@kanyun-ai-infra/agenthub 1.5.0 → 1.5.2

package/dist/index.cjs

@@ -218,6 +218,7 @@ var import_zod67 = require("zod");
 var import_zod68 = require("zod");
 var import_zod69 = require("zod");
 var import_zod70 = require("zod");
+var import_zod71 = require("zod");
 var MODELGATE_VENDOR_TYPES = [
   "anthropic",
   "openai",
@@ -5558,35 +5559,41 @@ var SessionDeliveryEnvelopeSchema = import_zod47.z.object({
   /** ISO-8601 last-write time; the latest-wins ordering key. */
   updatedAt: import_zod47.z.string().min(1)
 }).strict();
+var SESSION_INCLUDE_FIELDS = ["streamCursor"];
+var SessionIncludeQuerySchema = import_zod48.z.object({
+  include: import_zod48.z.string().optional().transform(
+    (raw) => raw ? raw.split(",").map((value) => value.trim()).filter(Boolean) : []
+  ).pipe(import_zod48.z.array(import_zod48.z.enum(SESSION_INCLUDE_FIELDS)))
+});
 var SECRET_VALUE_MAX_LENGTH = 65536;
 var SECRET_DISPLAY_NAME_MAX_LENGTH = 200;
-var SecretEnvKeySchema = import_zod48.z.string().min(1).max(SECRET_ENV_KEY_MAX_LENGTH).regex(SECRET_ENV_KEY_REGEX, "envKey must look like an environment variable name").refine((key) => !isDisallowedWorkerConfigEnvKey(key), { message: "ENV_KEY_FORBIDDEN" });
-var CreateSecretRequestSchema = import_zod48.z.object({
-  delivery: import_zod48.z.literal("env_jit"),
-  displayName: import_zod48.z.string().min(1).max(SECRET_DISPLAY_NAME_MAX_LENGTH),
+var SecretEnvKeySchema = import_zod49.z.string().min(1).max(SECRET_ENV_KEY_MAX_LENGTH).regex(SECRET_ENV_KEY_REGEX, "envKey must look like an environment variable name").refine((key) => !isDisallowedWorkerConfigEnvKey(key), { message: "ENV_KEY_FORBIDDEN" });
+var CreateSecretRequestSchema = import_zod49.z.object({
+  delivery: import_zod49.z.literal("env_jit"),
+  displayName: import_zod49.z.string().min(1).max(SECRET_DISPLAY_NAME_MAX_LENGTH),
   envKey: SecretEnvKeySchema,
   /** Plaintext, write-only; bounded so a blob cannot bloat the envelope. */
-  value: import_zod48.z.string().min(1).max(SECRET_VALUE_MAX_LENGTH)
+  value: import_zod49.z.string().min(1).max(SECRET_VALUE_MAX_LENGTH)
 }).strict();
-var RotateSecretRequestSchema = import_zod48.z.object({
-  value: import_zod48.z.string().min(1).max(SECRET_VALUE_MAX_LENGTH)
+var RotateSecretRequestSchema = import_zod49.z.object({
+  value: import_zod49.z.string().min(1).max(SECRET_VALUE_MAX_LENGTH)
 }).strict();
-var SecretRecordSchema = import_zod48.z.object({
+var SecretRecordSchema = import_zod49.z.object({
   publicId: SecretPublicIdSchema,
-  displayName: import_zod48.z.string(),
+  displayName: import_zod49.z.string(),
   delivery: SecretDeliverySchema,
   /** env_jit: target env var name; proxy_inject (P2): null. */
-  envKey: import_zod48.z.string().nullable(),
-  createdAt: import_zod48.z.string(),
-  updatedAt: import_zod48.z.string(),
-  archivedAt: import_zod48.z.string().nullable()
+  envKey: import_zod49.z.string().nullable(),
+  createdAt: import_zod49.z.string(),
+  updatedAt: import_zod49.z.string(),
+  archivedAt: import_zod49.z.string().nullable()
 }).strict();
-var SecretPickItemSchema = import_zod48.z.object({
+var SecretPickItemSchema = import_zod49.z.object({
   publicId: SecretPublicIdSchema,
-  displayName: import_zod48.z.string(),
-  envKey: import_zod48.z.string().nullable()
+  displayName: import_zod49.z.string(),
+  envKey: import_zod49.z.string().nullable()
 }).strict();
-var RecordWorkspaceSnapshotRequestSchema = import_zod49.z.object({
+var RecordWorkspaceSnapshotRequestSchema = import_zod50.z.object({
   /**
    * The split workspace snapshot produced at the prior turn's end. Both
    * parts may be null ("nothing to restore" — a valid no-op snapshot, NOT
@@ -5594,14 +5601,14 @@ var RecordWorkspaceSnapshotRequestSchema = import_zod49.z.object({
    */
   snapshot: WorkspaceSnapshotSchema
 }).strict();
-var RecordWorkspaceSnapshotResponseSchema = import_zod49.z.object({
-  success: import_zod49.z.literal(true),
-  data: import_zod49.z.object({
-    applied: import_zod49.z.boolean(),
-    gateInjected: import_zod49.z.boolean()
+var RecordWorkspaceSnapshotResponseSchema = import_zod50.z.object({
+  success: import_zod50.z.literal(true),
+  data: import_zod50.z.object({
+    applied: import_zod50.z.boolean(),
+    gateInjected: import_zod50.z.boolean()
   })
 });
-var RecordWorkspaceSnapshotErrorCodeSchema = import_zod49.z.enum([
+var RecordWorkspaceSnapshotErrorCodeSchema = import_zod50.z.enum([
   // 400 — request was malformed or schema-invalid
   "VALIDATION_ERROR",
   // 401 — Authorization header missing or session token invalid/expired
@@ -5618,12 +5625,12 @@ var RecordWorkspaceSnapshotErrorCodeSchema = import_zod49.z.enum([
 ]);
 var WorkspaceExportPartSchema = WorkspaceSnapshotPartSchema.extend({
   /** Presigned OSS download URL, valid for `WORKSPACE_EXPORT_URL_TTL_SECONDS`. */
-  downloadUrl: import_zod49.z.string().min(1),
+  downloadUrl: import_zod50.z.string().min(1),
   /** ISO-8601 instant at which `downloadUrl` stops working. */
-  expiresAt: import_zod49.z.string().min(1)
+  expiresAt: import_zod50.z.string().min(1)
 }).strip();
-var WorkspaceExportDataSchema = import_zod49.z.object({
-  version: import_zod49.z.literal("v1"),
+var WorkspaceExportDataSchema = import_zod50.z.object({
+  version: import_zod50.z.literal("v1"),
   /**
    * Opaque monotonic cursor identifying this capture. **Not a turn ordinal**
    * despite the name: the capture side sets it to `capturedAt.getTime()`
@@ -5660,19 +5667,19 @@ var WorkspaceExportDataSchema = import_zod49.z.object({
    * from "nothing was produced". Anchoring the snapshot to a turn identity
    * rather than a timestamp is the real fix — see the spec's follow-ups.
    */
-  capturedAtTurn: import_zod49.z.number().int().nonnegative(),
+  capturedAtTurn: import_zod50.z.number().int().nonnegative(),
   /** ISO-8601 capture time — the field to show a human. */
-  capturedAt: import_zod49.z.string().min(1),
-  parts: import_zod49.z.object({
+  capturedAt: import_zod50.z.string().min(1),
+  parts: import_zod50.z.object({
     repoBundle: WorkspaceExportPartSchema.nullable(),
     externalArchive: WorkspaceExportPartSchema.nullable()
   })
 });
-var WorkspaceExportResponseSchema = import_zod49.z.object({
-  success: import_zod49.z.literal(true),
+var WorkspaceExportResponseSchema = import_zod50.z.object({
+  success: import_zod50.z.literal(true),
   data: WorkspaceExportDataSchema
 });
-var WorkspaceExportErrorCodeSchema = import_zod49.z.enum([
+var WorkspaceExportErrorCodeSchema = import_zod50.z.enum([
   // 400 — the URL session id is not a well-formed uuid
   "VALIDATION_ERROR",
   // 404 — no such session, or it is not visible to this caller
@@ -5702,25 +5709,25 @@ var WorkspaceExportErrorCodeSchema = import_zod49.z.enum([
 var SESSION_ARTIFACT_MAX_BUNDLE_COMPRESSED_BYTES = 8 * 1024 * 1024;
 var SESSION_ARTIFACT_MAX_ENTRY_BYTES = 8 * 1024 * 1024;
 var SESSION_ARTIFACT_MAX_TOTAL_UNCOMPRESSED_BYTES = 16 * 1024 * 1024;
-var ScheduleTargetKindSchema = import_zod50.z.enum(["workload", "agent", "inline_v1", "inline_v2"]);
-var ScheduleApiVersionPreferenceSchema = import_zod50.z.enum(["v1", "v2"]);
-var ScheduleLifecycleStatusSchema = import_zod50.z.enum(["active", "disabled", "deleted"]);
-var ScheduleConcurrencyPolicySchema = import_zod50.z.enum(["allow", "forbid"]);
-var ScheduleMisfirePolicySchema = import_zod50.z.enum(["skip", "fire_once_immediately"]);
-var ScheduleTriggerSourceSchema = import_zod50.z.enum(["cron", "manual"]);
-var ScheduleTriggerStatusSchema = import_zod50.z.enum([
+var ScheduleTargetKindSchema = import_zod51.z.enum(["workload", "agent", "inline_v1", "inline_v2"]);
+var ScheduleApiVersionPreferenceSchema = import_zod51.z.enum(["v1", "v2"]);
+var ScheduleLifecycleStatusSchema = import_zod51.z.enum(["active", "disabled", "deleted"]);
+var ScheduleConcurrencyPolicySchema = import_zod51.z.enum(["allow", "forbid"]);
+var ScheduleMisfirePolicySchema = import_zod51.z.enum(["skip", "fire_once_immediately"]);
+var ScheduleTriggerSourceSchema = import_zod51.z.enum(["cron", "manual"]);
+var ScheduleTriggerStatusSchema = import_zod51.z.enum([
   "pending",
   "dispatched",
   "skipped",
   "failed_to_dispatch"
 ]);
-var ScheduleSkippedReasonSchema = import_zod50.z.enum([
+var ScheduleSkippedReasonSchema = import_zod51.z.enum([
   "misfire",
   "concurrency_forbidden",
   "schedule_disabled",
   "out_of_window"
 ]);
-var ScheduleFailureReasonCodeSchema = import_zod50.z.enum([
+var ScheduleFailureReasonCodeSchema = import_zod51.z.enum([
   "TARGET_NOT_FOUND",
   "TARGET_DISABLED",
   "REVISION_NOT_FOUND",
@@ -5731,7 +5738,7 @@ var ScheduleFailureReasonCodeSchema = import_zod50.z.enum([
   "STAGE_NOT_DEPLOYED",
   "UNKNOWN_DISPATCH_FAILURE"
 ]);
-var ScheduleApiErrorCodeSchema = import_zod50.z.enum([
+var ScheduleApiErrorCodeSchema = import_zod51.z.enum([
   "INVALID_CRON",
   "INVALID_TIMEZONE",
   "INVALID_TARGET",
@@ -5788,16 +5795,16 @@ function isCronStructurallyValid(value) {
   const segments = trimmed.split(/\s+/);
   return segments.length === 5 || segments.length === 6;
 }
-var TimezoneStringSchema = import_zod50.z.string().min(1, "timezone must be a non-empty IANA identifier").refine(isValidIanaTimezone, "timezone must be a valid IANA identifier");
-var CronExpressionSchema = import_zod50.z.string().min(1, "cronExpression must be non-empty").max(200, "cronExpression must be at most 200 characters").refine(isCronStructurallyValid, "cronExpression must have 5 or 6 whitespace-separated segments");
-var IsoDatetimeSchema = import_zod50.z.string().datetime({ offset: true });
+var TimezoneStringSchema = import_zod51.z.string().min(1, "timezone must be a non-empty IANA identifier").refine(isValidIanaTimezone, "timezone must be a valid IANA identifier");
+var CronExpressionSchema = import_zod51.z.string().min(1, "cronExpression must be non-empty").max(200, "cronExpression must be at most 200 characters").refine(isCronStructurallyValid, "cronExpression must have 5 or 6 whitespace-separated segments");
+var IsoDatetimeSchema = import_zod51.z.string().datetime({ offset: true });
 var SCHEDULE_PAYLOAD_PROMPT_MAX_LENGTH = 5e4;
-var SchedulePayloadV1Schema = import_zod50.z.object({
+var SchedulePayloadV1Schema = import_zod51.z.object({
   /** Required for v1 — `RunService.createRun` rejects empty prompts. */
-  prompt: import_zod50.z.string().min(1).max(SCHEDULE_PAYLOAD_PROMPT_MAX_LENGTH),
-  repo: import_zod50.z.string().max(2048).optional(),
-  ref: import_zod50.z.string().max(255).optional(),
-  model: import_zod50.z.string().max(255).optional(),
+  prompt: import_zod51.z.string().min(1).max(SCHEDULE_PAYLOAD_PROMPT_MAX_LENGTH),
+  repo: import_zod51.z.string().max(2048).optional(),
+  ref: import_zod51.z.string().max(255).optional(),
+  model: import_zod51.z.string().max(255).optional(),
   /**
    * P1.6: tightened from `z.string().max(64).optional()` to
    * `ProviderTypeSchema.optional()`. Catches invalid provider strings
@@ -5813,31 +5820,31 @@ var SchedulePayloadV1Schema = import_zod50.z.object({
    * cron-triggered runs. Null / undefined falls back to the
    * service-level Bedrock key.
    */
-  triggerUserLdap: import_zod50.z.string().min(1).max(255).optional()
+  triggerUserLdap: import_zod51.z.string().min(1).max(255).optional()
 }).strict();
-var SchedulePayloadV2Schema = import_zod50.z.object({
+var SchedulePayloadV2Schema = import_zod51.z.object({
   /**
    * Sandbox-environment overrides forwarded to
    * `CreateSessionRequest.configValues`. Reserved-env-key sanitization
    * is enforced at the SessionStartupService boundary; the schema
    * here keeps the shape opaque to avoid duplicating that policy.
    */
-  configValues: import_zod50.z.record(import_zod50.z.string(), import_zod50.z.string()).optional(),
+  configValues: import_zod51.z.record(import_zod51.z.string(), import_zod51.z.string()).optional(),
   /** Free-form audit metadata; non-functional. */
-  metadata: import_zod50.z.record(import_zod50.z.string(), import_zod50.z.unknown()).optional()
+  metadata: import_zod51.z.record(import_zod51.z.string(), import_zod51.z.unknown()).optional()
 }).strict();
-var ScheduleInlineV1PayloadSchema = import_zod50.z.object({
-  prompt: import_zod50.z.string().min(1).max(SCHEDULE_PAYLOAD_PROMPT_MAX_LENGTH),
-  repo: import_zod50.z.string().min(1).max(2048).optional(),
-  ref: import_zod50.z.string().min(1).max(255).optional(),
-  model: import_zod50.z.string().max(255).optional(),
+var ScheduleInlineV1PayloadSchema = import_zod51.z.object({
+  prompt: import_zod51.z.string().min(1).max(SCHEDULE_PAYLOAD_PROMPT_MAX_LENGTH),
+  repo: import_zod51.z.string().min(1).max(2048).optional(),
+  ref: import_zod51.z.string().min(1).max(255).optional(),
+  model: import_zod51.z.string().max(255).optional(),
   /**
    * P1.6: see `SchedulePayloadV1Schema.provider` — same rationale.
    * Closes the unsafe `as RunSpec["provider"]` cast in
    * `schedule-dispatcher.ts dispatchInlineV1` (P1.3 review [CONSIDER]).
    */
   provider: ProviderTypeSchema.optional(),
-  triggerUserLdap: import_zod50.z.string().min(1).max(255).optional(),
+  triggerUserLdap: import_zod51.z.string().min(1).max(255).optional(),
   /**
    * Per-fire MCP / Skills enable lists — same wire shape the home
    * composer sends to `POST /api/agents` (run-level override, spec
@@ -5861,20 +5868,20 @@ var ScheduleInlineV1PayloadSchema = import_zod50.z.object({
    * onto every synthesised `RunSpec`, so each cron-created Run sees
    * the same attachments. Capped at 5 to match `RunSpec.attachments`.
    */
-  attachments: import_zod50.z.array(AttachmentMetaSchema).max(5).optional()
+  attachments: import_zod51.z.array(AttachmentMetaSchema).max(5).optional()
 }).strict();
 var SCHEDULE_INLINE_V2_WORKLOAD_SLUG_REGEX = /^[a-z0-9][a-z0-9-]{0,127}$/;
-var ScheduleInlineV2PayloadSchema = import_zod50.z.object({
-  workloadSlug: import_zod50.z.string().min(1).max(128).refine(
+var ScheduleInlineV2PayloadSchema = import_zod51.z.object({
+  workloadSlug: import_zod51.z.string().min(1).max(128).refine(
     (s) => SCHEDULE_INLINE_V2_WORKLOAD_SLUG_REGEX.test(s),
     "workloadSlug must be lowercase alphanumeric / dashes (1..128 chars)"
   ),
   /** Default `"latest"`; UUID strings are treated as revision pin. */
-  revisionSelector: import_zod50.z.union([import_zod50.z.literal("latest"), import_zod50.z.string().uuid()]).default("latest"),
-  configValues: import_zod50.z.record(import_zod50.z.string(), import_zod50.z.string()).optional(),
-  metadata: import_zod50.z.record(import_zod50.z.string(), import_zod50.z.unknown()).optional()
+  revisionSelector: import_zod51.z.union([import_zod51.z.literal("latest"), import_zod51.z.string().uuid()]).default("latest"),
+  configValues: import_zod51.z.record(import_zod51.z.string(), import_zod51.z.string()).optional(),
+  metadata: import_zod51.z.record(import_zod51.z.string(), import_zod51.z.unknown()).optional()
 }).strict();
-var RawPayloadSchema = import_zod50.z.record(import_zod50.z.string(), import_zod50.z.unknown());
+var RawPayloadSchema = import_zod51.z.record(import_zod51.z.string(), import_zod51.z.unknown());
 var ADMISSIBLE_TARGET_VERSION_COMBOS = ["workload:v2", "agent:v1", "inline_v1:v1", "inline_v1:v2", "inline_v2:v2"];
 function refineTargetFields(schema) {
   return schema.superRefine((value, ctx) => {
@@ -5882,14 +5889,14 @@ function refineTargetFields(schema) {
       case "workload": {
         if (!value.targetWorkloadId) {
           ctx.addIssue({
-            code: import_zod50.z.ZodIssueCode.custom,
+            code: import_zod51.z.ZodIssueCode.custom,
             message: "targetWorkloadId is required when targetKind is 'workload'",
             path: ["targetWorkloadId"]
           });
         }
         if (value.targetAgentId) {
           ctx.addIssue({
-            code: import_zod50.z.ZodIssueCode.custom,
+            code: import_zod51.z.ZodIssueCode.custom,
             message: "targetAgentId must be omitted when targetKind is 'workload'",
             path: ["targetAgentId"]
           });
@@ -5899,21 +5906,21 @@ function refineTargetFields(schema) {
       case "agent": {
         if (!value.targetAgentId) {
           ctx.addIssue({
-            code: import_zod50.z.ZodIssueCode.custom,
+            code: import_zod51.z.ZodIssueCode.custom,
             message: "targetAgentId is required when targetKind is 'agent'",
             path: ["targetAgentId"]
           });
         }
         if (value.targetWorkloadId) {
           ctx.addIssue({
-            code: import_zod50.z.ZodIssueCode.custom,
+            code: import_zod51.z.ZodIssueCode.custom,
             message: "targetWorkloadId must be omitted when targetKind is 'agent'",
             path: ["targetWorkloadId"]
           });
         }
         if (value.targetRevisionId) {
           ctx.addIssue({
-            code: import_zod50.z.ZodIssueCode.custom,
+            code: import_zod51.z.ZodIssueCode.custom,
             message: "targetRevisionId is only allowed when targetKind is 'workload'",
             path: ["targetRevisionId"]
           });
@@ -5924,21 +5931,21 @@ function refineTargetFields(schema) {
       case "inline_v2": {
         if (value.targetWorkloadId) {
           ctx.addIssue({
-            code: import_zod50.z.ZodIssueCode.custom,
+            code: import_zod51.z.ZodIssueCode.custom,
             message: `targetWorkloadId must be omitted when targetKind is '${value.targetKind}'`,
             path: ["targetWorkloadId"]
           });
         }
         if (value.targetAgentId) {
           ctx.addIssue({
-            code: import_zod50.z.ZodIssueCode.custom,
+            code: import_zod51.z.ZodIssueCode.custom,
             message: `targetAgentId must be omitted when targetKind is '${value.targetKind}'`,
             path: ["targetAgentId"]
           });
         }
         if (value.targetRevisionId) {
           ctx.addIssue({
-            code: import_zod50.z.ZodIssueCode.custom,
+            code: import_zod51.z.ZodIssueCode.custom,
             message: `targetRevisionId must be omitted when targetKind is '${value.targetKind}' (use payload.revisionSelector for inline_v2)`,
             path: ["targetRevisionId"]
           });
@@ -5949,7 +5956,7 @@ function refineTargetFields(schema) {
     const combo = `${value.targetKind}:${value.pilotApiVersionPreference}`;
     if (!ADMISSIBLE_TARGET_VERSION_COMBOS.includes(combo)) {
       ctx.addIssue({
-        code: import_zod50.z.ZodIssueCode.custom,
+        code: import_zod51.z.ZodIssueCode.custom,
         message: `Unsupported (targetKind, pilotApiVersionPreference) combination. Admissible: ${ADMISSIBLE_TARGET_VERSION_COMBOS.join(
           ", "
         )}`,
@@ -5959,7 +5966,7 @@ function refineTargetFields(schema) {
     const isInline = value.targetKind === "inline_v1" || value.targetKind === "inline_v2";
     if (!isInline && !value.projectId) {
       ctx.addIssue({
-        code: import_zod50.z.ZodIssueCode.custom,
+        code: import_zod51.z.ZodIssueCode.custom,
         message: `projectId is required when targetKind is '${value.targetKind}'`,
         path: ["projectId"]
       });
@@ -5968,7 +5975,7 @@ function refineTargetFields(schema) {
     const hasOwner = Boolean(value.ownerLdap && value.ownerLdap.length > 0);
     if (!hasProject && !hasOwner) {
       ctx.addIssue({
-        code: import_zod50.z.ZodIssueCode.custom,
+        code: import_zod51.z.ZodIssueCode.custom,
         message: "At least one of projectId / ownerLdap must be present (project-or-owner anchor)",
         path: ["ownerLdap"]
       });
@@ -5982,7 +5989,7 @@ function refineLifecycleWindow(schema) {
       const end = Date.parse(value.endAt);
       if (Number.isFinite(start) && Number.isFinite(end) && end <= start) {
         ctx.addIssue({
-          code: import_zod50.z.ZodIssueCode.custom,
+          code: import_zod51.z.ZodIssueCode.custom,
           message: "endAt must be strictly later than startAt",
           path: ["endAt"]
         });
@@ -5990,13 +5997,13 @@ function refineLifecycleWindow(schema) {
     }
   });
 }
-var CreateScheduleRequestBaseSchema = import_zod50.z.object({
+var CreateScheduleRequestBaseSchema = import_zod51.z.object({
   /**
    * Host project. Required for `targetKind ∈ {workload, agent}` (P0
    * shape); MAY be null for `inline_v1` / `inline_v2`. When null, the
    * `ownerLdap` field becomes the sole authorization anchor.
    */
-  projectId: import_zod50.z.string().uuid().nullable().optional(),
+  projectId: import_zod51.z.string().uuid().nullable().optional(),
   /**
    * LDAP of the schedule owner (P1.2). Distinct from the implicit
    * `createdBy` which is captured server-side from the auth context.
@@ -6004,20 +6011,20 @@ var CreateScheduleRequestBaseSchema = import_zod50.z.object({
    * authoritative for enforcing "createdBy === ownerLdap" on create
    * (delegation / ownership transfer is an explicit follow-up).
    */
-  ownerLdap: import_zod50.z.string().min(1).max(255).optional(),
-  displayName: import_zod50.z.string().min(1, "displayName must be non-empty").max(SCHEDULE_DISPLAY_NAME_MAX_LENGTH),
-  description: import_zod50.z.string().max(SCHEDULE_DESCRIPTION_MAX_LENGTH).optional(),
+  ownerLdap: import_zod51.z.string().min(1).max(255).optional(),
+  displayName: import_zod51.z.string().min(1, "displayName must be non-empty").max(SCHEDULE_DISPLAY_NAME_MAX_LENGTH),
+  description: import_zod51.z.string().max(SCHEDULE_DESCRIPTION_MAX_LENGTH).optional(),
   cronExpression: CronExpressionSchema,
   timezone: TimezoneStringSchema,
   targetKind: ScheduleTargetKindSchema,
-  targetWorkloadId: import_zod50.z.string().uuid().optional(),
-  targetRevisionId: import_zod50.z.string().uuid().optional(),
-  targetAgentId: import_zod50.z.string().uuid().optional(),
+  targetWorkloadId: import_zod51.z.string().uuid().optional(),
+  targetRevisionId: import_zod51.z.string().uuid().optional(),
+  targetAgentId: import_zod51.z.string().uuid().optional(),
   pilotApiVersionPreference: ScheduleApiVersionPreferenceSchema,
   concurrencyPolicy: ScheduleConcurrencyPolicySchema.default("allow"),
   misfirePolicy: ScheduleMisfirePolicySchema.default("skip"),
-  misfireGraceSeconds: import_zod50.z.number().int().min(SCHEDULE_MISFIRE_GRACE_SECONDS_MIN).max(SCHEDULE_MISFIRE_GRACE_SECONDS_MAX).default(SCHEDULE_MISFIRE_GRACE_SECONDS_DEFAULT),
-  consecutiveFailureThreshold: import_zod50.z.number().int().min(SCHEDULE_FAILURE_THRESHOLD_MIN).max(SCHEDULE_FAILURE_THRESHOLD_MAX).default(SCHEDULE_FAILURE_THRESHOLD_DEFAULT),
+  misfireGraceSeconds: import_zod51.z.number().int().min(SCHEDULE_MISFIRE_GRACE_SECONDS_MIN).max(SCHEDULE_MISFIRE_GRACE_SECONDS_MAX).default(SCHEDULE_MISFIRE_GRACE_SECONDS_DEFAULT),
+  consecutiveFailureThreshold: import_zod51.z.number().int().min(SCHEDULE_FAILURE_THRESHOLD_MIN).max(SCHEDULE_FAILURE_THRESHOLD_MAX).default(SCHEDULE_FAILURE_THRESHOLD_DEFAULT),
   startAt: IsoDatetimeSchema.optional(),
   endAt: IsoDatetimeSchema.optional(),
   /**
@@ -6048,7 +6055,7 @@ function refinePayload(schema) {
     if (!result.success) {
       for (const issue of result.error.issues) {
         ctx.addIssue({
-          code: import_zod50.z.ZodIssueCode.custom,
+          code: import_zod51.z.ZodIssueCode.custom,
           message: issue.message,
           path: ["payload", ...issue.path]
         });
@@ -6059,21 +6066,21 @@ function refinePayload(schema) {
 var CreateScheduleRequestSchema = refinePayload(
   refineLifecycleWindow(refineTargetFields(CreateScheduleRequestBaseSchema))
 );
-var UpdateScheduleRequestBaseSchema = import_zod50.z.object({
-  displayName: import_zod50.z.string().min(1).max(SCHEDULE_DISPLAY_NAME_MAX_LENGTH).optional(),
-  description: import_zod50.z.string().max(SCHEDULE_DESCRIPTION_MAX_LENGTH).nullable().optional(),
+var UpdateScheduleRequestBaseSchema = import_zod51.z.object({
+  displayName: import_zod51.z.string().min(1).max(SCHEDULE_DISPLAY_NAME_MAX_LENGTH).optional(),
+  description: import_zod51.z.string().max(SCHEDULE_DESCRIPTION_MAX_LENGTH).nullable().optional(),
   /**
    * Convenience field — `true` ⇒ lifecycle_status='active',
    * `false` ⇒ lifecycle_status='disabled'. Cannot reach `deleted`
    * via PATCH (use DELETE).
