function isCreditSettlementMode(value) {
   return typeof value === "string" && CREDIT_SETTLEMENT_MODES.includes(value);
 }
-var CREDIT_PRICE_GROUPS = ["research", "data", "tools", "models"];
+var CREDIT_PRICE_GROUPS = ["research", "data", "tools", "models", "hosting"];
 
 // src/notifications/attention.types.ts
 var ATTENTION_TARGET_CLASSES = ["email", "channel"];
@@ -6017,6 +9180,17 @@ var SAFETY_PAUSE_WRITES_PER_MINUTE = 10;
 var SAFETY_CANCEL_WRITES_PER_MINUTE = 5;
 var UNCLASSIFIED_ACTION_POLICY = "warn";
 var SHIPPED_DEFAULT_RUNG_POLICY = "display";
+/**
+ * One header finding of the licence scan (plan §2.6:324-325, FR-54): the
+ * `SPDX-License-Identifier:` / `@license` tag a file declares in its first
+ * `LICENSE_HEADER_SCAN_BYTES` bytes.
+ *
+ * **Gap, named rather than guessed:** plan §3.1:437 writes the column's third
+ * field as `headerFindings: …` without a shape. `path` is certain — it is the
+ * first field of the scan's input — and the detected identifier is the second
+ * fact the scan produces, so both are declared; anything further an
+ * implementation adds is additive.
+ */
 
 exports.ACTION_CATEGORIES = ACTION_CATEGORIES;
 exports.ACTION_CATEGORY_CEILING = ACTION_CATEGORY_CEILING;
@@ -6047,7 +9221,578 @@ exports.AGENT_STATUS_BATCH_MAX = AGENT_STATUS_BATCH_MAX;
 exports.AGENT_STATUS_DOT = AGENT_STATUS_DOT;
 exports.AGENT_STATUS_POLL_INTERVAL_MS = AGENT_STATUS_POLL_INTERVAL_MS;
 exports.AGENT_STATUS_REASONS = AGENT_STATUS_REASONS;
+exports.APPS_CATALOG_CACHE_TTL_MS = APPS_CATALOG_CACHE_TTL_MS;
+exports.APPS_CATALOG_CATEGORIES = APPS_CATALOG_CATEGORIES;
+exports.APPS_CATALOG_ENTRY_LICENSE_CLASSES = APPS_CATALOG_ENTRY_LICENSE_CLASSES;
+exports.APPS_CATALOG_ENTRY_STATUSES = APPS_CATALOG_ENTRY_STATUSES;
+exports.APPS_CATALOG_FAILURE_TTL_MS = APPS_CATALOG_FAILURE_TTL_MS;
+exports.APPS_CATALOG_FANOUT_PER_RUN = APPS_CATALOG_FANOUT_PER_RUN;
+exports.APPS_CATALOG_FETCH_TIMEOUT_MS = APPS_CATALOG_FETCH_TIMEOUT_MS;
+exports.APPS_CATALOG_LAST_GOOD_REGISTRY_MS = APPS_CATALOG_LAST_GOOD_REGISTRY_MS;
+exports.APPS_CATALOG_MANIFEST_MAX_BYTES = APPS_CATALOG_MANIFEST_MAX_BYTES;
+exports.APPS_CATALOG_MAX_ENTRIES = APPS_CATALOG_MAX_ENTRIES;
+exports.APPS_CATALOG_PAGE_SIZE = APPS_CATALOG_PAGE_SIZE;
+exports.APPS_CATALOG_PAGE_SIZE_MAX = APPS_CATALOG_PAGE_SIZE_MAX;
+exports.APPS_CATALOG_PUBLIC_PER_MIN = APPS_CATALOG_PUBLIC_PER_MIN;
+exports.APPS_CATALOG_README_MAX_BYTES = APPS_CATALOG_README_MAX_BYTES;
+exports.APPS_CATALOG_REFRESH_CRON = APPS_CATALOG_REFRESH_CRON;
+exports.APPS_CATALOG_REGISTRY_MAX_BYTES = APPS_CATALOG_REGISTRY_MAX_BYTES;
+exports.APPS_CATALOG_SEARCH_MIN_CHARS = APPS_CATALOG_SEARCH_MIN_CHARS;
+exports.APPS_CATALOG_VERIFICATION_STATUSES = APPS_CATALOG_VERIFICATION_STATUSES;
+exports.APPS_MANAGED_REQUIRES_VERIFIED = APPS_MANAGED_REQUIRES_VERIFIED;
+exports.APPS_TIER_ACTIVITY_ACTION_TYPE = APPS_TIER_ACTIVITY_ACTION_TYPE;
+exports.APPS_TIER_ALLOWED_HOSTS_ANNOTATION = APPS_TIER_ALLOWED_HOSTS_ANNOTATION;
+exports.APPS_TIER_API_GROUP = APPS_TIER_API_GROUP;
+exports.APPS_TIER_API_VERSION = APPS_TIER_API_VERSION;
+exports.APPS_TIER_ATTESTATION_EVIDENCE_MAX_CHARS = APPS_TIER_ATTESTATION_EVIDENCE_MAX_CHARS;
+exports.APPS_TIER_ATTESTATION_EVIDENCE_MIN_CHARS = APPS_TIER_ATTESTATION_EVIDENCE_MIN_CHARS;
+exports.APPS_TIER_ATTESTATION_EVIDENCE_REFERENCE_MAX_CHARS = APPS_TIER_ATTESTATION_EVIDENCE_REFERENCE_MAX_CHARS;
+exports.APPS_TIER_AUTO_REOPENABLE_REASON_CODES = APPS_TIER_AUTO_REOPENABLE_REASON_CODES;
+exports.APPS_TIER_BILLING_GRACE_DAYS = APPS_TIER_BILLING_GRACE_DAYS;
+exports.APPS_TIER_BILLING_QUARANTINE_CATEGORY = APPS_TIER_BILLING_QUARANTINE_CATEGORY;
+exports.APPS_TIER_CLOSED_REASON_CODES = APPS_TIER_CLOSED_REASON_CODES;
+exports.APPS_TIER_COMPONENT_ROLES = APPS_TIER_COMPONENT_ROLES;
+exports.APPS_TIER_CONTROLLER_MIN_VERSION_ENV_VAR = APPS_TIER_CONTROLLER_MIN_VERSION_ENV_VAR;
+exports.APPS_TIER_CONTROL_KUBECONFIG_ENV_VAR = APPS_TIER_CONTROL_KUBECONFIG_ENV_VAR;
+exports.APPS_TIER_CONTROL_NAMESPACE_DEFAULT = APPS_TIER_CONTROL_NAMESPACE_DEFAULT;
+exports.APPS_TIER_DAILY_RECEIPTS_CRON = APPS_TIER_DAILY_RECEIPTS_CRON;
+exports.APPS_TIER_DEPENDENCY_PHASES = APPS_TIER_DEPENDENCY_PHASES;
+exports.APPS_TIER_DEPLOY_PHASES = APPS_TIER_DEPLOY_PHASES;
+exports.APPS_TIER_EDGE_TLS_MODE = APPS_TIER_EDGE_TLS_MODE;
+exports.APPS_TIER_EGRESS_NOTICE_SHARE = APPS_TIER_EGRESS_NOTICE_SHARE;
+exports.APPS_TIER_EGRESS_THROTTLE_MBPS = APPS_TIER_EGRESS_THROTTLE_MBPS;
+exports.APPS_TIER_ELIGIBILITY_DISABLED_REASONS = APPS_TIER_ELIGIBILITY_DISABLED_REASONS;
+exports.APPS_TIER_ELIGIBILITY_REASONS = APPS_TIER_ELIGIBILITY_REASONS;
+exports.APPS_TIER_EVENT_NAMES = APPS_TIER_EVENT_NAMES;
+exports.APPS_TIER_GATE_MAX_AGE_HOURS_ENV_VAR = APPS_TIER_GATE_MAX_AGE_HOURS_ENV_VAR;
+exports.APPS_TIER_HEARTBEAT_STALE_MS = APPS_TIER_HEARTBEAT_STALE_MS;
+exports.APPS_TIER_JOB_PHASES = APPS_TIER_JOB_PHASES;
+exports.APPS_TIER_JOB_STATUSES = APPS_TIER_JOB_STATUSES;
+exports.APPS_TIER_MAIL_REFUSED_ATTEMPTS_PER_HOUR = APPS_TIER_MAIL_REFUSED_ATTEMPTS_PER_HOUR;
+exports.APPS_TIER_MANAGED_ENABLED_ENV_VAR = APPS_TIER_MANAGED_ENABLED_ENV_VAR;
+exports.APPS_TIER_MAX_COMPONENTS = APPS_TIER_MAX_COMPONENTS;
+exports.APPS_TIER_MAX_COMPONENT_REPLICAS = APPS_TIER_MAX_COMPONENT_REPLICAS;
+exports.APPS_TIER_MAX_COMPONENT_VOLUMES = APPS_TIER_MAX_COMPONENT_VOLUMES;
+exports.APPS_TIER_MAX_CRON = APPS_TIER_MAX_CRON;
+exports.APPS_TIER_MAX_ENV_NAMES = APPS_TIER_MAX_ENV_NAMES;
+exports.APPS_TIER_MAX_HOSTS = APPS_TIER_MAX_HOSTS;
+exports.APPS_TIER_MAX_IMAGES = APPS_TIER_MAX_IMAGES;
+exports.APPS_TIER_MAX_JOBS = APPS_TIER_MAX_JOBS;
+exports.APPS_TIER_MAX_JOB_TIMEOUT_SECONDS = APPS_TIER_MAX_JOB_TIMEOUT_SECONDS;
+exports.APPS_TIER_MAX_PER_USER_ENV_VAR = APPS_TIER_MAX_PER_USER_ENV_VAR;
+exports.APPS_TIER_MAX_PULL_CREDENTIAL_BYTES = APPS_TIER_MAX_PULL_CREDENTIAL_BYTES;
+exports.APPS_TIER_MAX_SCOPE_ENV_VAR = APPS_TIER_MAX_SCOPE_ENV_VAR;
+exports.APPS_TIER_MAX_SEALED_ENV_BYTES = APPS_TIER_MAX_SEALED_ENV_BYTES;
+exports.APPS_TIER_MAX_SMOKE = APPS_TIER_MAX_SMOKE;
+exports.APPS_TIER_MAX_WORK_BYTES = APPS_TIER_MAX_WORK_BYTES;
+exports.APPS_TIER_METERING_IMPORT_CRON = APPS_TIER_METERING_IMPORT_CRON;
+exports.APPS_TIER_MINING_CPU_SHARE = APPS_TIER_MINING_CPU_SHARE;
+exports.APPS_TIER_MINING_CPU_WINDOW_MS = APPS_TIER_MINING_CPU_WINDOW_MS;
+exports.APPS_TIER_MINING_MEDIUM_WINDOW_MS = APPS_TIER_MINING_MEDIUM_WINDOW_MS;
+exports.APPS_TIER_MINING_REFUSED_CONNECTIONS = APPS_TIER_MINING_REFUSED_CONNECTIONS;
+exports.APPS_TIER_MIN_CRON_INTERVAL_MS = APPS_TIER_MIN_CRON_INTERVAL_MS;
+exports.APPS_TIER_NOTIFICATION_IDS = APPS_TIER_NOTIFICATION_IDS;
+exports.APPS_TIER_OPEN_REFUSED_CODE = APPS_TIER_OPEN_REFUSED_CODE;
+exports.APPS_TIER_PAUSE_ALL_CATEGORY = APPS_TIER_PAUSE_ALL_CATEGORY;
+exports.APPS_TIER_PAUSE_ALL_CONFIRMATION = APPS_TIER_PAUSE_ALL_CONFIRMATION;
+exports.APPS_TIER_POLICY_DEFAULT_SCOPE = APPS_TIER_POLICY_DEFAULT_SCOPE;
+exports.APPS_TIER_PRICEBOOK_VERSION = APPS_TIER_PRICEBOOK_VERSION;
+exports.APPS_TIER_PRICE_GROUP = APPS_TIER_PRICE_GROUP;
+exports.APPS_TIER_PRICE_KEYS = APPS_TIER_PRICE_KEYS;
+exports.APPS_TIER_PRICE_UNITS = APPS_TIER_PRICE_UNITS;
+exports.APPS_TIER_PROBE_REASON_CODES = APPS_TIER_PROBE_REASON_CODES;
+exports.APPS_TIER_PUBLIC_KEY_CONFIG_MAP = APPS_TIER_PUBLIC_KEY_CONFIG_MAP;
+exports.APPS_TIER_QUARANTINED_LABEL = APPS_TIER_QUARANTINED_LABEL;
+exports.APPS_TIER_QUARANTINE_CATEGORIES = APPS_TIER_QUARANTINE_CATEGORIES;
+exports.APPS_TIER_QUARANTINE_REASON_MIN_CHARS = APPS_TIER_QUARANTINE_REASON_MIN_CHARS;
+exports.APPS_TIER_QUARANTINE_SOURCES = APPS_TIER_QUARANTINE_SOURCES;
+exports.APPS_TIER_QUOTA_CEILINGS = APPS_TIER_QUOTA_CEILINGS;
+exports.APPS_TIER_QUOTA_CEILING_EXCEEDED_CODE = APPS_TIER_QUOTA_CEILING_EXCEEDED_CODE;
+exports.APPS_TIER_QUOTA_PROFILES = APPS_TIER_QUOTA_PROFILES;
+exports.APPS_TIER_QUOTA_PROFILE_NAMES = APPS_TIER_QUOTA_PROFILE_NAMES;
+exports.APPS_TIER_RETAINED_UNTIL_LABEL = APPS_TIER_RETAINED_UNTIL_LABEL;
+exports.APPS_TIER_RUN_JOB_ANNOTATION = APPS_TIER_RUN_JOB_ANNOTATION;
