@keystrokehq/keystroke 0.0.0-staging-20260714181321

package/dist/dist-D0P3wUQe.mjs

@@ -0,0 +1,3846 @@
+import { z } from "zod";
+new Set([
+	"hello",
+	"greeting",
+	"greet"
+]);
+/**
+* Set by the platform LLM proxy on inference responses: `byok` when the
+* request was served with the customer's own provider key, else `platform`.
+* The worker-side usage recorder reads it to bill (or not bill) the tokens.
+*/
+const LLM_KEY_SOURCE_HEADER = "x-keystroke-llm-key-source";
+/**
+* Best-effort run attribution the worker sets on LLM proxy requests so the
+* platform can tag gateway-recorded usage to a run for the history UI. Billing
+* never depends on these — a missing or forged value only loses attribution.
+*/
+const LLM_RUN_ID_HEADER = "x-keystroke-run-id";
+const LLM_RUN_KIND_HEADER = "x-keystroke-run-kind";
+/**
+* Marks internal, best-effort model calls (such as chat title generation) that
+* must not create a billable platform usage event.
+*/
+const LLM_SKIP_USAGE_HEADER = "x-keystroke-skip-usage";
+/** Auth, session, and account-entry URL segments. */
+const AUTH_ACCOUNT_SLUGS = [
+	"2fa",
+	"accept-invite",
+	"auth",
+	"authorize",
+	"callback",
+	"callbacks",
+	"confirm-email",
+	"confirmation",
+	"connect",
+	"device",
+	"email-verification",
+	"forgot-password",
+	"invite",
+	"invites",
+	"login",
+	"logout",
+	"magic-link",
+	"mfa",
+	"oauth",
+	"onboarding",
+	"password",
+	"recovery",
+	"register",
+	"reset-password",
+	"saml",
+	"session",
+	"sessions",
+	"sign-in",
+	"sign-up",
+	"signin",
+	"signout",
+	"signup",
+	"sso",
+	"token",
+	"tokens",
+	"unlink",
+	"verify",
+	"verify-email"
+];
+/** Org, workspace, billing, and account-management URL segments. */
+const ORG_ACCOUNT_SLUGS = [
+	"account",
+	"accounts",
+	"billing",
+	"console",
+	"invoice",
+	"invoices",
+	"member",
+	"members",
+	"me",
+	"org",
+	"organization",
+	"organizations",
+	"orgs",
+	"payment",
+	"payments",
+	"plan",
+	"plans",
+	"portal",
+	"preferences",
+	"profile",
+	"settings",
+	"subscription",
+	"subscriptions",
+	"team",
+	"teams",
+	"upgrade",
+	"usage",
+	"user",
+	"users",
+	"workspace",
+	"workspaces"
+];
+/** Product surfaces, resource types, and in-app navigation segments. */
+const PRODUCT_SLUGS = [
+	"action",
+	"actions",
+	"activity",
+	"agent",
+	"agents",
+	"analytics",
+	"app",
+	"apps",
+	"artifact",
+	"artifacts",
+	"assistant",
+	"assistants",
+	"audit",
+	"audit-log",
+	"automation",
+	"automations",
+	"branch",
+	"branches",
+	"canvas",
+	"chat",
+	"chats",
+	"connection",
+	"connections",
+	"create",
+	"credential",
+	"credentials",
+	"dashboard",
+	"deployment",
+	"deployments",
+	"examples",
+	"execute",
+	"execution",
+	"executions",
+	"explore",
+	"get-started",
+	"history",
+	"inbox",
+	"inspector",
+	"integration",
+	"integrations",
+	"library",
+	"logs",
+	"marketplace",
+	"mcp",
+	"mcps",
+	"new",
+	"notifications",
+	"observe",
+	"plugin",
+	"plugins",
+	"primitive",
+	"primitives",
+	"project",
+	"projects",
+	"recents",
+	"registry",
+	"reports",
+	"run",
+	"runs",
+	"runtime",
+	"runtimes",
+	"sandbox",
+	"sandboxes",
+	"search",
+	"skill",