    */
-  enabled: import_zod50.z.boolean().optional(),
+  enabled: import_zod51.z.boolean().optional(),
   cronExpression: CronExpressionSchema.optional(),
   timezone: TimezoneStringSchema.optional(),
   concurrencyPolicy: ScheduleConcurrencyPolicySchema.optional(),
   misfirePolicy: ScheduleMisfirePolicySchema.optional(),
-  misfireGraceSeconds: import_zod50.z.number().int().min(SCHEDULE_MISFIRE_GRACE_SECONDS_MIN).max(SCHEDULE_MISFIRE_GRACE_SECONDS_MAX).optional(),
-  consecutiveFailureThreshold: import_zod50.z.number().int().min(SCHEDULE_FAILURE_THRESHOLD_MIN).max(SCHEDULE_FAILURE_THRESHOLD_MAX).optional(),
+  misfireGraceSeconds: import_zod51.z.number().int().min(SCHEDULE_MISFIRE_GRACE_SECONDS_MIN).max(SCHEDULE_MISFIRE_GRACE_SECONDS_MAX).optional(),
+  consecutiveFailureThreshold: import_zod51.z.number().int().min(SCHEDULE_FAILURE_THRESHOLD_MIN).max(SCHEDULE_FAILURE_THRESHOLD_MAX).optional(),
   endAt: IsoDatetimeSchema.nullable().optional(),
   /**
    * Replaces the entire dispatch payload. Null is forbidden — to
@@ -6088,41 +6095,41 @@ var UpdateScheduleRequestSchema = UpdateScheduleRequestBaseSchema.refine(
   (data) => Object.keys(data).length > 0,
   { message: "PATCH body must contain at least one field" }
 );
-var ScheduleViewBaseSchema = import_zod50.z.object({
-  id: import_zod50.z.string().uuid(),
+var ScheduleViewBaseSchema = import_zod51.z.object({
+  id: import_zod51.z.string().uuid(),
   /**
    * Nullable since P1.2 — only inline kinds may have null projectId in
    * persisted form; workload / agent kinds keep it set (enforced at
    * create time and by DB shape CHECK).
    */
-  projectId: import_zod50.z.string().uuid().nullable(),
+  projectId: import_zod51.z.string().uuid().nullable(),
   /**
    * Owner LDAP (P1.2). NOT NULL in DB; the read shape exposes it for
    * UI to render "owned by" labels and for permission checks on
    * project-less schedules.
    */
-  ownerLdap: import_zod50.z.string(),
-  displayName: import_zod50.z.string(),
-  description: import_zod50.z.string().nullable(),
-  cronExpression: import_zod50.z.string(),
-  timezone: import_zod50.z.string(),
+  ownerLdap: import_zod51.z.string(),
+  displayName: import_zod51.z.string(),
+  description: import_zod51.z.string().nullable(),
+  cronExpression: import_zod51.z.string(),
+  timezone: import_zod51.z.string(),
   targetKind: ScheduleTargetKindSchema,
-  targetWorkloadId: import_zod50.z.string().uuid().nullable(),
-  targetRevisionId: import_zod50.z.string().uuid().nullable(),
-  targetAgentId: import_zod50.z.string().uuid().nullable(),
+  targetWorkloadId: import_zod51.z.string().uuid().nullable(),
+  targetRevisionId: import_zod51.z.string().uuid().nullable(),
+  targetAgentId: import_zod51.z.string().uuid().nullable(),
   pilotApiVersionPreference: ScheduleApiVersionPreferenceSchema,
   lifecycleStatus: ScheduleLifecycleStatusSchema,
   concurrencyPolicy: ScheduleConcurrencyPolicySchema,
   misfirePolicy: ScheduleMisfirePolicySchema,
-  misfireGraceSeconds: import_zod50.z.number().int().nonnegative(),
+  misfireGraceSeconds: import_zod51.z.number().int().nonnegative(),
   startAt: IsoDatetimeSchema.nullable(),
   endAt: IsoDatetimeSchema.nullable(),
   payload: RawPayloadSchema,
-  consecutiveFailureCount: import_zod50.z.number().int().nonnegative(),
-  consecutiveFailureThreshold: import_zod50.z.number().int().positive(),
+  consecutiveFailureCount: import_zod51.z.number().int().nonnegative(),
+  consecutiveFailureThreshold: import_zod51.z.number().int().positive(),
   lastTriggerAt: IsoDatetimeSchema.nullable(),
   nextFireAt: IsoDatetimeSchema.nullable(),
-  createdBy: import_zod50.z.string(),
+  createdBy: import_zod51.z.string(),
   createdAt: IsoDatetimeSchema,
   updatedAt: IsoDatetimeSchema,
   deletedAt: IsoDatetimeSchema.nullable()
@@ -6147,37 +6154,37 @@ var ScheduleListItemSchema = ScheduleViewBaseSchema.pick({
   createdAt: true,
   updatedAt: true
 });
-var ScheduleListResponseSchema = import_zod50.z.object({
-  items: import_zod50.z.array(ScheduleListItemSchema),
-  nextCursor: import_zod50.z.string().optional()
+var ScheduleListResponseSchema = import_zod51.z.object({
+  items: import_zod51.z.array(ScheduleListItemSchema),
+  nextCursor: import_zod51.z.string().optional()
 });
-var ScheduleTriggerViewSchema = import_zod50.z.object({
-  id: import_zod50.z.string().uuid(),
-  scheduleId: import_zod50.z.string().uuid(),
+var ScheduleTriggerViewSchema = import_zod51.z.object({
+  id: import_zod51.z.string().uuid(),
+  scheduleId: import_zod51.z.string().uuid(),
   firedAt: IsoDatetimeSchema,
   triggerSource: ScheduleTriggerSourceSchema,
   status: ScheduleTriggerStatusSchema,
   dispatchedAt: IsoDatetimeSchema.nullable(),
-  dispatchedRunId: import_zod50.z.string().uuid().nullable(),
-  dispatchedSessionId: import_zod50.z.string().uuid().nullable(),
+  dispatchedRunId: import_zod51.z.string().uuid().nullable(),
+  dispatchedSessionId: import_zod51.z.string().uuid().nullable(),
   /**
    * Owning agent of the dispatched Run / Session, when one exists.
    * Run IDs join `runs.id`; Session IDs join `runs.session_id` with a
    * cold-start legacy fallback to the matching run ID.
    */
-  dispatchedAgentId: import_zod50.z.string().uuid().nullable(),
+  dispatchedAgentId: import_zod51.z.string().uuid().nullable(),
   skippedReason: ScheduleSkippedReasonSchema.nullable(),
   failureReasonCode: ScheduleFailureReasonCodeSchema.nullable(),
-  failureReasonMessage: import_zod50.z.string().max(SCHEDULE_FAILURE_REASON_MESSAGE_MAX_LENGTH).nullable(),
-  idempotencyKey: import_zod50.z.string(),
-  attemptCount: import_zod50.z.number().int().nonnegative(),
-  blockingTriggerId: import_zod50.z.string().uuid().nullable(),
+  failureReasonMessage: import_zod51.z.string().max(SCHEDULE_FAILURE_REASON_MESSAGE_MAX_LENGTH).nullable(),
+  idempotencyKey: import_zod51.z.string(),
+  attemptCount: import_zod51.z.number().int().nonnegative(),
+  blockingTriggerId: import_zod51.z.string().uuid().nullable(),
   createdAt: IsoDatetimeSchema
 }).superRefine((trigger, ctx) => {
   if (trigger.status === "dispatched") {
     if (!trigger.dispatchedAt) {
       ctx.addIssue({
-        code: import_zod50.z.ZodIssueCode.custom,
+        code: import_zod51.z.ZodIssueCode.custom,
         message: "dispatchedAt is required when status is 'dispatched'",
         path: ["dispatchedAt"]
       });
@@ -6186,7 +6193,7 @@ var ScheduleTriggerViewSchema = import_zod50.z.object({
     const hasSession = trigger.dispatchedSessionId !== null;
     if (hasRun === hasSession) {
       ctx.addIssue({
-        code: import_zod50.z.ZodIssueCode.custom,
+        code: import_zod51.z.ZodIssueCode.custom,
         message: "Exactly one of dispatchedRunId / dispatchedSessionId must be set when status is 'dispatched'",
         path: ["dispatchedRunId"]
       });
@@ -6194,7 +6201,7 @@ var ScheduleTriggerViewSchema = import_zod50.z.object({
   } else {
     if (trigger.dispatchedAt !== null) {
       ctx.addIssue({
-        code: import_zod50.z.ZodIssueCode.custom,
+        code: import_zod51.z.ZodIssueCode.custom,
         message: "dispatchedAt must be null when status is not 'dispatched'",
         path: ["dispatchedAt"]
       });
@@ -6202,74 +6209,74 @@ var ScheduleTriggerViewSchema = import_zod50.z.object({
   }
   if (trigger.status === "skipped" && trigger.skippedReason === null) {
     ctx.addIssue({
-      code: import_zod50.z.ZodIssueCode.custom,
+      code: import_zod51.z.ZodIssueCode.custom,
       message: "skippedReason is required when status is 'skipped'",
       path: ["skippedReason"]
     });
   }
   if (trigger.status !== "skipped" && trigger.skippedReason !== null) {
     ctx.addIssue({
-      code: import_zod50.z.ZodIssueCode.custom,
+      code: import_zod51.z.ZodIssueCode.custom,
       message: "skippedReason must be null when status is not 'skipped'",
       path: ["skippedReason"]
     });
   }
   if (trigger.status === "failed_to_dispatch" && trigger.failureReasonCode === null) {
     ctx.addIssue({
-      code: import_zod50.z.ZodIssueCode.custom,
+      code: import_zod51.z.ZodIssueCode.custom,
       message: "failureReasonCode is required when status is 'failed_to_dispatch'",
       path: ["failureReasonCode"]
     });
   }
   if (trigger.status !== "failed_to_dispatch" && trigger.failureReasonCode !== null) {
     ctx.addIssue({
-      code: import_zod50.z.ZodIssueCode.custom,
+      code: import_zod51.z.ZodIssueCode.custom,
       message: "failureReasonCode must be null when status is not 'failed_to_dispatch'",
       path: ["failureReasonCode"]
     });
   }
   if (trigger.blockingTriggerId !== null && !(trigger.status === "skipped" && trigger.skippedReason === "concurrency_forbidden")) {
     ctx.addIssue({
-      code: import_zod50.z.ZodIssueCode.custom,
+      code: import_zod51.z.ZodIssueCode.custom,
       message: "blockingTriggerId is only meaningful for skipped+concurrency_forbidden rows",
       path: ["blockingTriggerId"]
     });
   }
 });
-var ScheduleTriggerListResponseSchema = import_zod50.z.object({
-  items: import_zod50.z.array(ScheduleTriggerViewSchema),
-  nextCursor: import_zod50.z.string().optional()
+var ScheduleTriggerListResponseSchema = import_zod51.z.object({
+  items: import_zod51.z.array(ScheduleTriggerViewSchema),
+  nextCursor: import_zod51.z.string().optional()
 });
-var RunScheduleResponseSchema = import_zod50.z.object({
-  triggerId: import_zod50.z.string().uuid(),
-  dispatchedRunId: import_zod50.z.string().uuid().optional(),
-  dispatchedSessionId: import_zod50.z.string().uuid().optional()
+var RunScheduleResponseSchema = import_zod51.z.object({
+  triggerId: import_zod51.z.string().uuid(),
+  dispatchedRunId: import_zod51.z.string().uuid().optional(),
+  dispatchedSessionId: import_zod51.z.string().uuid().optional()
 }).superRefine((value, ctx) => {
   const hasRun = value.dispatchedRunId !== void 0;
   const hasSession = value.dispatchedSessionId !== void 0;
   if (hasRun === hasSession) {
     ctx.addIssue({
-      code: import_zod50.z.ZodIssueCode.custom,
+      code: import_zod51.z.ZodIssueCode.custom,
       message: "Exactly one of dispatchedRunId / dispatchedSessionId must be present in run-now response"
     });
   }
 });
-var ScheduleApiErrorBodySchema = import_zod50.z.object({
-  error: import_zod50.z.object({
+var ScheduleApiErrorBodySchema = import_zod51.z.object({
+  error: import_zod51.z.object({
     code: ScheduleApiErrorCodeSchema,
-    message: import_zod50.z.string(),
-    details: import_zod50.z.record(import_zod50.z.string(), import_zod50.z.unknown()).optional()
+    message: import_zod51.z.string(),
+    details: import_zod51.z.record(import_zod51.z.string(), import_zod51.z.unknown()).optional()
   })
 });
-var EnvChangeFanoutJobSchema = import_zod51.z.object({
-  environmentId: import_zod51.z.string().uuid(),
-  projectId: import_zod51.z.string().uuid(),
-  trigger: import_zod51.z.enum(["env_change", "rebake"]).default("env_change")
+var EnvChangeFanoutJobSchema = import_zod52.z.object({
+  environmentId: import_zod52.z.string().uuid(),
+  projectId: import_zod52.z.string().uuid(),
+  trigger: import_zod52.z.enum(["env_change", "rebake"]).default("env_change")
 }).strict();
-var EnvironmentReleasePropagationJobSchema = import_zod51.z.object({
-  environmentId: import_zod51.z.string().uuid(),
+var EnvironmentReleasePropagationJobSchema = import_zod52.z.object({
+  environmentId: import_zod52.z.string().uuid(),
   /** Released base template name (patch source + mirror-refresh pairing key). */
-  baseTemplateName: import_zod51.z.string().min(1),
+  baseTemplateName: import_zod52.z.string().min(1),
   /**
    * Release identity (E-DEC6): the `platform_release` version's idempotency
    * key — a redelivered job never creates a duplicate version (template
@@ -6277,46 +6284,46 @@ var EnvironmentReleasePropagationJobSchema = import_zod51.z.object({
    * deploy-window compatibility with in-flight pre-E-DEC6 jobs; the worker
    * falls back to `legacy:<baseTemplateName>`.
    */
-  releaseRef: import_zod51.z.string().min(1).optional()
+  releaseRef: import_zod52.z.string().min(1).optional()
 }).strict();
-var EnvironmentPackagesBuildJobSchema = import_zod51.z.object({
-  environmentId: import_zod51.z.string().uuid(),
+var EnvironmentPackagesBuildJobSchema = import_zod52.z.object({
+  environmentId: import_zod52.z.string().uuid(),
   /**
    * The building version. Its predecessor (version - 1, or none when this
    * is v1) is the CAS `fromVersion` of the deferred second-phase repoint
    * (PKG-D3) — versions are strictly monotonic (+1 under the env row
    * lock), so it is derived, not carried.
    */
-  version: import_zod51.z.number().int().positive(),
+  version: import_zod52.z.number().int().positive(),
   /** Who initiated the edit (repoint ledger actor on the second phase). */
-  actor: import_zod51.z.string().nullable(),
+  actor: import_zod52.z.string().nullable(),
   /**
    * ENV-V5 flag captured at the edit: false = advanced create-only path —
    * the second phase skips the repoint even after a successful build.
    */
-  repointReferences: import_zod51.z.boolean().default(true),
+  repointReferences: import_zod52.z.boolean().default(true),
   /**
    * Ledger source of the second-phase repoint: user_edit for interactive
    * edits, platform_release for the PKG-D7 rebake pipeline.
    */
-  repointSource: import_zod51.z.enum(["user_edit", "platform_release"]).default("user_edit"),
+  repointSource: import_zod52.z.enum(["user_edit", "platform_release"]).default("user_edit"),
   /** trigger = generate+start the build; poll = check build status. */
-  phase: import_zod51.z.enum(["trigger", "poll"]).default("trigger")
+  phase: import_zod52.z.enum(["trigger", "poll"]).default("trigger")
 }).strict();
-var EnvironmentDeleteCleanupJobSchema = import_zod51.z.object({
-  projectId: import_zod51.z.string().uuid(),
-  environmentId: import_zod51.z.string().uuid(),
+var EnvironmentDeleteCleanupJobSchema = import_zod52.z.object({
+  projectId: import_zod52.z.string().uuid(),
+  environmentId: import_zod52.z.string().uuid(),
   /** Archived Dockerfile paths captured from `environment_versions` right before the delete. */
-  dockerfilePaths: import_zod51.z.array(import_zod51.z.string().min(1)).min(1)
+  dockerfilePaths: import_zod52.z.array(import_zod52.z.string().min(1)).min(1)
 }).strict();
-var EnvironmentStatusSchema = import_zod51.z.enum(["active", "archived"]);
-var EnvironmentVersionSourceSchema = import_zod51.z.enum([
+var EnvironmentStatusSchema = import_zod52.z.enum(["active", "archived"]);
+var EnvironmentVersionSourceSchema = import_zod52.z.enum([
   "user_edit",
   "platform_release",
   "seed",
   "backfill"
 ]);
-var EnvironmentRepointSourceSchema = import_zod51.z.enum([
+var EnvironmentRepointSourceSchema = import_zod52.z.enum([
   "user_edit",
   "platform_release",
   "stage_binding",
@@ -6325,9 +6332,9 @@ var EnvironmentRepointSourceSchema = import_zod51.z.enum([
 ]);
 var ENVIRONMENT_CPU_QUANTITY_RE = /^\d+(\.\d+)?m?$/;
 var ENVIRONMENT_MEMORY_QUANTITY_RE = /^\d+(\.\d+)?(Ki|Mi|Gi|Ti|K|M|G|T)$/;
-var EnvironmentResourcesSchema = import_zod51.z.object({
-  cpu: import_zod51.z.string().regex(ENVIRONMENT_CPU_QUANTITY_RE, 'cpu must be a K8s quantity like "2", "0.5" or "500m"'),
-  memory: import_zod51.z.string().regex(ENVIRONMENT_MEMORY_QUANTITY_RE, 'memory must be a K8s quantity like "4Gi" or "512Mi"')
+var EnvironmentResourcesSchema = import_zod52.z.object({
+  cpu: import_zod52.z.string().regex(ENVIRONMENT_CPU_QUANTITY_RE, 'cpu must be a K8s quantity like "2", "0.5" or "500m"'),
+  memory: import_zod52.z.string().regex(ENVIRONMENT_MEMORY_QUANTITY_RE, 'memory must be a K8s quantity like "4Gi" or "512Mi"')
 }).strict();
 var RESERVED_ENVIRONMENT_ENV_PREFIXES = [
   "POD_AGENT_",
@@ -6363,14 +6370,14 @@ function findReservedEnvironmentEnvKey(envVars) {
   return null;
 }
 var ENVIRONMENT_ENV_VAR_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var EnvironmentEnvVarsSchema = import_zod51.z.record(
-  import_zod51.z.string().regex(ENVIRONMENT_ENV_VAR_KEY_RE, "env var keys must match [A-Za-z_][A-Za-z0-9_]*"),
-  import_zod51.z.string().max(4e3)
+var EnvironmentEnvVarsSchema = import_zod52.z.record(
+  import_zod52.z.string().regex(ENVIRONMENT_ENV_VAR_KEY_RE, "env var keys must match [A-Za-z_][A-Za-z0-9_]*"),
+  import_zod52.z.string().max(4e3)
 ).superRefine((envVars, ctx) => {
   const reserved = findReservedEnvironmentEnvKey(envVars);
   if (reserved) {
     ctx.addIssue({
-      code: import_zod51.z.ZodIssueCode.custom,
+      code: import_zod52.z.ZodIssueCode.custom,
       path: [reserved],
       // `params.pilotPolicyCode` is LOAD-BEARING: `classifyEnvironmentInputIssues`
       // (below) reads it so the four environment routes (agent-hub +
@@ -6387,14 +6394,14 @@ var EnvironmentEnvVarsSchema = import_zod51.z.record(
     });
   }
 });
-var EnvironmentDefaultTtlSecondsSchema = import_zod51.z.number().int().positive().max(30 * 24 * 60 * 60);
+var EnvironmentDefaultTtlSecondsSchema = import_zod52.z.number().int().positive().max(30 * 24 * 60 * 60);
 var ENVIRONMENT_PACKAGE_ENTRY_PATTERN = /^[A-Za-z0-9@_][A-Za-z0-9@._/:+,[\]<>=!~^*-]*$/;
-var EnvironmentPackageEntrySchema = import_zod51.z.string().min(1).max(128).regex(
+var EnvironmentPackageEntrySchema = import_zod52.z.string().min(1).max(128).regex(
   ENVIRONMENT_PACKAGE_ENTRY_PATTERN,
   "package entries must not contain whitespace or shell metacharacters (PKG-D1)"
 );
-var environmentPackageListSchema = import_zod51.z.array(EnvironmentPackageEntrySchema).max(64);
-var EnvironmentPackagesSchema = import_zod51.z.object({
+var environmentPackageListSchema = import_zod52.z.array(EnvironmentPackageEntrySchema).max(64);
+var EnvironmentPackagesSchema = import_zod52.z.object({
   pip: environmentPackageListSchema.optional(),
   npm: environmentPackageListSchema.optional(),
   apt: environmentPackageListSchema.optional(),
@@ -6407,7 +6414,7 @@ function normalizeEnvironmentPackages(value) {
   const entries = Object.entries(value).filter(([, list]) => list !== void 0 && list.length > 0);
   return entries.length > 0 ? Object.fromEntries(entries) : null;
 }
-var EnvironmentConfigSchema = import_zod51.z.object({
+var EnvironmentConfigSchema = import_zod52.z.object({
   // PKG-D1 shape + PKG-D2 gate: malformed packages → 400 here; a VALID
   // non-null value still 422s via findUnsupportedEnvironmentConfigField
   // until the P2.1-A2 pipeline PR flips the gate. Tightening from
@@ -6417,7 +6424,7 @@ var EnvironmentConfigSchema = import_zod51.z.object({
   // drops the optional mark) — `.optional()` restores the v3 inference so
   // callers can construct partial configs; runtime behavior is unchanged.
   packages: EnvironmentPackagesSchema.nullish().transform(normalizeEnvironmentPackages).optional(),
-  networking: import_zod51.z.unknown().nullish(),
+  networking: import_zod52.z.unknown().nullish(),
   resources: EnvironmentResourcesSchema.nullish(),
   // Normalize an empty `{}` to `null` (E-DEC4 null-representation LOCK — the
   // pool-fingerprint hash must not see `{}` vs `null` as different). Preserve
@@ -6428,72 +6435,72 @@ var EnvironmentConfigSchema = import_zod51.z.object({
   ).optional(),
   defaultTtlSeconds: EnvironmentDefaultTtlSecondsSchema.nullish()
 }).strict();
-var EnvironmentVersionConfigSchema = import_zod51.z.object({
-  provider: import_zod51.z.string(),
-  providerPoolName: import_zod51.z.string().nullish(),
+var EnvironmentVersionConfigSchema = import_zod52.z.object({
+  provider: import_zod52.z.string(),
+  providerPoolName: import_zod52.z.string().nullish(),
   /** Base identity at version creation (null = the row itself is a base). */
-  baseProviderTemplateName: import_zod51.z.string().nullish(),
-  resources: import_zod51.z.object({ cpu: import_zod51.z.string(), memory: import_zod51.z.string() }).nullish(),
+  baseProviderTemplateName: import_zod52.z.string().nullish(),
+  resources: import_zod52.z.object({ cpu: import_zod52.z.string(), memory: import_zod52.z.string() }).nullish(),
   /** RAW record — no reserved-key refinement on the frozen read path. */
-  envVars: import_zod51.z.record(import_zod51.z.string(), import_zod51.z.string()).nullish(),
-  defaultTtlSeconds: import_zod51.z.number().int().nullish(),
-  packages: import_zod51.z.unknown().nullish(),
-  networking: import_zod51.z.unknown().nullish()
+  envVars: import_zod52.z.record(import_zod52.z.string(), import_zod52.z.string()).nullish(),
+  defaultTtlSeconds: import_zod52.z.number().int().nullish(),
+  packages: import_zod52.z.unknown().nullish(),
+  networking: import_zod52.z.unknown().nullish()
 }).passthrough();
-var EnvironmentVersionMaterializationStatusSchema = import_zod51.z.enum([
+var EnvironmentVersionMaterializationStatusSchema = import_zod52.z.enum([
   "building",
   "ready",
   "failed",
   "superseded"
 ]);
-var EnvironmentVersionSchema = import_zod51.z.object({
-  environmentId: import_zod51.z.string().uuid(),
-  version: import_zod51.z.number().int().positive(),
+var EnvironmentVersionSchema = import_zod52.z.object({
+  environmentId: import_zod52.z.string().uuid(),
+  version: import_zod52.z.number().int().positive(),
   config: EnvironmentVersionConfigSchema,
   source: EnvironmentVersionSourceSchema,
   /** Idempotency ref for machine producers (platform_release); null otherwise. */
-  sourceRef: import_zod51.z.string().nullable(),
-  createdBy: import_zod51.z.string().nullable(),
-  createdAt: import_zod51.z.coerce.date(),
-  providerTemplateName: import_zod51.z.string().nullable(),
+  sourceRef: import_zod52.z.string().nullable(),
+  createdBy: import_zod52.z.string().nullable(),
+  createdAt: import_zod52.z.coerce.date(),
+  providerTemplateName: import_zod52.z.string().nullable(),
   /** null = pre-E-DEC7 version (ready semantics). */
   materializationStatus: EnvironmentVersionMaterializationStatusSchema.nullable(),
   /** Failure reason for the UI (PKG-D4); null unless failed. */
-  materializationDetail: import_zod51.z.string().nullable(),
+  materializationDetail: import_zod52.z.string().nullable(),
   /** Baked image ref (repository:tag@digest) once built (PKG-D6/D9). */
-  imageRef: import_zod51.z.string().nullable(),
+  imageRef: import_zod52.z.string().nullable(),
   /** Generated Dockerfile archived verbatim (PKG-D9, audit-only). */
-  dockerfile: import_zod51.z.string().nullable()
+  dockerfile: import_zod52.z.string().nullable()
 }).strict();
-var EnvironmentRepointRecordSchema = import_zod51.z.object({
-  id: import_zod51.z.string().uuid(),
-  environmentId: import_zod51.z.string().uuid(),
-  workloadId: import_zod51.z.string().uuid(),
-  workloadStageId: import_zod51.z.string().uuid(),
+var EnvironmentRepointRecordSchema = import_zod52.z.object({
+  id: import_zod52.z.string().uuid(),
+  environmentId: import_zod52.z.string().uuid(),
+  workloadId: import_zod52.z.string().uuid(),
+  workloadStageId: import_zod52.z.string().uuid(),
   stage: StageSchema,
   /** null = first pin (the slot had no pinned version yet). */
-  fromVersion: import_zod51.z.number().int().positive().nullable(),
-  toVersion: import_zod51.z.number().int().positive(),
+  fromVersion: import_zod52.z.number().int().positive().nullable(),
+  toVersion: import_zod52.z.number().int().positive(),
   source: EnvironmentRepointSourceSchema,
-  actor: import_zod51.z.string().nullable(),
-  createdAt: import_zod51.z.coerce.date()
+  actor: import_zod52.z.string().nullable(),
+  createdAt: import_zod52.z.coerce.date()
 }).strict();
-var EnvironmentReferenceSchema = import_zod51.z.object({
-  workloadId: import_zod51.z.string().uuid(),
-  workloadSlug: import_zod51.z.string(),
+var EnvironmentReferenceSchema = import_zod52.z.object({
+  workloadId: import_zod52.z.string().uuid(),
+  workloadSlug: import_zod52.z.string(),
   stage: StageSchema,
   /**
    * Pinned environment version of this slot (ENV-V2). null = legacy pin
    * written before the version line landed (deploy window) — resolution
    * falls back to the tip version for those.
    */
-  environmentVersion: import_zod51.z.number().int().positive().nullable()
+  environmentVersion: import_zod52.z.number().int().positive().nullable()
 }).strict();
-var EnvironmentSchema = import_zod51.z.object({
-  id: import_zod51.z.string().uuid(),
-  projectId: import_zod51.z.string().uuid(),
-  name: import_zod51.z.string().min(1).max(255),
-  description: import_zod51.z.string().nullish(),
+var EnvironmentSchema = import_zod52.z.object({
+  id: import_zod52.z.string().uuid(),
+  projectId: import_zod52.z.string().uuid(),
+  name: import_zod52.z.string().min(1).max(255),
+  description: import_zod52.z.string().nullish(),
   status: EnvironmentStatusSchema,
   config: EnvironmentConfigSchema,
   /**
@@ -6502,19 +6509,19 @@ var EnvironmentSchema = import_zod51.z.object({
    * `providerTemplateName` verbatim (no dedicated Kanyun template until the
    * config first diverges, E5/P2.1).
    */
-  base: import_zod51.z.object({ platformTemplateName: import_zod51.z.string() }).strict(),
-  referencedBy: import_zod51.z.array(EnvironmentReferenceSchema),
+  base: import_zod52.z.object({ platformTemplateName: import_zod52.z.string() }).strict(),
+  referencedBy: import_zod52.z.array(EnvironmentReferenceSchema),
   /** Platform-shared environments are project-agnostic and admin-managed. */
-  isPlatformShared: import_zod51.z.boolean(),
+  isPlatformShared: import_zod52.z.boolean(),
   /**
    * Tip of the version line (E-DEC6): the latest immutable version number.
    * The row's config columns always mirror this version. null only for
    * legacy rows created by pre-E-DEC6 writers during the deploy window
    * (their first config write creates v1).