+exports.APPS_TIER_SCOPES = APPS_TIER_SCOPES;
+exports.APPS_TIER_SEAL_AAD_PREFIX = APPS_TIER_SEAL_AAD_PREFIX;
+exports.APPS_TIER_SELF_CHECK_RUN_RETENTION_COUNT = APPS_TIER_SELF_CHECK_RUN_RETENTION_COUNT;
+exports.APPS_TIER_SELF_CHECK_RUN_RETENTION_DAYS = APPS_TIER_SELF_CHECK_RUN_RETENTION_DAYS;
+exports.APPS_TIER_SIGNAL_KINDS = APPS_TIER_SIGNAL_KINDS;
+exports.APPS_TIER_SIGNAL_SEVERITIES = APPS_TIER_SIGNAL_SEVERITIES;
+exports.APPS_TIER_SIGNAL_SUMMARY_MAX_CHARS = APPS_TIER_SIGNAL_SUMMARY_MAX_CHARS;
+exports.APPS_TIER_SMOKE_SCOPES = APPS_TIER_SMOKE_SCOPES;
+exports.APPS_TIER_SMOKE_STATUSES = APPS_TIER_SMOKE_STATUSES;
+exports.APPS_TIER_STATES = APPS_TIER_STATES;
+exports.APPS_TIER_TENANT_LABEL = APPS_TIER_TENANT_LABEL;
+exports.APPS_TIER_TENANT_NAMESPACE_PREFIX = APPS_TIER_TENANT_NAMESPACE_PREFIX;
+exports.APPS_TIER_USAGE_FRESHNESS_MS = APPS_TIER_USAGE_FRESHNESS_MS;
+exports.APPS_TIER_USAGE_UNITS = APPS_TIER_USAGE_UNITS;
+exports.APPS_TIER_WORK_CANARY_LABEL = APPS_TIER_WORK_CANARY_LABEL;
+exports.APPS_TIER_WORK_DEGRADED_REASONS = APPS_TIER_WORK_DEGRADED_REASONS;
+exports.APPS_TIER_WORK_DESIRED_STATES = APPS_TIER_WORK_DESIRED_STATES;
+exports.APPS_TIER_WORK_ID_LABEL = APPS_TIER_WORK_ID_LABEL;
+exports.APPS_TIER_WORK_NAME_PREFIX = APPS_TIER_WORK_NAME_PREFIX;
+exports.APPS_TIER_WORK_OWNER_LABEL = APPS_TIER_WORK_OWNER_LABEL;
+exports.APPS_TIER_WORK_PHASES = APPS_TIER_WORK_PHASES;
+exports.APPS_TIER_WORK_REFUSAL_CODES = APPS_TIER_WORK_REFUSAL_CODES;
+exports.APPS_TIER_ZONE_AUDIT_RETENTION_DAYS = APPS_TIER_ZONE_AUDIT_RETENTION_DAYS;
+exports.APPS_TIER_ZONE_INFO_CONFIG_MAP = APPS_TIER_ZONE_INFO_CONFIG_MAP;
+exports.APP_ACTIONS_HYGIENE_MAX_WORKFLOWS = APP_ACTIONS_HYGIENE_MAX_WORKFLOWS;
+exports.APP_ACTIONS_STATES = APP_ACTIONS_STATES;
+exports.APP_BEHIND_EVENT_STEP = APP_BEHIND_EVENT_STEP;
+exports.APP_BLUEPRINT_APPLY_STATUSES = APP_BLUEPRINT_APPLY_STATUSES;
+exports.APP_BUILD_ACTIVITY_ACTION_TYPE = APP_BUILD_ACTIVITY_ACTION_TYPE;
+exports.APP_BUILD_ADOPT_WINDOW_MS = APP_BUILD_ADOPT_WINDOW_MS;
+exports.APP_BUILD_BLOCKED_ACTIONS = APP_BUILD_BLOCKED_ACTIONS;
+exports.APP_BUILD_BLOCKED_REASONS = APP_BUILD_BLOCKED_REASONS;
+exports.APP_BUILD_BLOCKED_REASON_ACTIONS = APP_BUILD_BLOCKED_REASON_ACTIONS;
+exports.APP_BUILD_BRANCH_SLUG_MAX_CHARS = APP_BUILD_BRANCH_SLUG_MAX_CHARS;
+exports.APP_BUILD_CANCEL_REASONS = APP_BUILD_CANCEL_REASONS;
+exports.APP_BUILD_CHECKS_JOB_ID = APP_BUILD_CHECKS_JOB_ID;
+exports.APP_BUILD_CHECKS_MAX = APP_BUILD_CHECKS_MAX;
+exports.APP_BUILD_CHECKS_MAX_PARALLEL = APP_BUILD_CHECKS_MAX_PARALLEL;
+exports.APP_BUILD_CHECK_NAME_PREFIX = APP_BUILD_CHECK_NAME_PREFIX;
+exports.APP_BUILD_DEPLOYABLE_TRIGGERS = APP_BUILD_DEPLOYABLE_TRIGGERS;
+exports.APP_BUILD_ENV_SYNC_SLA_MS = APP_BUILD_ENV_SYNC_SLA_MS;
+exports.APP_BUILD_EVENT_NAMES = APP_BUILD_EVENT_NAMES;
+exports.APP_BUILD_EXCERPT_MAX_LINES = APP_BUILD_EXCERPT_MAX_LINES;
+exports.APP_BUILD_EXCERPT_MAX_LINE_CHARS = APP_BUILD_EXCERPT_MAX_LINE_CHARS;
+exports.APP_BUILD_FAILURE_CLASSES = APP_BUILD_FAILURE_CLASSES;
+exports.APP_BUILD_FAILURE_COPY_EN = APP_BUILD_FAILURE_COPY_EN;
+exports.APP_BUILD_GENERATOR_VERSION = APP_BUILD_GENERATOR_VERSION;
+exports.APP_BUILD_IMAGE_NAME = APP_BUILD_IMAGE_NAME;
+exports.APP_BUILD_KINDS = APP_BUILD_KINDS;
+exports.APP_BUILD_LIST_MAX_PAGE_SIZE = APP_BUILD_LIST_MAX_PAGE_SIZE;
+exports.APP_BUILD_LIST_PAGE_SIZE = APP_BUILD_LIST_PAGE_SIZE;
+exports.APP_BUILD_LOG_TAIL_BYTES = APP_BUILD_LOG_TAIL_BYTES;
+exports.APP_BUILD_LOST_GRACE_MINUTES = APP_BUILD_LOST_GRACE_MINUTES;
+exports.APP_BUILD_MANAGED_CONCURRENCY = APP_BUILD_MANAGED_CONCURRENCY;
+exports.APP_BUILD_MANAGED_DEFAULTS = APP_BUILD_MANAGED_DEFAULTS;
+exports.APP_BUILD_MANAGED_MAXIMUMS = APP_BUILD_MANAGED_MAXIMUMS;
+exports.APP_BUILD_MAX_VALUES = APP_BUILD_MAX_VALUES;
+exports.APP_BUILD_NOT_DEPLOYABLE_REASONS = APP_BUILD_NOT_DEPLOYABLE_REASONS;
+exports.APP_BUILD_POLL_AFTER_SILENCE_MS = APP_BUILD_POLL_AFTER_SILENCE_MS;
+exports.APP_BUILD_PREPARE_WORKFLOW_STATES = APP_BUILD_PREPARE_WORKFLOW_STATES;
+exports.APP_BUILD_PULL_TOKEN_EXPIRY_WARN_DAYS = APP_BUILD_PULL_TOKEN_EXPIRY_WARN_DAYS;
+exports.APP_BUILD_REBUILDS_PER_HOUR = APP_BUILD_REBUILDS_PER_HOUR;
+exports.APP_BUILD_REBUILD_DEDUPE_MS = APP_BUILD_REBUILD_DEDUPE_MS;
+exports.APP_BUILD_RESTRICTED_VALUE_LITERAL = APP_BUILD_RESTRICTED_VALUE_LITERAL;
+exports.APP_BUILD_RESULT_ARTIFACT_FILE = APP_BUILD_RESULT_ARTIFACT_FILE;
+exports.APP_BUILD_RESULT_ARTIFACT_NAME = APP_BUILD_RESULT_ARTIFACT_NAME;
+exports.APP_BUILD_RESULT_ARTIFACT_RETENTION_DAYS = APP_BUILD_RESULT_ARTIFACT_RETENTION_DAYS;
+exports.APP_BUILD_RESULT_MAX_BYTES = APP_BUILD_RESULT_MAX_BYTES;
+exports.APP_BUILD_RUNNERS = APP_BUILD_RUNNERS;
+exports.APP_BUILD_RUNNER_CLASSES = APP_BUILD_RUNNER_CLASSES;
+exports.APP_BUILD_RUNNER_HEADROOM_GIB = APP_BUILD_RUNNER_HEADROOM_GIB;
+exports.APP_BUILD_RUN_DISCOVERY_BATCH = APP_BUILD_RUN_DISCOVERY_BATCH;
+exports.APP_BUILD_RUN_DISCOVERY_PER_PAGE = APP_BUILD_RUN_DISCOVERY_PER_PAGE;
+exports.APP_BUILD_RUN_SOURCES = APP_BUILD_RUN_SOURCES;
+exports.APP_BUILD_SECRET_CHECK_MIN_CHARS = APP_BUILD_SECRET_CHECK_MIN_CHARS;
+exports.APP_BUILD_SECRET_CHECK_RESULTS = APP_BUILD_SECRET_CHECK_RESULTS;
+exports.APP_BUILD_SECRET_MAX_BYTES = APP_BUILD_SECRET_MAX_BYTES;
+exports.APP_BUILD_SECRET_PREFIX = APP_BUILD_SECRET_PREFIX;
+exports.APP_BUILD_SETTING_ALLOW_VALUES_ON_PULL_REQUESTS = APP_BUILD_SETTING_ALLOW_VALUES_ON_PULL_REQUESTS;
+exports.APP_BUILD_SETTING_ATTESTATIONS = APP_BUILD_SETTING_ATTESTATIONS;
+exports.APP_BUILD_SETTING_RECLAIM_DISK = APP_BUILD_SETTING_RECLAIM_DISK;
+exports.APP_BUILD_SETTING_VERIFICATION_PROMPTED_REQUIRES_APPROVAL = APP_BUILD_SETTING_VERIFICATION_PROMPTED_REQUIRES_APPROVAL;
+exports.APP_BUILD_SIGNATURE_STATES = APP_BUILD_SIGNATURE_STATES;
+exports.APP_BUILD_STATUSES = APP_BUILD_STATUSES;
+exports.APP_BUILD_STATUS_EVENT_MAP = APP_BUILD_STATUS_EVENT_MAP;
+exports.APP_BUILD_STRATEGIES = APP_BUILD_STRATEGIES;
+exports.APP_BUILD_SWEEP_BATCH = APP_BUILD_SWEEP_BATCH;
+exports.APP_BUILD_SWEEP_CRON = APP_BUILD_SWEEP_CRON;
+exports.APP_BUILD_SYNC_ORIGINS = APP_BUILD_SYNC_ORIGINS;
+exports.APP_BUILD_TRIGGERS = APP_BUILD_TRIGGERS;
+exports.APP_BUILD_VERIFICATION_RESULT_MAX_SMOKE = APP_BUILD_VERIFICATION_RESULT_MAX_SMOKE;
+exports.APP_BUILD_VERIFY_MEMORY_GIB = APP_BUILD_VERIFY_MEMORY_GIB;
+exports.APP_BUILD_VERIFY_PLAN_INPUT = APP_BUILD_VERIFY_PLAN_INPUT;
+exports.APP_BUILD_VERIFY_PLAN_MAX_CHARS = APP_BUILD_VERIFY_PLAN_MAX_CHARS;
+exports.APP_BUILD_VERIFY_PLAN_MAX_COMPONENTS = APP_BUILD_VERIFY_PLAN_MAX_COMPONENTS;
+exports.APP_BUILD_VERIFY_PLAN_MAX_DEPENDENCIES = APP_BUILD_VERIFY_PLAN_MAX_DEPENDENCIES;
+exports.APP_BUILD_VERIFY_PLAN_MAX_ENV_ENTRIES = APP_BUILD_VERIFY_PLAN_MAX_ENV_ENTRIES;
+exports.APP_BUILD_VERIFY_PLAN_MAX_JOBS = APP_BUILD_VERIFY_PLAN_MAX_JOBS;
+exports.APP_BUILD_VERIFY_PLAN_MAX_SMOKE = APP_BUILD_VERIFY_PLAN_MAX_SMOKE;
+exports.APP_BUILD_VERIFY_PROMPTED_SECRET = APP_BUILD_VERIFY_PROMPTED_SECRET;
+exports.APP_BUILD_VERIFY_TIMEOUT_MINUTES = APP_BUILD_VERIFY_TIMEOUT_MINUTES;
+exports.APP_BUILD_WEBHOOK_EVENT = APP_BUILD_WEBHOOK_EVENT;
+exports.APP_BUILD_WEBHOOK_STATES = APP_BUILD_WEBHOOK_STATES;
+exports.APP_BUILD_WORKFLOW_BRANCH = APP_BUILD_WORKFLOW_BRANCH;
+exports.APP_BUILD_WORKFLOW_PATH = APP_BUILD_WORKFLOW_PATH;
+exports.APP_BUILD_WORKFLOW_STATES = APP_BUILD_WORKFLOW_STATES;
+exports.APP_CANCEL_REASONS = APP_CANCEL_REASONS;
+exports.APP_CERT_NOTIFY_AFTER_MIN = APP_CERT_NOTIFY_AFTER_MIN;
+exports.APP_CLUSTER_CHECK_TIMEOUT_S = APP_CLUSTER_CHECK_TIMEOUT_S;
+exports.APP_CLUSTER_DIAL_TIMEOUT_S = APP_CLUSTER_DIAL_TIMEOUT_S;
+exports.APP_CREATE_IDEMPOTENCY_WINDOW_MS = APP_CREATE_IDEMPOTENCY_WINDOW_MS;
+exports.APP_CREATE_LOCK_TTL_MS = APP_CREATE_LOCK_TTL_MS;
+exports.APP_CREATE_RESPONSE_BUDGET_MS = APP_CREATE_RESPONSE_BUDGET_MS;
+exports.APP_DEPENDENCY_BACKUP_OVERDUE_MS = APP_DEPENDENCY_BACKUP_OVERDUE_MS;
+exports.APP_DEPENDENCY_BACKUP_POLICIES = APP_DEPENDENCY_BACKUP_POLICIES;