+	"skills",
+	"templates",
+	"thread",
+	"threads",
+	"trigger",
+	"triggers",
+	"version",
+	"versions",
+	"workflow",
+	"workflows"
+];
+/** Marketing, docs, company, and go-to-market URL segments. */
+const MARKETING_SITE_SLUGS = [
+	"about",
+	"affiliates",
+	"ai",
+	"announcements",
+	"anthropic",
+	"blog",
+	"book-demo",
+	"brand",
+	"campaigns",
+	"career",
+	"careers",
+	"case-studies",
+	"casestudies",
+	"changelog",
+	"chatgpt",
+	"chrome-extension",
+	"claude",
+	"codex",
+	"community",
+	"company",
+	"compare",
+	"contact",
+	"contribute",
+	"creators",
+	"customers",
+	"demo",
+	"demos",
+	"discord",
+	"docs",
+	"documentation",
+	"download",
+	"downloads",
+	"dust",
+	"emerging-talent",
+	"engineering-blog",
+	"enterprise",
+	"events",
+	"experts",
+	"extension",
+	"faq",
+	"faqs",
+	"features",
+	"forum",
+	"glean",
+	"grok",
+	"guide",
+	"guides",
+	"gumloop",
+	"handbook",
+	"help",
+	"help-center",
+	"home",
+	"how-it-works",
+	"howitworks",
+	"inspo",
+	"intern",
+	"investors",
+	"jobs",
+	"legal",
+	"lindy",
+	"llm",
+	"llms",
+	"love",
+	"make",
+	"manifesto",
+	"media",
+	"merch",
+	"mission",
+	"mobile",
+	"models",
+	"n8n",
+	"news",
+	"newsroom",
+	"open",
+	"open-claw",
+	"open-source",
+	"openai",
+	"our-story",
+	"overview",
+	"partners",
+	"pi",
+	"pipedream",
+	"platform",
+	"press",
+	"press-kit",
+	"pricing",
+	"privacy",
+	"product",
+	"products",
+	"provider",
+	"providers",
+	"quick-start",
+	"quickstart",
+	"refer",
+	"relay",
+	"relay-app",
+	"reporting",
+	"request-demo",
+	"resources",
+	"roadmap",
+	"schedule-demo",
+	"security",
+	"solutions",
+	"stack-ai",
+	"stackai",
+	"startup",
+	"startups",
+	"status",
+	"stories",
+	"story",
+	"students",
+	"support",
+	"swag",
+	"switch",
+	"talent",
+	"terms",
+	"testimonials",
+	"thesis",
+	"tines",
+	"trust",
+	"tutorials",
+	"university",
+	"use-case",
+	"use-cases",
+	"usecases",
+	"versus",
+	"vellum",
+	"vs",
+	"webinars",
+	"workato",
+	"xai",
+	"yc",
+	"zapier"
+];
+/** Integrations, competitors, and partner brand slugs (marketing / integration pages). */
+const INTEGRATION_BRAND_SLUGS = [
+	"airtable",
+	"asana",
+	"aws",
+	"azure",
+	"bun",
+	"confluence",
+	"copilot",
+	"cursor",
+	"databricks",
+	"figma",
+	"firebase",
+	"fly",
+	"gcp",
+	"gemini",
+	"github",
+	"gitlab",
+	"gmail",
+	"heroku",
+	"hubspot",
+	"huggingface",
+	"jira",
+	"linear",
+	"mailchimp",
+	"meta",
+	"mistral",
+	"mixmax",
+	"monday",
+	"netlify",
+	"neon",
+	"notion",
+	"npm",
+	"outlook",
+	"outreach",
+	"perplexity",
+	"planetscale",
+	"pnpm",
+	"postmark",
+	"ramp",
+	"railway",
+	"render",
+	"resend",
+	"salesforce",
+	"segment",
+	"sendgrid",
+	"shopify",
+	"slack",
+	"snowflake",
+	"stripe",
+	"supabase",
+	"terraform",
+	"trello",
+	"turso",
+	"twilio",
+	"typeform",
+	"vercel",
+	"vscode",
+	"windsurf",
+	"yarn"
+];
+/** Company, team, and department landing-page segments. */
+const COMPANY_TEAM_SLUGS = [
+	"engineers",
+	"engineering",
+	"executives",
+	"hc",
+	"intern",
+	"it",
+	"leadership",
+	"marketing",
+	"ops",
+	"revops",
+	"sales",
+	"services",
+	"tech"
+];
+/** Legal, trust, compliance, and policy URL segments. */