    */
-  currentVersion: import_zod51.z.number().int().positive().nullable(),
-  createdAt: import_zod51.z.coerce.date(),
-  updatedAt: import_zod51.z.coerce.date()
+  currentVersion: import_zod52.z.number().int().positive().nullable(),
+  createdAt: import_zod52.z.coerce.date(),
+  updatedAt: import_zod52.z.coerce.date()
 }).strict();
 function findUnsupportedEnvironmentConfigField(config) {
   if (!config) return null;
@@ -6525,7 +6532,7 @@ function rejectReservedConfigFields(config, ctx) {
   const field = findUnsupportedEnvironmentConfigField(config);
   if (field) {
     ctx.addIssue({
-      code: import_zod51.z.ZodIssueCode.custom,
+      code: import_zod52.z.ZodIssueCode.custom,
       path: ["config", field],
       // `params.pilotPolicyCode` is what `classifyEnvironmentInputIssues` keys
       // on (structural, spoof-proof) — see the env-var superRefine above.
@@ -6534,16 +6541,16 @@ function rejectReservedConfigFields(config, ctx) {
     });
   }
 }
-var CreateEnvironmentInputSchema = import_zod51.z.object({
-  name: import_zod51.z.string().min(1).max(255),
-  description: import_zod51.z.string().max(4e3).optional(),
-  base: import_zod51.z.object({ platformTemplateName: import_zod51.z.string().min(1) }).strict(),
+var CreateEnvironmentInputSchema = import_zod52.z.object({
+  name: import_zod52.z.string().min(1).max(255),
+  description: import_zod52.z.string().max(4e3).optional(),
+  base: import_zod52.z.object({ platformTemplateName: import_zod52.z.string().min(1) }).strict(),
   config: EnvironmentConfigSchema.optional()
 }).strict().superRefine((input, ctx) => rejectReservedConfigFields(input.config, ctx));
-var UpdateEnvironmentInputSchema = import_zod51.z.object({
-  name: import_zod51.z.string().min(1).max(255).optional(),
+var UpdateEnvironmentInputSchema = import_zod52.z.object({
+  name: import_zod52.z.string().min(1).max(255).optional(),
   /** `null` clears the description; omitted keeps the stored value. */
-  description: import_zod51.z.string().max(4e3).nullish(),
+  description: import_zod52.z.string().max(4e3).nullish(),
   config: EnvironmentConfigSchema.optional(),
   /**
    * ENV-V5: a config-face change creates a new immutable version. Default
@@ -6553,11 +6560,11 @@ var UpdateEnvironmentInputSchema = import_zod51.z.object({
    * dial slots individually via the repoint endpoint (canary/rollback).
    * Ignored for metadata-only writes (name/description never version).
    */
-  repointReferences: import_zod51.z.boolean().optional()
+  repointReferences: import_zod52.z.boolean().optional()
 }).strict().superRefine((input, ctx) => rejectReservedConfigFields(input.config, ctx));
-var RepointEnvironmentInputSchema = import_zod51.z.object({
-  toVersion: import_zod51.z.number().int().positive(),
-  slots: import_zod51.z.array(import_zod51.z.object({ workloadId: import_zod51.z.string().uuid(), stage: StageSchema }).strict()).min(1).optional(),
+var RepointEnvironmentInputSchema = import_zod52.z.object({
+  toVersion: import_zod52.z.number().int().positive(),
+  slots: import_zod52.z.array(import_zod52.z.object({ workloadId: import_zod52.z.string().uuid(), stage: StageSchema }).strict()).min(1).optional(),
   /**
    * TOCTOU guard (codex #7 residual, §4 impact-confirmation dialog): the
    * FULL `(workloadId, stage)` set the caller observed as "affected" when
@@ -6574,7 +6581,7 @@ var RepointEnvironmentInputSchema = import_zod51.z.object({
    * (backward compatible: platform/manifest callers that don't render a
    * confirmation dialog are unaffected).
    */
-  expectedSlots: import_zod51.z.array(import_zod51.z.object({ workloadId: import_zod51.z.string().uuid(), stage: StageSchema }).strict()).optional()
+  expectedSlots: import_zod52.z.array(import_zod52.z.object({ workloadId: import_zod52.z.string().uuid(), stage: StageSchema }).strict()).optional()
 }).strict();
 var WORKER_PROTOCOL_TERMINAL_EVENT_TYPES = [
   "worker_protocol.prompt.completed",
@@ -6589,13 +6596,13 @@ var LEAK_RECONCILER_INTERVAL_MS = 30 * 60 * 1e3;
 var SESSION_STARTUP_LEASE_MS = 10 * 6e4;
 var INSTRUCTIONS_JOIN_SEPARATOR = "\n\n";
 var MANAGED_AGENT_PROFILE_KIND = "ManagedAgentProfile";
-var ManagedAgentProfileMetadataSchema = import_zod52.z.object({
+var ManagedAgentProfileMetadataSchema = import_zod53.z.object({
   name: WorkloadManifestNameSchema,
   displayName: WorkloadManifestDisplayNameSchema,
-  labels: import_zod52.z.record(import_zod52.z.string(), import_zod52.z.string()).optional(),
-  annotations: import_zod52.z.record(import_zod52.z.string(), import_zod52.z.string()).optional()
+  labels: import_zod53.z.record(import_zod53.z.string(), import_zod53.z.string()).optional(),
+  annotations: import_zod53.z.record(import_zod53.z.string(), import_zod53.z.string()).optional()
 }).strict();
-var ManagedAgentProfileSpecSchema = import_zod52.z.object({
+var ManagedAgentProfileSpecSchema = import_zod53.z.object({
   runtimeTemplateRef: WorkloadManifestObjectRefSchema,
   env: SessionConfigValuesSchema.optional(),
   ui: WorkloadManifestUiHintSchema.optional(),
@@ -6617,7 +6624,7 @@ var ManagedAgentProfileSpecSchema = import_zod52.z.object({
   // `agents.enabled_skills` at agent creation when the caller omits
   // skills. See `specs/features/pilot-v2-managed-agent-profile.md`
   // §"Phase C".
-  skills: import_zod52.z.array(import_zod52.z.string().min(1)).optional(),
+  skills: import_zod53.z.array(import_zod53.z.string().min(1)).optional(),
   // Phase C2/C3 (🟡): workload-level default MCP servers as friendly rush
   // MCP ids (e.g. `github`). Projected to
   // `manifest.spec.defaults.enabledMcpServers` as `EnabledMcpRef[]`. At
@@ -6627,7 +6634,7 @@ var ManagedAgentProfileSpecSchema = import_zod52.z.object({
   // user at bootstrap (C3). Seeded into `agents.enabled_mcp_servers` at
   // agent creation when the caller omits MCP servers. See
   // `specs/features/pilot-v2-managed-agent-profile.md` §"Phase C".
-  mcpServers: import_zod52.z.array(import_zod52.z.string().min(1)).optional(),
+  mcpServers: import_zod53.z.array(import_zod53.z.string().min(1)).optional(),
   // Phase D: workload-level default system prompt. Projected to
   // `manifest.spec.defaults.systemPrompt`, seeded onto
   // `agents.system_prompt` at agent creation, and forwarded per-run as
@@ -6641,14 +6648,14 @@ var ManagedAgentProfileSpecSchema = import_zod52.z.object({
   resources: SessionResourcesSchema.optional(),
   agentPackage: AgentPackageSchema.optional()
 }).strict();
-var ManagedAgentProfileSchema = import_zod52.z.object({
+var ManagedAgentProfileSchema = import_zod53.z.object({
   apiVersion: PilotWorkloadManifestApiVersionSchema,
-  kind: import_zod52.z.literal(MANAGED_AGENT_PROFILE_KIND),
+  kind: import_zod53.z.literal(MANAGED_AGENT_PROFILE_KIND),
   metadata: ManagedAgentProfileMetadataSchema,
   spec: ManagedAgentProfileSpecSchema
 }).strict();
 var MANAGED_AGENT_PROFILE_V1_API_VERSION = "pilot.zhenguanyu.com/v1alpha1";
-var ManagedAgentProfileV1RuntimeSchema = import_zod52.z.object({
+var ManagedAgentProfileV1RuntimeSchema = import_zod53.z.object({
   templateRef: WorkloadManifestObjectRefSchema.optional(),
   environmentRef: WorkloadManifestObjectRefSchema.optional(),
   env: SessionConfigValuesSchema.optional(),
@@ -6662,65 +6669,65 @@ var ManagedAgentProfileV1RuntimeSchema = import_zod52.z.object({
 }).strict().superRefine((runtime, ctx) => {
   if (!runtime.templateRef && !runtime.environmentRef) {
     ctx.addIssue({
-      code: import_zod52.z.ZodIssueCode.custom,
+      code: import_zod53.z.ZodIssueCode.custom,
       path: ["templateRef"],
       message: "runtime group requires exactly one of `templateRef` / `environmentRef`"
     });
   }
   if (runtime.templateRef && runtime.environmentRef) {
     ctx.addIssue({
-      code: import_zod52.z.ZodIssueCode.custom,
+      code: import_zod53.z.ZodIssueCode.custom,
       path: ["environmentRef"],
       message: "runtime.environmentRef is mutually exclusive with runtime.templateRef"
     });
   }
 });
-var ManagedAgentProfileV1ModelSchema = import_zod52.z.object({
+var ManagedAgentProfileV1ModelSchema = import_zod53.z.object({
   primary: WorkloadManifestModelSchema.optional(),
   providerRef: LlmProviderConfigPublicIdSchema.optional()
 }).strict().refine((model) => model.primary !== void 0 || model.providerRef !== void 0, {
   message: "model group requires at least one of `primary` / `providerRef`"
 });
-var ManagedAgentProfileV1InstructionItemSchema = import_zod52.z.object({
+var ManagedAgentProfileV1InstructionItemSchema = import_zod53.z.object({
   inline: WorkloadManifestSystemPromptSchema
 }).strict();
-var ManagedAgentProfileV1InstructionsSchema = import_zod52.z.union([
+var ManagedAgentProfileV1InstructionsSchema = import_zod53.z.union([
   WorkloadManifestSystemPromptSchema,
-  import_zod52.z.array(ManagedAgentProfileV1InstructionItemSchema).min(1).superRefine((blocks, ctx) => {
+  import_zod53.z.array(ManagedAgentProfileV1InstructionItemSchema).min(1).superRefine((blocks, ctx) => {
     const joinedLength = blocks.reduce((sum, b) => sum + b.inline.length, 0) + INSTRUCTIONS_JOIN_SEPARATOR.length * Math.max(0, blocks.length - 1);
     if (joinedLength > WORKLOAD_MANIFEST_SYSTEM_PROMPT_MAX_LENGTH) {
       ctx.addIssue({
-        code: import_zod52.z.ZodIssueCode.custom,
+        code: import_zod53.z.ZodIssueCode.custom,
         message: `joined instructions length ${joinedLength} exceeds the ${WORKLOAD_MANIFEST_SYSTEM_PROMPT_MAX_LENGTH} system-prompt limit`
       });
     }
   })
 ]);
-var ManagedAgentProfileV1SkillRefSchema = import_zod52.z.object({
-  source: import_zod52.z.literal("ref"),
-  name: import_zod52.z.string().min(1)
+var ManagedAgentProfileV1SkillRefSchema = import_zod53.z.object({
+  source: import_zod53.z.literal("ref"),
+  name: import_zod53.z.string().min(1)
 }).strict();
-var ManagedAgentProfileV1SkillInlineSchema = import_zod52.z.object({
-  source: import_zod52.z.literal("inline"),
+var ManagedAgentProfileV1SkillInlineSchema = import_zod53.z.object({
+  source: import_zod53.z.literal("inline"),
   /** Skill file path inside the package, e.g. `SKILL.md`. */
-  path: import_zod52.z.string().min(1),
-  content: import_zod52.z.string().min(1)
+  path: import_zod53.z.string().min(1),
+  content: import_zod53.z.string().min(1)
 }).strict();
-var ManagedAgentProfileV1SkillSchema = import_zod52.z.discriminatedUnion("source", [
+var ManagedAgentProfileV1SkillSchema = import_zod53.z.discriminatedUnion("source", [
   ManagedAgentProfileV1SkillRefSchema,
   ManagedAgentProfileV1SkillInlineSchema
 ]);
-var ManagedAgentProfileV1McpRefSchema = import_zod52.z.object({
-  source: import_zod52.z.literal("ref"),
-  rushMcpId: import_zod52.z.string().min(1)
+var ManagedAgentProfileV1McpRefSchema = import_zod53.z.object({
+  source: import_zod53.z.literal("ref"),
+  rushMcpId: import_zod53.z.string().min(1)
 }).strict();
-var ManagedAgentProfileV1CapabilitiesSchema = import_zod52.z.object({
-  skills: import_zod52.z.array(ManagedAgentProfileV1SkillSchema).optional(),
-  mcpServers: import_zod52.z.array(ManagedAgentProfileV1McpRefSchema).optional()
+var ManagedAgentProfileV1CapabilitiesSchema = import_zod53.z.object({
+  skills: import_zod53.z.array(ManagedAgentProfileV1SkillSchema).optional(),
+  mcpServers: import_zod53.z.array(ManagedAgentProfileV1McpRefSchema).optional()
 }).strict();
-var ManagedAgentProfileV1EvalsSchema = import_zod52.z.object({
-  suiteRef: import_zod52.z.object({
-    name: import_zod52.z.string().min(1)
+var ManagedAgentProfileV1EvalsSchema = import_zod53.z.object({
+  suiteRef: import_zod53.z.object({
+    name: import_zod53.z.string().min(1)
   }).strict()
 }).strict();
 var MANAGED_AGENT_PROFILE_V1_KNOWN_SPEC_KEYS = [
@@ -6771,7 +6778,7 @@ function validateXExtensionValueShape(value) {
   return "x-* value must be a scalar or a one-level object of scalars";
 }
 var ManagedAgentProfileV1MemorySchema = WorkloadManifestMemorySchema;
-var ManagedAgentProfileV1SpecSchema = import_zod52.z.object({
+var ManagedAgentProfileV1SpecSchema = import_zod53.z.object({
   runtime: ManagedAgentProfileV1RuntimeSchema,
   model: ManagedAgentProfileV1ModelSchema.optional(),
   instructions: ManagedAgentProfileV1InstructionsSchema.optional(),
@@ -6795,7 +6802,7 @@ var ManagedAgentProfileV1SpecSchema = import_zod52.z.object({
   var _a, _b, _c, _d;
   if (((_b = (_a = spec.vaultMcpBindings) == null ? void 0 : _a.length) != null ? _b : 0) > 0 && ((_d = (_c = spec.managedMcpBindings) == null ? void 0 : _c.length) != null ? _d : 0) > 0) {
     ctx.addIssue({
-      code: import_zod52.z.ZodIssueCode.custom,
+      code: import_zod53.z.ZodIssueCode.custom,
       path: ["managedMcpBindings"],
       message: "managedMcpBindings and vaultMcpBindings are mutually exclusive (#1469 D2) \u2014 declare only one binding granularity"
     });
@@ -6807,7 +6814,7 @@ var ManagedAgentProfileV1SpecSchema = import_zod52.z.object({
     if (known.has(key)) continue;
     if (!X_EXTENSION_KEY_PATTERN.test(key)) {
       ctx.addIssue({
-        code: import_zod52.z.ZodIssueCode.custom,
+        code: import_zod53.z.ZodIssueCode.custom,
         path: [key],
         message: `unknown key "${key}" \u2014 spec only allows known capability groups or x-* extension keys`
       });
@@ -6817,34 +6824,34 @@ var ManagedAgentProfileV1SpecSchema = import_zod52.z.object({
     const value = spec[key];
     const shapeError = validateXExtensionValueShape(value);
     if (shapeError) {
-      ctx.addIssue({ code: import_zod52.z.ZodIssueCode.custom, path: [key], message: shapeError });
+      ctx.addIssue({ code: import_zod53.z.ZodIssueCode.custom, path: [key], message: shapeError });
       continue;
     }
     xTotalBytes += utf8ByteLength(JSON.stringify(value));
   }
   if (xKeyCount > X_EXTENSION_MAX_KEYS) {
     ctx.addIssue({
-      code: import_zod52.z.ZodIssueCode.custom,
+      code: import_zod53.z.ZodIssueCode.custom,
       path: [],
       message: `too many x-* extension keys (${xKeyCount} > ${X_EXTENSION_MAX_KEYS})`
     });
   }
   if (xTotalBytes > X_EXTENSION_MAX_TOTAL_BYTES) {
     ctx.addIssue({
-      code: import_zod52.z.ZodIssueCode.custom,
+      code: import_zod53.z.ZodIssueCode.custom,
       path: [],
       message: `x-* extension total size ${xTotalBytes} bytes exceeds ${X_EXTENSION_MAX_TOTAL_BYTES}`
     });
   }
 });
-var ManagedAgentProfileV1Schema = import_zod52.z.object({
-  apiVersion: import_zod52.z.literal(MANAGED_AGENT_PROFILE_V1_API_VERSION),
-  kind: import_zod52.z.literal(MANAGED_AGENT_PROFILE_KIND),
+var ManagedAgentProfileV1Schema = import_zod53.z.object({
+  apiVersion: import_zod53.z.literal(MANAGED_AGENT_PROFILE_V1_API_VERSION),
+  kind: import_zod53.z.literal(MANAGED_AGENT_PROFILE_KIND),
   metadata: ManagedAgentProfileMetadataSchema,
   spec: ManagedAgentProfileV1SpecSchema
 }).strict();
-var CanaryArmSchema = import_zod53.z.enum(["stable", "canary"]);
-var CanaryDecisionReasonSchema = import_zod53.z.enum([
+var CanaryArmSchema = import_zod54.z.enum(["stable", "canary"]);
+var CanaryDecisionReasonSchema = import_zod54.z.enum([
   "kill_switch",
   "fail_safe",
   "pool_exempt",
@@ -6855,25 +6862,25 @@ var CanaryDecisionReasonSchema = import_zod53.z.enum([
   "percentage_miss",
   "pool_canary"
 ]);
-var StageCanaryStateSchema = import_zod53.z.object({
+var StageCanaryStateSchema = import_zod54.z.object({
   /** 灰度 revision。与主指针同 workload（跨 workload 引用在写路径被拒）。 */
-  revisionId: import_zod53.z.string().uuid(),
+  revisionId: import_zod54.z.string().uuid(),
   /**
    * 灰度百分比 0..99。100 不是灰度态（那是 promote）；0 = 冻结观察态：
    * hash 全 miss，仅名单命中仍走 canary 臂。
    */
-  percentage: import_zod53.z.number().int().min(0).max(99),
+  percentage: import_zod54.z.number().int().min(0).max(99),
   /** ldap 精确匹配名单（命中优先于百分比）。缺省解析为 `[]`。 */
-  userAllowlist: import_zod53.z.array(import_zod53.z.string()).default([]),
+  userAllowlist: import_zod54.z.array(import_zod54.z.string()).default([]),
   /** 灰度开始时间（ISO）。`null` = 存量行无记录。 */
-  startedAt: import_zod53.z.string().nullable(),
+  startedAt: import_zod54.z.string().nullable(),
   /** 灰度发起人。`null` = 非请求上下文写入。 */
-  startedBy: import_zod53.z.string().nullable()
+  startedBy: import_zod54.z.string().nullable()
 }).strict();
-var StageSlotViewSchema = import_zod53.z.object({
+var StageSlotViewSchema = import_zod54.z.object({
   stage: StageSchema,
   /** 槽位当前指针；同 workload 的 revision（跨 workload 引用在写路径被拒）。 */
-  revisionId: import_zod53.z.string().uuid(),
+  revisionId: import_zod54.z.string().uuid(),
   /**
    * Stage-level runtime overrides layered on top of the revision snapshot
    * (top-level key replace, no deep merge — STG-R3). `null` → none stored.
@@ -6886,20 +6893,20 @@ var StageSlotViewSchema = import_zod53.z.object({
    * and re-running them on read could brick `GET /stages` for rows written
    * before a rule tightened.
    */
-  configValues: import_zod53.z.record(import_zod53.z.string(), import_zod53.z.string()).nullable(),
+  configValues: import_zod54.z.record(import_zod54.z.string(), import_zod54.z.string()).nullable(),
   /**
    * Environment binding（P2, spec §6.3）。`null` = 槽位以 revision 快照为
    * 基底（P1 行为）；非空 = 会话创建按 E-DEC2 字段组组合解析（PR-E3）。
    * P1 的 `z.null()` 锁死已按计划放开。
    */
-  environmentId: import_zod53.z.string().uuid().nullable(),
+  environmentId: import_zod54.z.string().uuid().nullable(),
   /**
    * Pinned environment version（E-DEC6 ENV-V2）：引用是 (environmentId,
    * environmentVersion) 对。`null` 且 environmentId 非空 = legacy 钉
    * （部署窗口写入，解析回退 tip）。Optional so existing fixtures that
    * predate this field keep parsing.
    */
-  environmentVersion: import_zod53.z.number().int().positive().nullable().optional(),
+  environmentVersion: import_zod54.z.number().int().positive().nullable().optional(),
   /**
    * Display name hydrated for an EXISTING `environmentId` reference
    * (UI-11). Deliberately independent of the environment-picker's active
@@ -6911,19 +6918,19 @@ var StageSlotViewSchema = import_zod53.z.object({
    * no longer exists (e.g. hard-deleted). Optional so existing fixtures
    * that predate this field keep parsing.
    */
-  environmentName: import_zod53.z.string().nullable().optional(),
+  environmentName: import_zod54.z.string().nullable().optional(),
   /**
    * 活跃灰度状态（#1214 canary rollout）。`null` = 无灰度（绝大多数槽位）。
    * 必填字段：read 端总是显式报告 null，而非靠省略表达「无灰度」。
    */
   canary: StageCanaryStateSchema.nullable(),
   /** ISO timestamp of the last pointer/overrides/config change (STG-D2 audit baseline). */
-  deployedAt: import_zod53.z.string(),
+  deployedAt: import_zod54.z.string(),
   /**
    * Actor of the last change. `null` only for rows created outside a
    * request context (e.g. the STG-M1 backfill migration).
    */
-  deployedBy: import_zod53.z.string().nullable(),
+  deployedBy: import_zod54.z.string().nullable(),
   /**
    * ISO timestamp of the slot row's last write — the UI-5 optimistic
    * concurrency token. Confirm dialogs MUST echo this back as
@@ -6931,10 +6938,10 @@ var StageSlotViewSchema = import_zod53.z.object({
    * (someone else wrote the slot in between) is a 409 `STAGE_CONFLICT` that
    * requires re-fetching the preview. Never null — the row always has one.