+exports.APP_DEPENDENCY_BACKUP_STATES = APP_DEPENDENCY_BACKUP_STATES;
+exports.APP_DEPENDENCY_BACKUP_STATE_MESSAGE_KEY_PREFIX = APP_DEPENDENCY_BACKUP_STATE_MESSAGE_KEY_PREFIX;
+exports.APP_DEPENDENCY_BACKUP_STATE_MESSAGE_LEAVES = APP_DEPENDENCY_BACKUP_STATE_MESSAGE_LEAVES;
+exports.APP_DEPENDENCY_BUCKET_OUTPUT_PATTERN = APP_DEPENDENCY_BUCKET_OUTPUT_PATTERN;
+exports.APP_DEPENDENCY_BUCKET_OUTPUT_PREFIX = APP_DEPENDENCY_BUCKET_OUTPUT_PREFIX;
+exports.APP_DEPENDENCY_DEFAULT_SIZE_GIB = APP_DEPENDENCY_DEFAULT_SIZE_GIB;
+exports.APP_DEPENDENCY_ENV_VARS = APP_DEPENDENCY_ENV_VARS;
+exports.APP_DEPENDENCY_ERROR_CODES = APP_DEPENDENCY_ERROR_CODES;
+exports.APP_DEPENDENCY_EXTERNAL_TEST_MS = APP_DEPENDENCY_EXTERNAL_TEST_MS;
+exports.APP_DEPENDENCY_INACTIVE_STATUSES = APP_DEPENDENCY_INACTIVE_STATUSES;
+exports.APP_DEPENDENCY_KINDS = APP_DEPENDENCY_KINDS;
+exports.APP_DEPENDENCY_MANAGED = APP_DEPENDENCY_MANAGED;
+exports.APP_DEPENDENCY_OUTPUTS = APP_DEPENDENCY_OUTPUTS;
+exports.APP_DEPENDENCY_OUTPUT_NAMES = APP_DEPENDENCY_OUTPUT_NAMES;
+exports.APP_DEPENDENCY_POSTGRES_DEFAULT_PORT = APP_DEPENDENCY_POSTGRES_DEFAULT_PORT;
+exports.APP_DEPENDENCY_PROVIDER_IDS = APP_DEPENDENCY_PROVIDER_IDS;
+exports.APP_DEPENDENCY_READY_DEADLINE_MS = APP_DEPENDENCY_READY_DEADLINE_MS;
+exports.APP_DEPENDENCY_REASONS = APP_DEPENDENCY_REASONS;
+exports.APP_DEPENDENCY_REASON_MESSAGE_KEY_PREFIX = APP_DEPENDENCY_REASON_MESSAGE_KEY_PREFIX;
+exports.APP_DEPENDENCY_REASON_MESSAGE_LEAVES = APP_DEPENDENCY_REASON_MESSAGE_LEAVES;
+exports.APP_DEPENDENCY_REFRESH_AFTER_MS = APP_DEPENDENCY_REFRESH_AFTER_MS;
+exports.APP_DEPENDENCY_RELAY_DAILY_LIMIT = APP_DEPENDENCY_RELAY_DAILY_LIMIT;
+exports.APP_DEPENDENCY_RELAY_LIMITS = APP_DEPENDENCY_RELAY_LIMITS;
+exports.APP_DEPENDENCY_RETRY_DELAY_MS = APP_DEPENDENCY_RETRY_DELAY_MS;
+exports.APP_DEPENDENCY_STATUSES = APP_DEPENDENCY_STATUSES;
+exports.APP_DEPENDENCY_STATUS_MESSAGE_KEY_PREFIX = APP_DEPENDENCY_STATUS_MESSAGE_KEY_PREFIX;
+exports.APP_DEPENDENCY_STATUS_MESSAGE_LEAVES = APP_DEPENDENCY_STATUS_MESSAGE_LEAVES;
+exports.APP_DEPENDENCY_STATUS_REASONS = APP_DEPENDENCY_STATUS_REASONS;
+exports.APP_DEPENDENCY_TARGETS = APP_DEPENDENCY_TARGETS;
+exports.APP_DEPENDENCY_TOKEN_SCHEME = APP_DEPENDENCY_TOKEN_SCHEME;
+exports.APP_DEPENDENCY_TOKEN_UNKNOWN_CODE = APP_DEPENDENCY_TOKEN_UNKNOWN_CODE;
+exports.APP_DEPENDENCY_TRANSIENT_ATTEMPTS = APP_DEPENDENCY_TRANSIENT_ATTEMPTS;
+exports.APP_DEPENDENCY_ZONE_BUCKET_NAME_SHAPE = APP_DEPENDENCY_ZONE_BUCKET_NAME_SHAPE;
+exports.APP_DEPENDENCY_ZONE_BUCKET_PREFIX = APP_DEPENDENCY_ZONE_BUCKET_PREFIX;
+exports.APP_DEPENDENCY_ZONE_REDIS_MAX_MEMORY_MIB = APP_DEPENDENCY_ZONE_REDIS_MAX_MEMORY_MIB;
+exports.APP_DEPLOYMENT_DISPLAY_STATES = APP_DEPLOYMENT_DISPLAY_STATES;
+exports.APP_DEPLOYMENT_STATES = APP_DEPLOYMENT_STATES;
+exports.APP_DEPLOYMENT_TERMINAL_STATES = APP_DEPLOYMENT_TERMINAL_STATES;
+exports.APP_DEPLOY_LOCK_STALE_S = APP_DEPLOY_LOCK_STALE_S;
+exports.APP_DEPLOY_MAX_DURATION_S = APP_DEPLOY_MAX_DURATION_S;
+exports.APP_DEPLOY_OUTCOMES = APP_DEPLOY_OUTCOMES;
+exports.APP_DEPLOY_PHASES = APP_DEPLOY_PHASES;
+exports.APP_DEPLOY_PURPOSES = APP_DEPLOY_PURPOSES;
+exports.APP_DEPLOY_REQUEST_BUDGET_MS = APP_DEPLOY_REQUEST_BUDGET_MS;
+exports.APP_DEPLOY_TARGETS = APP_DEPLOY_TARGETS;
+exports.APP_DEPLOY_TARGET_CHOICES = APP_DEPLOY_TARGET_CHOICES;
+exports.APP_DIVERGENCE_DAILY_MS = APP_DIVERGENCE_DAILY_MS;
+exports.APP_DIVERGENCE_TTL_MS = APP_DIVERGENCE_TTL_MS;
+exports.APP_DOMAIN_RECONCILE_S = APP_DOMAIN_RECONCILE_S;
+exports.APP_ENV_ALPHABETS = APP_ENV_ALPHABETS;
+exports.APP_ENV_API_ERROR_CODES = APP_ENV_API_ERROR_CODES;
+exports.APP_ENV_BASE64_MAX_BYTES = APP_ENV_BASE64_MAX_BYTES;
+exports.APP_ENV_BASE64_MIN_BYTES = APP_ENV_BASE64_MIN_BYTES;
+exports.APP_ENV_BUILD_SERVICE_OBJECT_STORAGE_REGION = APP_ENV_BUILD_SERVICE_OBJECT_STORAGE_REGION;
+exports.APP_ENV_BUILD_SERVICE_OUTPUTS = APP_ENV_BUILD_SERVICE_OUTPUTS;
+exports.APP_ENV_BUILD_SERVICE_SMTP_FROM = APP_ENV_BUILD_SERVICE_SMTP_FROM;
+exports.APP_ENV_BUILD_SERVICE_VALUE_FLAG = APP_ENV_BUILD_SERVICE_VALUE_FLAG;
+exports.APP_ENV_CHARS_MAX_LENGTH = APP_ENV_CHARS_MAX_LENGTH;
+exports.APP_ENV_CHARS_MIN_LENGTH = APP_ENV_CHARS_MIN_LENGTH;
+exports.APP_ENV_DECLARED_SOURCES = APP_ENV_DECLARED_SOURCES;
+exports.APP_ENV_DEP_PASSWORD_TOKEN_PREFIX = APP_ENV_DEP_PASSWORD_TOKEN_PREFIX;
+exports.APP_ENV_DEP_PASSWORD_TOKEN_SUFFIX = APP_ENV_DEP_PASSWORD_TOKEN_SUFFIX;
+exports.APP_ENV_DOTENV_MAX_BYTES = APP_ENV_DOTENV_MAX_BYTES;
+exports.APP_ENV_DOTENV_MAX_LINES = APP_ENV_DOTENV_MAX_LINES;
+exports.APP_ENV_ERROR_CODES = APP_ENV_ERROR_CODES;
+exports.APP_ENV_ERROR_MESSAGE_KEY_PREFIX = APP_ENV_ERROR_MESSAGE_KEY_PREFIX;
+exports.APP_ENV_ERROR_MESSAGE_LEAVES = APP_ENV_ERROR_MESSAGE_LEAVES;
+exports.APP_ENV_GENERATE_SLA_MS = APP_ENV_GENERATE_SLA_MS;
+exports.APP_ENV_GENERATOR_KINDS = APP_ENV_GENERATOR_KINDS;
+exports.APP_ENV_IMPORT_OUTCOMES = APP_ENV_IMPORT_OUTCOMES;
+exports.APP_ENV_KEYPAIR_DEFAULT_FORMAT = APP_ENV_KEYPAIR_DEFAULT_FORMAT;
+exports.APP_ENV_KEYPAIR_FORMATS = APP_ENV_KEYPAIR_FORMATS;
+exports.APP_ENV_KEYPAIR_RAW_TYPES = APP_ENV_KEYPAIR_RAW_TYPES;
+exports.APP_ENV_KEYPAIR_TYPES = APP_ENV_KEYPAIR_TYPES;
+exports.APP_ENV_MAX_STORED = APP_ENV_MAX_STORED;
+exports.APP_ENV_NAME_PATTERN = APP_ENV_NAME_PATTERN;
+exports.APP_ENV_ORIGINS = APP_ENV_ORIGINS;
+exports.APP_ENV_PATTERN_BUDGET_MS = APP_ENV_PATTERN_BUDGET_MS;
+exports.APP_ENV_PHASES = APP_ENV_PHASES;
+exports.APP_ENV_PUBLIC_HALF_MAX_BYTES = APP_ENV_PUBLIC_HALF_MAX_BYTES;
+exports.APP_ENV_PUBLIC_HALF_SUFFIX = APP_ENV_PUBLIC_HALF_SUFFIX;
+exports.APP_ENV_PUBLIC_PREFIXES = APP_ENV_PUBLIC_PREFIXES;
+exports.APP_ENV_PUTS_PER_MINUTE = APP_ENV_PUTS_PER_MINUTE;
+exports.APP_ENV_RECIPE_SOURCES = APP_ENV_RECIPE_SOURCES;
+exports.APP_ENV_RECIPE_TOKEN_KINDS = APP_ENV_RECIPE_TOKEN_KINDS;
+exports.APP_ENV_REDACT_MIN_CHARS = APP_ENV_REDACT_MIN_CHARS;
+exports.APP_ENV_RESERVED_PREFIX = APP_ENV_RESERVED_PREFIX;
+exports.APP_ENV_RESOLUTION_TARGETS = APP_ENV_RESOLUTION_TARGETS;
+exports.APP_ENV_ROTATE_MODES = APP_ENV_ROTATE_MODES;
+exports.APP_ENV_ROTATIONS_PER_HOUR = APP_ENV_ROTATIONS_PER_HOUR;
+exports.APP_ENV_RUNNER_RECIPE_ENDPOINTS = APP_ENV_RUNNER_RECIPE_ENDPOINTS;
+exports.APP_ENV_SECRETS_KEPT = APP_ENV_SECRETS_KEPT;
+exports.APP_ENV_STORED_ORIGINS = APP_ENV_STORED_ORIGINS;
+exports.APP_ENV_TEMPLATE_MAX_DEPTH = APP_ENV_TEMPLATE_MAX_DEPTH;
+exports.APP_ENV_TOTAL_MAX_BYTES = APP_ENV_TOTAL_MAX_BYTES;
+exports.APP_ENV_UNRESOLVED_REASONS = APP_ENV_UNRESOLVED_REASONS;
+exports.APP_ENV_UUID_LENGTH = APP_ENV_UUID_LENGTH;
+exports.APP_ENV_VALIDATION_REFUSAL_CODES = APP_ENV_VALIDATION_REFUSAL_CODES;
+exports.APP_ENV_VALUE_MAX_BYTES = APP_ENV_VALUE_MAX_BYTES;
+exports.APP_FAILURE_CODES = APP_FAILURE_CODES;
+exports.APP_FAILURE_CODES_WITHOUT_MESSAGE_LEAF = APP_FAILURE_CODES_WITHOUT_MESSAGE_LEAF;
+exports.APP_FAILURE_LEAVES_WITHOUT_FAILURE_CODE = APP_FAILURE_LEAVES_WITHOUT_FAILURE_CODE;
+exports.APP_FAILURE_MESSAGE_LEAVES = APP_FAILURE_MESSAGE_LEAVES;
+exports.APP_FORK_READINESS_IDLE_MS = APP_FORK_READINESS_IDLE_MS;
+exports.APP_FORK_READINESS_MANUAL_RETRIES_PER_HOUR = APP_FORK_READINESS_MANUAL_RETRIES_PER_HOUR;
+exports.APP_FORK_READINESS_MAX_REDISPATCH = APP_FORK_READINESS_MAX_REDISPATCH;
+exports.APP_FORK_READINESS_POLL_DELAYS_MS = APP_FORK_READINESS_POLL_DELAYS_MS;
+exports.APP_FORK_READINESS_POLL_INTERVAL_MS = APP_FORK_READINESS_POLL_INTERVAL_MS;
+exports.APP_FORK_READINESS_READY_LATENCY_MS = APP_FORK_READINESS_READY_LATENCY_MS;
+exports.APP_FORK_READINESS_REASONS = APP_FORK_READINESS_REASONS;
+exports.APP_FORK_READINESS_TIMEOUT_ENV = APP_FORK_READINESS_TIMEOUT_ENV;
+exports.APP_FORK_READINESS_TIMEOUT_MS = APP_FORK_READINESS_TIMEOUT_MS;
+exports.APP_FORK_READINESS_TIMEOUT_OVERRIDE_MIN_MS = APP_FORK_READINESS_TIMEOUT_OVERRIDE_MIN_MS;
+exports.APP_HEALTH_BATCH = APP_HEALTH_BATCH;
+exports.APP_HEALTH_CLUSTER_CONCURRENCY = APP_HEALTH_CLUSTER_CONCURRENCY;
+exports.APP_HEALTH_FAILS_TO_NOTIFY = APP_HEALTH_FAILS_TO_NOTIFY;