+const LEGAL_TRUST_SLUGS = [
+	"accessibility",
+	"agreement",
+	"a11y",
+	"bug-bounty",
+	"compliance",
+	"cookie-policy",
+	"cookies",
+	"data-use",
+	"disclose",
+	"dpa",
+	"eula",
+	"gdpr",
+	"hipaa",
+	"iso",
+	"msa",
+	"pci",
+	"responsible-disclosure",
+	"sla",
+	"soc2",
+	"tos",
+	"trust-center",
+	"trustcenter",
+	"vulnerability"
+];
+/** Developer, API, CLI, and technical URL segments. */
+const DEVELOPER_TECH_SLUGS = [
+	"api",
+	"api-docs",
+	"cli",
+	"code",
+	"config",
+	"developer",
+	"developer-tools",
+	"developers",
+	"dev-tools",
+	"devtools",
+	"dev",
+	"dev-states",
+	"graphql",
+	"graphql-playground",
+	"mcp-server",
+	"mcp-servers",
+	"openapi",
+	"sdk",
+	"swagger"
+];
+/** Infra, ops, static assets, and system URL segments. */
+const INFRA_SYSTEM_SLUGS = [
+	"acme-challenge",
+	"admin",
+	"apple-app-site-association",
+	"assets",
+	"batch",
+	"cache",
+	"cdn",
+	"cron",
+	"debug",
+	"error",
+	"errors",
+	"favicon",
+	"feed",
+	"files",
+	"health",
+	"healthcheck",
+	"healthz",
+	"hook-resume",
+	"hooks",
+	"internal",
+	"item",
+	"manifest",
+	"metrics",
+	"null",
+	"ping",
+	"prod",
+	"public",
+	"redirect",
+	"robots",
+	"rpc",
+	"rss",
+	"sharer",
+	"sitemap",
+	"staging",
+	"static",
+	"storage",
+	"test",
+	"undefined",
+	"universal",
+	"webhooks",
+	"well-known",
+	"www"
+];
+/** Reserved slugs that are valid org names in theory but blocked for routing safety. */
+const ROUTING_SAFETY_SLUGS = [
+	"alpha",
+	"anonymous",
+	"archive",
+	"archived",
+	"beta",
+	"clone",
+	"copy",
+	"default",
+	"deleted",
+	"demo-org",
+	"draft",
+	"drafts",
+	"duplicate",
+	"early-access",
+	"embed",
+	"embedded",
+	"export",
+	"fork",
+	"free",
+	"guest",
+	"import",
+	"index",
+	"list",
+	"manage",
+	"moderator",
+	"newsletter",
+	"owner",
+	"preview",
+	"previews",
+	"private",
+	"pro",
+	"public-api",
+	"publish",
+	"published",
+	"queue",
+	"remove",
+	"root",
+	"sample",
+	"samples",
+	"selection",
+	"share",
+	"shared",
+	"sponsor",
+	"sponsors",
+	"sponsorship",
+	"subscribe",
+	"super",
+	"superuser",
+	"system",
+	"sys",
+	"test-org",
+	"trash",
+	"unpublish",
+	"unsubscribe",
+	"upload",
+	"uploads",
+	"waitlist",
+	"widget",
+	"widgets",
+	"worker",
+	"workers"
+];
+/**
+* URL segments reserved for global (non-org) routes — cannot be used as an org slug.
+* Prefer adding new entries to the category arrays above; the Set is the enforcement surface.
+*/
+const RESERVED_ORGANIZATION_SLUGS = new Set([
+	...AUTH_ACCOUNT_SLUGS,
+	...ORG_ACCOUNT_SLUGS,
+	...PRODUCT_SLUGS,
+	...MARKETING_SITE_SLUGS,
+	...INTEGRATION_BRAND_SLUGS,
+	...COMPANY_TEAM_SLUGS,
+	...LEGAL_TRUST_SLUGS,
+	...DEVELOPER_TECH_SLUGS,
+	...INFRA_SYSTEM_SLUGS,
+	...ROUTING_SAFETY_SLUGS
+]);
+/**
+* Base slug format: lowercase, 2-64 chars, alphanumeric + dashes.
+*
+* IMPORTANT: this is the schema for *reading* slugs (persisted rows, API
+* responses). It intentionally does NOT enforce the reserved-name list — an org
+* created before a name became reserved must still parse on read. Use
+* `ClaimableOrganizationSlugSchema` to validate slugs a user is trying to claim.