    */
-  updatedAt: import_zod53.z.string()
+  updatedAt: import_zod54.z.string()
 }).strict();
-var ListStagesResponseSchema = import_zod53.z.object({
-  stages: import_zod53.z.array(StageSlotViewSchema)
+var ListStagesResponseSchema = import_zod54.z.object({
+  stages: import_zod54.z.array(StageSlotViewSchema)
 }).strict();
 function findFrozenStagePutField(rawBody) {
   if (typeof rawBody !== "object" || rawBody === null) return null;
@@ -6959,9 +6966,9 @@ function parsePutStageRequest(rawBody) {
   }
   return { ok: true, data: parsed.data };
 }
-var PutStageRequestSchema = import_zod53.z.object({
+var PutStageRequestSchema = import_zod54.z.object({
   /** 必填：槽位指针。MUST 属于路径上的 workload（服务层校验跨 workload 引用）。 */
-  revisionId: import_zod53.z.string().uuid(),
+  revisionId: import_zod54.z.string().uuid(),
   /**
    * Stage-level runtime overrides. Reuses the shipped revision overrides
    * contract (`pilot-v2-workload-manifest.ts`) — same shape, same
@@ -6985,7 +6992,7 @@ var PutStageRequestSchema = import_zod53.z.object({
    * 回退 revision 快照基底；UUID = 绑定该 environment（服务层校验存在 /
    * 同 project 或平台共享 / 未 archived）。
    */
-  environmentId: import_zod53.z.string().uuid().nullable().optional(),
+  environmentId: import_zod54.z.string().uuid().nullable().optional(),
   /**
    * UI-5 乐观并发 token（可选）。语义：
    *
@@ -6996,12 +7003,12 @@ var PutStageRequestSchema = import_zod53.z.object({
    *
    * 任一期望落空 → 409 `STAGE_CONFLICT`，须重新拉取预览。
    */
-  expectedUpdatedAt: import_zod53.z.string().datetime().nullable().optional()
+  expectedUpdatedAt: import_zod54.z.string().datetime().nullable().optional()
 }).strict().superRefine((input, ctx) => {
   for (const field of ["runtimeOverrides", "configValues"]) {
     if (input[field] != null) {
       ctx.addIssue({
-        code: import_zod53.z.ZodIssueCode.custom,
+        code: import_zod54.z.ZodIssueCode.custom,
         path: [field],
         // `params.pilotPolicyCode` is LOAD-BEARING: `classifyStageInputIssues`
         // (above) keys on it so the stage PUT routes map this rejection to
@@ -7014,17 +7021,17 @@ var PutStageRequestSchema = import_zod53.z.object({
   }
 });
 var PutStageResponseSchema = StageSlotViewSchema;
-var PromoteRequestSchema = import_zod53.z.object({
-  expectedUpdatedAt: import_zod53.z.string().datetime().nullable().optional(),
+var PromoteRequestSchema = import_zod54.z.object({
+  expectedUpdatedAt: import_zod54.z.string().datetime().nullable().optional(),
   /**
    * Environment binding for the production slot（P2 §6.3）：omitted = 保留
    * production 槽位现值；`null` = 清引用；UUID = 绑定（同 PUT 语义）。
    */
-  environmentId: import_zod53.z.string().uuid().nullable().optional(),
+  environmentId: import_zod54.z.string().uuid().nullable().optional(),
   /** 弹窗快照的 test 槽位 revision（预览与确认针对的对象）。 */
-  sourceRevisionId: import_zod53.z.string().uuid().optional(),
+  sourceRevisionId: import_zod54.z.string().uuid().optional(),
   /** 弹窗快照的 test 槽位 `updatedAt`（`StageSlotView.updatedAt` 原样回传）。 */
-  expectedTestUpdatedAt: import_zod53.z.string().datetime().optional(),
+  expectedTestUpdatedAt: import_zod54.z.string().datetime().optional(),
   /**
    * 人工 override pipeline 门禁（§5.6 / §5.1 per-agent 判据）：门禁开启
    * （`promote_gate_enabled`）时，被晋级的 revision 所属 agent 在其挂过的
@@ -7033,120 +7040,120 @@ var PromoteRequestSchema = import_zod53.z.object({
    * `PIPELINE_GATE_NOT_PASSED` 拒；带 override（必须给出 `reason`）可显式
    * 放行并落审计。门禁关闭时忽略。
    */
-  override: import_zod53.z.object({ reason: import_zod53.z.string().min(1) }).strict().optional()
+  override: import_zod54.z.object({ reason: import_zod54.z.string().min(1) }).strict().optional()
 }).strict();
-var PromoteResponseSchema = import_zod53.z.object({
+var PromoteResponseSchema = import_zod54.z.object({
   /** production 槽位晋级后的视图。 */
   production: StageSlotViewSchema,
   /** 晋级前 production 指针；production 槽位此前不存在时为 `null`。 */
-  fromRevisionId: import_zod53.z.string().uuid().nullable(),
+  fromRevisionId: import_zod54.z.string().uuid().nullable(),
   /** = 事务读取时 test 槽位所指 revision。 */
-  toRevisionId: import_zod53.z.string().uuid()
+  toRevisionId: import_zod54.z.string().uuid()
 }).strict();
-var PreviewStageResolutionRequestSchema = import_zod53.z.object({
+var PreviewStageResolutionRequestSchema = import_zod54.z.object({
   /** 预览基底 revision。MUST 属于路径上的 workload（跨 workload 拒绝）。 */
-  revisionId: import_zod53.z.string().uuid(),
+  revisionId: import_zod54.z.string().uuid(),
   /** 槽位 runtime overrides（顶层键整体替换，STG-R3）。`null`/omitted = 无叠加。 */
   runtimeOverrides: RevisionRuntimeEnvironmentOverridesSchema.nullable().optional(),
   /** 槽位 config values（key 级整体替换，叠加到 revision 级之上）。 */
-  configValues: import_zod53.z.record(import_zod53.z.string(), import_zod53.z.string()).nullable().optional(),
+  configValues: import_zod54.z.record(import_zod54.z.string(), import_zod54.z.string()).nullable().optional(),
   /**
    * Environment binding to preview（P2 §6.3 / E-DEC2）。`null`/omitted =
    * revision 快照基底；UUID = 按字段组组合预览（可引用性同写路径校验）。
    */
-  environmentId: import_zod53.z.string().uuid().nullable().optional()
+  environmentId: import_zod54.z.string().uuid().nullable().optional()
 }).strict();
-var PreviewStageResolutionResponseSchema = import_zod53.z.object({
+var PreviewStageResolutionResponseSchema = import_zod54.z.object({
   /** revision 快照 ⊕ environment 字段组 ⊕ overrides（E-DEC2）后的最终 runtime 配置。 */
   runtimeSnapshot: RuntimeTemplateSnapshotSchema,
   /** revision 级 configValues + 槽位 configValues 合并结果（revision < slot）。 */
-  configValues: import_zod53.z.record(import_zod53.z.string(), import_zod53.z.string()),
+  configValues: import_zod54.z.record(import_zod54.z.string(), import_zod54.z.string()),
   /** 解析基底来源（§6.3）：绑定 environment 时 = "environment"。 */
-  base: import_zod53.z.enum(["revision_snapshot", "environment"]),
+  base: import_zod54.z.enum(["revision_snapshot", "environment"]),
   /** 基底环境摘要（UI-5 展示；base = "environment" 时非 null）。 */
-  environment: import_zod53.z.object({ id: import_zod53.z.string().uuid(), name: import_zod53.z.string(), updatedAt: import_zod53.z.string() }).strict().nullable()
+  environment: import_zod54.z.object({ id: import_zod54.z.string().uuid(), name: import_zod54.z.string(), updatedAt: import_zod54.z.string() }).strict().nullable()
 }).strict();
-var StartCanaryRequestSchema = import_zod53.z.object({
+var StartCanaryRequestSchema = import_zod54.z.object({
   /** 灰度 revision。MUST 属于路径上的 workload；= 主指针时 422 `CANARY_SAME_REVISION`。 */
-  revisionId: import_zod53.z.string().uuid(),
+  revisionId: import_zod54.z.string().uuid(),
   /** 0..99（100 = promote，走 promote 端点；0 = 冻结观察，仅名单命中）。 */
-  percentage: import_zod53.z.number().int().min(0).max(99),
+  percentage: import_zod54.z.number().int().min(0).max(99),
   /** ldap 精确匹配名单（≤200 条，条目非空）。 */
-  userAllowlist: import_zod53.z.array(import_zod53.z.string().min(1)).max(200).optional(),
-  expectedUpdatedAt: import_zod53.z.string().nullable().optional()
+  userAllowlist: import_zod54.z.array(import_zod54.z.string().min(1)).max(200).optional(),
+  expectedUpdatedAt: import_zod54.z.string().nullable().optional()
 }).strict();
-var CanaryPromoteRequestSchema = import_zod53.z.object({
-  expectedUpdatedAt: import_zod53.z.string().nullable().optional()
+var CanaryPromoteRequestSchema = import_zod54.z.object({
+  expectedUpdatedAt: import_zod54.z.string().nullable().optional()
 }).strict();
 var CanaryAbortRequestSchema = CanaryPromoteRequestSchema;
-var RolloutEventActionSchema = import_zod53.z.enum([
+var RolloutEventActionSchema = import_zod54.z.enum([
   "start",
   "adjust",
   "promote",
   "abort",
   "cascade_abort"
 ]);
-var CanaryArmSessionMetricsSchema = import_zod53.z.object({
-  total: import_zod53.z.number().int().min(0),
-  ready: import_zod53.z.number().int().min(0),
-  failed: import_zod53.z.number().int().min(0),
-  terminated: import_zod53.z.number().int().min(0)
-}).strict();
-var CanaryRolloutTimelineEntrySchema = import_zod53.z.object({
-  id: import_zod53.z.string().uuid(),
+var CanaryArmSessionMetricsSchema = import_zod54.z.object({
+  total: import_zod54.z.number().int().min(0),
+  ready: import_zod54.z.number().int().min(0),
+  failed: import_zod54.z.number().int().min(0),
+  terminated: import_zod54.z.number().int().min(0)
+}).strict();
+var CanaryRolloutTimelineEntrySchema = import_zod54.z.object({
+  id: import_zod54.z.string().uuid(),
   action: RolloutEventActionSchema,
-  fromPercentage: import_zod53.z.number().int().nullable(),
-  toPercentage: import_zod53.z.number().int().nullable(),
+  fromPercentage: import_zod54.z.number().int().nullable(),
+  toPercentage: import_zod54.z.number().int().nullable(),
   /** to 侧 canary revision 短名（join revisions 解析）；无 to 臂 / 解析不到为 null。 */
-  toRevisionLabel: import_zod53.z.string().nullable(),
-  actor: import_zod53.z.string().nullable(),
-  createdAt: import_zod53.z.string()
+  toRevisionLabel: import_zod54.z.string().nullable(),
+  actor: import_zod54.z.string().nullable(),
+  createdAt: import_zod54.z.string()
 }).strict();
-var CanaryObservationSchema = import_zod53.z.object({
+var CanaryObservationSchema = import_zod54.z.object({
   /** 活跃灰度状态快照（与 `StageSlotView.canary` 同 shape）。 */
   canary: StageCanaryStateSchema,
   /**
    * 会话聚合窗口起点 = 本轮灰度 `startedAt`（CNR-D3 生命周期基线，adjust
    * 不重置）；存量行无记录时为 null（退化为全量打标行聚合）。
    */
-  observedSince: import_zod53.z.string().nullable(),
+  observedSince: import_zod54.z.string().nullable(),
   /**
    * 两臂对比。聚合口径：`canary_arm` 非 NULL 的会话（含池补给
    * pool_exempt / pool_canary 打标行——池行 provisioning 失败同样是臂
    * 健康信号；决策 reason 明细在会话 `metadata.canaryDecision`，不进聚合）。
    */
-  arms: import_zod53.z.object({
+  arms: import_zod54.z.object({
     stable: CanaryArmSessionMetricsSchema,
     canary: CanaryArmSessionMetricsSchema
   }).strict(),
   /** rollout 账表时间线，`createdAt` 降序，最多 `CANARY_OBSERVATION_TIMELINE_LIMIT` 条。 */
-  timeline: import_zod53.z.array(CanaryRolloutTimelineEntrySchema)
+  timeline: import_zod54.z.array(CanaryRolloutTimelineEntrySchema)
 }).strict();
-var ProfileNameSchema = import_zod54.z.string().regex(
+var ProfileNameSchema = import_zod55.z.string().regex(
   /^@[a-z0-9-]{1,40}\/[a-z0-9-]{1,60}$/,
   "Profile name must be a scoped lowercase slug like @scope/name"
 );
-var SemverSchema = import_zod54.z.string().regex(
+var SemverSchema = import_zod55.z.string().regex(
   /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/,
   "Version must be semver major.minor.patch (no leading zeros; pre-release segments non-empty)"
 );
-var ProfileSchemaVersionSchema = import_zod54.z.string().regex(
+var ProfileSchemaVersionSchema = import_zod55.z.string().regex(
   /^[a-z0-9]([a-z0-9.-]*[a-z0-9])?\/v\d+[a-z0-9]*$/,
   "schemaVersion must be a k8s-style apiVersion like pilot.zhenguanyu.com/v0alpha1"
 );
-var ProfileIntegritySchema = import_zod54.z.string().regex(
+var ProfileIntegritySchema = import_zod55.z.string().regex(
   /^sha256-[A-Za-z0-9+/]{43}=$/,
   "Integrity must be an SRI sha256-<base64> of a 32-byte digest"
 );
-var ProfileVersionStatusSchema = import_zod54.z.enum(["published", "yanked"]);
-var ProfileVisibilitySchema = import_zod54.z.enum(["public", "private"]);
-var ProfileLdapSchema = import_zod54.z.string().min(1).max(64);
-var WorkloadBindKindSchema = import_zod54.z.enum(["profile", "legacy_direct_bind"]);
-var WorkloadProfileRefSchema = import_zod54.z.object({
+var ProfileVersionStatusSchema = import_zod55.z.enum(["published", "yanked"]);
+var ProfileVisibilitySchema = import_zod55.z.enum(["public", "private"]);
+var ProfileLdapSchema = import_zod55.z.string().min(1).max(64);
+var WorkloadBindKindSchema = import_zod55.z.enum(["profile", "legacy_direct_bind"]);
+var WorkloadProfileRefSchema = import_zod55.z.object({
   bindKind: WorkloadBindKindSchema.default("profile"),
   profileName: ProfileNameSchema.optional(),
   resolvedVersion: SemverSchema.optional(),
-  resolvedAt: import_zod54.z.string().datetime().optional(),
+  resolvedAt: import_zod55.z.string().datetime().optional(),
   integrity: ProfileIntegritySchema.optional()
 }).strict().superRefine((ref, ctx) => {
   if (ref.bindKind === "profile") {
@@ -7154,7 +7161,7 @@ var WorkloadProfileRefSchema = import_zod54.z.object({
     for (const field of required) {
       if (ref[field] === void 0) {
         ctx.addIssue({
-          code: import_zod54.z.ZodIssueCode.custom,
+          code: import_zod55.z.ZodIssueCode.custom,
           path: [field],
           message: `profile bind requires ${field} for audit`
         });
@@ -7164,7 +7171,7 @@ var WorkloadProfileRefSchema = import_zod54.z.object({
     for (const field of ["profileName", "resolvedVersion", "resolvedAt", "integrity"]) {
       if (ref[field] !== void 0) {
         ctx.addIssue({
-          code: import_zod54.z.ZodIssueCode.custom,
+          code: import_zod55.z.ZodIssueCode.custom,
           path: [field],
           message: `legacy_direct_bind must not carry ${field}`
         });
@@ -7172,139 +7179,139 @@ var WorkloadProfileRefSchema = import_zod54.z.object({
     }
   }
 });
-var CreateProfileRequestSchema = import_zod54.z.object({
+var CreateProfileRequestSchema = import_zod55.z.object({
   name: ProfileNameSchema,
-  displayName: import_zod54.z.string().min(1).max(255),
-  description: import_zod54.z.string().max(4096).optional(),
+  displayName: import_zod55.z.string().min(1).max(255),
+  description: import_zod55.z.string().max(4096).optional(),
   visibility: ProfileVisibilitySchema.default("private"),
-  whitelistLdaps: import_zod54.z.array(ProfileLdapSchema).max(256).optional()
+  whitelistLdaps: import_zod55.z.array(ProfileLdapSchema).max(256).optional()
 }).strict();
-var SetVisibilityRequestSchema = import_zod54.z.object({
+var SetVisibilityRequestSchema = import_zod55.z.object({
   visibility: ProfileVisibilitySchema,
-  whitelistLdaps: import_zod54.z.array(ProfileLdapSchema).max(256).optional()
+  whitelistLdaps: import_zod55.z.array(ProfileLdapSchema).max(256).optional()
 }).strict();
-var PublishProfileVersionRequestSchema = import_zod54.z.object({
+var PublishProfileVersionRequestSchema = import_zod55.z.object({
   version: SemverSchema,
   schemaVersion: ProfileSchemaVersionSchema,
-  content: import_zod54.z.record(import_zod54.z.string(), import_zod54.z.unknown()),
+  content: import_zod55.z.record(import_zod55.z.string(), import_zod55.z.unknown()),
   integrity: ProfileIntegritySchema.optional()
 }).strict();
-var SetStableRequestSchema = import_zod54.z.object({
+var SetStableRequestSchema = import_zod55.z.object({
   version: SemverSchema
 }).strict();
-var YankVersionRequestSchema = import_zod54.z.object({
-  reason: import_zod54.z.string().max(1024).optional()
+var YankVersionRequestSchema = import_zod55.z.object({
+  reason: import_zod55.z.string().max(1024).optional()
 }).strict();
-var ResolveReasonSchema = import_zod54.z.enum(["stable", "pinned", "no_stable", "yanked", "not_found"]);
-var ResolveResultSchema = import_zod54.z.object({
+var ResolveReasonSchema = import_zod55.z.enum(["stable", "pinned", "no_stable", "yanked", "not_found"]);
+var ResolveResultSchema = import_zod55.z.object({
   profileName: ProfileNameSchema,
   requestedVersion: SemverSchema.nullable(),
   resolvedVersion: SemverSchema.nullable(),
   integrity: ProfileIntegritySchema.nullable(),
   reason: ResolveReasonSchema
 });
-var PlatformProjectSchema = import_zod55.z.object({
-  id: import_zod55.z.string().uuid(),
+var PlatformProjectSchema = import_zod56.z.object({
+  id: import_zod56.z.string().uuid(),
   slug: WorkloadManifestNameSchema,
   displayName: WorkloadManifestDisplayNameSchema,
-  description: import_zod55.z.string().nullable().optional(),
+  description: import_zod56.z.string().nullable().optional(),
   defaultRuntimeTemplateRefName: WorkloadManifestRefNameSchema.nullable().optional(),
-  createdAt: import_zod55.z.string().optional(),
-  updatedAt: import_zod55.z.string().optional()
+  createdAt: import_zod56.z.string().optional(),
+  updatedAt: import_zod56.z.string().optional()
 }).strict();
-var CreatePlatformProjectRequestSchema = import_zod55.z.object({
+var CreatePlatformProjectRequestSchema = import_zod56.z.object({
   slug: WorkloadManifestNameSchema,
   displayName: WorkloadManifestDisplayNameSchema,
-  description: import_zod55.z.string().max(2e3).optional(),
+  description: import_zod56.z.string().max(2e3).optional(),
   defaultRuntimeTemplateRefName: WorkloadManifestRefNameSchema.optional()
 }).strict();
-var ListPlatformProjectsResponseSchema = import_zod55.z.object({
-  projects: import_zod55.z.array(PlatformProjectSchema)
+var ListPlatformProjectsResponseSchema = import_zod56.z.object({
+  projects: import_zod56.z.array(PlatformProjectSchema)
 }).strict();
-var DeletePlatformProjectResponseSchema = import_zod55.z.object({
-  action: import_zod55.z.literal("deactivated"),
-  projectId: import_zod55.z.string().uuid()
+var DeletePlatformProjectResponseSchema = import_zod56.z.object({
+  action: import_zod56.z.literal("deactivated"),
+  projectId: import_zod56.z.string().uuid()
 }).strict();
-var PlatformWorkloadDefaultsSchema = import_zod55.z.object({
+var PlatformWorkloadDefaultsSchema = import_zod56.z.object({
   workerContract: WorkloadManifestWorkerContractDefaultsSchema.optional(),
   configValues: SessionConfigValuesSchema.optional(),
-  model: import_zod55.z.string().min(1).max(255).optional(),
-  systemPrompt: import_zod55.z.string().min(1).max(32768).optional(),
+  model: import_zod56.z.string().min(1).max(255).optional(),
+  systemPrompt: import_zod56.z.string().min(1).max(32768).optional(),
   enabledSkills: EnabledSkillEntryListSchema.optional(),
   enabledMcpServers: EnabledMcpEntryListSchema.optional(),
   agentOptions: AgentOptionsSchema.optional(),
   agentPackage: AgentPackageSchema.optional()
 }).strict();
-var CreatePlatformWorkloadRequestSchema = import_zod55.z.object({
-  projectId: import_zod55.z.string().uuid(),
+var CreatePlatformWorkloadRequestSchema = import_zod56.z.object({
+  projectId: import_zod56.z.string().uuid(),
   slug: WorkloadManifestNameSchema,
   displayName: WorkloadManifestDisplayNameSchema,
   kind: ActiveWorkloadKindSchema,
   defaults: PlatformWorkloadDefaultsSchema.optional(),
   ui: WorkloadManifestUiHintSchema.optional()
 }).strict();
-var PlatformWorkloadSchema = import_zod55.z.object({
-  id: import_zod55.z.string().uuid(),
-  projectId: import_zod55.z.string().uuid(),
+var PlatformWorkloadSchema = import_zod56.z.object({
+  id: import_zod56.z.string().uuid(),
+  projectId: import_zod56.z.string().uuid(),
   slug: WorkloadManifestNameSchema,
   displayName: WorkloadManifestDisplayNameSchema,
   kind: ActiveWorkloadKindSchema,
-  defaultRevisionId: import_zod55.z.string().uuid().nullable().optional(),
-  createdAt: import_zod55.z.string().optional(),
-  updatedAt: import_zod55.z.string().optional()
+  defaultRevisionId: import_zod56.z.string().uuid().nullable().optional(),
+  createdAt: import_zod56.z.string().optional(),
+  updatedAt: import_zod56.z.string().optional()
 }).strict();
-var PublishPlatformRevisionWorkerContractSchema = import_zod55.z.object({
+var PublishPlatformRevisionWorkerContractSchema = import_zod56.z.object({
   kind: ActiveWorkloadKindSchema,
   name: WorkloadManifestRefNameSchema.optional(),
-  version: import_zod55.z.string().min(1).max(100).optional()
+  version: import_zod56.z.string().min(1).max(100).optional()
 }).strict();
-var PublishPlatformRevisionRequestSchema = import_zod55.z.object({
-  projectId: import_zod55.z.string().uuid(),
+var PublishPlatformRevisionRequestSchema = import_zod56.z.object({
+  projectId: import_zod56.z.string().uuid(),
   workloadSlug: WorkloadManifestNameSchema,
   version: WorkloadManifestNameSchema,
   workerContract: PublishPlatformRevisionWorkerContractSchema,
-  setDefault: import_zod55.z.boolean().default(true),
-  startup: import_zod55.z.object({
-    requiredGates: import_zod55.z.array(import_zod55.z.string().min(1)).optional(),
-    optionalGates: import_zod55.z.array(import_zod55.z.string().min(1)).optional()
+  setDefault: import_zod56.z.boolean().default(true),
+  startup: import_zod56.z.object({
+    requiredGates: import_zod56.z.array(import_zod56.z.string().min(1)).optional(),
+    optionalGates: import_zod56.z.array(import_zod56.z.string().min(1)).optional()
   }).strict().optional(),
   configValues: SessionConfigValuesSchema.optional(),
   managedAgentProfileSnapshot: ManagedAgentProfileSnapshotSchema.optional(),
   runtime: RevisionRuntimeSchema.optional()
 }).strict();
-var PlatformRevisionSchema = import_zod55.z.object({
-  id: import_zod55.z.string().uuid(),
-  projectId: import_zod55.z.string().uuid(),
-  workloadId: import_zod55.z.string().uuid(),
+var PlatformRevisionSchema = import_zod56.z.object({
+  id: import_zod56.z.string().uuid(),
+  projectId: import_zod56.z.string().uuid(),
+  workloadId: import_zod56.z.string().uuid(),
   workloadSlug: WorkloadManifestNameSchema.optional(),
   version: WorkloadManifestNameSchema,
-  runtimeSnapshotHash: import_zod55.z.string().nullable().optional(),
-  createdAt: import_zod55.z.string().optional()
+  runtimeSnapshotHash: import_zod56.z.string().nullable().optional(),
+  createdAt: import_zod56.z.string().optional()
 }).strict();
 var GetPlatformWorkloadResponseSchema = PlatformWorkloadSchema.extend({
   kind: WorkloadKindSchema,
   defaultRevision: PlatformRevisionSchema.nullable()
 });
 var GetPlatformRevisionResponseSchema = PlatformRevisionSchema;
-var GetPlatformSessionResponseSchema = import_zod55.z.object({
-  id: import_zod55.z.string().uuid(),
-  projectId: import_zod55.z.string().uuid(),
-  workloadId: import_zod55.z.string().uuid(),
-  revisionId: import_zod55.z.string().uuid(),
+var GetPlatformSessionResponseSchema = import_zod56.z.object({
+  id: import_zod56.z.string().uuid(),
+  projectId: import_zod56.z.string().uuid(),
+  workloadId: import_zod56.z.string().uuid(),
+  revisionId: import_zod56.z.string().uuid(),
   status: SessionStatusSchema,
-  createdAt: import_zod55.z.string().optional(),
-  updatedAt: import_zod55.z.string().optional()
+  createdAt: import_zod56.z.string().optional(),
+  updatedAt: import_zod56.z.string().optional()
 }).strict();
 var CreatePlatformSessionRequestSchema = CreateSessionRequestSchema;
 var CreatePlatformSessionResponseSchema = CreateSessionResponseSchema;
-var ReleaseSandboxResponseSchema = import_zod55.z.object({
-  released: import_zod55.z.literal(true),
-  sandboxId: import_zod55.z.string().nullable(),
-  sandboxDestroyed: import_zod55.z.boolean(),
-  destroyError: import_zod55.z.string().optional()
+var ReleaseSandboxResponseSchema = import_zod56.z.object({
+  released: import_zod56.z.literal(true),
+  sandboxId: import_zod56.z.string().nullable(),
+  sandboxDestroyed: import_zod56.z.boolean(),
+  destroyError: import_zod56.z.string().optional()
 }).strict();
 var PlatformFileUploadResponseSchema = AttachmentMetaSchema.extend({
-  url: import_zod55.z.string()
+  url: import_zod56.z.string()
 });
 function platformWorkloadCreateToManifest(input) {
   const defaults = input.defaults ? omitUndefined(input.defaults) : void 0;
@@ -7339,29 +7346,29 @@ function platformRevisionPublishToManifest(input) {
     }), input.startup ? { startup: input.startup } : {}), input.configValues ? { configValues: input.configValues } : {}), input.managedAgentProfileSnapshot ? { managedAgentProfileSnapshot: input.managedAgentProfileSnapshot } : {})
   });
 }
-var SessionTurnRequestSchema = import_zod56.z.object({
-  text: import_zod56.z.string().min(1).max(5e4),
+var SessionTurnRequestSchema = import_zod57.z.object({
+  text: import_zod57.z.string().min(1).max(5e4),
   /**
    * Optional attachments uploaded via `POST /api/files/upload`. The Worker
    * Protocol envelope itself does not carry attachments, so the handler
    * splices the URLs into `promptText` as a trailing context block; the
    * worker (LLM) treats them as references it can fetch.
    */
-  attachments: import_zod56.z.array(AttachmentMetaSchema).max(20).optional()
+  attachments: import_zod57.z.array(AttachmentMetaSchema).max(20).optional()
 }).strict();
-var SessionTurnDispatchedResponseSchema = import_zod56.z.object({
-  success: import_zod56.z.literal(true),
-  data: import_zod56.z.object({ outcome: DispatchOutcomeSchema })
+var SessionTurnDispatchedResponseSchema = import_zod57.z.object({
+  success: import_zod57.z.literal(true),
+  data: import_zod57.z.object({ outcome: DispatchOutcomeSchema })
 });
-var SessionTurnRevivalResponseSchema = import_zod56.z.object({
-  success: import_zod56.z.literal(false),
-  revivalInProgress: import_zod56.z.literal(true),
-  sessionId: import_zod56.z.string(),
-  attemptId: import_zod56.z.string(),
-  alreadyReviving: import_zod56.z.boolean().optional(),
-  turnId: import_zod56.z.string().optional()
+var SessionTurnRevivalResponseSchema = import_zod57.z.object({
+  success: import_zod57.z.literal(false),
+  revivalInProgress: import_zod57.z.literal(true),
+  sessionId: import_zod57.z.string(),
+  attemptId: import_zod57.z.string(),
+  alreadyReviving: import_zod57.z.boolean().optional(),
+  turnId: import_zod57.z.string().optional()
 });
-var GatewayErrorCodeSchema = import_zod57.z.enum([
+var GatewayErrorCodeSchema = import_zod58.z.enum([
   "gateway_invalid_session_token",
   "gateway_session_not_found",
   "gateway_missing_mcp_target",
@@ -7404,7 +7411,7 @@ var GatewayErrorCodeSchema = import_zod57.z.enum([
   "gateway_request_too_large",
   "gateway_response_too_large"
 ]);
-var WebhookEventTypeSchema = import_zod58.z.enum([
+var WebhookEventTypeSchema = import_zod59.z.enum([
   /** v1/v2 Run reached terminal `completed`. */
   "run.completed",
   /** v1/v2 Run reached terminal `failed`. */
@@ -7437,43 +7444,43 @@ var WebhookEventTypeSchema = import_zod58.z.enum([
 ]);
 var WEBHOOK_EVENT_TYPES = WebhookEventTypeSchema.options;
 var MAX_WEBHOOK_EVENT_ID_LENGTH = 255;
-var WebhookEventPayloadSchema = import_zod58.z.object({
-  event_id: import_zod58.z.string().min(1).max(MAX_WEBHOOK_EVENT_ID_LENGTH),
+var WebhookEventPayloadSchema = import_zod59.z.object({
+  event_id: import_zod59.z.string().min(1).max(MAX_WEBHOOK_EVENT_ID_LENGTH),
   event_type: WebhookEventTypeSchema,
   /** ISO-8601 instant at which the transition was recorded. */
-  occurred_at: import_zod58.z.string(),
-  project_id: import_zod58.z.string().uuid(),
-  run_id: import_zod58.z.string().uuid().optional(),
-  agent_id: import_zod58.z.string().uuid().optional(),
-  session_id: import_zod58.z.string().uuid().optional(),
+  occurred_at: import_zod59.z.string(),
+  project_id: import_zod59.z.string().uuid(),
+  run_id: import_zod59.z.string().uuid().optional(),
+  agent_id: import_zod59.z.string().uuid().optional(),
+  session_id: import_zod59.z.string().uuid().optional(),
   /**
    * Worker turn id of a `turn.*` event, paired with `session_id`.
    * NOT a uuid: `deriveWorkerTurnId` yields a uuid-v5, but other
    * emitters use composite forms (`${kind}:${idempotencyKey}`), so the
    * wire type stays an opaque string.