+exports.APP_HEALTH_NOTIFY_DEDUPE_H = APP_HEALTH_NOTIFY_DEDUPE_H;
+exports.APP_HEALTH_PASSES_TO_RECOVER = APP_HEALTH_PASSES_TO_RECOVER;
+exports.APP_HEALTH_POLL_S = APP_HEALTH_POLL_S;
+exports.APP_HEALTH_POLL_TIMEOUT_S = APP_HEALTH_POLL_TIMEOUT_S;
+exports.APP_HEALTH_UNREACHABLE_POLLS = APP_HEALTH_UNREACHABLE_POLLS;
+exports.APP_HTTP_AUTH_SCHEMES = APP_HTTP_AUTH_SCHEMES;
+exports.APP_INSPECT_CACHE_TTL_MS = APP_INSPECT_CACHE_TTL_MS;
+exports.APP_INSPECT_FIXED_PROVIDER_CALLS = APP_INSPECT_FIXED_PROVIDER_CALLS;
+exports.APP_INSPECT_MAX_PROVIDER_CALLS = APP_INSPECT_MAX_PROVIDER_CALLS;
+exports.APP_INSPECT_OWNER_MIN_CALLS_REMAINING = APP_INSPECT_OWNER_MIN_CALLS_REMAINING;
+exports.APP_INSPECT_P95_BUDGET_MS = APP_INSPECT_P95_BUDGET_MS;
+exports.APP_INSPECT_RATE_LIMIT_PER_MINUTE = APP_INSPECT_RATE_LIMIT_PER_MINUTE;
+exports.APP_ISOLATION_PROBE_TIMEOUT_S = APP_ISOLATION_PROBE_TIMEOUT_S;
+exports.APP_JOB_RUNS_KEPT = APP_JOB_RUNS_KEPT;
+exports.APP_JOB_TIMEOUT_DEFAULT_S = APP_JOB_TIMEOUT_DEFAULT_S;
+exports.APP_JOB_TTL_S = APP_JOB_TTL_S;
+exports.APP_LAUNCHER_CATALOG_MAX_ENTRIES = APP_LAUNCHER_CATALOG_MAX_ENTRIES;
+exports.APP_LAUNCHER_CLIENT_CACHE_MS = APP_LAUNCHER_CLIENT_CACHE_MS;
+exports.APP_LAUNCHER_DESCRIPTION_MAX_LENGTH = APP_LAUNCHER_DESCRIPTION_MAX_LENGTH;
+exports.APP_LAUNCHER_EMPTY_ACTIONS = APP_LAUNCHER_EMPTY_ACTIONS;
+exports.APP_LAUNCHER_ENVIRONMENTS = APP_LAUNCHER_ENVIRONMENTS;
+exports.APP_LAUNCHER_FILTER_MAX_LENGTH = APP_LAUNCHER_FILTER_MAX_LENGTH;
+exports.APP_LAUNCHER_ICON_MAX_BYTES = APP_LAUNCHER_ICON_MAX_BYTES;
+exports.APP_LAUNCHER_ITEM_KINDS = APP_LAUNCHER_ITEM_KINDS;
+exports.APP_LAUNCHER_MANAGE_STATES = APP_LAUNCHER_MANAGE_STATES;
+exports.APP_LAUNCHER_MAX_CHANGES_PER_SAVE = APP_LAUNCHER_MAX_CHANGES_PER_SAVE;
+exports.APP_LAUNCHER_MAX_ITEMS_RESPONSE = APP_LAUNCHER_MAX_ITEMS_RESPONSE;
+exports.APP_LAUNCHER_MAX_PREFERENCE_ROWS = APP_LAUNCHER_MAX_PREFERENCE_ROWS;
+exports.APP_LAUNCHER_NAME_MAX_LENGTH = APP_LAUNCHER_NAME_MAX_LENGTH;
+exports.APP_LAUNCHER_PANEL_PLATFORMS_MAX = APP_LAUNCHER_PANEL_PLATFORMS_MAX;
+exports.APP_LAUNCHER_PANEL_WORKS_MAX = APP_LAUNCHER_PANEL_WORKS_MAX;
+exports.APP_LAUNCHER_PIN_LIMIT = APP_LAUNCHER_PIN_LIMIT;
+exports.APP_LAUNCHER_PLATFORM_STATUSES = APP_LAUNCHER_PLATFORM_STATUSES;
+exports.APP_LAUNCHER_REJECTION_REASONS = APP_LAUNCHER_REJECTION_REASONS;
+exports.APP_LAUNCHER_SECTIONS = APP_LAUNCHER_SECTIONS;
+exports.APP_LAUNCHER_WORK_CHIPS = APP_LAUNCHER_WORK_CHIPS;
+exports.APP_LICENSE_EVALUATION_REASONS = APP_LICENSE_EVALUATION_REASONS;
+exports.APP_LOG_BYTES_MAX = APP_LOG_BYTES_MAX;
+exports.APP_LOG_CACHE_S = APP_LOG_CACHE_S;
+exports.APP_LOG_LINES_DEFAULT = APP_LOG_LINES_DEFAULT;
+exports.APP_LOG_LINES_MAX = APP_LOG_LINES_MAX;
+exports.APP_LOG_REDACT_MIN_CHARS = APP_LOG_REDACT_MIN_CHARS;
+exports.APP_MANAGED_CRON_MIN_INTERVAL_MIN = APP_MANAGED_CRON_MIN_INTERVAL_MIN;
+exports.APP_MANAGED_MAX_PER_USER_DEFAULT = APP_MANAGED_MAX_PER_USER_DEFAULT;
+exports.APP_MANIFEST_JOB_PHASES = APP_MANIFEST_JOB_PHASES;
+exports.APP_PAUSE_TIMEOUT_S = APP_PAUSE_TIMEOUT_S;
+exports.APP_PRECONDITION_CODES = APP_PRECONDITION_CODES;
+exports.APP_PRECONDITION_MESSAGE_LEAVES = APP_PRECONDITION_MESSAGE_LEAVES;
+exports.APP_PRECONDITION_STATES = APP_PRECONDITION_STATES;
+exports.APP_PREPARE_TIMEOUT_S = APP_PREPARE_TIMEOUT_S;
+exports.APP_PREVIEWS_MAX = APP_PREVIEWS_MAX;
+exports.APP_PREVIEW_CLOSE_REMOVE_MIN = APP_PREVIEW_CLOSE_REMOVE_MIN;
+exports.APP_PREVIEW_IDLE_H = APP_PREVIEW_IDLE_H;
+exports.APP_PRIVATE_COPY_MAX_SIZE_KB = APP_PRIVATE_COPY_MAX_SIZE_KB;
+exports.APP_PRIVATE_COPY_NAME_ATTEMPTS = APP_PRIVATE_COPY_NAME_ATTEMPTS;
+exports.APP_PROVISIONING_DETECTION_SOURCES = APP_PROVISIONING_DETECTION_SOURCES;
+exports.APP_PROVISIONING_FAILURE_REASONS = APP_PROVISIONING_FAILURE_REASONS;
+exports.APP_PROVISIONING_FAILURE_REASON_I18N_KEY = APP_PROVISIONING_FAILURE_REASON_I18N_KEY;
+exports.APP_PROVISIONING_OPTION_I18N_KEY = APP_PROVISIONING_OPTION_I18N_KEY;
+exports.APP_PROVISIONING_PARK_REASONS = APP_PROVISIONING_PARK_REASONS;
+exports.APP_PROVISIONING_QUESTION_REASONS = APP_PROVISIONING_QUESTION_REASONS;
+exports.APP_PROVISIONING_QUESTION_REASON_I18N_KEY = APP_PROVISIONING_QUESTION_REASON_I18N_KEY;
+exports.APP_PROVISIONING_QUEUED_REASON_I18N_KEY = APP_PROVISIONING_QUEUED_REASON_I18N_KEY;
+exports.APP_PROVISIONING_STATUSES = APP_PROVISIONING_STATUSES;
+exports.APP_PROVISIONING_STEPS = APP_PROVISIONING_STEPS;
+exports.APP_PROVISIONING_STEP_STATES = APP_PROVISIONING_STEP_STATES;
+exports.APP_PROVISION_CHAT_ATTEMPT_RED = APP_PROVISION_CHAT_ATTEMPT_RED;
+exports.APP_PROVISION_CHAT_FAILED = APP_PROVISION_CHAT_FAILED;
+exports.APP_PROVISION_CHAT_NEEDS_INPUT = APP_PROVISION_CHAT_NEEDS_INPUT;
+exports.APP_PROVISION_CHAT_PROPOSED = APP_PROVISION_CHAT_PROPOSED;
+exports.APP_PROVISION_CHAT_STARTED = APP_PROVISION_CHAT_STARTED;
+exports.APP_PROVISION_CHAT_SUCCEEDED = APP_PROVISION_CHAT_SUCCEEDED;
+exports.APP_PROVISION_CHAT_TEMPLATES = APP_PROVISION_CHAT_TEMPLATES;
+exports.APP_PROVISION_COPY_PARAMS = APP_PROVISION_COPY_PARAMS;
+exports.APP_PROVISION_COPY_TEMPLATES = APP_PROVISION_COPY_TEMPLATES;
+exports.APP_PROVISION_EVIDENCE_ATTEMPT = APP_PROVISION_EVIDENCE_ATTEMPT;
+exports.APP_PROVISION_EVIDENCE_BUILD_LOG = APP_PROVISION_EVIDENCE_BUILD_LOG;
+exports.APP_PROVISION_EVIDENCE_DURATION = APP_PROVISION_EVIDENCE_DURATION;
+exports.APP_PROVISION_EVIDENCE_HEADINGS = APP_PROVISION_EVIDENCE_HEADINGS;
+exports.APP_PROVISION_EVIDENCE_IMAGE_DIGEST = APP_PROVISION_EVIDENCE_IMAGE_DIGEST;
+exports.APP_PROVISION_EVIDENCE_SMOKE = APP_PROVISION_EVIDENCE_SMOKE;
+exports.APP_PROVISION_EVIDENCE_SPEND = APP_PROVISION_EVIDENCE_SPEND;
+exports.APP_PROVISION_EVIDENCE_STEP = APP_PROVISION_EVIDENCE_STEP;
+exports.APP_PROVISION_EVIDENCE_TARGET = APP_PROVISION_EVIDENCE_TARGET;
+exports.APP_PROVISION_EVIDENCE_VERDICT = APP_PROVISION_EVIDENCE_VERDICT;
+exports.APP_PROVISION_LIMITS = APP_PROVISION_LIMITS;
+exports.APP_PROVISION_OPTION_ACCEPT_BUILD_ONLY = APP_PROVISION_OPTION_ACCEPT_BUILD_ONLY;
+exports.APP_PROVISION_OPTION_CHOOSE = APP_PROVISION_OPTION_CHOOSE;
+exports.APP_PROVISION_OPTION_LABELS = APP_PROVISION_OPTION_LABELS;
+exports.APP_PROVISION_OPTION_OPTIONAL = APP_PROVISION_OPTION_OPTIONAL;
+exports.APP_PROVISION_OPTION_RAISE_CAP_MINUTES = APP_PROVISION_OPTION_RAISE_CAP_MINUTES;
+exports.APP_PROVISION_OPTION_RAISE_CAP_TOKENS = APP_PROVISION_OPTION_RAISE_CAP_TOKENS;
+exports.APP_PROVISION_OPTION_RETRY = APP_PROVISION_OPTION_RETRY;
+exports.APP_PROVISION_OPTION_RETRY_AFTER_SETTING = APP_PROVISION_OPTION_RETRY_AFTER_SETTING;
+exports.APP_PROVISION_OPTION_STOP = APP_PROVISION_OPTION_STOP;
+exports.APP_PROVISION_OPTION_VERIFY_ON_CLUSTER = APP_PROVISION_OPTION_VERIFY_ON_CLUSTER;
+exports.APP_PROVISION_PRESERVED_SPEC_FIELDS = APP_PROVISION_PRESERVED_SPEC_FIELDS;
+exports.APP_PROVISION_QUESTION_SUBJECTS = APP_PROVISION_QUESTION_SUBJECTS;
+exports.APP_PROVISION_QUESTION_SUBJECT_AGENT_ASKED = APP_PROVISION_QUESTION_SUBJECT_AGENT_ASKED;
+exports.APP_PROVISION_QUESTION_SUBJECT_ATTEMPTS_SPENT = APP_PROVISION_QUESTION_SUBJECT_ATTEMPTS_SPENT;
+exports.APP_PROVISION_QUESTION_SUBJECT_MISSING_REQUIRED_VALUE = APP_PROVISION_QUESTION_SUBJECT_MISSING_REQUIRED_VALUE;
+exports.APP_PROVISION_QUESTION_SUBJECT_MULTIPLE_APPS = APP_PROVISION_QUESTION_SUBJECT_MULTIPLE_APPS;
+exports.APP_PROVISION_QUESTION_SUBJECT_PREFIX = APP_PROVISION_QUESTION_SUBJECT_PREFIX;
+exports.APP_PROVISION_QUESTION_SUBJECT_REPEATED_FAILURE = APP_PROVISION_QUESTION_SUBJECT_REPEATED_FAILURE;
+exports.APP_PROVISION_QUESTION_SUBJECT_RUNNER_CAPACITY = APP_PROVISION_QUESTION_SUBJECT_RUNNER_CAPACITY;
+exports.APP_PROVISION_QUESTION_SUBJECT_RUNNER_MINUTE_CAP = APP_PROVISION_QUESTION_SUBJECT_RUNNER_MINUTE_CAP;
+exports.APP_PROVISION_QUESTION_SUBJECT_SAFETY_RAIL = APP_PROVISION_QUESTION_SUBJECT_SAFETY_RAIL;
+exports.APP_PROVISION_QUESTION_SUBJECT_TOKEN_CAP = APP_PROVISION_QUESTION_SUBJECT_TOKEN_CAP;
+exports.APP_PROVISION_QUEUED_REASON_ORG_LIMIT = APP_PROVISION_QUEUED_REASON_ORG_LIMIT;
+exports.APP_PROVISION_QUEUED_REASON_TEXTS = APP_PROVISION_QUEUED_REASON_TEXTS;
+exports.APP_PROVISION_QUEUED_REASON_USER_LIMIT = APP_PROVISION_QUEUED_REASON_USER_LIMIT;
+exports.APP_PROVISION_RAISE_CAP_LABELS = APP_PROVISION_RAISE_CAP_LABELS;
+exports.APP_PROVISION_REASON_TEXTS = APP_PROVISION_REASON_TEXTS;
+exports.APP_PROVISION_REASON_TEXT_COULD_NOT_VERIFY = APP_PROVISION_REASON_TEXT_COULD_NOT_VERIFY;
+exports.APP_PROVISION_REASON_TEXT_DEADLINE = APP_PROVISION_REASON_TEXT_DEADLINE;
+exports.APP_PROVISION_REASON_TEXT_NOT_RUNNABLE = APP_PROVISION_REASON_TEXT_NOT_RUNNABLE;
+exports.APP_PROVISION_REASON_TEXT_NO_ANSWER = APP_PROVISION_REASON_TEXT_NO_ANSWER;
+exports.APP_PROVISION_REASON_TEXT_NO_ISOLATED_RUNTIME = APP_PROVISION_REASON_TEXT_NO_ISOLATED_RUNTIME;
+exports.APP_PROVISION_REASON_TEXT_PRIVATE_REPOSITORY = APP_PROVISION_REASON_TEXT_PRIVATE_REPOSITORY;
+exports.APP_PROVISION_REASON_TEXT_REPOSITORY_NOT_READY = APP_PROVISION_REASON_TEXT_REPOSITORY_NOT_READY;
+exports.APP_PROVISION_REASON_TEXT_REPOSITORY_TOO_LARGE = APP_PROVISION_REASON_TEXT_REPOSITORY_TOO_LARGE;
+exports.APP_PROVISION_REASON_TEXT_RUNNER_MINUTE_CAP = APP_PROVISION_REASON_TEXT_RUNNER_MINUTE_CAP;
+exports.APP_PROVISION_REASON_TEXT_TOKEN_CAP = APP_PROVISION_REASON_TEXT_TOKEN_CAP;
+exports.APP_PROVISION_REASON_TEXT_VERIFICATION_INFRASTRUCTURE = APP_PROVISION_REASON_TEXT_VERIFICATION_INFRASTRUCTURE;
+exports.APP_PROVISION_REMINDER_BODY = APP_PROVISION_REMINDER_BODY;
+exports.APP_PROVISION_REMINDER_TITLE = APP_PROVISION_REMINDER_TITLE;
+exports.APP_PROVISION_WRITABLE_PATHS = APP_PROVISION_WRITABLE_PATHS;
+exports.APP_PUBLISH_TIMEOUT_S = APP_PUBLISH_TIMEOUT_S;
+exports.APP_QUOTA_SCOPES = APP_QUOTA_SCOPES;
+exports.APP_RATE_LIMITED_PERSISTENT_AFTER = APP_RATE_LIMITED_PERSISTENT_AFTER;
+exports.APP_RATE_LIMIT_BACKOFF_BASE_MS = APP_RATE_LIMIT_BACKOFF_BASE_MS;
+exports.APP_RATE_LIMIT_BACKOFF_MAX_MS = APP_RATE_LIMIT_BACKOFF_MAX_MS;
+exports.APP_RATE_LIMIT_MIN_REMAINING = APP_RATE_LIMIT_MIN_REMAINING;
+exports.APP_RATE_LIMIT_RESET_GRACE_MS = APP_RATE_LIMIT_RESET_GRACE_MS;
+exports.APP_READINESS_FAILURE_REASONS = APP_READINESS_FAILURE_REASONS;
+exports.APP_READINESS_STATES = APP_READINESS_STATES;
+exports.APP_REMOVE_TIMEOUT_S = APP_REMOVE_TIMEOUT_S;
+exports.APP_REPOSITORY_MODES = APP_REPOSITORY_MODES;
+exports.APP_REPOSITORY_STAGES = APP_REPOSITORY_STAGES;
+exports.APP_REPOSITORY_STAGES_WITHOUT_SPEC_LIMIT = APP_REPOSITORY_STAGES_WITHOUT_SPEC_LIMIT;
+exports.APP_REPOSITORY_STAGE_LIMITS = APP_REPOSITORY_STAGE_LIMITS;
+exports.APP_REPOSITORY_STAGE_REFUSAL_CODES = APP_REPOSITORY_STAGE_REFUSAL_CODES;
+exports.APP_REPOSITORY_URL_MAX_LENGTH = APP_REPOSITORY_URL_MAX_LENGTH;
+exports.APP_ROLLBACK_CANDIDATES = APP_ROLLBACK_CANDIDATES;
+exports.APP_ROLLOUT_EXTRA_S = APP_ROLLOUT_EXTRA_S;
+exports.APP_ROLLOUT_MAX_S = APP_ROLLOUT_MAX_S;
+exports.APP_ROLLOUT_MIN_S = APP_ROLLOUT_MIN_S;
+exports.APP_ROLLOUT_POLL_S = APP_ROLLOUT_POLL_S;
+exports.APP_ROLLOUT_RESTARTS_FAIL = APP_ROLLOUT_RESTARTS_FAIL;
+exports.APP_ROLLOUT_STUCK_POD_S = APP_ROLLOUT_STUCK_POD_S;
+exports.APP_RUNTIME_HEALTH = APP_RUNTIME_HEALTH;
+exports.APP_RUNTIME_STATES = APP_RUNTIME_STATES;
+exports.APP_SETUP_PR_CHECK_BATCH = APP_SETUP_PR_CHECK_BATCH;
+exports.APP_SETUP_PR_CHECK_ON_VIEW_MIN_INTERVAL_MS = APP_SETUP_PR_CHECK_ON_VIEW_MIN_INTERVAL_MS;
+exports.APP_SMOKE_BODY_BYTES = APP_SMOKE_BODY_BYTES;
+exports.APP_SMOKE_FOUND_CHARS = APP_SMOKE_FOUND_CHARS;
+exports.APP_SMOKE_IN_CLUSTER_WINDOW_S = APP_SMOKE_IN_CLUSTER_WINDOW_S;
+exports.APP_SMOKE_PUBLIC_FIRST_WINDOW_S = APP_SMOKE_PUBLIC_FIRST_WINDOW_S;
+exports.APP_SMOKE_PUBLIC_WINDOW_S = APP_SMOKE_PUBLIC_WINDOW_S;
+exports.APP_SMOKE_RETRY_S = APP_SMOKE_RETRY_S;
+exports.APP_SOURCE_BLUEPRINT_MATCH_SOURCES = APP_SOURCE_BLUEPRINT_MATCH_SOURCES;
+exports.APP_SOURCE_BLUEPRINT_STATUSES = APP_SOURCE_BLUEPRINT_STATUSES;
+exports.APP_SOURCE_LICENSE_CLASSES = APP_SOURCE_LICENSE_CLASSES;
+exports.APP_SOURCE_LICENSE_SOURCES = APP_SOURCE_LICENSE_SOURCES;
+exports.APP_SOURCE_REASON_CODES = APP_SOURCE_REASON_CODES;
+exports.APP_SOURCE_REPOSITORY_NAME_SUFFIXES = APP_SOURCE_REPOSITORY_NAME_SUFFIXES;
+exports.APP_SOURCE_REPOSITORY_TYPES = APP_SOURCE_REPOSITORY_TYPES;
+exports.APP_SOURCE_REPOSITORY_TYPE_BY_MODE = APP_SOURCE_REPOSITORY_TYPE_BY_MODE;
+exports.APP_SOURCE_SPEC_FILE = APP_SOURCE_SPEC_FILE;
+exports.APP_SOURCE_SPEC_KIND = APP_SOURCE_SPEC_KIND;
+exports.APP_SOURCE_SPEC_VERSION = APP_SOURCE_SPEC_VERSION;
+exports.APP_SPEC_BLOCK_DEFAULTS = APP_SPEC_BLOCK_DEFAULTS;
+exports.APP_SPEC_BUILD_STRATEGIES = APP_SPEC_BUILD_STRATEGIES;
+exports.APP_SPEC_COMPONENT_ROLES = APP_SPEC_COMPONENT_ROLES;
+exports.APP_SPEC_CRON_CONCURRENCIES = APP_SPEC_CRON_CONCURRENCIES;
+exports.APP_SPEC_DOMAIN_CHANGES = APP_SPEC_DOMAIN_CHANGES;
+exports.APP_SPEC_DRAFT_VALIDATE_PER_MIN = APP_SPEC_DRAFT_VALIDATE_PER_MIN;
+exports.APP_SPEC_ENV_PHASES = APP_SPEC_ENV_PHASES;
+exports.APP_SPEC_EVALUATE_COALESCE_MS = APP_SPEC_EVALUATE_COALESCE_MS;
+exports.APP_SPEC_EVALUATION_TRIGGERS = APP_SPEC_EVALUATION_TRIGGERS;
+exports.APP_SPEC_EXTENSION_KEY_PREFIX = APP_SPEC_EXTENSION_KEY_PREFIX;
+exports.APP_SPEC_FILE_MAX_BYTES = APP_SPEC_FILE_MAX_BYTES;
+exports.APP_SPEC_GENERATE_ALPHABETS = APP_SPEC_GENERATE_ALPHABETS;
+exports.APP_SPEC_GENERATE_KINDS = APP_SPEC_GENERATE_KINDS;
+exports.APP_SPEC_GENERATE_ROTATIONS = APP_SPEC_GENERATE_ROTATIONS;
+exports.APP_SPEC_HTTP_AUTH_SCHEMES = APP_SPEC_HTTP_AUTH_SCHEMES;
+exports.APP_SPEC_HTTP_METHODS = APP_SPEC_HTTP_METHODS;
+exports.APP_SPEC_ISSUE_CODES = APP_SPEC_ISSUE_CODES;
+exports.APP_SPEC_JOB_WHENS = APP_SPEC_JOB_WHENS;
+exports.APP_SPEC_KEYPAIR_FORMATS = APP_SPEC_KEYPAIR_FORMATS;
+exports.APP_SPEC_KEYPAIR_TYPES = APP_SPEC_KEYPAIR_TYPES;
+exports.APP_SPEC_LAZY_HEAD_CHECK_MS = APP_SPEC_LAZY_HEAD_CHECK_MS;
+exports.APP_SPEC_MAX_DEPTH = APP_SPEC_MAX_DEPTH;
+exports.APP_SPEC_MAX_ISSUES = APP_SPEC_MAX_ISSUES;
+exports.APP_SPEC_MAX_PROTECTED_PATHS = APP_SPEC_MAX_PROTECTED_PATHS;
+exports.APP_SPEC_MAX_REQUIRE_HUMAN_MERGE_PATHS = APP_SPEC_MAX_REQUIRE_HUMAN_MERGE_PATHS;
+exports.APP_SPEC_POSTGRES_VERSIONS = APP_SPEC_POSTGRES_VERSIONS;
+exports.APP_SPEC_PROBE_KINDS = APP_SPEC_PROBE_KINDS;
+exports.APP_SPEC_PUBLIC_KEY_SUFFIX = APP_SPEC_PUBLIC_KEY_SUFFIX;
+exports.APP_SPEC_REDIS_MAXMEMORY_POLICIES = APP_SPEC_REDIS_MAXMEMORY_POLICIES;
+exports.APP_SPEC_REDIS_VERSIONS = APP_SPEC_REDIS_VERSIONS;
+exports.APP_SPEC_REFRESH_PER_MIN = APP_SPEC_REFRESH_PER_MIN;
+exports.APP_SPEC_SEVERITIES = APP_SPEC_SEVERITIES;
+exports.APP_SPEC_SMOKE_HTTP_METHODS = APP_SPEC_SMOKE_HTTP_METHODS;
+exports.APP_SPEC_SMOKE_WHENS = APP_SPEC_SMOKE_WHENS;
+exports.APP_SPEC_SOURCE_ONLY_KEYS = APP_SPEC_SOURCE_ONLY_KEYS;
+exports.APP_SPEC_SOURCE_RELATIONS = APP_SPEC_SOURCE_RELATIONS;
+exports.APP_SPEC_SUGGESTION_MAX_DISTANCE = APP_SPEC_SUGGESTION_MAX_DISTANCE;
+exports.APP_SPEC_UPSTREAM_SYNC_MODES = APP_SPEC_UPSTREAM_SYNC_MODES;
+exports.APP_SPEC_VALIDATION_MODES = APP_SPEC_VALIDATION_MODES;
+exports.APP_SPEC_VALIDATION_STATUSES = APP_SPEC_VALIDATION_STATUSES;
+exports.APP_SPEC_VERSION = APP_SPEC_VERSION;
+exports.APP_SPEC_YAML_MAX_ALIASES = APP_SPEC_YAML_MAX_ALIASES;
+exports.APP_STATUS_REFRESH_MIN_S = APP_STATUS_REFRESH_MIN_S;
+exports.APP_STATUS_STALE_S = APP_STATUS_STALE_S;
+exports.APP_SUBDOMAIN_LABEL_MIN = APP_SUBDOMAIN_LABEL_MIN;
+exports.APP_SYNC_REASONS = APP_SYNC_REASONS;
+exports.APP_SYNC_RESULTS = APP_SYNC_RESULTS;
+exports.APP_TARGET_OWNER_SCAN_LIMIT_P1 = APP_TARGET_OWNER_SCAN_LIMIT_P1;
+exports.APP_TARGET_OWNER_SCAN_LIMIT_P2 = APP_TARGET_OWNER_SCAN_LIMIT_P2;
+exports.APP_TMP_SIZE_MI = APP_TMP_SIZE_MI;
+exports.APP_UPSTREAM_CONFLICT_LABEL_PREFIX = APP_UPSTREAM_CONFLICT_LABEL_PREFIX;
+exports.APP_UPSTREAM_CONFLICT_MAX_PATHS = APP_UPSTREAM_CONFLICT_MAX_PATHS;
+exports.APP_UPSTREAM_STATUSES = APP_UPSTREAM_STATUSES;
+exports.APP_UPSTREAM_SYNC_ACK_BUDGET_MS = APP_UPSTREAM_SYNC_ACK_BUDGET_MS;
+exports.APP_UPSTREAM_SYNC_BRANCH = APP_UPSTREAM_SYNC_BRANCH;
+exports.APP_UPSTREAM_SYNC_DEFAULT_SCHEDULE = APP_UPSTREAM_SYNC_DEFAULT_SCHEDULE;