    */
-  turn_id: import_zod58.z.string().min(1).optional(),
-  lifecycle_phase: import_zod58.z.enum(["idle", "terminating", "terminated"]).optional(),
-  lifecycle_transition_id: import_zod58.z.string().uuid().optional(),
-  idle_since: import_zod58.z.string().optional(),
-  grace_deadline: import_zod58.z.string().optional(),
-  reason: import_zod58.z.string().optional(),
-  terminate_deadline: import_zod58.z.string().optional()
-}).strict();
-var WebhookSubscriptionStatusSchema = import_zod58.z.enum(["active", "disabled"]);
-var CreateWebhookSubscriptionRequestSchema = import_zod58.z.object({
-  projectId: import_zod58.z.string().uuid(),
+  turn_id: import_zod59.z.string().min(1).optional(),
+  lifecycle_phase: import_zod59.z.enum(["idle", "terminating", "terminated"]).optional(),
+  lifecycle_transition_id: import_zod59.z.string().uuid().optional(),
+  idle_since: import_zod59.z.string().optional(),
+  grace_deadline: import_zod59.z.string().optional(),
+  reason: import_zod59.z.string().optional(),
+  terminate_deadline: import_zod59.z.string().optional()
+}).strict();
+var WebhookSubscriptionStatusSchema = import_zod59.z.enum(["active", "disabled"]);
+var CreateWebhookSubscriptionRequestSchema = import_zod59.z.object({
+  projectId: import_zod59.z.string().uuid(),
   /** Subscriber endpoint. https required outside dev; SSRF-validated. */
-  url: import_zod58.z.string().url().max(1024),
+  url: import_zod59.z.string().url().max(1024),
   /** Event types to deliver. At least one. */
-  events: import_zod58.z.array(WebhookEventTypeSchema).min(1).max(WEBHOOK_EVENT_TYPES.length),
+  events: import_zod59.z.array(WebhookEventTypeSchema).min(1).max(WEBHOOK_EVENT_TYPES.length),
   /** Optional operator note shown in list responses. */
-  description: import_zod58.z.string().max(512).optional()
+  description: import_zod59.z.string().max(512).optional()
 }).strict();
-var UpdateWebhookSubscriptionRequestSchema = import_zod58.z.object({
-  url: import_zod58.z.string().url().max(1024).optional(),
-  events: import_zod58.z.array(WebhookEventTypeSchema).min(1).max(WEBHOOK_EVENT_TYPES.length).optional(),
-  description: import_zod58.z.string().max(512).nullable().optional(),
+var UpdateWebhookSubscriptionRequestSchema = import_zod59.z.object({
+  url: import_zod59.z.string().url().max(1024).optional(),
+  events: import_zod59.z.array(WebhookEventTypeSchema).min(1).max(WEBHOOK_EVENT_TYPES.length).optional(),
+  description: import_zod59.z.string().max(512).nullable().optional(),
   /**
    * `active` re-enables a subscription that was auto-disabled after
    * consecutive failures (resets the failure counter); `disabled`
@@ -7484,23 +7491,23 @@ var UpdateWebhookSubscriptionRequestSchema = import_zod58.z.object({
   (data) => data.url !== void 0 || data.events !== void 0 || data.description !== void 0 || data.status !== void 0,
   { message: "At least one of url / events / description / status MUST be provided" }
 );
-var WebhookSubscriptionSchema = import_zod58.z.object({
-  id: import_zod58.z.string().uuid(),
-  projectId: import_zod58.z.string().uuid(),
-  url: import_zod58.z.string(),
-  events: import_zod58.z.array(WebhookEventTypeSchema),
-  description: import_zod58.z.string().nullable(),
+var WebhookSubscriptionSchema = import_zod59.z.object({
+  id: import_zod59.z.string().uuid(),
+  projectId: import_zod59.z.string().uuid(),
+  url: import_zod59.z.string(),
+  events: import_zod59.z.array(WebhookEventTypeSchema),
+  description: import_zod59.z.string().nullable(),
   status: WebhookSubscriptionStatusSchema,
-  consecutiveFailures: import_zod58.z.number().int().nonnegative(),
-  createdBy: import_zod58.z.string(),
-  createdAt: import_zod58.z.string(),
-  updatedAt: import_zod58.z.string()
+  consecutiveFailures: import_zod59.z.number().int().nonnegative(),
+  createdBy: import_zod59.z.string(),
+  createdAt: import_zod59.z.string(),
+  updatedAt: import_zod59.z.string()
 });
-var WebhookSubscriptionWithSecretSchema = import_zod58.z.object({
+var WebhookSubscriptionWithSecretSchema = import_zod59.z.object({
   subscription: WebhookSubscriptionSchema,
-  secret: import_zod58.z.string()
+  secret: import_zod59.z.string()
 });
-var WebhookSubscriptionErrorCodeSchema = import_zod58.z.enum([
+var WebhookSubscriptionErrorCodeSchema = import_zod59.z.enum([
   // 400
   "VALIDATION_ERROR",
   /** URL failed SSRF policy (non-https, private/loopback/link-local IP…). */
@@ -7513,117 +7520,125 @@ var WebhookSubscriptionErrorCodeSchema = import_zod58.z.enum([
   // 500
   "INTERNAL_ERROR"
 ]);
-var SessionPrewarmingIdentitySchema = import_zod59.z.object({
-  projectIdGenerator: import_zod59.z.literal("nanoid"),
-  claimNameTemplate: import_zod59.z.string().min(1),
-  idempotencyScopePrefix: import_zod59.z.string().min(1)
-}).strict();
-var SessionPrewarmingSessionTemplateSchema = import_zod59.z.object({
-  configValues: import_zod59.z.record(import_zod59.z.string(), import_zod59.z.string()),
-  metadata: import_zod59.z.record(import_zod59.z.string(), import_zod59.z.unknown()).optional()
-}).strict();
-var BusinessReadyProbeSchema = import_zod59.z.object({
-  endpointName: import_zod59.z.enum(["api", "preview"]),
-  path: import_zod59.z.string().min(1),
-  successCodes: import_zod59.z.array(import_zod59.z.number().int().min(100).max(599)).min(1),
-  timeoutMs: import_zod59.z.number().int().min(500).max(3e4)
-}).strict();
-var SessionPrewarmingSpecSchema = import_zod59.z.object({
-  targetReadyCount: import_zod59.z.number().int().min(1).max(50),
-  reVerifyIntervalSeconds: import_zod59.z.number().int().min(60).max(3600),
-  warmingTimeoutSeconds: import_zod59.z.number().int().min(60).max(600),
-  claimingLeaseTtlSeconds: import_zod59.z.number().int().min(10).max(120),
-  replenishIntervalSeconds: import_zod59.z.number().int().min(5).max(300),
-  maxConcurrentWarming: import_zod59.z.number().int().min(1).max(10),
+var SessionPrewarmingIdentitySchema = import_zod60.z.object({
+  projectIdGenerator: import_zod60.z.literal("nanoid"),
+  claimNameTemplate: import_zod60.z.string().min(1),
+  idempotencyScopePrefix: import_zod60.z.string().min(1)
+}).strict();
+var SessionPrewarmingSessionTemplateSchema = import_zod60.z.object({
+  configValues: import_zod60.z.record(import_zod60.z.string(), import_zod60.z.string()),
+  metadata: import_zod60.z.record(import_zod60.z.string(), import_zod60.z.unknown()).optional()
+}).strict();
+var BusinessReadyProbeSchema = import_zod60.z.object({
+  endpointName: import_zod60.z.enum(["api", "preview"]),
+  path: import_zod60.z.string().min(1),
+  successCodes: import_zod60.z.array(import_zod60.z.number().int().min(100).max(599)).min(1),
+  timeoutMs: import_zod60.z.number().int().min(500).max(3e4)
+}).strict();
+var SessionPrewarmingSpecSchema = import_zod60.z.object({
+  targetReadyCount: import_zod60.z.number().int().min(1).max(50),
+  reVerifyIntervalSeconds: import_zod60.z.number().int().min(60).max(3600),
+  warmingTimeoutSeconds: import_zod60.z.number().int().min(60).max(600),
+  claimingLeaseTtlSeconds: import_zod60.z.number().int().min(10).max(120),
+  replenishIntervalSeconds: import_zod60.z.number().int().min(5).max(300),
+  maxConcurrentWarming: import_zod60.z.number().int().min(1).max(10),
   identity: SessionPrewarmingIdentitySchema,
   sessionTemplate: SessionPrewarmingSessionTemplateSchema,
   businessReadyProbe: BusinessReadyProbeSchema.optional()
 }).strict();
-var AcquireSessionRequestSchema = import_zod59.z.object({
-  workloadId: import_zod59.z.string().uuid(),
-  clientMutationId: import_zod59.z.string().min(1).max(255)
-}).strict();
-var AcquireSessionResponseSchema = import_zod59.z.object({
-  leaseToken: import_zod59.z.string().min(1),
-  leaseExpiresAt: import_zod59.z.string().datetime(),
-  sessionId: import_zod59.z.string().uuid(),
-  projectId: import_zod59.z.string().min(1),
-  runtimeClaimName: import_zod59.z.string().min(1),
-  configValues: import_zod59.z.record(import_zod59.z.string(), import_zod59.z.string()),
+var AcquireSessionRequestSchema = import_zod60.z.object({
+  workloadId: import_zod60.z.string().uuid(),
+  clientMutationId: import_zod60.z.string().min(1).max(255)
+}).strict();
+var AcquireSessionResponseSchema = import_zod60.z.object({
+  leaseToken: import_zod60.z.string().min(1),
+  leaseExpiresAt: import_zod60.z.string().datetime(),
+  sessionId: import_zod60.z.string().uuid(),
+  projectId: import_zod60.z.string().min(1),
+  runtimeClaimName: import_zod60.z.string().min(1),
+  configValues: import_zod60.z.record(import_zod60.z.string(), import_zod60.z.string()),
   // Optional: outbox-protocol workloads (`managed_agent`) expose no public HTTP
   // endpoint, so a ready slot is claimable with no `apiUrl`. self_managed
   // (rush-app) slots always carry it. Omitted (not null) when absent — mirrors
   // `previewUrl`. See `pilot-v2-managed-agent-prewarming.md` § Readiness and
   // `SessionPoolService.buildAcquireResponse`.
-  apiUrl: import_zod59.z.string().url().optional(),
-  previewUrl: import_zod59.z.string().url().optional()
+  apiUrl: import_zod60.z.string().url().optional(),
+  previewUrl: import_zod60.z.string().url().optional()
 }).strict();
-var FinalizeAcquireRequestSchema = import_zod59.z.object({
-  leaseToken: import_zod59.z.string().min(1),
-  sessionId: import_zod59.z.string().uuid(),
-  clientMutationId: import_zod59.z.string().min(1).max(255).optional()
+var FinalizeAcquireRequestSchema = import_zod60.z.object({
+  leaseToken: import_zod60.z.string().min(1),
+  sessionId: import_zod60.z.string().uuid(),
+  clientMutationId: import_zod60.z.string().min(1).max(255).optional()
 }).strict();
-var AbortAcquireRequestSchema = import_zod59.z.object({
-  leaseToken: import_zod59.z.string().min(1),
-  sessionId: import_zod59.z.string().uuid()
+var AbortAcquireRequestSchema = import_zod60.z.object({
+  leaseToken: import_zod60.z.string().min(1),
+  sessionId: import_zod60.z.string().uuid()
 }).strict();
-var WorkloadLifecycleKindSchema = import_zod60.z.enum(["managed_agent", "self_managed"]);
-var WorkloadLifecycleConfigSchema = import_zod60.z.object({
-  idleEnabled: import_zod60.z.boolean().nullable(),
-  idleAfterSeconds: import_zod60.z.number().int().min(300).max(86400).nullable(),
-  idleGraceSeconds: import_zod60.z.number().int().min(60).max(3600).nullable(),
-  maxSessionLifetimeMs: import_zod60.z.number().int().min(36e5).max(6048e5).nullable()
+var WorkloadLifecycleKindSchema = import_zod61.z.enum(["managed_agent", "self_managed"]);
+var WorkloadLifecycleConfigSchema = import_zod61.z.object({
+  idleEnabled: import_zod61.z.boolean().nullable(),
+  idleAfterSeconds: import_zod61.z.number().int().min(300).max(86400).nullable(),
+  idleGraceSeconds: import_zod61.z.number().int().min(60).max(3600).nullable(),
+  maxSessionLifetimeMs: import_zod61.z.number().int().min(36e5).max(6048e5).nullable()
 }).strict();
 var WorkloadLifecycleConfigUpdateSchema = WorkloadLifecycleConfigSchema.partial().strict();
-var EffectiveWorkloadLifecycleConfigSchema = import_zod60.z.object({
-  idleEnabled: import_zod60.z.boolean(),
-  idleAfterSeconds: import_zod60.z.number().int().min(300).max(86400),
-  idleGraceSeconds: import_zod60.z.number().int().min(60).max(3600),
-  maxSessionLifetimeMs: import_zod60.z.number().int().min(36e5).max(6048e5)
-}).strict();
-var WorkloadLifecycleConfigResponseSchema = import_zod60.z.object({
-  workloadId: import_zod60.z.string().uuid(),
+var EffectiveWorkloadLifecycleConfigSchema = import_zod61.z.object({
+  idleEnabled: import_zod61.z.boolean(),
+  idleAfterSeconds: import_zod61.z.number().int().min(300).max(86400),
+  idleGraceSeconds: import_zod61.z.number().int().min(60).max(3600),
+  maxSessionLifetimeMs: import_zod61.z.number().int().min(36e5).max(6048e5)
+}).strict();
+var WorkloadLifecycleConfigResponseSchema = import_zod61.z.object({
+  workloadId: import_zod61.z.string().uuid(),
   kind: WorkloadLifecycleKindSchema,
   config: WorkloadLifecycleConfigSchema,
   effective: EffectiveWorkloadLifecycleConfigSchema
 }).strict();
-var OtelJobContextSchema = import_zod61.z.object({
+var OtelJobContextSchema = import_zod62.z.object({
   /** W3C Trace Context `traceparent` header value. */
-  traceparent: import_zod61.z.string().optional(),
+  traceparent: import_zod62.z.string().optional(),
   /** W3C Trace Context `tracestate` header value. */
-  tracestate: import_zod61.z.string().optional(),
+  tracestate: import_zod62.z.string().optional(),
   /** W3C Baggage header value. */
-  baggage: import_zod61.z.string().optional()
+  baggage: import_zod62.z.string().optional()
 }).passthrough();
-var LifecycleStageNameSchema = import_zod62.z.enum(["test", "production"]);
-var SlotCanarySummarySchema = import_zod62.z.object({
+var LifecycleStageNameSchema = import_zod63.z.enum(["test", "production"]);
+var SlotCanarySummarySchema = import_zod63.z.object({
   /** canary 臂 revision id。 */
-  revisionId: import_zod62.z.string(),
+  revisionId: import_zod63.z.string(),
   /** canary revision 的人可读版本短名;revision 行缺失时 null(降级显示 id 前缀)。 */
-  revisionLabel: import_zod62.z.string().nullable(),
+  revisionLabel: import_zod63.z.string().nullable(),
   /** 0..99;0 = 冻结观察态(仅名单命中仍入 canary)。 */
-  percentage: import_zod62.z.number().int(),
+  percentage: import_zod63.z.number().int(),
   /** ldap 名单人数(徽章"名单 N 人";0 = 无名单)。 */
-  userAllowlistCount: import_zod62.z.number().int(),
+  userAllowlistCount: import_zod63.z.number().int(),
   /** 本轮灰度开始时间(ISO);存量行无记录时 null。 */
-  startedAt: import_zod62.z.string().nullable()
+  startedAt: import_zod63.z.string().nullable()
 });
-var SlotSummarySchema = import_zod62.z.object({
-  revisionId: import_zod62.z.string().nullable(),
+var SlotSummarySchema = import_zod63.z.object({
+  revisionId: import_zod63.z.string().nullable(),
   /** 人可读的版本标识(revision name/number);无部署时 null。 */
-  revisionLabel: import_zod62.z.string().nullable(),
-  environmentId: import_zod62.z.string().nullable(),
-  environmentName: import_zod62.z.string().nullable(),
-  environmentVersion: import_zod62.z.number().int().nullable(),
+  revisionLabel: import_zod63.z.string().nullable(),
+  environmentId: import_zod63.z.string().nullable(),
+  environmentName: import_zod63.z.string().nullable(),
+  environmentVersion: import_zod63.z.number().int().nullable(),
+  /**
+   * 槽位所指 revision 自带的运行环境(`revisions.runtime_template_id` 及其名字)。
+   * 槽位 `environmentId` 为 NULL(存量未绑定行)时会话实际跑的就是它——读侧用
+   * 它兜底显示,不再渲染「内置于版本」伪状态(ENV-R1a)。发布板读模型必带;
+   * 工作台等其它 SlotSummary 生产方可省略(省略 = 未报告)。
+   */
+  revisionEnvironmentId: import_zod63.z.string().nullable().optional(),
+  revisionEnvironmentName: import_zod63.z.string().nullable().optional(),
   /** 槽位最近一次变更时间(ISO);数据缺口约定:仅当前指针,无历史流水。 */
-  updatedAt: import_zod62.z.string().nullable(),
+  updatedAt: import_zod63.z.string().nullable(),
   /**
    * 活跃灰度摘要(#1214)。目前仅发布板读模型的槽位显式带出(null = 无灰度);
    * 工作台等其它 SlotSummary 生产方不带(optional,省略 = 未报告)。
    */
   canary: SlotCanarySummarySchema.nullable().optional()
 });
-var WorkbenchStageDriftKindSchema = import_zod62.z.enum([
+var WorkbenchStageDriftKindSchema = import_zod63.z.enum([
   /** test 指向新于 production(待晋级)。 */
   "test_ahead",
   /** 只有 test 有部署(从未上过 production)。 */
@@ -7646,27 +7661,27 @@ var WorkbenchStageDriftKindSchema = import_zod62.z.enum([
    */
   "diverged"
 ]);
-var WorkbenchStageDriftItemSchema = import_zod62.z.object({
-  workloadId: import_zod62.z.string(),
-  workloadName: import_zod62.z.string(),
-  workloadSlug: import_zod62.z.string().nullable(),
+var WorkbenchStageDriftItemSchema = import_zod63.z.object({
+  workloadId: import_zod63.z.string(),
+  workloadName: import_zod63.z.string(),
+  workloadSlug: import_zod63.z.string().nullable(),
   kind: WorkbenchStageDriftKindSchema,
   test: SlotSummarySchema.nullable(),
   production: SlotSummarySchema.nullable(),
   /** 差异开始的近似时间 = 领先侧槽位的 updatedAt(ISO)。 */
-  since: import_zod62.z.string().nullable()
+  since: import_zod63.z.string().nullable()
 });
-var WorkbenchRecentChangeKindSchema = import_zod62.z.enum([
+var WorkbenchRecentChangeKindSchema = import_zod63.z.enum([
   "stage_updated",
   "revision_published",
   "environment_version_created"
 ]);
-var WorkbenchRecentChangeSchema = import_zod62.z.object({
+var WorkbenchRecentChangeSchema = import_zod63.z.object({
   kind: WorkbenchRecentChangeKindSchema,
   /** 变更主体的可读标题(如 workload 名 / 环境名)。 */
-  subject: import_zod62.z.string(),
+  subject: import_zod63.z.string(),
   /** 主体 id(workloadId / environmentId),用于前端拼详情链接。 */
-  subjectId: import_zod62.z.string(),
+  subjectId: import_zod63.z.string(),
   /**
    * workload 类变更(stage_updated / revision_published)的 slug——详情路由
    * UUID / slug 双形态均可达,前端优先用可读的 slug 拼链接,缺失时回退
@@ -7677,26 +7692,26 @@ var WorkbenchRecentChangeSchema = import_zod62.z.object({
    * agenthub-sdk 对 WorkbenchDTO 的硬 parse)在滚动发版遇到旧产出时
    * 降级为无 slug,而不是整个 DTO 校验失败。
    */
-  subjectSlug: import_zod62.z.string().nullable().optional(),
+  subjectSlug: import_zod63.z.string().nullable().optional(),
   /** 一句话变更描述(如 "production → rev-12" / "环境 v3 创建")。 */
-  detail: import_zod62.z.string(),
-  occurredAt: import_zod62.z.string()
+  detail: import_zod63.z.string(),
+  occurredAt: import_zod63.z.string()
 });
-var WorkbenchSessionStatsSchema = import_zod62.z.object({
-  running: import_zod62.z.number().int(),
-  failed24h: import_zod62.z.number().int(),
-  total24h: import_zod62.z.number().int()
+var WorkbenchSessionStatsSchema = import_zod63.z.object({
+  running: import_zod63.z.number().int(),
+  failed24h: import_zod63.z.number().int(),
+  total24h: import_zod63.z.number().int()
 });
-var WorkbenchDTOSchema = import_zod62.z.object({
-  workloadCount: import_zod62.z.number().int(),
+var WorkbenchDTOSchema = import_zod63.z.object({
+  workloadCount: import_zod63.z.number().int(),
   sessionStats: WorkbenchSessionStatsSchema,
-  stageDrift: import_zod62.z.array(WorkbenchStageDriftItemSchema),
-  recentChanges: import_zod62.z.array(WorkbenchRecentChangeSchema)
+  stageDrift: import_zod63.z.array(WorkbenchStageDriftItemSchema),
+  recentChanges: import_zod63.z.array(WorkbenchRecentChangeSchema)
 });
-var ReleaseBoardRowSchema = import_zod62.z.object({
-  workloadId: import_zod62.z.string(),
-  workloadName: import_zod62.z.string(),
-  workloadSlug: import_zod62.z.string().nullable(),
+var ReleaseBoardRowSchema = import_zod63.z.object({
+  workloadId: import_zod63.z.string(),
+  workloadName: import_zod63.z.string(),
+  workloadSlug: import_zod63.z.string().nullable(),
   /**
    * @deprecated Workload 当前默认指针(`default_revision_id`,production 部署
    * 从写)。指针收敛(2026-08-02)后发布 UI 不再移动它,本字段随删列窗口结束
@@ -7705,7 +7720,7 @@ var ReleaseBoardRowSchema = import_zod62.z.object({
    * 新消费方一律读 `latestRevision`(前端回退链 latestRevision ?? defaultRevision
    * 只为兼容旧服务端缺字段,不表示两者同义)。
    */
-  defaultRevision: import_zod62.z.object({ id: import_zod62.z.string(), version: import_zod62.z.string(), createdAt: import_zod62.z.string() }).nullable(),
+  defaultRevision: import_zod63.z.object({ id: import_zod63.z.string(), version: import_zod63.z.string(), createdAt: import_zod63.z.string() }).nullable(),
   /**
    * Workload 最近发布的 Revision(createdAt 最新;并列时 id 大者,保证确定性)。
    * 发布板用它判断"有新版本尚未部署到 test"(latestRevision.id ≠
@@ -7718,12 +7733,12 @@ var ReleaseBoardRowSchema = import_zod62.z.object({
    * pendingRevision)一直想要的一致。**optional**:旧服务端的响应没有此字段,
    * 新 client 解析须容忍(双向滚动窗口兼容),缺席时回退读 defaultRevision。
    */
-  latestRevision: import_zod62.z.object({
-    id: import_zod62.z.string(),
-    version: import_zod62.z.string(),
-    createdAt: import_zod62.z.string(),
+  latestRevision: import_zod63.z.object({
+    id: import_zod63.z.string(),
+    version: import_zod63.z.string(),
+    createdAt: import_zod63.z.string(),
     /** 真实发布时间；optional 仅用于新旧服务端滚动窗口兼容。 */
-    publishedAt: import_zod62.z.string().optional()
+    publishedAt: import_zod63.z.string().optional()
   }).nullable().optional(),
   /**
    * 用户当前有理由继续使用的 Revision（latestRevision、test、production）中，
@@ -7731,30 +7746,35 @@ var ReleaseBoardRowSchema = import_zod62.z.object({
    * latestRevision；具体复制哪份配置由升级弹窗显式选择。optional 仅用于
    * 新旧服务端滚动窗口兼容。
    */
-  runtimeUpgradeAvailable: import_zod62.z.boolean().optional(),
+  runtimeUpgradeAvailable: import_zod63.z.boolean().optional(),
   test: SlotSummarySchema.nullable(),
   production: SlotSummarySchema.nullable(),
-  /** test 与 production 指向不同 revision 或不同环境版本。 */
-  drift: import_zod62.z.boolean(),
+  /**
+   * test 与 production 指向不同 revision，或**有效环境**不同
+   * (`environmentId ?? revisionEnvironmentId`,ENV-R1a);环境版本号只在两侧
+   * 都显式绑定时参与比较——任一侧是兜底态(槽位未绑、跑版本自带环境)时
+   * 没有可比的版本钉。发布板展开面板的环境行高亮与本字段同口径。
+   */
+  drift: import_zod63.z.boolean(),
   /** 两槽位 updatedAt 的较新者(ISO);均空则 null。 */
-  lastChangedAt: import_zod62.z.string().nullable()
-});
-var ReleaseBoardDTOSchema = import_zod62.z.object({
-  rows: import_zod62.z.array(ReleaseBoardRowSchema)
-});
-var SessionDiagnosisSessionSchema = import_zod62.z.object({
-  id: import_zod62.z.string(),
-  workloadId: import_zod62.z.string().nullable(),
-  workloadName: import_zod62.z.string().nullable(),
-  workloadSlug: import_zod62.z.string().nullable(),
-  status: import_zod62.z.string(),
-  lifecyclePhase: import_zod62.z.string().nullable(),
-  model: import_zod62.z.string().nullable(),
-  createdAt: import_zod62.z.string(),
-  readyAt: import_zod62.z.string().nullable(),
-  endedAt: import_zod62.z.string().nullable(),
+  lastChangedAt: import_zod63.z.string().nullable()
+});
+var ReleaseBoardDTOSchema = import_zod63.z.object({
+  rows: import_zod63.z.array(ReleaseBoardRowSchema)
+});
+var SessionDiagnosisSessionSchema = import_zod63.z.object({
+  id: import_zod63.z.string(),
+  workloadId: import_zod63.z.string().nullable(),
+  workloadName: import_zod63.z.string().nullable(),
+  workloadSlug: import_zod63.z.string().nullable(),
+  status: import_zod63.z.string(),
+  lifecyclePhase: import_zod63.z.string().nullable(),
+  model: import_zod63.z.string().nullable(),
+  createdAt: import_zod63.z.string(),
+  readyAt: import_zod63.z.string().nullable(),
+  endedAt: import_zod63.z.string().nullable(),
   /** 会话创建链路 trace(Octopus 深链"启动 Trace"数据源)。 */
-  rootTraceId: import_zod62.z.string().nullable(),
+  rootTraceId: import_zod63.z.string().nullable(),
   /**
    * 该会话能不能点进对话面(`/p/<pid>/s/<sid>`)。**由服务端算好下发,前端不要
    * 自己按 `usageKind` 重推** —— `usage_kind` 是会话创建时写死的名字、认领后
@@ -7762,37 +7782,37 @@ var SessionDiagnosisSessionSchema = import_zod62.z.object({
    * `packages/control-plane/src/session-lifecycle/session-chat-entry.ts`,
    * 排障列表的 `chatHref` 走的是同一个函数。
    */
-  canOpenChat: import_zod62.z.boolean()
+  canOpenChat: import_zod63.z.boolean()
 });
-var SessionDiagnosisFailureSchema = import_zod62.z.object({
-  kind: import_zod62.z.string().nullable(),
-  message: import_zod62.z.string().nullable(),
-  occurredAt: import_zod62.z.string().nullable()
+var SessionDiagnosisFailureSchema = import_zod63.z.object({
+  kind: import_zod63.z.string().nullable(),
+  message: import_zod63.z.string().nullable(),
+  occurredAt: import_zod63.z.string().nullable()
 });
-var SessionDiagnosisEventSchema = import_zod62.z.object({
-  id: import_zod62.z.string(),
-  type: import_zod62.z.string(),
+var SessionDiagnosisEventSchema = import_zod63.z.object({
+  id: import_zod63.z.string(),
+  type: import_zod63.z.string(),
   /** 该轮 dispatch trace(每条用户消息的 Octopus 深链数据源);非 dispatch 事件为 null。 */
-  traceId: import_zod62.z.string().nullable(),
-  summary: import_zod62.z.string().nullable(),
-  occurredAt: import_zod62.z.string()
+  traceId: import_zod63.z.string().nullable(),
+  summary: import_zod63.z.string().nullable(),
+  occurredAt: import_zod63.z.string()
 });
-var SessionDiagnosisSandboxSchema = import_zod62.z.object({
-  id: import_zod62.z.string(),
-  status: import_zod62.z.string(),
-  expiresAt: import_zod62.z.string().nullable(),
-  createdAt: import_zod62.z.string().nullable()
+var SessionDiagnosisSandboxSchema = import_zod63.z.object({
+  id: import_zod63.z.string(),
+  status: import_zod63.z.string(),
+  expiresAt: import_zod63.z.string().nullable(),
+  createdAt: import_zod63.z.string().nullable()
 });
-var SessionDiagnosisDTOSchema = import_zod62.z.object({
+var SessionDiagnosisDTOSchema = import_zod63.z.object({
   session: SessionDiagnosisSessionSchema,
   failure: SessionDiagnosisFailureSchema.nullable(),
-  events: import_zod62.z.array(SessionDiagnosisEventSchema).nullable(),
+  events: import_zod63.z.array(SessionDiagnosisEventSchema).nullable(),
   sandbox: SessionDiagnosisSandboxSchema.nullable(),
   // zod v4 infers `z.record(enum, string)` as a FULL `Record` (all keys
   // present) instead of v3's `Partial` — but only failing blocks appear here.
   // Explicit partial object keeps the v3 inference; runtime behavior matches
   // the record form (any key subset accepted, extras rejected).