+exports.APP_UPSTREAM_SYNC_DISPATCH_BATCH = APP_UPSTREAM_SYNC_DISPATCH_BATCH;
+exports.APP_UPSTREAM_SYNC_DISPATCH_CRON = APP_UPSTREAM_SYNC_DISPATCH_CRON;
+exports.APP_UPSTREAM_SYNC_JITTER_MAX_MS = APP_UPSTREAM_SYNC_JITTER_MAX_MS;
+exports.APP_UPSTREAM_SYNC_LOCK_TTL_MS = APP_UPSTREAM_SYNC_LOCK_TTL_MS;
+exports.APP_UPSTREAM_SYNC_MANUAL_PER_HOUR = APP_UPSTREAM_SYNC_MANUAL_PER_HOUR;
+exports.APP_UPSTREAM_SYNC_MAX_PROVIDER_CALLS = APP_UPSTREAM_SYNC_MAX_PROVIDER_CALLS;
+exports.APP_UPSTREAM_SYNC_MIN_INTERVAL_MS = APP_UPSTREAM_SYNC_MIN_INTERVAL_MS;
+exports.APP_UPSTREAM_UNAVAILABLE_RECHECK_MS = APP_UPSTREAM_UNAVAILABLE_RECHECK_MS;
+exports.APP_UPSTREAM_WARNING_CODES = APP_UPSTREAM_WARNING_CODES;
+exports.APP_VERIFICATION_COMPONENT_ROLES = APP_VERIFICATION_COMPONENT_ROLES;
+exports.APP_VERIFICATION_DEPENDENCY_CONTAINERS = APP_VERIFICATION_DEPENDENCY_CONTAINERS;
+exports.APP_VERIFICATION_DEPENDENCY_KINDS = APP_VERIFICATION_DEPENDENCY_KINDS;
+exports.APP_VERIFICATION_HTTP_METHODS = APP_VERIFICATION_HTTP_METHODS;
+exports.APP_VERIFICATION_JOB_PHASES = APP_VERIFICATION_JOB_PHASES;
+exports.APP_VERIFICATION_PLAN_VERSION = APP_VERIFICATION_PLAN_VERSION;
+exports.APP_VERIFICATION_PROBE_KINDS = APP_VERIFICATION_PROBE_KINDS;
+exports.APP_VERIFICATION_SMOKE_WHENS = APP_VERIFICATION_SMOKE_WHENS;
+exports.APP_WORKER_STABLE_S = APP_WORKER_STABLE_S;
+exports.APP_WORK_QUOTA_CAPS = APP_WORK_QUOTA_CAPS;
+exports.APP_WORK_REPOSITORY_ROLE = APP_WORK_REPOSITORY_ROLE;
 exports.ATTENTION_TARGET_CLASSES = ATTENTION_TARGET_CLASSES;
+exports.ATTESTATION_NOTICE_DAYS = ATTESTATION_NOTICE_DAYS;
+exports.ATTESTATION_TTL_DAYS = ATTESTATION_TTL_DAYS;
 exports.AUTONOMY_GRANT_SCOPE_PRECEDENCE = AUTONOMY_GRANT_SCOPE_PRECEDENCE;
 exports.AUTO_RECHARGE_MAX_CONSECUTIVE_FAILURES = AUTO_RECHARGE_MAX_CONSECUTIVE_FAILURES;
 exports.AUTO_RECHARGE_MONTHLY_CAP_DEFAULT_CENTS = AUTO_RECHARGE_MONTHLY_CAP_DEFAULT_CENTS;
@@ -6063,8 +9808,23 @@ exports.BACKUP_FORMAT_VERSION = BACKUP_FORMAT_VERSION;
 exports.BACKUP_FULL_HISTORY_CEILING_DAYS = BACKUP_FULL_HISTORY_CEILING_DAYS;
 exports.BACKUP_MANIFEST_SENTINEL_FIELDS = BACKUP_MANIFEST_SENTINEL_FIELDS;
 exports.BACKUP_TRIM_POLICIES = BACKUP_TRIM_POLICIES;
+exports.BLUEPRINT_ALTERNATIVES_MAX = BLUEPRINT_ALTERNATIVES_MAX;
+exports.BLUEPRINT_APPLY_PER_HOUR = BLUEPRINT_APPLY_PER_HOUR;
+exports.BLUEPRINT_APPLY_RETRIES = BLUEPRINT_APPLY_RETRIES;
+exports.BLUEPRINT_MATCH_SOURCES = BLUEPRINT_MATCH_SOURCES;
+exports.BLUEPRINT_OVERLAY_FILE_MAX_BYTES = BLUEPRINT_OVERLAY_FILE_MAX_BYTES;
+exports.BLUEPRINT_OVERLAY_MAX_FILES = BLUEPRINT_OVERLAY_MAX_FILES;
+exports.BLUEPRINT_OVERLAY_TOTAL_MAX_BYTES = BLUEPRINT_OVERLAY_TOTAL_MAX_BYTES;
+exports.BLUEPRINT_PROBE_MAX_READS = BLUEPRINT_PROBE_MAX_READS;
+exports.BLUEPRINT_RESOLUTION_REASONS = BLUEPRINT_RESOLUTION_REASONS;
+exports.BLUEPRINT_RESOLVE_HIT_TTL_MS = BLUEPRINT_RESOLVE_HIT_TTL_MS;
+exports.BLUEPRINT_RESOLVE_MISS_TTL_MS = BLUEPRINT_RESOLVE_MISS_TTL_MS;
 exports.BREAKDOWN_EVERYTHING_ELSE_KEY = BREAKDOWN_EVERYTHING_ELSE_KEY;
 exports.BREAKDOWN_TOP_N = BREAKDOWN_TOP_N;
+exports.BUILD_SERVICE_DEFAULTS = BUILD_SERVICE_DEFAULTS;
+exports.BUILD_SERVICE_HEALTH_KINDS = BUILD_SERVICE_HEALTH_KINDS;
+exports.BUILD_SERVICE_HOST = BUILD_SERVICE_HOST;
+exports.BUILD_SERVICE_KINDS = BUILD_SERVICE_KINDS;
 exports.CATALOG_SEARCH_MIN_CHARS = CATALOG_SEARCH_MIN_CHARS;
 exports.COMPUTER_AUTO_REFRESH_AFTER_MS = COMPUTER_AUTO_REFRESH_AFTER_MS;
 exports.COMPUTER_BLOCKED_SHORTCUTS = COMPUTER_BLOCKED_SHORTCUTS;
@@ -6156,6 +9916,7 @@ exports.DEFAULT_GOAL_KIND = DEFAULT_GOAL_KIND;
 exports.DEFAULT_REASONING_EFFORT = DEFAULT_REASONING_EFFORT;
 exports.DEFAULT_TASK_CHECK_PHASE = DEFAULT_TASK_CHECK_PHASE;
 exports.DEFAULT_WORK_REPO_DECLARED_COMMAND_POLICY = DEFAULT_WORK_REPO_DECLARED_COMMAND_POLICY;
+exports.DETECTOR_QUARANTINE_MS = DETECTOR_QUARANTINE_MS;
 exports.DRAFTABLE_CATEGORIES = DRAFTABLE_CATEGORIES;
 exports.DomainType = DomainType;
 exports.EMAIL_ADDRESS_ALIAS_GRACE_DAYS = EMAIL_ADDRESS_ALIAS_GRACE_DAYS;
@@ -6196,6 +9957,18 @@ exports.EMAIL_SEND_ORIGINS = EMAIL_SEND_ORIGINS;
 exports.EMAIL_SEND_UNDO_GRACE_MS = EMAIL_SEND_UNDO_GRACE_MS;
 exports.EMAIL_WORKSPACE_DAILY_CAP = EMAIL_WORKSPACE_DAILY_CAP;
 exports.EMAIL_WORKSPACE_MONTHLY_CAP = EMAIL_WORKSPACE_MONTHLY_CAP;
+exports.EVER_ID_DEFAULT_API_AUDIENCE = EVER_ID_DEFAULT_API_AUDIENCE;
+exports.EVER_ID_DEFAULT_DISPLAY_NAME = EVER_ID_DEFAULT_DISPLAY_NAME;
+exports.EVER_ID_DELEGATED_AUTH_METHOD = EVER_ID_DELEGATED_AUTH_METHOD;
+exports.EVER_ID_DELEGATED_SCOPES = EVER_ID_DELEGATED_SCOPES;
+exports.EVER_ID_ERROR_CODE_WIRE_VALUES = EVER_ID_ERROR_CODE_WIRE_VALUES;
+exports.EVER_ID_LIMITS = EVER_ID_LIMITS;
+exports.EVER_ID_LINKED_VIA = EVER_ID_LINKED_VIA;
+exports.EVER_ID_QUERY_TOKEN_PARAMS = EVER_ID_QUERY_TOKEN_PARAMS;
+exports.EVER_ID_REGISTRATION_PROVIDER = EVER_ID_REGISTRATION_PROVIDER;
+exports.EVER_ID_SCOPES = EVER_ID_SCOPES;
+exports.EVER_ID_SIGNING_ALGS = EVER_ID_SIGNING_ALGS;
+exports.EVER_ID_WIRE_ERROR_CODES = EVER_ID_WIRE_ERROR_CODES;
 exports.FEED_ACTORS_WINDOW_HOURS_DEFAULT = FEED_ACTORS_WINDOW_HOURS_DEFAULT;
 exports.FEED_ACTORS_WINDOW_HOURS_MAX = FEED_ACTORS_WINDOW_HOURS_MAX;
 exports.FEED_ACTOR_KINDS = FEED_ACTOR_KINDS;
@@ -6346,11 +10119,14 @@ exports.GATE_JUDGE_MAX_REASON_CHARS = GATE_JUDGE_MAX_REASON_CHARS;
 exports.GATE_JUDGE_MAX_UNMET_CHARS = GATE_JUDGE_MAX_UNMET_CHARS;
 exports.GATE_JUDGE_MAX_UNMET_ENTRIES = GATE_JUDGE_MAX_UNMET_ENTRIES;
 exports.GATE_JUDGE_VERDICTS = GATE_JUDGE_VERDICTS;
+exports.GATE_MAX_AGE_HOURS = GATE_MAX_AGE_HOURS;
 exports.GATE_VERDICTS = GATE_VERDICTS;
+exports.GATE_WATCH_INTERVAL_MIN = GATE_WATCH_INTERVAL_MIN;
 exports.GOAL_KINDS = GOAL_KINDS;
 exports.GTM_SKILLS = GTM_SKILLS;
 exports.GTM_SKILL_SLUGS = GTM_SKILL_SLUGS;
 exports.GTM_SKILL_STAGES = GTM_SKILL_STAGES;
+exports.HEARTBEAT_MAX_AGE_MS = HEARTBEAT_MAX_AGE_MS;
 exports.HELD_ACTION_EXPIRY_DAYS = HELD_ACTION_EXPIRY_DAYS;
 exports.HELD_ACTION_WARN_DAYS = HELD_ACTION_WARN_DAYS;
 exports.HITL_MAX_CONTEXT_CHARS = HITL_MAX_CONTEXT_CHARS;
@@ -6391,6 +10167,7 @@ exports.HOME_TODAY_DUE_MAX = HOME_TODAY_DUE_MAX;
 exports.HOME_TODAY_RAN_MAX = HOME_TODAY_RAN_MAX;
 exports.HOME_WAITING_WARN_HOURS = HOME_WAITING_WARN_HOURS;
 exports.HOME_WORKING_NOW_MAX = HOME_WORKING_NOW_MAX;
+exports.IMAGE_ALLOWANCE_MAX_DAYS = IMAGE_ALLOWANCE_MAX_DAYS;
 exports.INBOX_DECISION_DORMANT_AFTER_DAYS = INBOX_DECISION_DORMANT_AFTER_DAYS;
 exports.INBOX_DECISION_KINDS = INBOX_DECISION_KINDS;
 exports.INBOX_DECISION_MAX_LIMIT = INBOX_DECISION_MAX_LIMIT;
@@ -6452,6 +10229,26 @@ exports.KB_SYNTHESIS_PATH_PREFIX = KB_SYNTHESIS_PATH_PREFIX;
 exports.KB_SYNTHESIS_TAG = KB_SYNTHESIS_TAG;
 exports.KB_UPLOAD_EXTRACTION_STATUSES = KB_UPLOAD_EXTRACTION_STATUSES;
 exports.LADDERED_CATEGORIES = LADDERED_CATEGORIES;
+exports.LAUNCH_GATE_ITEMS = LAUNCH_GATE_ITEMS;
+exports.LAUNCH_GATE_ITEM_IDS = LAUNCH_GATE_ITEM_IDS;
+exports.LAUNCH_GATE_KINDS = LAUNCH_GATE_KINDS;
+exports.LAUNCH_GATE_OUTCOMES = LAUNCH_GATE_OUTCOMES;
+exports.LAUNCH_GATE_PHASES = LAUNCH_GATE_PHASES;
+exports.LICENSE_ATTEST_PER_MIN = LICENSE_ATTEST_PER_MIN;
+exports.LICENSE_CLASSES = LICENSE_CLASSES;
+exports.LICENSE_CLASS_RANK = LICENSE_CLASS_RANK;
+exports.LICENSE_EVIDENCE_MAX = LICENSE_EVIDENCE_MAX;
+exports.LICENSE_HEADER_SCAN_BYTES = LICENSE_HEADER_SCAN_BYTES;
+exports.LICENSE_HOSTING_DECISIONS = LICENSE_HOSTING_DECISIONS;
+exports.LICENSE_MAX_FILE_READS = LICENSE_MAX_FILE_READS;
+exports.LICENSE_MIXED_DIR_NAMES = LICENSE_MIXED_DIR_NAMES;
+exports.LICENSE_MIXED_MAX_DEPTH = LICENSE_MIXED_MAX_DEPTH;
+exports.LICENSE_REGISTRY_SOURCES = LICENSE_REGISTRY_SOURCES;
+exports.LICENSE_SOURCES = LICENSE_SOURCES;
+exports.LICENSE_TEXT_MATCH_THRESHOLD = LICENSE_TEXT_MATCH_THRESHOLD;
+exports.LICENSE_TREE_MAX_ENTRIES = LICENSE_TREE_MAX_ENTRIES;
+exports.MANAGED_HOSTING_AVAILABILITIES = MANAGED_HOSTING_AVAILABILITIES;
+exports.MANAGED_HOSTING_REASONS = MANAGED_HOSTING_REASONS;
 exports.MAX_ALWAYS_LOADED_WORKSPACE_FILES = MAX_ALWAYS_LOADED_WORKSPACE_FILES;
 exports.MAX_ATTACHMENTS_PER_MESSAGE = MAX_ATTACHMENTS_PER_MESSAGE;
 exports.MAX_BROADCAST_AGENTS = MAX_BROADCAST_AGENTS;
@@ -6522,6 +10319,8 @@ exports.PLAYBOOK_SLUG_PATTERN = PLAYBOOK_SLUG_PATTERN;
 exports.PLAYBOOK_TEXT_LIMITS = PLAYBOOK_TEXT_LIMITS;
 exports.PLAYBOOK_TRIGGER_KINDS = PLAYBOOK_TRIGGER_KINDS;
 exports.PLAYBOOK_VERSION_PATTERN = PLAYBOOK_VERSION_PATTERN;
+exports.PROBE_ATTEMPTS = PROBE_ATTEMPTS;
+exports.PROBE_CONNECT_TIMEOUT_MS = PROBE_CONNECT_TIMEOUT_MS;
 exports.PROMOTION_CARRY_DAYS = PROMOTION_CARRY_DAYS;
 exports.PROMOTION_CARRY_MESSAGES = PROMOTION_CARRY_MESSAGES;
 exports.PROMOTION_GATE_DECISION_GRACE_MS = PROMOTION_GATE_DECISION_GRACE_MS;
@@ -6532,6 +10331,10 @@ exports.PROMOTION_LANE_OPEN = PROMOTION_LANE_OPEN;
 exports.PROMOTION_RUNGS = PROMOTION_RUNGS;
 exports.PROMOTION_STATES = PROMOTION_STATES;
 exports.PROMOTION_TASK_LABEL = PROMOTION_TASK_LABEL;
+exports.PULL_CREDENTIAL_MAX_MS = PULL_CREDENTIAL_MAX_MS;
+exports.QUARANTINE_EDGE_MS = QUARANTINE_EDGE_MS;
+exports.QUARANTINE_ISOLATE_MS = QUARANTINE_ISOLATE_MS;
+exports.QUARANTINE_SCALE_MS = QUARANTINE_SCALE_MS;
 exports.QUEUED_REASON_WAITING_FOR_RUNNER = QUEUED_REASON_WAITING_FOR_RUNNER;
 exports.RAIL_REFUSAL_COLLAPSE_THRESHOLD = RAIL_REFUSAL_COLLAPSE_THRESHOLD;
 exports.RAIL_REFUSAL_PAGE_SIZE = RAIL_REFUSAL_PAGE_SIZE;
@@ -6547,6 +10350,7 @@ exports.READINESS_WINDOW_DAYS = READINESS_WINDOW_DAYS;
 exports.REASONING_EFFORTS = REASONING_EFFORTS;
 exports.RELEASE_BRANCH_MAX_LENGTH = RELEASE_BRANCH_MAX_LENGTH;
 exports.RELEASE_ENVIRONMENTS = RELEASE_ENVIRONMENTS;
+exports.RELEASE_RESTORE_MS = RELEASE_RESTORE_MS;
 exports.RELEASE_REVERT_TASK_LABEL = RELEASE_REVERT_TASK_LABEL;
 exports.RELEASE_VERIFY_ATTEMPT_INTERVAL_MS = RELEASE_VERIFY_ATTEMPT_INTERVAL_MS;
 exports.RELEASE_VERIFY_BUDGET_MS = RELEASE_VERIFY_BUDGET_MS;
@@ -6559,6 +10363,7 @@ exports.RELEASE_VERIFY_ROLLOUT_CONFIRMATIONS = RELEASE_VERIFY_ROLLOUT_CONFIRMATI
 exports.RELEASE_VERIFY_SHA_EXPECT_LENGTH = RELEASE_VERIFY_SHA_EXPECT_LENGTH;
 exports.RELEASE_VERIFY_STATES = RELEASE_VERIFY_STATES;
 exports.RELEASE_VERIFY_URL_MAX_LENGTH = RELEASE_VERIFY_URL_MAX_LENGTH;
+exports.REMOVED_DATA_RETENTION_DAYS = REMOVED_DATA_RETENTION_DAYS;
 exports.REPO_DECLARED_COMMANDS_MAX = REPO_DECLARED_COMMANDS_MAX;
 exports.REPO_DECLARED_COMMAND_ID_PREFIX = REPO_DECLARED_COMMAND_ID_PREFIX;
 exports.REQUIRE_HTTPS_FOR_CREDENTIALS_SETTING = REQUIRE_HTTPS_FOR_CREDENTIALS_SETTING;
@@ -6585,6 +10390,8 @@ exports.SAFETY_PAUSE_WRITES_PER_MINUTE = SAFETY_PAUSE_WRITES_PER_MINUTE;
 exports.SAFETY_RAIL_ORDER = SAFETY_RAIL_ORDER;
 exports.SAFETY_REASON_CODES = SAFETY_REASON_CODES;
 exports.SAFETY_RUNG_WRITES_PER_MINUTE = SAFETY_RUNG_WRITES_PER_MINUTE;
+exports.SELF_CHECK_BUDGET_MS = SELF_CHECK_BUDGET_MS;
+exports.SELF_CHECK_INTERVAL_HOURS = SELF_CHECK_INTERVAL_HOURS;
 exports.SHIPPED_DEFAULT_RUNG_POLICY = SHIPPED_DEFAULT_RUNG_POLICY;
 exports.SKILL_CAPTURE_BODY_MAX_CHARS = SKILL_CAPTURE_BODY_MAX_CHARS;
 exports.SKILL_CAPTURE_BODY_MIN_CHARS = SKILL_CAPTURE_BODY_MIN_CHARS;
@@ -6647,6 +10454,16 @@ exports.TASK_MAX_EXTRA_REPOS = TASK_MAX_EXTRA_REPOS;
 exports.TASK_PROVENANCE_PRECEDENCE = TASK_PROVENANCE_PRECEDENCE;
 exports.TASK_PROVENANCE_VISIBLE_CHIPS = TASK_PROVENANCE_VISIBLE_CHIPS;
 exports.TASK_RUN_FINISHED_STATUSES = TASK_RUN_FINISHED_STATUSES;
+exports.TENANT_POSTGRES_DATABASE_CONNECTION_LIMIT = TENANT_POSTGRES_DATABASE_CONNECTION_LIMIT;
+exports.TENANT_POSTGRES_DATABASE_PREFIX = TENANT_POSTGRES_DATABASE_PREFIX;
+exports.TENANT_POSTGRES_DDL_REFUSALS = TENANT_POSTGRES_DDL_REFUSALS;
+exports.TENANT_POSTGRES_DEFAULT_PORT = TENANT_POSTGRES_DEFAULT_PORT;
+exports.TENANT_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS = TENANT_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS;
+exports.TENANT_POSTGRES_PASSWORD_PATTERN = TENANT_POSTGRES_PASSWORD_PATTERN;
+exports.TENANT_POSTGRES_ROLE_ATTRIBUTES = TENANT_POSTGRES_ROLE_ATTRIBUTES;
+exports.TENANT_POSTGRES_ROLE_CONNECTION_LIMIT = TENANT_POSTGRES_ROLE_CONNECTION_LIMIT;
+exports.TENANT_POSTGRES_ROLE_PREFIX = TENANT_POSTGRES_ROLE_PREFIX;
+exports.TENANT_POSTGRES_STATEMENT_TIMEOUT_MS = TENANT_POSTGRES_STATEMENT_TIMEOUT_MS;
 exports.TERMINAL_CLIENT_TO_SERVER_KINDS = TERMINAL_CLIENT_TO_SERVER_KINDS;
 exports.TERMINAL_EXIT_REASONS = TERMINAL_EXIT_REASONS;
 exports.TERMINAL_MAX_AUTH_TOKEN_LENGTH = TERMINAL_MAX_AUTH_TOKEN_LENGTH;
@@ -6688,12 +10505,46 @@ exports.WORK_REPO_DECLARED_COMMAND_MAX_ALLOW = WORK_REPO_DECLARED_COMMAND_MAX_AL
 exports.WORK_REPO_DECLARED_COMMAND_MAX_LENGTH = WORK_REPO_DECLARED_COMMAND_MAX_LENGTH;
 exports.WORK_REPO_DECLARED_COMMAND_MODES = WORK_REPO_DECLARED_COMMAND_MODES;
 exports.acceptPlaybookEntry = acceptPlaybookEntry;
+exports.appBuildCheckName = appBuildCheckName;
+exports.appBuildEventNameForStatus = appBuildEventNameForStatus;
+exports.appBuildRunnerCapacity = appBuildRunnerCapacity;
+exports.appComponentDeadlineSeconds = appComponentDeadlineSeconds;
+exports.appDependencyBackupStateMessageKey = appDependencyBackupStateMessageKey;
+exports.appDependencyBlocksDeploy = appDependencyBlocksDeploy;
+exports.appDependencyDefaultSizeGiB = appDependencyDefaultSizeGiB;
+exports.appDependencyOutputNames = appDependencyOutputNames;
+exports.appDependencyReadyDeadlineMs = appDependencyReadyDeadlineMs;
+exports.appDependencyReasonMessageKey = appDependencyReasonMessageKey;
+exports.appDependencyStatusMessageKey = appDependencyStatusMessageKey;
+exports.appDependencyToken = appDependencyToken;
+exports.appEnvDependencyFingerprint = appEnvDependencyFingerprint;
+exports.appEnvDependencyPasswordToken = appEnvDependencyPasswordToken;
+exports.appEnvErrorMessageKey = appEnvErrorMessageKey;
+exports.appEnvGeneratorFingerprint = appEnvGeneratorFingerprint;
+exports.appEnvKeypairFormatSupported = appEnvKeypairFormatSupported;
+exports.appEnvPublicHalfName = appEnvPublicHalfName;
+exports.appEnvStoredFingerprint = appEnvStoredFingerprint;
+exports.appEnvTemplateFingerprint = appEnvTemplateFingerprint;
+exports.appLauncherPinLimitExceeded = appLauncherPinLimitExceeded;
+exports.appManualSyncAllowed = appManualSyncAllowed;
+exports.appProvisionCopy = appProvisionCopy;
+exports.appProvisionCopyPlaceholders = appProvisionCopyPlaceholders;
+exports.appRateLimitAllowsSync = appRateLimitAllowsSync;
+exports.appRepositoryUrlLengthExceeded = appRepositoryUrlLengthExceeded;
+exports.appWorkQuotaAllows = appWorkQuotaAllows;
 exports.applyConnectionScopePresetToToolGrant = applyConnectionScopePresetToToolGrant;
 exports.applyConnectionScopePresetWithOwnership = applyConnectionScopePresetWithOwnership;
 exports.applyWorkflowInputMapping = applyWorkflowInputMapping;
+exports.appsTierReceiptIdempotencyKey = appsTierReceiptIdempotencyKey;
 exports.assessCredentialTransport = assessCredentialTransport;
+exports.buildAppSpecLineLink = buildAppSpecLineLink;
 exports.buildBackupArchiveFilename = buildBackupArchiveFilename;
+exports.buildFailureExcerpt = buildFailureExcerpt;
+exports.buildTenantPostgresDdl = buildTenantPostgresDdl;
+exports.canDeleteAppDependencyData = canDeleteAppDependencyData;
+exports.canStartTargetOwnerScan = canStartTargetOwnerScan;
 exports.catalogSearchRank = catalogSearchRank;
+exports.clampAppsTierQuotaProfile = clampAppsTierQuotaProfile;
 exports.clampEscalationConfidence = clampEscalationConfidence;
 exports.clampLeaseTtlSec = clampLeaseTtlSec;
 exports.clampMaxAttempts = clampMaxAttempts;
@@ -6706,6 +10557,7 @@ exports.comparePlaybookVersions = comparePlaybookVersions;
 exports.compareRung = compareRung;
 exports.compareTaskBoardCards = compareTaskBoardCards;
 exports.composeFleetPushCommitMessage = composeFleetPushCommitMessage;
+exports.computeBuildInputsHash = computeBuildInputsHash;
 exports.computeEmailCapRetryAfterSeconds = computeEmailCapRetryAfterSeconds;
 exports.computerStallStateForAge = computerStallStateForAge;
 exports.connectionHealthIsWarning = connectionHealthIsWarning;
@@ -6737,12 +10589,17 @@ exports.effectiveModelAccountHealth = effectiveModelAccountHealth;