-  blockErrors: import_zod62.z.object({ failure: import_zod62.z.string(), events: import_zod62.z.string(), sandbox: import_zod62.z.string() }).partial().optional()
+  blockErrors: import_zod63.z.object({ failure: import_zod63.z.string(), events: import_zod63.z.string(), sandbox: import_zod63.z.string() }).partial().optional()
 });
 var PIPELINE_TRIGGERS = ["push", "merge", "manual", "env_change", "rebake"];
 var PIPELINE_RUN_STATUSES = [
@@ -7834,12 +7854,12 @@ var PIPELINE_FULL_FACE_TRIGGERS = Object.keys(PIPELINE_TRIGGER_STAGES).filter((t
   return set.length === PIPELINE_STEPS.length && PIPELINE_STEPS.every((s) => set.includes(s));
 });
 var IMAGE_FINGERPRINT_RE = /^fp_[0-9a-f]{64}$/;
-var BakeInputsSchema = import_zod63.z.object({
-  v: import_zod63.z.literal(1),
-  fingerprint: import_zod63.z.string().regex(IMAGE_FINGERPRINT_RE),
-  baseImage: import_zod63.z.string().min(1),
+var BakeInputsSchema = import_zod64.z.object({
+  v: import_zod64.z.literal(1),
+  fingerprint: import_zod64.z.string().regex(IMAGE_FINGERPRINT_RE),
+  baseImage: import_zod64.z.string().min(1),
   packages: EnvironmentPackagesSchema.nullable(),
-  generatorVersion: import_zod63.z.number().int().positive()
+  generatorVersion: import_zod64.z.number().int().positive()
 }).strict();
 var BAKE_IMAGE_BUILD_TIMEOUT_MS = 45 * 60 * 1e3;
 var BAKE_MATERIALIZE_WAIT_MS = 30 * 60 * 1e3;
@@ -7857,7 +7877,7 @@ var FILE_AGENT_REFERENCE_NAME_MAX_LENGTH = 200;
 var FILE_AGENT_REFERENCE_LIST_MAX_LENGTH = 100;
 var FILE_AGENT_PACKAGE_FILE_CHAR_WHITELIST = /^[A-Za-z0-9._/-]+$/;
 function packageFilePathSchema(fieldName) {
-  return import_zod64.z.string().min(1).max(FILE_AGENT_PACKAGE_FILE_PATH_MAX_LENGTH).refine((value) => FILE_AGENT_PACKAGE_FILE_CHAR_WHITELIST.test(value), {
+  return import_zod65.z.string().min(1).max(FILE_AGENT_PACKAGE_FILE_PATH_MAX_LENGTH).refine((value) => FILE_AGENT_PACKAGE_FILE_CHAR_WHITELIST.test(value), {
     message: `${fieldName} may only contain [A-Za-z0-9._/-]`
   }).refine((value) => !value.startsWith("/"), {
     message: `${fieldName} must be a relative path`
@@ -7873,11 +7893,11 @@ function packageFilePathSchema(fieldName) {
 var FileAgentSystemPromptFileSchema = packageFilePathSchema("systemPromptFile");
 var FileAgentSetupScriptFileSchema = packageFilePathSchema("setupScriptFile");
 var FILE_AGENT_RUSH_NAME_WHITELIST = /^(@[A-Za-z0-9][A-Za-z0-9._-]*\/)?[A-Za-z0-9][A-Za-z0-9._-]*$/;
-var FileAgentReferenceNameSchema = import_zod64.z.string().min(1).max(FILE_AGENT_REFERENCE_NAME_MAX_LENGTH).refine((value) => FILE_AGENT_RUSH_NAME_WHITELIST.test(value), {
+var FileAgentReferenceNameSchema = import_zod65.z.string().min(1).max(FILE_AGENT_REFERENCE_NAME_MAX_LENGTH).refine((value) => FILE_AGENT_RUSH_NAME_WHITELIST.test(value), {
   message: "rush registry name must match (@scope/)?name using only [A-Za-z0-9._-] (no spaces or invisible characters)"
 });
 function platformEntityNameSchema(fieldName) {
-  return import_zod64.z.string().min(1).max(FILE_AGENT_REFERENCE_NAME_MAX_LENGTH).refine((value) => value.trim() === value, {
+  return import_zod65.z.string().min(1).max(FILE_AGENT_REFERENCE_NAME_MAX_LENGTH).refine((value) => value.trim() === value, {
     message: `${fieldName} name must not have leading or trailing whitespace`
   }).refine((value) => !/[\p{Cc}\p{Cf}]/u.test(value), {
     message: `${fieldName} name must not contain control or invisible format characters`
@@ -7885,29 +7905,30 @@ function platformEntityNameSchema(fieldName) {
 }
 var FileAgentEnvironmentNameSchema = platformEntityNameSchema("environment");
 var FileAgentModelServiceNameSchema = platformEntityNameSchema("modelService");
-var FileAgentMcpServerEntrySchema = import_zod64.z.union([
+var FileAgentMcpServerEntrySchema = import_zod65.z.union([
   ManagedMcpIdSchema,
-  import_zod64.z.object({
+  import_zod65.z.object({
     id: ManagedMcpIdSchema,
-    disabled: import_zod64.z.boolean().optional()
+    disabled: import_zod65.z.boolean().optional()
   }).strict()
 ]);
 function mcpEntryId(entry) {
   return typeof entry === "string" ? entry : entry.id;
 }
-var FileAgentMcpServerListSchema = import_zod64.z.array(FileAgentMcpServerEntrySchema).max(FILE_AGENT_REFERENCE_LIST_MAX_LENGTH).refine(
+var FileAgentMcpServerListSchema = import_zod65.z.array(FileAgentMcpServerEntrySchema).max(FILE_AGENT_REFERENCE_LIST_MAX_LENGTH).refine(
   (list) => {
     const ids = list.map(mcpEntryId);
     return new Set(ids).size === ids.length;
   },
   { message: "must not contain duplicate mcpServers entries (compared by id)" }
 );
-var FileAgentClaudeCodeSectionSchema = import_zod64.z.object({
+var FileAgentClaudeCodeSectionSchema = import_zod65.z.object({
   entryCommand: ClaudeCodeAgentPackageEntryCommandSchema.optional()
 }).strict();
-var FileAgentClaudeCodeDefinitionSchema = import_zod64.z.object({
-  apiVersion: import_zod64.z.literal(FILE_AGENT_API_VERSION),
-  format: import_zod64.z.literal("claude_code"),
+var FileAgentMemorySchema = WorkloadManifestMemorySchema.pick({ enabled: true }).strict();
+var FileAgentClaudeCodeDefinitionSchema = import_zod65.z.object({
+  apiVersion: import_zod65.z.literal(FILE_AGENT_API_VERSION),
+  format: import_zod65.z.literal("claude_code"),
   model: WorkloadManifestModelSchema.optional(),
   /**
    * **待退场旧入口**（owner 2026-08-11 拍板，见
@@ -7971,25 +7992,40 @@ var FileAgentClaudeCodeDefinitionSchema = import_zod64.z.object({
    * 沿用既有 `assertLlmProviderModelExclusive` 在解析层触发。
    */
   modelService: FileAgentModelServiceNameSchema.optional(),
+  /**
+   * per-agent 记忆闸（#1873）。**缺省 = 开**：不写这一段与写 `enabled: true`
+   * 在运行时等价，区别只在快照里有没有这个键（缺省不投影，见转换器）。
+   *
+   * `enabled: false` 关掉的是这个 Agent 的**全部**记忆面（spec §10 第三层与门）：
+   * 召回不带入任何记忆——`memory/` 里的记忆文档与运行时条目**一起**不进 prompt；
+   * `memory_search` 工具查到空；写入面（抽取 / 直写 / 转达晋升）一律回
+   * `agent_disabled`；对话内容不被记录，声明的业务主体也不写。
+   *
+   * 记忆文档的**物化**不受此声明 gating（它是构建产物，照常打进包里），关的是
+   * "带不带进上下文"。
+   *
+   * 与总闸 `v2_managed_memory_enabled` 是 AND 关系：这里写 `true` 打不开总闸。
+   */
+  memory: FileAgentMemorySchema.optional(),
   claudeCode: FileAgentClaudeCodeSectionSchema.optional()
 }).strict();
-var FileAgentDefinitionSchema = import_zod64.z.discriminatedUnion("format", [FileAgentClaudeCodeDefinitionSchema]).superRefine((definition, ctx) => {
+var FileAgentDefinitionSchema = import_zod65.z.discriminatedUnion("format", [FileAgentClaudeCodeDefinitionSchema]).superRefine((definition, ctx) => {
   if (definition.systemPrompt !== void 0 && definition.systemPromptFile !== void 0) {
     ctx.addIssue({
-      code: import_zod64.z.ZodIssueCode.custom,
+      code: import_zod65.z.ZodIssueCode.custom,
       path: ["systemPromptFile"],
       message: "systemPrompt and systemPromptFile are mutually exclusive (D18)"
     });
   }
   if (definition.setupScript !== void 0 && definition.setupScriptFile !== void 0) {
     ctx.addIssue({
-      code: import_zod64.z.ZodIssueCode.custom,
+      code: import_zod65.z.ZodIssueCode.custom,
       path: ["setupScriptFile"],
       message: "setupScript and setupScriptFile are mutually exclusive (D21)"
     });
   }
 });
-var FileAgentErrorCodeSchema = import_zod64.z.enum([
+var FileAgentErrorCodeSchema = import_zod65.z.enum([
   /** agent.yaml failed schema validation (unknown/reserved key, apiVersion boundary, field shape). */
   "FILE_AGENT_INVALID",
   /**
@@ -8007,6 +8043,16 @@ var FileAgentErrorCodeSchema = import_zod64.z.enum([
    * operator sees WHICH declaration is broken without parsing the message.
    */
   "FILE_AGENT_SETUP_SCRIPT_FILE_UNRESOLVED",
+  /**
+   * A definition doc (`CLAUDE.md`/`AGENTS.md`, see
+   * {@link verdictForFileAgentDefinitionDocCandidate}) resolved to content
+   * over {@link WORKLOAD_MANIFEST_SYSTEM_PROMPT_MAX_LENGTH} characters — but
+   * ONLY for the FIRST doc in `FILE_AGENT_DEFINITION_DOCS` order (the
+   * author's primary declared prompt). An oversize FALLBACK doc is treated
+   * as absent instead (see that function's jsdoc), so this code is never
+   * raised for `AGENTS.md` while `CLAUDE.md` is present.
+   */
+  "FILE_AGENT_DEFINITION_DOC_OVERSIZE",
   /**
    * `modelService` is declared but the caller supplied no resolved
    * `llmProviderRef` id (or supplied one without a declaration). The converter
@@ -8025,7 +8071,7 @@ var FileAgentErrorCodeSchema = import_zod64.z.enum([
   /** Converted output failed `RevisionManifestSchema` — a pipeline-context input is invalid (e.g. a non-endorsed package URL). */
   "FILE_AGENT_REVISION_INVALID"
 ]);
-var BindProjectRepoRequestSchema = import_zod65.z.object({
+var BindProjectRepoRequestSchema = import_zod66.z.object({
   /**
    * Project uuid — the ONLY form accepted (#1635). Slugs used to be
    * resolved here (exact `slug` column, then derived-from-`name` fallback
@@ -8034,8 +8080,8 @@ var BindProjectRepoRequestSchema = import_zod65.z.object({
    * scan was a full-table fallback with no ordering. Identity is uuid-only;
    * slugs are display-only and never resolve.
    */
-  project: import_zod65.z.string().uuid(),
-  repoUrl: import_zod65.z.string().min(1).max(1024),
+  project: import_zod66.z.string().uuid(),
+  repoUrl: import_zod66.z.string().min(1).max(1024),
   /**
    * Repoint a project that already names a DIFFERENT repo.
    *
@@ -8044,53 +8090,53 @@ var BindProjectRepoRequestSchema = import_zod65.z.object({
    * next release publish agent definitions from another repository, under
    * the same project, with no visible signal.
    */
-  allowRebind: import_zod65.z.boolean().optional()
+  allowRebind: import_zod66.z.boolean().optional()
 }).strict();
-var BindProjectRepoResponseSchema = import_zod65.z.discriminatedUnion("outcome", [
-  import_zod65.z.object({ outcome: import_zod65.z.literal("bound"), projectId: import_zod65.z.string().uuid(), repoUrl: import_zod65.z.string() }).strict(),
+var BindProjectRepoResponseSchema = import_zod66.z.discriminatedUnion("outcome", [
+  import_zod66.z.object({ outcome: import_zod66.z.literal("bound"), projectId: import_zod66.z.string().uuid(), repoUrl: import_zod66.z.string() }).strict(),
   /** Idempotent re-run: already bound to this repo, nothing written. */
-  import_zod65.z.object({ outcome: import_zod65.z.literal("unchanged"), projectId: import_zod65.z.string().uuid(), repoUrl: import_zod65.z.string() }).strict()
+  import_zod66.z.object({ outcome: import_zod66.z.literal("unchanged"), projectId: import_zod66.z.string().uuid(), repoUrl: import_zod66.z.string() }).strict()
 ]);
-var FileAgentRefKindSchema = import_zod65.z.enum(["environment", "modelService", "managedMcp"]);
-var CheckFileAgentRefsQuerySchema = import_zod65.z.object({
-  projectId: import_zod65.z.string().uuid(),
-  environment: import_zod65.z.string().min(1).max(200).optional(),
-  modelService: import_zod65.z.string().min(1).max(200).optional(),
+var FileAgentRefKindSchema = import_zod66.z.enum(["environment", "modelService", "managedMcp"]);
+var CheckFileAgentRefsQuerySchema = import_zod66.z.object({
+  projectId: import_zod66.z.string().uuid(),
+  environment: import_zod66.z.string().min(1).max(200).optional(),
+  modelService: import_zod66.z.string().min(1).max(200).optional(),
   /**
    * `agent.yaml` `mcpServers:` —— 托管 MCP id（`vcrd_*`），已经是 id 而不是名字，
    * 所以这里问的是「它在这个项目里存在吗」。上限对齐 `mcpServers` 的列表上限。
    */
-  managedMcpIds: import_zod65.z.array(ManagedMcpIdSchema).max(64).optional()
+  managedMcpIds: import_zod66.z.array(ManagedMcpIdSchema).max(64).optional()
 }).strict();
-var FileAgentRefProblemSchema = import_zod65.z.object({
+var FileAgentRefProblemSchema = import_zod66.z.object({
   kind: FileAgentRefKindSchema,
-  name: import_zod65.z.string(),
+  name: import_zod66.z.string(),
   /** Existing names in the project, for a "did you mean" hint (server-capped). */
-  available: import_zod65.z.array(import_zod65.z.string())
+  available: import_zod66.z.array(import_zod66.z.string())
 }).strict();
-var CheckFileAgentRefsResponseSchema = import_zod65.z.object({
-  environmentId: import_zod65.z.string().optional(),
-  llmProviderRef: import_zod65.z.string().optional(),
+var CheckFileAgentRefsResponseSchema = import_zod66.z.object({
+  environmentId: import_zod66.z.string().optional(),
+  llmProviderRef: import_zod66.z.string().optional(),
   /** 解析到的 `managedMcpId → 展示名`（发布侧要把名字冻进快照；check 只看 problems）。 */
-  managedMcpDisplayNames: import_zod65.z.record(import_zod65.z.string(), import_zod65.z.string()).optional(),
-  problems: import_zod65.z.array(FileAgentRefProblemSchema)
+  managedMcpDisplayNames: import_zod66.z.record(import_zod66.z.string(), import_zod66.z.string()).optional(),
+  problems: import_zod66.z.array(FileAgentRefProblemSchema)
 }).strict();
-var IssueMcpDevTicketRequestSchema = import_zod66.z.object({
-  projectId: import_zod66.z.string().uuid(),
+var IssueMcpDevTicketRequestSchema = import_zod67.z.object({
+  projectId: import_zod67.z.string().uuid(),
   /**
    * 人可读的用途标记（典型值：`<agent slug>@<主机名>`）。只为审计与自助排查
    * （"我还有几张票在外面"），不参与鉴权。
    */
-  label: import_zod66.z.string().min(1).max(200).optional(),
+  label: import_zod67.z.string().min(1).max(200).optional(),
   /** 省略 = 服务端默认（一个开发日）。服务端另有 24h 上限。 */
-  ttlSeconds: import_zod66.z.number().int().positive().max(24 * 60 * 60).optional()
+  ttlSeconds: import_zod67.z.number().int().positive().max(24 * 60 * 60).optional()
 }).strict();
-var McpDevTicketTargetSchema = import_zod66.z.object({
+var McpDevTicketTargetSchema = import_zod67.z.object({
   managedMcpId: ManagedMcpIdSchema,
   /** 展示名 —— 给人看的（提示、报错）。**不是** `.mcp.json` 的键。 */
-  displayName: import_zod66.z.string(),
+  displayName: import_zod67.z.string(),
   /** 真实上游 URL。作为 `X-Pilot-MCP-Target` 头传给 gateway（**不是**凭据）。 */
-  mcpServerUrl: import_zod66.z.string(),
+  mcpServerUrl: import_zod67.z.string(),
   /**
    * `.mcp.json` 的**键名**，平台侧创建期定死（`pilot_v2_vault_credentials.
    * server_key`）。CLI 必须用它，不许从 `displayName` 现造：LLM 看到的工具名是
@@ -8105,37 +8151,37 @@ var McpDevTicketTargetSchema = import_zod66.z.object({
    * 版本 skew 面（老服务端可能回 null → 新 SDK parse 抛错），而收益只是类型更
    * 诚实。CLI 侧不该再有 null 分支——那个分支正是这条修复要消灭的东西。
    */
-  serverKey: import_zod66.z.string().nullable()
+  serverKey: import_zod67.z.string().nullable()
 }).strict();
-var McpDevTicketStdioTargetSchema = import_zod66.z.object({
+var McpDevTicketStdioTargetSchema = import_zod67.z.object({
   managedMcpId: ManagedMcpIdSchema,
   /**
    * `.mcp.json` 的键名。与 remote 的 `serverKey` 在**同一个命名空间**里分配：
    * `.mcp.json` 是一张表，stdio 与 remote 的键撞了就是互相覆盖（沙箱冻结侧同
    * 此约束，见 `vault-snapshot-freezer`）。
    */
-  serverKey: import_zod66.z.string().min(1).max(200),
+  serverKey: import_zod67.z.string().min(1).max(200),
   /** 展示名 —— 给人看的。**不是**键。 */
-  displayName: import_zod66.z.string(),
-  command: import_zod66.z.string().min(1).max(500),
-  args: import_zod66.z.array(import_zod66.z.string().max(500)).max(64).optional(),
+  displayName: import_zod67.z.string(),
+  command: import_zod67.z.string().min(1).max(500),
+  args: import_zod67.z.array(import_zod67.z.string().max(500)).max(64).optional(),
   /** 变量名 → 已渲染的值（`${MCP_...}` 占位符或字面量）。**绝不含明文凭据。** */
-  env: import_zod66.z.record(import_zod66.z.string(), import_zod66.z.string()).optional()
+  env: import_zod67.z.record(import_zod67.z.string(), import_zod67.z.string()).optional()
 }).strict();
-var IssueMcpDevTicketResponseSchema = import_zod66.z.object({
+var IssueMcpDevTicketResponseSchema = import_zod67.z.object({
   /**
    * 写进 `.mcp.json` 的 `Authorization: Bearer <token>`。
    * **只在这一次响应里出现**，服务端不留明文。
    */
-  token: import_zod66.z.string(),
+  token: import_zod67.z.string(),
   /** 票据的 public id —— 撤销时用它。 */
-  ticketId: import_zod66.z.string(),
+  ticketId: import_zod67.z.string(),
   /** ISO 时间串。 */
-  expiresAt: import_zod66.z.string(),
+  expiresAt: import_zod67.z.string(),
   /** gateway URL（CLI 不该自己猜环境）。 */
-  gatewayUrl: import_zod66.z.string(),
+  gatewayUrl: import_zod67.z.string(),
   /** `remote` 形态 —— 经 gateway 代理，白名单即 `allowedMcpTargets`。 */
-  targets: import_zod66.z.array(McpDevTicketTargetSchema),
+  targets: import_zod67.z.array(McpDevTicketTargetSchema),
   /**
    * `stdio` 形态 —— 本机子进程，不经 gateway、不进白名单。上限与
    * `FrozenStdioMcpListSchema` 对齐（64），两侧同一个上限才不会出现
@@ -8150,20 +8196,20 @@ var IssueMcpDevTicketResponseSchema = import_zod66.z.object({
    * 注意输出类型仍是**非可选数组**（`z.infer` 取的是 default 之后的形态），所以
    * 消费方不需要写 `?? []` 分支。
    */
-  stdioTargets: import_zod66.z.array(McpDevTicketStdioTargetSchema).max(64).default([])
+  stdioTargets: import_zod67.z.array(McpDevTicketStdioTargetSchema).max(64).default([])
 }).strict();
-var RevokeMcpDevTicketResponseSchema = import_zod66.z.object({
+var RevokeMcpDevTicketResponseSchema = import_zod67.z.object({
   /** `false` = 本来就不活跃（已撤销/不存在）。撤销是幂等的，两种都算成功。 */
-  revoked: import_zod66.z.boolean()
+  revoked: import_zod67.z.boolean()
 }).strict();
-var DevSecretEnvKeySchema = import_zod67.z.string().min(1).max(100).regex(/^[A-Z_][A-Z0-9_]*$/, "env key must match ^[A-Z_][A-Z0-9_]*$");
-var ResolveMcpDevSecretsRequestSchema = import_zod67.z.object({
-  projectId: import_zod67.z.string().uuid(),
+var DevSecretEnvKeySchema = import_zod68.z.string().min(1).max(100).regex(/^[A-Z_][A-Z0-9_]*$/, "env key must match ^[A-Z_][A-Z0-9_]*$");
+var ResolveMcpDevSecretsRequestSchema = import_zod68.z.object({
+  projectId: import_zod68.z.string().uuid(),
   /**
    * 这个 agent 声明的托管 MCP id。服务端据此推导要解哪些 `sec_*` ——
    * 只有 `stdio` 形态有凭据要下发（`remote` 走 gateway，明文不出平台）。
    */
-  managedMcpIds: import_zod67.z.array(ManagedMcpIdSchema).max(64).optional(),
+  managedMcpIds: import_zod68.z.array(ManagedMcpIdSchema).max(64).optional(),
   /**
    * `agent.yaml` 的 `env:` 里指向 secret 的条目：`envKey → sec_*`。
    *
@@ -8172,16 +8218,16 @@ var ResolveMcpDevSecretsRequestSchema = import_zod67.z.object({
    * `secrets:resolve` 的调用方本来就被授权读本项目任意 secret，所以这不扩大权限；
    * 上限在这里是为了让一次请求不能变成"把整个项目扫一遍"的批量导出工具。
    */
-  envSecretRefs: import_zod67.z.record(DevSecretEnvKeySchema, SecretPublicIdSchema).refine((refs) => Object.keys(refs).length <= 64, {
+  envSecretRefs: import_zod68.z.record(DevSecretEnvKeySchema, SecretPublicIdSchema).refine((refs) => Object.keys(refs).length <= 64, {
     message: "envSecretRefs must have at most 64 entries"
   }).optional()
 }).strict();
-var ResolveMcpDevSecretsResponseSchema = import_zod67.z.object({
+var ResolveMcpDevSecretsResponseSchema = import_zod68.z.object({
   /**
    * env 变量名 → **明文**。CLI 只把它放进子进程 env（`.mcp.json` 与 env 文件里
    * 都只写 `${VAR}` 占位符），不落盘。
    */
-  values: import_zod67.z.record(DevSecretEnvKeySchema, import_zod67.z.string()),
+  values: import_zod68.z.record(DevSecretEnvKeySchema, import_zod68.z.string()),
   /**
    * 声明了但解不出来的 env key（不存在 / 已归档 / 不属于本项目）。
    *
@@ -8189,7 +8235,7 @@ var ResolveMcpDevSecretsResponseSchema = import_zod67.z.object({
    * `${VAR}` 字面量原样传给 MCP server，于是上游报"token 无效"，排查方向被带到
    * 上游去，而真实原因是这里少了一个值。
    */
-  missing: import_zod67.z.array(import_zod67.z.string())
+  missing: import_zod68.z.array(import_zod68.z.string())
 }).strict();
 var EVAL_SUITE_API_VERSION = "agenthub/v1alpha1";
 var EVAL_SUITE_KIND = "EvalSuite";
@@ -8199,7 +8245,7 @@ var EVAL_MAX_RETRIES = 2;
 var EVAL_MAX_TURN_BYTES = 32 * 1024;
 var EVAL_MAX_FIXTURE_FILE_BYTES = 64 * 1024;
 var EVAL_MAX_FIXTURE_TOTAL_BYTES = 512 * 1024;
-var EvalRunStatusSchema = import_zod68.z.enum([
+var EvalRunStatusSchema = import_zod69.z.enum([
   "pending",
   "running",
   "passed",
@@ -8207,20 +8253,20 @@ var EvalRunStatusSchema = import_zod68.z.enum([
   "errored",
   "cancelled"
 ]);
-var EvalCaseVerdictSchema = import_zod68.z.enum(["passed", "failed", "errored"]);
-var EvalGraderStatusSchema = import_zod68.z.enum(["passed", "failed", "errored", "skipped"]);
-var EvalErrorClassSchema = import_zod68.z.enum([
+var EvalCaseVerdictSchema = import_zod69.z.enum(["passed", "failed", "errored"]);
+var EvalGraderStatusSchema = import_zod69.z.enum(["passed", "failed", "errored", "skipped"]);
+var EvalErrorClassSchema = import_zod69.z.enum([
   "capability_unavailable",
   "infrastructure_error",
   "indeterminate",
   "invalid_definition"
 ]);
-var EvalErrorCodeSchema = import_zod68.z.enum([
+var EvalErrorCodeSchema = import_zod69.z.enum([
   "EVAL_GRADER_CAPABILITY_UNAVAILABLE",
   "EVAL_SELF_EVAL_FORBIDDEN"
 ]);
 var EVAL_SCRIPT_STDOUT_TAIL_MAX_BYTES = 64 * 1024;
-var EvalTriggerSchema = import_zod68.z.enum([
+var EvalTriggerSchema = import_zod69.z.enum([
   "manual",
   "promote_gate",
   "cli",
@@ -8230,123 +8276,135 @@ var EvalTriggerSchema = import_zod68.z.enum([
   "replay",
   "pipeline"
 ]);
-var EvalSeveritySchema = import_zod68.z.enum(["gate", "soft"]);
-var EvalGraderTypeSchema = import_zod68.z.enum(["transcript", "file", "llm", "script"]);
-var EvalPassPolicySchema = import_zod68.z.enum(["all", "any"]);
-var EvalSuitePurposeSchema = import_zod68.z.enum(["regression", "capability"]);
+var EvalSeveritySchema = import_zod69.z.enum(["gate", "soft"]);
+var EvalGraderTypeSchema = import_zod69.z.enum(["transcript", "file", "llm", "script"]);
+var EvalPassPolicySchema = import_zod69.z.enum(["all", "any"]);
+var EvalSuitePurposeSchema = import_zod69.z.enum(["regression", "capability"]);
 var EVAL_SKIP_REASON_MAX = 2048;
-var EvalSuiteSkipSchema = import_zod68.z.object({ reason: import_zod68.z.string().min(1).max(EVAL_SKIP_REASON_MAX) }).strict();
-var EvalSkippedSuiteSchema = import_zod68.z.object({ path: import_zod68.z.string().min(1), reason: import_zod68.z.string().min(1) }).strict();
-var EvalConclusionStatusSchema = import_zod68.z.enum(["passed", "failed", "errored", "unassessed"]);
+var EvalSuiteSkipSchema = import_zod69.z.object({ reason: import_zod69.z.string().min(1).max(EVAL_SKIP_REASON_MAX) }).strict();
+var EvalSkippedSuiteSchema = import_zod69.z.object({ path: import_zod69.z.string().min(1), reason: import_zod69.z.string().min(1) }).strict();
+var EvalConclusionStatusSchema = import_zod69.z.enum(["passed", "failed", "errored", "unassessed"]);
 var isSafeRelativePath = (p) => !p.startsWith("/") && !p.split("/").includes("..") && !p.split("/").includes(".");
-var EvalRelativePathSchema = import_zod68.z.string().min(1).max(255).refine(isSafeRelativePath, {
+var EvalRelativePathSchema = import_zod69.z.string().min(1).max(255).refine(isSafeRelativePath, {
   message: "path must be a relative path without '.' or '..' segments"
 });
-var EvalSlugSchema = import_zod68.z.string().regex(/^[a-z0-9-]{1,64}$/, {
+var EvalSlugSchema = import_zod69.z.string().regex(/^[a-z0-9-]{1,64}$/, {
   message: "must be a slug matching [a-z0-9-]{1,64}"
 });
-var EvalTimesExprSchema = import_zod68.z.string().regex(/^(>=|<=|=|>|<)?\d+$/, {
+var EvalTimesExprSchema = import_zod69.z.string().regex(/^(>=|<=|=|>|<)?\d+$/, {
   message: 'times must match an operator + integer, e.g. ">=1", "=3", "2"'
 });
-var EvalMarkerSchema = import_zod68.z.object({
-  evalRunId: import_zod68.z.string().min(1),
+var EvalMarkerSchema = import_zod69.z.object({
+  evalRunId: import_zod69.z.string().min(1),
   caseId: EvalSlugSchema,
-  trial: import_zod68.z.number().int().nonnegative()
-}).strict();
-var EvalPatternRulesSchema = import_zod68.z.object({
-  required: import_zod68.z.array(import_zod68.z.string()).optional(),
-  forbidden: import_zod68.z.array(import_zod68.z.string()).optional()
-}).strict();
-var EvalTranscriptExpectSchema = import_zod68.z.object({
-  completed: import_zod68.z.boolean().optional(),
-  calledTool: import_zod68.z.object({ name: import_zod68.z.string().min(1), times: EvalTimesExprSchema.optional() }).strict().optional(),
-  toolOrder: import_zod68.z.array(import_zod68.z.string().min(1)).optional(),
-  forbiddenTools: import_zod68.z.array(import_zod68.z.string().min(1)).optional(),
-  calledSubagent: import_zod68.z.object({ name: import_zod68.z.string().min(1).optional(), times: EvalTimesExprSchema.optional() }).strict().optional(),
-  usedNoTools: import_zod68.z.boolean().optional(),
-  loadedSkill: import_zod68.z.string().min(1).optional(),
-  maxToolCalls: import_zod68.z.number().int().positive().optional(),
+  trial: import_zod69.z.number().int().nonnegative()
+}).strict();
+var EvalPatternRulesSchema = import_zod69.z.object({
+  required: import_zod69.z.array(import_zod69.z.string()).optional(),
+  forbidden: import_zod69.z.array(import_zod69.z.string()).optional()
+}).strict();
+var EvalTranscriptExpectSchema = import_zod69.z.object({
+  completed: import_zod69.z.boolean().optional(),
+  calledTool: import_zod69.z.object({ name: import_zod69.z.string().min(1), times: EvalTimesExprSchema.optional() }).strict().optional(),
+  toolOrder: import_zod69.z.array(import_zod69.z.string().min(1)).optional(),
+  forbiddenTools: import_zod69.z.array(import_zod69.z.string().min(1)).optional(),
+  calledSubagent: import_zod69.z.object({ name: import_zod69.z.string().min(1).optional(), times: EvalTimesExprSchema.optional() }).strict().optional(),
+  usedNoTools: import_zod69.z.boolean().optional(),
+  loadedSkill: import_zod69.z.string().min(1).optional(),
+  maxToolCalls: import_zod69.z.number().int().positive().optional(),
   commandPatterns: EvalPatternRulesSchema.optional(),
   toolInputPatterns: EvalPatternRulesSchema.optional()
 }).strict();
-var EvalTranscriptGraderSchema = import_zod68.z.object({
-  type: import_zod68.z.literal("transcript"),
+var EvalTranscriptGraderSchema = import_zod69.z.object({
+  type: import_zod69.z.literal("transcript"),
   label: EvalSlugSchema.optional(),
   severity: EvalSeveritySchema.optional(),
   // 缺省 gate
-  online: import_zod68.z.boolean().optional(),
+  online: import_zod69.z.boolean().optional(),
+  /**
+   * T2 真·多轮：只对第 `turn` 轮（0-based，指向 `case.turns` 的下标）的轨迹
+   * 断言——可以表达"第二轮才调用 run_sql"。缺省 = 整个 trial 的合并轨迹
+   * （全部轮的工具按序拼接，终态取最后一轮）。executor 保证走到 grader 的
+   * trial 中间轮恒为 completed（非末轮非 completed 直接整 trial 报 infra
+   * 错，不会被末轮掩盖），所以缺省 grader 看到的末轮终态就是真实终态；
+   * `turn` 的价值在**按轮收窄工具断言**，不再承担防掩盖职责。上界
+   * （< turns.length）在 EvalSuiteSchema 的 superRefine 校验（需要 case 的
+   * turns 上下文；单 parse 一个 grader 不带上界，越界到 gradeTranscript
+   * 才 errored——已知取舍）。
+   */
+  turn: import_zod69.z.number().int().min(0).optional(),
   expect: EvalTranscriptExpectSchema
 }).strict();
-var EvalFileEntrySchema = import_zod68.z.object({
+var EvalFileEntrySchema = import_zod69.z.object({
   path: EvalRelativePathSchema,
-  mustMatch: import_zod68.z.array(import_zod68.z.string()).optional(),
-  mustNotMatch: import_zod68.z.array(import_zod68.z.string()).optional()
+  mustMatch: import_zod69.z.array(import_zod69.z.string()).optional(),
+  mustNotMatch: import_zod69.z.array(import_zod69.z.string()).optional()
 }).strict();
-var EvalFileShorthandExpectSchema = import_zod68.z.object({
-  includes: import_zod68.z.string().optional(),
-  equals: import_zod68.z.string().optional(),
-  matches: import_zod68.z.string().optional()
+var EvalFileShorthandExpectSchema = import_zod69.z.object({
+  includes: import_zod69.z.string().optional(),
+  equals: import_zod69.z.string().optional(),
+  matches: import_zod69.z.string().optional()
   // 正则字符串
 }).strict();
-var EvalFileGraderSchema = import_zod68.z.object({
-  type: import_zod68.z.literal("file"),
+var EvalFileGraderSchema = import_zod69.z.object({