 exports.emailSendCapWindowsInForce = emailSendCapWindowsInForce;
 exports.encodeComputerFrame = encodeComputerFrame;
 exports.encodeTerminalFrame = encodeTerminalFrame;
+exports.evaluateAppsTierPolicyState = evaluateAppsTierPolicyState;
+exports.evaluateBuildDeployability = evaluateBuildDeployability;
+exports.evaluateBuildRunnerFit = evaluateBuildRunnerFit;
+exports.evaluateBuildServicePort = evaluateBuildServicePort;
 exports.evaluateCollaboratorDelegation = evaluateCollaboratorDelegation;
 exports.evaluateEmailSendCaps = evaluateEmailSendCaps;
 exports.evaluateWorkflowCondition = evaluateWorkflowCondition;
 exports.filterToolNamesBySubAgentScope = filterToolNamesBySubAgentScope;
 exports.findConversationDocumentReferences = findConversationDocumentReferences;
 exports.findTaskBoardColumn = findTaskBoardColumn;
+exports.firstRefusingRepositoryStage = firstRefusingRepositoryStage;
 exports.fleetAgentExecutionProviderSupportsMountGrants = fleetAgentExecutionProviderSupportsMountGrants;
 exports.fleetModelCostUsdToCents = fleetModelCostUsdToCents;
 exports.fleetModelPluginId = fleetModelPluginId;
@@ -6753,6 +10610,7 @@ exports.getBackupDomain = getBackupDomain;
 exports.getGtmSkill = getGtmSkill;
 exports.getWorkCapabilities = getWorkCapabilities;
 exports.getWorkMetricDefinition = getWorkMetricDefinition;
+exports.hasAppEnvPublicPrefix = hasAppEnvPublicPrefix;
 exports.homeCapTone = homeCapTone;
 exports.homeRunChip = homeRunChip;
 exports.homeWaitingTone = homeWaitingTone;
@@ -6760,6 +10618,14 @@ exports.inboxDecisionNeedsReason = inboxDecisionNeedsReason;
 exports.isActionCategory = isActionCategory;
 exports.isAgentRunTimelineInsertionOrderTieBreak = isAgentRunTimelineInsertionOrderTieBreak;
 exports.isAllowedTerminalWsUrl = isAllowedTerminalWsUrl;
+exports.isAppBuildCheckJobName = isAppBuildCheckJobName;
+exports.isAppDependencyBackupOverdue = isAppDependencyBackupOverdue;
+exports.isAppDependencyOutputSecret = isAppDependencyOutputSecret;
+exports.isAppDependencyReason = isAppDependencyReason;
+exports.isAppDependencySizeChangeAllowed = isAppDependencySizeChangeAllowed;
+exports.isAppLauncherEnvironment = isAppLauncherEnvironment;
+exports.isAppSourceReasonCode = isAppSourceReasonCode;
+exports.isAppWorkKind = isAppWorkKind;
 exports.isAutonomyGrantScopeType = isAutonomyGrantScopeType;
 exports.isComputerChannel = isComputerChannel;
 exports.isComputerClientToServerFrame = isComputerClientToServerFrame;
@@ -6789,6 +10655,8 @@ exports.isCredentialKey = isCredentialKey;
 exports.isCreditSettlementMode = isCreditSettlementMode;
 exports.isDeliveryGoalKind = isDeliveryGoalKind;
 exports.isDraftableCategory = isDraftableCategory;
+exports.isEverIdAllowedIssuerCountAllowed = isEverIdAllowedIssuerCountAllowed;
+exports.isEverIdClockSkewAllowed = isEverIdClockSkewAllowed;
 exports.isFleetAgentExecutionEffort = isFleetAgentExecutionEffort;
 exports.isFleetAgentExecutionMode = isFleetAgentExecutionMode;
 exports.isFleetAgentExecutionPermissionMode = isFleetAgentExecutionPermissionMode;
@@ -6818,6 +10686,7 @@ exports.isNarrowerConnectionScopePreset = isNarrowerConnectionScopePreset;
 exports.isNodeBusy = isNodeBusy;
 exports.isOverLinkLimits = isOverLinkLimits;
 exports.isPersonallyDeletableConversationKind = isPersonallyDeletableConversationKind;
+exports.isPlatformDataServer = isPlatformDataServer;
 exports.isPromotionGateDecided = isPromotionGateDecided;
 exports.isPromotionGateDecisionOverdue = isPromotionGateDecisionOverdue;
 exports.isPromotionGateOverridden = isPromotionGateOverridden;
@@ -6838,8 +10707,10 @@ exports.isReservedMountDir = isReservedMountDir;
 exports.isRunLedgerCalendarDate = isRunLedgerCalendarDate;
 exports.isSafetyRailId = isSafetyRailId;
 exports.isSafetyReasonCode = isSafetyReasonCode;
+exports.isSemverLessThan = isSemverLessThan;
 exports.isSkillCardState = isSkillCardState;
 exports.isSkillReadinessState = isSkillReadinessState;
+exports.isSourceOnlyAppSpec = isSourceOnlyAppSpec;
 exports.isSubAgentDelegationSuccessful = isSubAgentDelegationSuccessful;
 exports.isSubAgentScopeSubset = isSubAgentScopeSubset;
 exports.isTaskBoardLayout = isTaskBoardLayout;
@@ -6855,6 +10726,7 @@ exports.isValidFleetRunEnvFilePath = isValidFleetRunEnvFilePath;
 exports.isValidTerminalRunId = isValidTerminalRunId;
 exports.isWorkflowEdgeKind = isWorkflowEdgeKind;
 exports.isWorkspaceContextFileSlug = isWorkspaceContextFileSlug;
+exports.launchGateItemsForPhase = launchGateItemsForPhase;
 exports.listGtmSkills = listGtmSkills;
 exports.listGtmSkillsForStage = listGtmSkillsForStage;
 exports.lowerComputerQuality = lowerComputerQuality;
@@ -6871,6 +10743,7 @@ exports.moreRestrictiveCategory = moreRestrictiveCategory;
 exports.narrowSubAgentScope = narrowSubAgentScope;
 exports.nextRungUp = nextRungUp;
 exports.nodeSatisfiesCapabilities = nodeSatisfiesCapabilities;
+exports.normaliseDataServerEndpoint = normaliseDataServerEndpoint;
 exports.normalizeCommitSha = normalizeCommitSha;
 exports.normalizeComputerFrame = normalizeComputerFrame;
 exports.normalizeConnectionScopePresetOwnership = normalizeConnectionScopePresetOwnership;
@@ -6901,13 +10774,16 @@ exports.onFailureEdgeCatches = onFailureEdgeCatches;
 exports.orderTaskProvenance = orderTaskProvenance;
 exports.organizationRequiresHttpsForCredentials = organizationRequiresHttpsForCredentials;
 exports.outgoingWorkflowEdges = outgoingWorkflowEdges;
+exports.parseAppDependencyToken = parseAppDependencyToken;
 exports.parseConversationMentions = parseConversationMentions;
+exports.parseDataServerUrl = parseDataServerUrl;
 exports.parseFleetAgentTaskQuestionMarkdown = parseFleetAgentTaskQuestionMarkdown;
 exports.parseGitHubRepositoryUrl = parseGitHubRepositoryUrl;
 exports.parseHitlAnswer = parseHitlAnswer;
 exports.parseHitlQuestion = parseHitlQuestion;
 exports.parseHomeBlockIds = parseHomeBlockIds;
 exports.parseModelPolicyScheduleKey = parseModelPolicyScheduleKey;
+exports.platformDataServerEndpoints = platformDataServerEndpoints;
 exports.playbookSearchFields = playbookSearchFields;
 exports.promotionGateVerdictFromRun = promotionGateVerdictFromRun;
 exports.promotionLaneKey = promotionLaneKey;
@@ -6915,6 +10791,7 @@ exports.promotionRungFromLabels = promotionRungFromLabels;
 exports.promotionRungLabel = promotionRungLabel;
 exports.promotionTaskLabels = promotionTaskLabels;
 exports.pruneConnectionScopePresetOwnership = pruneConnectionScopePresetOwnership;
+exports.quoteTenantPostgresIdentifier = quoteTenantPostgresIdentifier;
 exports.readKbConnectorSource = readKbConnectorSource;
 exports.redactSecrets = redactSecrets;
 exports.refuseSubAgentDelegation = refuseSubAgentDelegation;
@@ -6926,6 +10803,12 @@ exports.releaseVerificationProbe = releaseVerificationProbe;
 exports.releaseVerifyAppProof = releaseVerifyAppProof;
 exports.releaseVerifyIdempotencyKey = releaseVerifyIdempotencyKey;
 exports.repoDeclaredCommandId = repoDeclaredCommandId;
+exports.resolveAppProvisionCopy = resolveAppProvisionCopy;
+exports.resolveAppRepositoryModes = resolveAppRepositoryModes;
+exports.resolveAppsTierQuotaProfile = resolveAppsTierQuotaProfile;
+exports.resolveBuildServiceEnv = resolveBuildServiceEnv;
+exports.resolveBuildServiceKind = resolveBuildServiceKind;
+exports.resolveBuildServicePort = resolveBuildServicePort;
 exports.resolveEffectiveConnectionScopePreset = resolveEffectiveConnectionScopePreset;
 exports.resolveEmailSendCaps = resolveEmailSendCaps;
 exports.resolveExclusiveAgentCredentials = resolveExclusiveAgentCredentials;
@@ -6950,6 +10833,7 @@ exports.sanitizeToolGrantOverride = sanitizeToolGrantOverride;
 exports.scanForSecrets = scanForSecrets;
 exports.serializeHitlAnswer = serializeHitlAnswer;
 exports.serializeHitlQuestion = serializeHitlQuestion;
+exports.sha256Hex = sha256Hex;
 exports.shouldDegrade = shouldDegrade;
 exports.shouldRecover = shouldRecover;
 exports.skillCardStateNeedsAttention = skillCardStateNeedsAttention;