+  type: import_zod69.z.literal("file"),
   label: EvalSlugSchema.optional(),
   severity: EvalSeveritySchema.optional(),
   // 缺省 gate
-  online: import_zod68.z.boolean().optional(),
+  online: import_zod69.z.boolean().optional(),
   // 多文件形式
-  files: import_zod68.z.array(EvalFileEntrySchema).min(1).optional(),
+  files: import_zod69.z.array(EvalFileEntrySchema).min(1).optional(),
   // 简写形式
   path: EvalRelativePathSchema.optional(),
   expect: EvalFileShorthandExpectSchema.optional()
 }).strict();
-var EvalLlmGraderSchema = import_zod68.z.object({
-  type: import_zod68.z.literal("llm"),
+var EvalLlmGraderSchema = import_zod69.z.object({
+  type: import_zod69.z.literal("llm"),
   label: EvalSlugSchema.optional(),
   severity: EvalSeveritySchema.optional(),
   // 缺省 soft
-  online: import_zod68.z.boolean().optional(),
+  online: import_zod69.z.boolean().optional(),
   rubric: EvalRelativePathSchema.refine((p) => p.endsWith(".md"), {
     message: "rubric must be a relative .md path within the suite"
   }),
-  dimensions: import_zod68.z.array(import_zod68.z.string().min(1)).optional(),
-  threshold: import_zod68.z.number().min(0).max(1),
-  graderVersion: import_zod68.z.number().int().positive()
+  dimensions: import_zod69.z.array(import_zod69.z.string().min(1)).optional(),
+  threshold: import_zod69.z.number().min(0).max(1),
+  graderVersion: import_zod69.z.number().int().positive()
 }).strict();
-var EvalScriptExpectSchema = import_zod68.z.object({
-  exitCode: import_zod68.z.number().int().optional(),
+var EvalScriptExpectSchema = import_zod69.z.object({
+  exitCode: import_zod69.z.number().int().optional(),
   // 缺省 0
-  stdoutIncludes: import_zod68.z.array(import_zod68.z.string()).optional()
+  stdoutIncludes: import_zod69.z.array(import_zod69.z.string()).optional()
 }).strict();
-var EvalScriptGraderSchema = import_zod68.z.object({
-  type: import_zod68.z.literal("script"),
+var EvalScriptGraderSchema = import_zod69.z.object({
+  type: import_zod69.z.literal("script"),
   label: EvalSlugSchema.optional(),
   severity: EvalSeveritySchema.optional(),
   // 缺省 gate
-  online: import_zod68.z.boolean().optional(),
-  run: import_zod68.z.string().min(1),
-  timeout: import_zod68.z.number().int().positive().max(EVAL_MAX_TIMEOUT_SECONDS).optional(),
+  online: import_zod69.z.boolean().optional(),
+  run: import_zod69.z.string().min(1),
+  timeout: import_zod69.z.number().int().positive().max(EVAL_MAX_TIMEOUT_SECONDS).optional(),
   expect: EvalScriptExpectSchema.optional()
 }).strict();
-var EvalGraderSpecSchema = import_zod68.z.discriminatedUnion("type", [
+var EvalGraderSpecSchema = import_zod69.z.discriminatedUnion("type", [
   EvalTranscriptGraderSchema,
   EvalFileGraderSchema,
   EvalLlmGraderSchema,
   EvalScriptGraderSchema
 ]);
-var EvalFixtureWorkspaceSchema = import_zod68.z.object({
-  repo: import_zod68.z.string().url(),
-  ref: import_zod68.z.string().min(1)
+var EvalFixtureWorkspaceSchema = import_zod69.z.object({
+  repo: import_zod69.z.string().url(),
+  ref: import_zod69.z.string().min(1)
 }).strict();
-var EvalFixtureFileSchema = import_zod68.z.object({
+var EvalFixtureFileSchema = import_zod69.z.object({
   path: EvalRelativePathSchema,
-  content: import_zod68.z.string()
+  content: import_zod69.z.string()
 }).strict();
-var EvalFixturesSchema = import_zod68.z.object({
+var EvalFixturesSchema = import_zod69.z.object({
   workspace: EvalFixtureWorkspaceSchema.optional(),
-  files: import_zod68.z.array(EvalFixtureFileSchema).optional()
+  files: import_zod69.z.array(EvalFixtureFileSchema).optional()
 }).strict();
-var EvalAgentOverridesSchema = import_zod68.z.object({
+var EvalAgentOverridesSchema = import_zod69.z.object({
   /**
    * 覆盖被测 agent 的模型。**被测 model 是 case 级可变的**：最终生效值 =
    * `agentOverrides.model ?? agent 默认 model`，故同一份卷不同 case 的被测
@@ -8359,33 +8417,51 @@ var EvalAgentOverridesSchema = import_zod68.z.object({
    * 先经 ModelGate 归一为 canonical id 再比较——**需运行时上下文，故不在本零依赖
    * 契约层做，留给 T3/T4 resolve 层的 400**。
    */
-  model: import_zod68.z.string().min(1).optional(),
-  skills: import_zod68.z.array(import_zod68.z.string().min(1)).optional(),
-  mcpServers: import_zod68.z.array(import_zod68.z.string().min(1)).optional(),
-  systemPromptAppend: import_zod68.z.string().optional()
+  model: import_zod69.z.string().min(1).optional(),
+  /**
+   * T1 语义（减法白名单）：把 revision 解析出的 skills **收窄**为名单内的
+   * 子集（按 `EnabledSkill.rushSkillName` 匹配——即 agent skills.json 里写的
+   * 名字）。`[]` = 全部禁用（合法的消融测试）。名单里的名字一个都匹配不上 →
+   * 执行层 infrastructure error（fail-loud：拼错名字静默测了个没装 skill 的
+   * agent，是假红灯）。**不能加塞** revision 未声明的 skill——eval 测的是
+   * 「已发布的 agent」，不是「一个不存在的配置」。
+   */
+  skills: import_zod69.z.array(import_zod69.z.string().min(1)).optional(),
+  /**
+   * T1 语义（减法白名单）：把 revision 解析出的 mcpServers **收窄**为名单内
+   * 的子集（按 runtime `.mcp.json` 的 server 键名匹配，即 agent 实际运行的
+   * server 名）。匹配规则与 fail-loud 姿态同 `skills`。stdio transport 的
+   * server 仍受 `allowStdioMcp` 总闸约束（默认不注入）。
+   */
+  mcpServers: import_zod69.z.array(import_zod69.z.string().min(1)).optional(),
+  /**
+   * T1 语义：追加在被测 agent 冻结 systemPrompt 之后的指令块（`\n\n` 拼接），
+   * 例如注入 case 特有的输出格式要求。不能替换（替换 = 测别的 agent）。
+   */
+  systemPromptAppend: import_zod69.z.string().optional()
 }).strict();
-var EvalCaseOriginSchema = import_zod68.z.object({
-  sessionId: import_zod68.z.string().min(1),
-  capturedAt: import_zod68.z.string().min(1)
+var EvalCaseOriginSchema = import_zod69.z.object({
+  sessionId: import_zod69.z.string().min(1),
+  capturedAt: import_zod69.z.string().min(1)
 }).strict();
-var EvalCaseSchema = import_zod68.z.object({
+var EvalCaseSchema = import_zod69.z.object({
   id: EvalSlugSchema,
-  description: import_zod68.z.string().optional(),
-  turns: import_zod68.z.array(import_zod68.z.object({ user: import_zod68.z.string().min(1) }).strict()).min(1),
+  description: import_zod69.z.string().optional(),
+  turns: import_zod69.z.array(import_zod69.z.object({ user: import_zod69.z.string().min(1) }).strict()).min(1),
   fixtures: EvalFixturesSchema.optional(),
   agentOverrides: EvalAgentOverridesSchema.optional(),
-  timeout: import_zod68.z.number().int().positive().max(EVAL_MAX_TIMEOUT_SECONDS).optional(),
-  maxRetries: import_zod68.z.number().int().min(0).max(EVAL_MAX_RETRIES).optional(),
-  trials: import_zod68.z.number().int().min(1).max(EVAL_MAX_TRIALS).optional(),
+  timeout: import_zod69.z.number().int().positive().max(EVAL_MAX_TIMEOUT_SECONDS).optional(),
+  maxRetries: import_zod69.z.number().int().min(0).max(EVAL_MAX_RETRIES).optional(),
+  trials: import_zod69.z.number().int().min(1).max(EVAL_MAX_TRIALS).optional(),
   // U1，默认 1
   passPolicy: EvalPassPolicySchema.optional(),
   // U1，缺省按 purpose
   origin: EvalCaseOriginSchema.optional(),
-  allowStdioMcp: import_zod68.z.boolean().optional(),
+  allowStdioMcp: import_zod69.z.boolean().optional(),
   // 默认 false（§2.1.1 副作用面）
-  graders: import_zod68.z.array(EvalGraderSpecSchema).min(1)
+  graders: import_zod69.z.array(EvalGraderSpecSchema).min(1)
 }).strict();
-var EvalSuiteDefaultsSchema = import_zod68.z.object({
+var EvalSuiteDefaultsSchema = import_zod69.z.object({
   /**
    * llm grader 的裁判模型。**仅 suite 级、不可 case/grader 级覆盖**（也不在
    * `EvalAgentOverridesSchema` 白名单里）。
@@ -8407,27 +8483,27 @@ var EvalSuiteDefaultsSchema = import_zod68.z.object({
    * 兑现留给 T7（llm grader 实现），届时大概率取当时最合适的 judge 且做成运行面
    * 可配置，而非硬编码进契约。
    */
-  judgeModel: import_zod68.z.string().min(1).optional(),
-  timeout: import_zod68.z.number().int().positive().max(EVAL_MAX_TIMEOUT_SECONDS).optional(),
-  maxConcurrency: import_zod68.z.number().int().positive().optional()
+  judgeModel: import_zod69.z.string().min(1).optional(),
+  timeout: import_zod69.z.number().int().positive().max(EVAL_MAX_TIMEOUT_SECONDS).optional(),
+  maxConcurrency: import_zod69.z.number().int().positive().optional()
 }).strict();
 var byteLen = (s) => new TextEncoder().encode(s).length;
-var EvalSuiteSchema = import_zod68.z.object({
-  apiVersion: import_zod68.z.literal(EVAL_SUITE_API_VERSION),
-  kind: import_zod68.z.literal(EVAL_SUITE_KIND),
+var EvalSuiteSchema = import_zod69.z.object({
+  apiVersion: import_zod69.z.literal(EVAL_SUITE_API_VERSION),
+  kind: import_zod69.z.literal(EVAL_SUITE_KIND),
   purpose: EvalSuitePurposeSchema.optional(),
   // U2，默认 regression
   skip: EvalSuiteSkipSchema.optional(),
   // §4 声明跳过（带必填理由）
   defaults: EvalSuiteDefaultsSchema.optional(),
-  cases: import_zod68.z.array(EvalCaseSchema).min(1)
+  cases: import_zod69.z.array(EvalCaseSchema).min(1)
 }).strict().superRefine((suite, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   suite.cases.forEach((c, ci) => {
     var _a, _b;
     if (seen.has(c.id)) {
       ctx.addIssue({
-        code: import_zod68.z.ZodIssueCode.custom,
+        code: import_zod69.z.ZodIssueCode.custom,
         path: ["cases", ci, "id"],
         message: `duplicate case id "${c.id}" (must be unique within suite)`
       });
@@ -8436,7 +8512,7 @@ var EvalSuiteSchema = import_zod68.z.object({
     c.turns.forEach((t, ti) => {
       if (byteLen(t.user) > EVAL_MAX_TURN_BYTES) {
         ctx.addIssue({
-          code: import_zod68.z.ZodIssueCode.custom,
+          code: import_zod69.z.ZodIssueCode.custom,
           path: ["cases", ci, "turns", ti, "user"],
           message: `turn exceeds ${EVAL_MAX_TURN_BYTES} bytes`
         });
@@ -8448,7 +8524,7 @@ var EvalSuiteSchema = import_zod68.z.object({
       fixtureTotal += size;
       if (size > EVAL_MAX_FIXTURE_FILE_BYTES) {
         ctx.addIssue({
-          code: import_zod68.z.ZodIssueCode.custom,
+          code: import_zod69.z.ZodIssueCode.custom,
           path: ["cases", ci, "fixtures", "files", fi, "content"],
           message: `fixture file exceeds ${EVAL_MAX_FIXTURE_FILE_BYTES} bytes`
         });
@@ -8456,7 +8532,7 @@ var EvalSuiteSchema = import_zod68.z.object({
     });
     if (fixtureTotal > EVAL_MAX_FIXTURE_TOTAL_BYTES) {
       ctx.addIssue({
-        code: import_zod68.z.ZodIssueCode.custom,
+        code: import_zod69.z.ZodIssueCode.custom,
         path: ["cases", ci, "fixtures", "files"],
         message: `fixture files total exceeds ${EVAL_MAX_FIXTURE_TOTAL_BYTES} bytes`
       });
@@ -8467,99 +8543,106 @@ var EvalSuiteSchema = import_zod68.z.object({
         const hasShorthand = g.path != null && g.expect != null;
         if (hasFiles === hasShorthand) {
           ctx.addIssue({
-            code: import_zod68.z.ZodIssueCode.custom,
+            code: import_zod69.z.ZodIssueCode.custom,
             path: ["cases", ci, "graders", gi],
             message: "file grader must use either `files[]` or `{path, expect}`, not both/neither"
           });
         }
       }
+      if (g.type === "transcript" && g.turn != null && g.turn >= c.turns.length) {
+        ctx.addIssue({
+          code: import_zod69.z.ZodIssueCode.custom,
+          path: ["cases", ci, "graders", gi, "turn"],
+          message: `transcript grader turn=${g.turn} is out of range (case has ${c.turns.length} turn(s); 0-based)`
+        });
+      }
     });
   });
 });
-var ScriptEvidenceSchema = import_zod68.z.discriminatedUnion("kind", [
-  import_zod68.z.object({
-    kind: import_zod68.z.literal("executed"),
+var ScriptEvidenceSchema = import_zod69.z.discriminatedUnion("kind", [
+  import_zod69.z.object({
+    kind: import_zod69.z.literal("executed"),
     // A1
-    exitCode: import_zod68.z.number().int(),
-    stdoutTailRef: import_zod68.z.string().optional(),
+    exitCode: import_zod69.z.number().int(),
+    stdoutTailRef: import_zod69.z.string().optional(),
     // 超限内容走 OSS ref
-    durationMs: import_zod68.z.number().int().nonnegative()
+    durationMs: import_zod69.z.number().int().nonnegative()
   }).strict(),
-  import_zod68.z.object({
-    kind: import_zod68.z.literal("capability_unavailable"),
+  import_zod69.z.object({
+    kind: import_zod69.z.literal("capability_unavailable"),
     // A0
-    capability: import_zod68.z.literal("script_grader"),
-    phase: import_zod68.z.literal("A0")
+    capability: import_zod69.z.literal("script_grader"),
+    phase: import_zod69.z.literal("A0")
   }).strict()
 ]);
-var EvalGraderEvidenceSchema = import_zod68.z.discriminatedUnion("type", [
-  import_zod68.z.object({
-    type: import_zod68.z.literal("transcript"),
-    matchedEventIds: import_zod68.z.array(import_zod68.z.string()).optional(),
-    violatedCheck: import_zod68.z.string().optional()
+var EvalGraderEvidenceSchema = import_zod69.z.discriminatedUnion("type", [
+  import_zod69.z.object({
+    type: import_zod69.z.literal("transcript"),
+    matchedEventIds: import_zod69.z.array(import_zod69.z.string()).optional(),
+    violatedCheck: import_zod69.z.string().optional()
   }).strict(),
-  import_zod68.z.object({
-    type: import_zod68.z.literal("file"),
-    path: import_zod68.z.string(),
-    excerpt: import_zod68.z.string().max(2048).optional()
+  import_zod69.z.object({
+    type: import_zod69.z.literal("file"),
+    path: import_zod69.z.string(),
+    excerpt: import_zod69.z.string().max(2048).optional()
     // ≤2KB
   }).strict(),
-  import_zod68.z.object({
-    type: import_zod68.z.literal("llm"),
-    judgeModel: import_zod68.z.string(),
-    rubricSha: import_zod68.z.string(),
+  import_zod69.z.object({
+    type: import_zod69.z.literal("llm"),
+    judgeModel: import_zod69.z.string(),
+    rubricSha: import_zod69.z.string(),
     // U5：离散档位 + 锚点文本（不是换算后小数）
-    dimensionScores: import_zod68.z.record(import_zod68.z.string(), import_zod68.z.unknown()).optional(),
-    judgeOutputRef: import_zod68.z.string().optional()
+    dimensionScores: import_zod69.z.record(import_zod69.z.string(), import_zod69.z.unknown()).optional(),
+    judgeOutputRef: import_zod69.z.string().optional()
     // judge 原始输出 OSS ref
   }).strict(),
-  import_zod68.z.object({ type: import_zod68.z.literal("script"), evidence: ScriptEvidenceSchema }).strict()
+  import_zod69.z.object({ type: import_zod69.z.literal("script"), evidence: ScriptEvidenceSchema }).strict()
 ]);
-var GraderVerdictSchema = import_zod68.z.object({
-  graderIndex: import_zod68.z.number().int().nonnegative(),
-  graderKey: import_zod68.z.string(),
+var GraderVerdictSchema = import_zod69.z.object({
+  graderIndex: import_zod69.z.number().int().nonnegative(),
+  graderKey: import_zod69.z.string(),
   type: EvalGraderTypeSchema,
   severity: EvalSeveritySchema,
   // resolve 后终值
-  label: import_zod68.z.string().optional(),
+  label: import_zod69.z.string().optional(),
   status: EvalGraderStatusSchema,
   errorClass: EvalErrorClassSchema.optional(),
   // status=errored 时
   errorCode: EvalErrorCodeSchema.optional(),
   // status=errored 时
-  score: import_zod68.z.number().nullable(),
+  score: import_zod69.z.number().nullable(),
   // llm=0~1；二值 grader=null
-  threshold: import_zod68.z.number().optional(),
-  reason: import_zod68.z.string(),
+  threshold: import_zod69.z.number().optional(),
+  reason: import_zod69.z.string(),
   evidence: EvalGraderEvidenceSchema.optional(),
-  graderVersion: import_zod68.z.number().int().optional(),
-  engineVersion: import_zod68.z.string(),
+  graderVersion: import_zod69.z.number().int().optional(),
+  engineVersion: import_zod69.z.string(),
   // 平台 grader 实现版本，基线口径用
-  durationMs: import_zod68.z.number().int().nonnegative().optional()
+  durationMs: import_zod69.z.number().int().nonnegative().optional()
 }).strict();
-var EvalCaseResultSchema = import_zod68.z.object({
-  caseId: import_zod68.z.string(),
-  trial: import_zod68.z.number().int().nonnegative(),
+var EvalCaseResultSchema = import_zod69.z.object({
+  caseId: import_zod69.z.string(),
+  trial: import_zod69.z.number().int().nonnegative(),
   // U1，online_sample 恒 0
-  attempt: import_zod68.z.number().int().nonnegative(),
+  attempt: import_zod69.z.number().int().nonnegative(),
   // 基础设施重试序
-  sessionId: import_zod68.z.string().optional(),
+  sessionId: import_zod69.z.string().optional(),
   verdict: EvalCaseVerdictSchema,
-  caseDefinitionDigest: import_zod68.z.string(),
+  caseDefinitionDigest: import_zod69.z.string(),
   errorClass: EvalErrorClassSchema.optional(),
   errorCode: EvalErrorCodeSchema.optional(),
-  softMisses: import_zod68.z.array(import_zod68.z.string()),
-  softIncomplete: import_zod68.z.array(import_zod68.z.string()),
-  graders: import_zod68.z.array(GraderVerdictSchema),
-  resolvedRef: import_zod68.z.string().optional()
+  softMisses: import_zod69.z.array(import_zod69.z.string()),
+  softIncomplete: import_zod69.z.array(import_zod69.z.string()),
+  graders: import_zod69.z.array(GraderVerdictSchema),
+  resolvedRef: import_zod69.z.string().optional()
   // fixtures.workspace.ref → commit SHA
 }).strict();
-var EvalRunSummarySchema = import_zod68.z.object({
-  total: import_zod68.z.number().int().nonnegative(),
-  passed: import_zod68.z.number().int().nonnegative(),
-  failed: import_zod68.z.number().int().nonnegative(),
-  errored: import_zod68.z.number().int().nonnegative(),
-  gatePass: import_zod68.z.boolean(),
+var EvalRunSummarySchema = import_zod69.z.object({
+  total: import_zod69.z.number().int().nonnegative(),
+  passed: import_zod69.z.number().int().nonnegative(),
+  failed: import_zod69.z.number().int().nonnegative(),
+  errored: import_zod69.z.number().int().nonnegative(),
+  gatePass: import_zod69.z.boolean(),
   // 正向断言：全部 case 的全部 gate grader 显式 passed
   /**
    * v1.2：本 run 参与门禁的 grader 总数。零 gate grader 时 `gatePass` 按「真空为真」
@@ -8567,116 +8650,116 @@ var EvalRunSummarySchema = import_zod68.z.object({
    * 本字段让使用者一眼分辨「真的全部通过」与「压根没有门禁断言」。
    * optional：老数据无此字段。
    */
-  gateGraderCount: import_zod68.z.number().int().nonnegative().optional(),
+  gateGraderCount: import_zod69.z.number().int().nonnegative().optional(),
   /**
    * v1.2：有多少 case 一个 gate grader 都没有（各自「真空为真」）。`gateGraderCount`
    * 是 sum，只能答「全 run 有没有任何门禁断言」；本字段答「是否每个 case 都有」——
    * `gatePass=true` 但本值 > 0 = 有 case 无门禁却被算作通过（case 级假绿）。optional：老数据无。
    */
-  casesWithoutGateGrader: import_zod68.z.number().int().nonnegative().optional(),
-  errorSummary: import_zod68.z.object({
-    capabilityUnavailable: import_zod68.z.number().int().nonnegative(),
-    infrastructureError: import_zod68.z.number().int().nonnegative(),
+  casesWithoutGateGrader: import_zod69.z.number().int().nonnegative().optional(),
+  errorSummary: import_zod69.z.object({
+    capabilityUnavailable: import_zod69.z.number().int().nonnegative(),
+    infrastructureError: import_zod69.z.number().int().nonnegative(),
     /** v1.2：judge 未能给出结论（gate llm UNKNOWN）。optional：老数据无此字段。 */
-    indeterminate: import_zod68.z.number().int().nonnegative().optional(),
+    indeterminate: import_zod69.z.number().int().nonnegative().optional(),
     /** v1.2：定义写错（自评防护 EVAL_SELF_EVAL_FORBIDDEN）。optional：老数据无此字段。 */
-    invalidDefinition: import_zod68.z.number().int().nonnegative().optional()
+    invalidDefinition: import_zod69.z.number().int().nonnegative().optional()
   }).loose().optional()
 }).loose();
 var EvalRunSummaryWriteSchema = EvalRunSummarySchema.extend({
   errorSummary: EvalRunSummarySchema.shape.errorSummary.unwrap().strict().optional()
 }).strict();
-var EvalSuiteRefSchema = import_zod68.z.object({
-  source: import_zod68.z.enum(["package", "repo"]),
-  digest: import_zod68.z.string().min(1),
-  path: import_zod68.z.string().min(1)
+var EvalSuiteRefSchema = import_zod69.z.object({
+  source: import_zod69.z.enum(["package", "repo"]),
+  digest: import_zod69.z.string().min(1),
+  path: import_zod69.z.string().min(1)
 }).strict();
-var CreateEvalRunRequestSchema = import_zod68.z.object({
-  agent: import_zod68.z.string().min(1),
+var CreateEvalRunRequestSchema = import_zod69.z.object({
+  agent: import_zod69.z.string().min(1),
   // A0 只打 test stage（§9 非目标：不做 prod 直评）。用 enum 而非 literal——
   // 将来放开 staging/prod 时「enum 加值」是非破坏性变更，literal 变 enum 才是
   // 破坏性变更（T1 评审建议，见设计文档 §2.1.6）。
-  stage: import_zod68.z.enum(["test"]),
+  stage: import_zod69.z.enum(["test"]),
   suiteRef: EvalSuiteRefSchema.optional(),
   // 缺省=目标 Revision 绑定的 suite
-  caseIds: import_zod68.z.array(EvalSlugSchema).optional(),
-  strict: import_zod68.z.boolean().optional()
+  caseIds: import_zod69.z.array(EvalSlugSchema).optional(),
+  strict: import_zod69.z.boolean().optional()
 }).strict();
-var CreateEvalRunResponseSchema = import_zod68.z.object({ runId: import_zod68.z.string().min(1) }).strict();
-var CancelEvalRunResponseSchema = import_zod68.z.object({ runId: import_zod68.z.string().min(1), cancelled: import_zod68.z.boolean() }).strict();
-var EvalRunViewSchema = import_zod68.z.object({
-  runId: import_zod68.z.string(),
+var CreateEvalRunResponseSchema = import_zod69.z.object({ runId: import_zod69.z.string().min(1) }).strict();
+var CancelEvalRunResponseSchema = import_zod69.z.object({ runId: import_zod69.z.string().min(1), cancelled: import_zod69.z.boolean() }).strict();
+var EvalRunViewSchema = import_zod69.z.object({
+  runId: import_zod69.z.string(),
   status: EvalRunStatusSchema,
-  agent: import_zod68.z.string(),
-  revisionId: import_zod68.z.string(),
-  stage: import_zod68.z.string(),
+  agent: import_zod69.z.string(),
+  revisionId: import_zod69.z.string(),
+  stage: import_zod69.z.string(),
   suiteRef: EvalSuiteRefSchema,
-  strict: import_zod68.z.boolean(),
+  strict: import_zod69.z.boolean(),
   trigger: EvalTriggerSchema,
-  startedAt: import_zod68.z.string().optional(),
-  completedAt: import_zod68.z.string().optional(),
-  cases: import_zod68.z.array(EvalCaseResultSchema),
+  startedAt: import_zod69.z.string().optional(),
+  completedAt: import_zod69.z.string().optional(),
+  cases: import_zod69.z.array(EvalCaseResultSchema),
   summary: EvalRunSummarySchema
 }).strict();
-var EvalRunListItemSchema = import_zod68.z.object({
-  runId: import_zod68.z.string(),
+var EvalRunListItemSchema = import_zod69.z.object({
+  runId: import_zod69.z.string(),
   status: EvalRunStatusSchema,
-  agent: import_zod68.z.string(),
-  revisionId: import_zod68.z.string(),
-  stage: import_zod68.z.string(),
+  agent: import_zod69.z.string(),
+  revisionId: import_zod69.z.string(),
+  stage: import_zod69.z.string(),
   trigger: EvalTriggerSchema,
-  startedAt: import_zod68.z.string().optional(),
-  completedAt: import_zod68.z.string().optional(),
+  startedAt: import_zod69.z.string().optional(),
+  completedAt: import_zod69.z.string().optional(),
   summary: EvalRunSummarySchema
 }).strict();
-var EvalRunListResponseSchema = import_zod68.z.object({
-  items: import_zod68.z.array(EvalRunListItemSchema),
-  nextCursor: import_zod68.z.string().optional()
+var EvalRunListResponseSchema = import_zod69.z.object({
+  items: import_zod69.z.array(EvalRunListItemSchema),
+  nextCursor: import_zod69.z.string().optional()
 }).strict();
 var PIPELINE_COMMIT_SHA_RE = /^[0-9a-f]{7,64}$/i;
-var CommitShaSchema = import_zod69.z.string().regex(PIPELINE_COMMIT_SHA_RE, {
+var CommitShaSchema = import_zod70.z.string().regex(PIPELINE_COMMIT_SHA_RE, {
   message: "commitSha must be 7-64 hexadecimal characters"
 });
 var PIPELINE_FULL_COMMIT_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
-var FullCommitShaSchema = import_zod69.z.string().regex(PIPELINE_FULL_COMMIT_SHA_RE, {
+var FullCommitShaSchema = import_zod70.z.string().regex(PIPELINE_FULL_COMMIT_SHA_RE, {
   message: "commitSha must be a full 40- or 64-character hexadecimal SHA (short prefixes cannot anchor a release)"
 });
 var PIPELINE_TRIGGERED_REF_MAX_LENGTH = 512;
-var TriggeredRefSchema = import_zod69.z.string().min(1).max(PIPELINE_TRIGGERED_REF_MAX_LENGTH);
-var IsoTimestampSchema = import_zod69.z.string().datetime({ offset: true });
+var TriggeredRefSchema = import_zod70.z.string().min(1).max(PIPELINE_TRIGGERED_REF_MAX_LENGTH);
+var IsoTimestampSchema = import_zod70.z.string().datetime({ offset: true });
 var NullableIsoTimestampSchema = IsoTimestampSchema.nullable();
-var PipelineTriggerSchema = import_zod69.z.enum(PIPELINE_TRIGGERS);
-var PipelineRunStatusSchema = import_zod69.z.enum(PIPELINE_RUN_STATUSES);
-var PipelineStepSchema = import_zod69.z.enum(PIPELINE_STEPS);
-var PipelineStepStatusSchema = import_zod69.z.enum(PIPELINE_STEP_STATUSES);
-var PipelineErrorCodeSchema = import_zod69.z.string().min(1).nullable();
-var ListPipelineRunsQuerySchema = import_zod69.z.object({
-  projectId: import_zod69.z.string().uuid(),
-  limit: import_zod69.z.coerce.number().int().min(1).max(200).default(50)
-}).strict();
-var NullableTriggeredRefSchema = import_zod69.z.string().nullable().optional();
-var PipelineRunListItemSchema = import_zod69.z.object({
-  id: import_zod69.z.string().uuid(),
-  commitSha: import_zod69.z.string(),
-  commitMessage: import_zod69.z.string().nullable(),
+var PipelineTriggerSchema = import_zod70.z.enum(PIPELINE_TRIGGERS);
+var PipelineRunStatusSchema = import_zod70.z.enum(PIPELINE_RUN_STATUSES);
+var PipelineStepSchema = import_zod70.z.enum(PIPELINE_STEPS);
+var PipelineStepStatusSchema = import_zod70.z.enum(PIPELINE_STEP_STATUSES);
+var PipelineErrorCodeSchema = import_zod70.z.string().min(1).nullable();
+var ListPipelineRunsQuerySchema = import_zod70.z.object({
+  projectId: import_zod70.z.string().uuid(),
+  limit: import_zod70.z.coerce.number().int().min(1).max(200).default(50)
+}).strict();
+var NullableTriggeredRefSchema = import_zod70.z.string().nullable().optional();
+var PipelineRunListItemSchema = import_zod70.z.object({
+  id: import_zod70.z.string().uuid(),
+  commitSha: import_zod70.z.string(),
+  commitMessage: import_zod70.z.string().nullable(),
   trigger: PipelineTriggerSchema,
   status: PipelineRunStatusSchema,
-  stagesKey: import_zod69.z.string(),
-  attempt: import_zod69.z.number().int().nonnegative(),
-  agentSlugs: import_zod69.z.array(import_zod69.z.string()),
-  createdBy: import_zod69.z.string().nullable(),
+  stagesKey: import_zod70.z.string(),
+  attempt: import_zod70.z.number().int().nonnegative(),
+  agentSlugs: import_zod70.z.array(import_zod70.z.string()),
+  createdBy: import_zod70.z.string().nullable(),
   createdAt: IsoTimestampSchema,
   startedAt: NullableIsoTimestampSchema,
   completedAt: NullableIsoTimestampSchema,
   errorCode: PipelineErrorCodeSchema,
   triggeredRef: NullableTriggeredRefSchema
 }).strict();
-var ListPipelineRunsResponseSchema = import_zod69.z.object({
-  enabled: import_zod69.z.boolean(),
-  items: import_zod69.z.array(PipelineRunListItemSchema)
+var ListPipelineRunsResponseSchema = import_zod70.z.object({
+  enabled: import_zod70.z.boolean(),
+  items: import_zod70.z.array(PipelineRunListItemSchema)
 }).strict();
-var CreatePipelineRunRequestSchema = import_zod69.z.object({
-  projectId: import_zod69.z.string().uuid(),
+var CreatePipelineRunRequestSchema = import_zod70.z.object({
+  projectId: import_zod70.z.string().uuid(),
   commitSha: FullCommitShaSchema,
   /**
    * Explicit re-run: mint `attempt+1` even when the latest run for this
@@ -8685,7 +8768,7 @@ var CreatePipelineRunRequestSchema = import_zod69.z.object({
    * against servers that predate it (`.strict()` on their side). Non-passed
    * terminal runs re-run automatically without this flag (§4).
    */
-  rerun: import_zod69.z.boolean().optional(),
+  rerun: import_zod70.z.boolean().optional(),
   /**
    * The ref the caller resolved `commitSha` from, recorded for display only
    * (see `TriggeredRefSchema`). Optional: a caller that has just a SHA and no
@@ -8698,54 +8781,54 @@ var CreatePipelineRunRequestSchema = import_zod69.z.object({
    */
   triggeredRef: TriggeredRefSchema.optional()
 }).strict();
-var CreatePipelineRunResponseSchema = import_zod69.z.object({
-  runId: import_zod69.z.string().uuid(),
-  deduplicated: import_zod69.z.boolean(),
-  attempt: import_zod69.z.number().int().nonnegative().optional(),
+var CreatePipelineRunResponseSchema = import_zod70.z.object({
+  runId: import_zod70.z.string().uuid(),
+  deduplicated: import_zod70.z.boolean(),
+  attempt: import_zod70.z.number().int().nonnegative().optional(),
   status: PipelineRunStatusSchema.optional()
 });
-var PipelineRunDetailRunSchema = import_zod69.z.object({
-  id: import_zod69.z.string().uuid(),
-  projectId: import_zod69.z.string().uuid(),
-  repoUrl: import_zod69.z.string(),
-  commitSha: import_zod69.z.string(),
-  commitMessage: import_zod69.z.string().nullable(),
+var PipelineRunDetailRunSchema = import_zod70.z.object({
+  id: import_zod70.z.string().uuid(),
+  projectId: import_zod70.z.string().uuid(),
+  repoUrl: import_zod70.z.string(),
+  commitSha: import_zod70.z.string(),
+  commitMessage: import_zod70.z.string().nullable(),
   trigger: PipelineTriggerSchema,
   status: PipelineRunStatusSchema,
-  stagesRequested: import_zod69.z.array(PipelineStepSchema).nullable(),
-  stagesKey: import_zod69.z.string(),
-  attempt: import_zod69.z.number().int().nonnegative(),
-  planJson: import_zod69.z.unknown().nullable(),
+  stagesRequested: import_zod70.z.array(PipelineStepSchema).nullable(),
+  stagesKey: import_zod70.z.string(),
+  attempt: import_zod70.z.number().int().nonnegative(),
+  planJson: import_zod70.z.unknown().nullable(),
   errorCode: PipelineErrorCodeSchema,
-  errorMessage: import_zod69.z.string().nullable(),
-  createdBy: import_zod69.z.string().nullable(),
+  errorMessage: import_zod70.z.string().nullable(),
+  createdBy: import_zod70.z.string().nullable(),
   createdAt: IsoTimestampSchema,
   startedAt: NullableIsoTimestampSchema,
   completedAt: NullableIsoTimestampSchema,
   triggeredRef: NullableTriggeredRefSchema
 }).strict();
-var PipelineRunStepSchema = import_zod69.z.object({
+var PipelineRunStepSchema = import_zod70.z.object({
   step: PipelineStepSchema,
   status: PipelineStepStatusSchema,
-  attempt: import_zod69.z.number().int().nonnegative(),
-  resultJson: import_zod69.z.unknown().nullable(),
+  attempt: import_zod70.z.number().int().nonnegative(),
+  resultJson: import_zod70.z.unknown().nullable(),
   errorCode: PipelineErrorCodeSchema,
-  errorMessage: import_zod69.z.string().nullable(),
+  errorMessage: import_zod70.z.string().nullable(),
   startedAt: NullableIsoTimestampSchema,
   completedAt: NullableIsoTimestampSchema
 }).strict();
-var PipelineRunWorkloadSchema = import_zod69.z.object({
-  agentSlug: import_zod69.z.string(),
-  affectedReason: import_zod69.z.string().nullable(),
-  workloadId: import_zod69.z.string().nullable(),
-  revisionId: import_zod69.z.string().nullable(),
-  repointStatus: import_zod69.z.string().nullable(),
-  freezeStatus: import_zod69.z.string().nullable(),
-  frozenPackageOssUrl: import_zod69.z.string().nullable(),
-  frozenPackageSha256: import_zod69.z.string().nullable(),
-  frozenPackageWarnings: import_zod69.z.array(import_zod69.z.string()).nullable(),
-  evalRunId: import_zod69.z.string().nullable(),
-  evalVerdict: import_zod69.z.string().nullable(),
+var PipelineRunWorkloadSchema = import_zod70.z.object({
+  agentSlug: import_zod70.z.string(),
+  affectedReason: import_zod70.z.string().nullable(),
+  workloadId: import_zod70.z.string().nullable(),
+  revisionId: import_zod70.z.string().nullable(),
+  repointStatus: import_zod70.z.string().nullable(),
+  freezeStatus: import_zod70.z.string().nullable(),
+  frozenPackageOssUrl: import_zod70.z.string().nullable(),
+  frozenPackageSha256: import_zod70.z.string().nullable(),
+  frozenPackageWarnings: import_zod70.z.array(import_zod70.z.string()).nullable(),
+  evalRunId: import_zod70.z.string().nullable(),
+  evalVerdict: import_zod70.z.string().nullable(),
   /**
    * joined | skipped_no_base_revision | skipped_no_image_change | failed.
    *
@@ -8754,7 +8837,7 @@ var PipelineRunWorkloadSchema = import_zod69.z.object({
    * so a client parsing a response from a control-plane that predates these
    * fields must not throw. Absent and null both read as "not reported".
    */
-  joinStatus: import_zod69.z.string().nullable().optional(),
+  joinStatus: import_zod70.z.string().nullable().optional(),
   /**
    * Per-workload failure, so a client can say WHICH agent failed and why —
    * the run/step level only ever counts failures. Deliberately NOT
@@ -8766,16 +8849,16 @@ var PipelineRunWorkloadSchema = import_zod69.z.object({
    * `.max()`-ed here — a schema cap would upgrade "the error text is long"
    * into "the whole response fails to parse".
    */
-  errorCode: import_zod69.z.string().nullable().optional(),
-  errorMessage: import_zod69.z.string().nullable().optional()
+  errorCode: import_zod70.z.string().nullable().optional(),
+  errorMessage: import_zod70.z.string().nullable().optional()
 }).strict();
-var PipelineRunDetailResponseSchema = import_zod69.z.object({
+var PipelineRunDetailResponseSchema = import_zod70.z.object({
   run: PipelineRunDetailRunSchema,
-  steps: import_zod69.z.array(PipelineRunStepSchema),
-  workloads: import_zod69.z.array(PipelineRunWorkloadSchema)
+  steps: import_zod70.z.array(PipelineRunStepSchema),
+  workloads: import_zod70.z.array(PipelineRunWorkloadSchema)
 }).strict();
-var GetPipelinePlanQuerySchema = import_zod69.z.object({
-  projectId: import_zod69.z.string().uuid(),
+var GetPipelinePlanQuerySchema = import_zod70.z.object({
+  projectId: import_zod70.z.string().uuid(),
   commitSha: CommitShaSchema,
   fromSha: CommitShaSchema.optional(),
   /**
@@ -8783,20 +8866,20 @@ var GetPipelinePlanQuerySchema = import_zod69.z.object({
    * Accepted as the STRING "false" because it arrives as a query param; any
    * other value (including absent) means "compute if missing".
    */
-  enqueue: import_zod69.z.enum(["true", "false"]).optional().transform((value) => value !== "false")
+  enqueue: import_zod70.z.enum(["true", "false"]).optional().transform((value) => value !== "false")
 }).strict();
-var PipelinePlanResponseSchema = import_zod69.z.discriminatedUnion("source", [
-  import_zod69.z.object({ source: import_zod69.z.literal("cache"), plan: import_zod69.z.unknown() }).strict(),
-  import_zod69.z.object({
-    source: import_zod69.z.literal("computing"),
-    enqueued: import_zod69.z.boolean(),
+var PipelinePlanResponseSchema = import_zod70.z.discriminatedUnion("source", [
+  import_zod70.z.object({ source: import_zod70.z.literal("cache"), plan: import_zod70.z.unknown() }).strict(),
+  import_zod70.z.object({
+    source: import_zod70.z.literal("computing"),
+    enqueued: import_zod70.z.boolean(),
     // 上一次计算的失败摘要（若有）。默认 enqueue=true 会不断重算，plan 一直
     // "computing" 时失败原本被吞——带上它让轮询者看到「在重试，但上次失败：…」
     // 而不是无限"计算中"（#1346 D4）。
     // 长度上游已有界（plan-cache fail() 落库前截断 2000），这里刻意不设
     // .max()：schema 硬上限会把"错误信息超长"升级成"整个响应 parse 失败"，
     // 让错误路径反过来炸掉主功能。
-    lastError: import_zod69.z.string().nullable().optional()
+    lastError: import_zod70.z.string().nullable().optional()
   }).strict()
 ]);
 var PIPELINE_API_ERROR_CODES = [
@@ -8807,23 +8890,23 @@ var PIPELINE_API_ERROR_CODES = [
   "PIPELINE_RUN_NOT_FOUND",
   "PLAN_NOT_CACHED"
 ];
-var PipelineApiErrorCodeSchema = import_zod69.z.enum(PIPELINE_API_ERROR_CODES);
+var PipelineApiErrorCodeSchema = import_zod70.z.enum(PIPELINE_API_ERROR_CODES);
 var SKILL_NAME_MAX_LENGTH = 200;
 var SKILL_SOURCE_REF_MAX_LENGTH = 512;
 var SKILL_NAME_WHITELIST = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-var SkillNameSchema = import_zod70.z.string().min(1).max(SKILL_NAME_MAX_LENGTH).refine((value) => SKILL_NAME_WHITELIST.test(value), {
+var SkillNameSchema = import_zod71.z.string().min(1).max(SKILL_NAME_MAX_LENGTH).refine((value) => SKILL_NAME_WHITELIST.test(value), {
   message: "skill name must start with [A-Za-z0-9] and contain only [A-Za-z0-9._-] (no path separators, spaces or invisible characters)"
 }).refine((value) => value !== "." && value !== "..", {
   message: "skill name must not be '.' or '..'"
 });
-var SkillSourceRefSchema = import_zod70.z.string().min(1).max(SKILL_SOURCE_REF_MAX_LENGTH);
-var SkillManifestSourceTypeSchema = import_zod70.z.enum(["rush", "github", "gitlab"]);
-var SkillsManifestDefaultsSchema = import_zod70.z.object({
-  installDir: import_zod70.z.string().min(1).max(SKILL_SOURCE_REF_MAX_LENGTH).optional(),
-  targetAgents: import_zod70.z.array(import_zod70.z.string().min(1)).optional(),
-  installMode: import_zod70.z.string().min(1).optional()
+var SkillSourceRefSchema = import_zod71.z.string().min(1).max(SKILL_SOURCE_REF_MAX_LENGTH);
+var SkillManifestSourceTypeSchema = import_zod71.z.enum(["rush", "github", "gitlab"]);
+var SkillsManifestDefaultsSchema = import_zod71.z.object({
+  installDir: import_zod71.z.string().min(1).max(SKILL_SOURCE_REF_MAX_LENGTH).optional(),
+  targetAgents: import_zod71.z.array(import_zod71.z.string().min(1)).optional(),
+  installMode: import_zod71.z.string().min(1).optional()
 }).passthrough();
-var SkillsManifestSchema = import_zod70.z.object({
+var SkillsManifestSchema = import_zod71.z.object({
   /**
    * **必填，刻意不做 `.optional().default({})`**（评审提过，权衡后维持）：
    * 本 schema 是 passthrough 的，若 `skills` 可省略，一个拼错的顶层 key
@@ -8832,27 +8915,27 @@ var SkillsManifestSchema = import_zod70.z.object({
    * 看到一条报错、补上 `"skills": {}`：响的、可恢复的。空清单请显式写
    * `{"skills": {}}`（脚手架生成的就是这个形态）。
    */
-  skills: import_zod70.z.record(SkillNameSchema, SkillSourceRefSchema),
-  registries: import_zod70.z.record(import_zod70.z.string().min(1), import_zod70.z.string().min(1)).optional(),
+  skills: import_zod71.z.record(SkillNameSchema, SkillSourceRefSchema),
+  registries: import_zod71.z.record(import_zod71.z.string().min(1), import_zod71.z.string().min(1)).optional(),
   defaults: SkillsManifestDefaultsSchema.optional()
 }).passthrough();
-var SkillsLockEntrySchema = import_zod70.z.object({
-  source: import_zod70.z.string().min(1).max(SKILL_SOURCE_REF_MAX_LENGTH),
+var SkillsLockEntrySchema = import_zod71.z.object({
+  source: import_zod71.z.string().min(1).max(SKILL_SOURCE_REF_MAX_LENGTH),
   /** 注册表源的精确版本；git 源这里是可读注记（实测常为 `main`）。 */
-  version: import_zod70.z.string().optional(),
+  version: import_zod71.z.string().optional(),
   /** 浮动 ref 的人类可读注记——**绝不参与安装**（D23）。 */
-  ref: import_zod70.z.string().optional(),
-  resolved: import_zod70.z.string().optional(),
+  ref: import_zod71.z.string().optional(),
+  resolved: import_zod71.z.string().optional(),
   /** git 源的钉死点。实测可能为 `""`（缺 commit），由校验层硬拒。 */
-  commit: import_zod70.z.string().optional(),
-  integrity: import_zod70.z.string().optional(),
-  installedAt: import_zod70.z.string().optional()
+  commit: import_zod71.z.string().optional(),
+  integrity: import_zod71.z.string().optional(),
+  installedAt: import_zod71.z.string().optional()
 }).passthrough();
-var SkillsLockSchema = import_zod70.z.object({
-  lockfileVersion: import_zod70.z.number().int().nonnegative().optional(),
-  skills: import_zod70.z.record(SkillNameSchema, SkillsLockEntrySchema)
+var SkillsLockSchema = import_zod71.z.object({
+  lockfileVersion: import_zod71.z.number().int().nonnegative().optional(),
+  skills: import_zod71.z.record(SkillNameSchema, SkillsLockEntrySchema)
 }).passthrough();
-var SkillsManifestErrorCodeSchema = import_zod70.z.enum([
+var SkillsManifestErrorCodeSchema = import_zod71.z.enum([
   /** `skills.json` 语法/结构非法。 */
   "SKILLS_MANIFEST_INVALID",
   /** `skills.lock` 语法/结构非法。 */
@@ -8988,7 +9071,7 @@ var BindingsResource = class {
 };
 
 // src/resources/environments.ts
-var import_zod71 = require("zod");
+var import_zod72 = require("zod");
 
 // src/agent-vocab.ts
 function resolveExclusiveAlias(canonicalKey, canonicalValue, aliasKey, aliasValue) {
@@ -9012,24 +9095,24 @@ function attachAgentAliases(data) {
 }
 
 // src/resources/environments.ts
-var EnvironmentVersionHistorySchema = import_zod71.z.object({
-  versions: import_zod71.z.array(EnvironmentVersionSchema),
-  repoints: import_zod71.z.array(EnvironmentRepointRecordSchema)
+var EnvironmentVersionHistorySchema = import_zod72.z.object({
+  versions: import_zod72.z.array(EnvironmentVersionSchema),
+  repoints: import_zod72.z.array(EnvironmentRepointRecordSchema)
 }).strict();
-var RepointedSlotResultSchema = import_zod71.z.object({
-  workloadId: import_zod71.z.string().uuid(),
+var RepointedSlotResultSchema = import_zod72.z.object({
+  workloadId: import_zod72.z.string().uuid(),
   stage: StageSchema,
-  fromVersion: import_zod71.z.number().int().positive().nullable()
+  fromVersion: import_zod72.z.number().int().positive().nullable()
 }).strict();
-var RepointEnvironmentResultSchema = import_zod71.z.object({
-  toVersion: import_zod71.z.number().int().positive(),
-  repointedSlotCount: import_zod71.z.number().int().nonnegative(),
-  repointedSlots: import_zod71.z.array(RepointedSlotResultSchema)
+var RepointEnvironmentResultSchema = import_zod72.z.object({
+  toVersion: import_zod72.z.number().int().positive(),
+  repointedSlotCount: import_zod72.z.number().int().nonnegative(),
+  repointedSlots: import_zod72.z.array(RepointedSlotResultSchema)
 }).strict();
-var UpdateEnvironmentResultSchema = import_zod71.z.object({
+var UpdateEnvironmentResultSchema = import_zod72.z.object({
   environment: EnvironmentSchema,
-  createdVersion: import_zod71.z.number().int().positive().nullable(),
-  repointedSlotCount: import_zod71.z.number().int().nonnegative()
+  createdVersion: import_zod72.z.number().int().positive().nullable(),
+  repointedSlotCount: import_zod72.z.number().int().nonnegative()
 }).strict();
 function attachAgentAliasesToEach(items) {
   return items.map((item) => attachAgentAliases(item));
@@ -9350,14 +9433,14 @@ var McpDevTicketsResource = class {
 };
 
 // src/resources/memories.ts
-var import_zod72 = require("zod");
+var import_zod73 = require("zod");
 var ListedMemorySchema = AgentMemorySchema.extend({
-  createdAt: import_zod72.z.string(),
-  updatedAt: import_zod72.z.string()
+  createdAt: import_zod73.z.string(),
+  updatedAt: import_zod73.z.string()
 });
-var ListMemoriesResponseSchema = import_zod72.z.object({
-  items: import_zod72.z.array(ListedMemorySchema),
-  nextCursor: import_zod72.z.string().nullish()
+var ListMemoriesResponseSchema = import_zod73.z.object({
+  items: import_zod73.z.array(ListedMemorySchema),
+  nextCursor: import_zod73.z.string().nullish()
 });
 function parseEnvelopeData2(envelope, routeLabel, schema) {
   if (envelope?.data === void 0) {
@@ -9828,7 +9911,7 @@ var ProjectsResource = class {
 };
 
 // src/resources/sessions.ts
-var import_zod73 = require("zod");
+var import_zod74 = require("zod");
 function normalizeSessionRequest(request) {
   const { agentId, versionId, ...rest } = request;
   const workloadId = resolveExclusiveAlias("workloadId", rest.workloadId, "agentId", agentId);
@@ -9853,28 +9936,28 @@ function normalizeSessionRequest(request) {
     ...revisionId !== void 0 ? { revisionId } : {}
   };
 }
-var ListSessionEventsEnvelopeSchema = import_zod73.z.object({
-  data: import_zod73.z.object({ events: import_zod73.z.array(SessionEventSchema) })
-});
-var DeliveryResultEnvelopeSchema = import_zod73.z.object({
-  data: import_zod73.z.object({ delivery: SessionDeliveryEnvelopeSchema.nullable() })
-});
-var SessionArtifactsListEnvelopeSchema = import_zod73.z.object({
-  data: import_zod73.z.object({
-    items: import_zod73.z.array(
-      import_zod73.z.object({
-        id: import_zod73.z.string(),
-        artifactId: import_zod73.z.string().optional(),
-        filename: import_zod73.z.string(),
-        path: import_zod73.z.string(),
-        contentType: import_zod73.z.string(),
-        size: import_zod73.z.number(),
-        turnId: import_zod73.z.string().optional(),
-        messageId: import_zod73.z.string().optional()
+var ListSessionEventsEnvelopeSchema = import_zod74.z.object({
+  data: import_zod74.z.object({ events: import_zod74.z.array(SessionEventSchema) })
+});
+var DeliveryResultEnvelopeSchema = import_zod74.z.object({
+  data: import_zod74.z.object({ delivery: SessionDeliveryEnvelopeSchema.nullable() })
+});
+var SessionArtifactsListEnvelopeSchema = import_zod74.z.object({
+  data: import_zod74.z.object({
+    items: import_zod74.z.array(
+      import_zod74.z.object({
+        id: import_zod74.z.string(),
+        artifactId: import_zod74.z.string().optional(),
+        filename: import_zod74.z.string(),
+        path: import_zod74.z.string(),
+        contentType: import_zod74.z.string(),
+        size: import_zod74.z.number(),
+        turnId: import_zod74.z.string().optional(),
+        messageId: import_zod74.z.string().optional()
       })
     ),
-    partial: import_zod73.z.boolean().optional(),
-    skippedBundles: import_zod73.z.array(import_zod73.z.object({ artifactId: import_zod73.z.string(), reason: import_zod73.z.string() })).optional()
+    partial: import_zod74.z.boolean().optional(),
+    skippedBundles: import_zod74.z.array(import_zod74.z.object({ artifactId: import_zod74.z.string(), reason: import_zod74.z.string() })).optional()
   })
 });
 var SessionsResource = class {
@@ -9897,6 +9980,11 @@ var SessionsResource = class {
         method: "GET",
         signal: options.signal,
         cache: "no-store",
+        // Omitted entirely (not sent as `include=`) unless explicitly
+        // requested — see `GetSessionOptions.include`'s docstring.
+        query: {
+          include: options.include?.length ? options.include.join(",") : void 0
+        },
         headers: {
           "Cache-Control": "no-cache",
           Pragma: "no-cache"
@@ -10039,8 +10127,8 @@ var SessionsResource = class {
    * `GET /api/sessions/:id/events` — cursor-paged read of the session event
    * log (`worker_protocol.*` dispatch markers, `pilot_coder.chunk` streaming
    * chunks, `agent.*` lifecycle events...). Requires scope `runs:stream`.
-   * Poll with `afterEventId` = the last id you have; rows are returned
-   * oldest-first.
+   * Poll with `afterEventId` = the `eventId` of the last event you have
+   * (not its `id`); rows are returned oldest-first.
    */
   async listEvents(sessionId, options = {}) {
     const path = `/api/sessions/${encodeURIComponent(sessionId)}/events`;
@@ -10414,7 +10502,7 @@ var SessionsResource = class {
         }
       }
       const last = events[events.length - 1];
-      if (last) cursor = last.id;
+      if (last) cursor = last.eventId;
       if (Date.now() - startedAt >= timeoutMs) {
         throw new PilotPlatformApiError({
           status: 0,
@@ -10480,11 +10568,11 @@ function sleep(ms, signal) {
 }
 
 // src/resources/workloads.ts
-var import_zod74 = require("zod");
-var CanaryPromoteResponseSchema = import_zod74.z.object({
+var import_zod75 = require("zod");
+var CanaryPromoteResponseSchema = import_zod75.z.object({
   slot: StageSlotViewSchema,
-  fromRevisionId: import_zod74.z.string().uuid(),
-  toRevisionId: import_zod74.z.string().uuid()
+  fromRevisionId: import_zod75.z.string().uuid(),
+  toRevisionId: import_zod75.z.string().uuid()
 }).strict();
 var WorkloadStageCanaryResource = class {
   constructor(client) {