+*/
+const OrganizationSlugSchema = z.string().trim().toLowerCase().min(2, "Slug must be at least 2 characters").max(64, "Slug must be at most 64 characters").regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Use lowercase letters, numbers, and dashes only");
+/**
+* Slug validation for *claiming* a slug (organization create/rename). Adds the
+* reserved-name check on top of the base format. Never use this to parse
+* existing org data, or pre-existing orgs whose slug later became reserved would
+* fail to load.
+*/
+const ClaimableOrganizationSlugSchema = OrganizationSlugSchema.refine((slug) => !RESERVED_ORGANIZATION_SLUGS.has(slug), "This slug is reserved");
+/** Same format as organization slugs — org-scoped, no global reserved list. */
+const ProjectSlugSchema = OrganizationSlugSchema;
+const OrganizationSlugErrorCodeSchema = z.enum([
+	"slug_taken",
+	"slug_reserved",
+	"slug_invalid"
+]);
+const SlugAvailabilityReasonSchema = z.enum([
+	"taken",
+	"reserved",
+	"invalid"
+]);
+z.object({
+	slug: z.string(),
+	available: z.boolean(),
+	reason: SlugAvailabilityReasonSchema.optional(),
+	suggestion: OrganizationSlugSchema.optional()
+});
+z.object({
+	slug: z.string().trim().min(1),
+	excludeOrganizationId: z.string().min(1).optional()
+});
+const ProjectSlugAvailabilityReasonSchema = z.enum(["taken", "invalid"]);
+z.object({
+	slug: z.string(),
+	available: z.boolean(),
+	reason: ProjectSlugAvailabilityReasonSchema.optional(),
+	suggestion: ProjectSlugSchema.optional()
+});
+z.object({
+	slug: z.string().trim().min(1),
+	excludeProjectId: z.string().min(1).optional()
+});
+const ProjectStatusSchema = z.enum([
+	"inactive",
+	"starting",
+	"active",
+	"failed"
+]);
+const OrganizationUserRoleSchema = z.enum([
+	"owner",
+	"admin",
+	"builder"
+]);
+const isoDateTime$7 = z.string().datetime();
+const OrganizationSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	slug: OrganizationSlugSchema,
+	verified: z.boolean(),
+	createdAt: isoDateTime$7,
+	updatedAt: isoDateTime$7
+});
+const ProjectSchema = z.object({
+	id: z.string(),
+	organizationId: z.string(),
+	name: z.string(),
+	slug: ProjectSlugSchema,
+	description: z.string().nullable(),
+	status: ProjectStatusSchema,
+	baseUrl: z.string().nullable(),
+	runtimeId: z.string().nullable(),
+	lastError: z.string().nullable(),
+	createdAt: isoDateTime$7,
+	updatedAt: isoDateTime$7
+});
+const UserOrganizationSchema = z.object({
+	organization: OrganizationSchema,
+	role: OrganizationUserRoleSchema
+});
+UserOrganizationSchema.nullable();
+z.array(UserOrganizationSchema);
+z.object({
+	name: z.string().trim().min(1),
+	/** Format-only at the wire boundary; reserved-name checks run in platform-database. */
+	slug: OrganizationSlugSchema.optional()
+});
+z.object({
+	name: z.string().trim().min(1).optional(),
+	slug: ClaimableOrganizationSlugSchema.optional()
+}).refine((data) => data.name !== void 0 || data.slug !== void 0, { message: "At least one field is required" });
+z.array(ProjectSchema);
+const ProjectListMetricsSchema = z.object({
+	agentCount: z.number(),
+	workflowCount: z.number(),
+	skillCount: z.number(),
+	credentialCount: z.number(),
+	lastDeploymentAt: isoDateTime$7.nullable()
+});
+z.record(z.string(), ProjectListMetricsSchema);
+z.object({
+	name: z.string().trim().min(1),
+	description: z.string().trim().min(1).optional()
+});
+z.object({
+	name: z.string().trim().min(1).optional(),
+	description: z.string().trim().optional(),
+	slug: ProjectSlugSchema.optional()
+}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.slug !== void 0, { message: "At least one field is required" });
+z.object({ reachable: z.boolean() });
+/** Org-custom app slug segment (the part after `{orgSlug}/`). Same format as project slugs. */
+const AppSlugSchema = ProjectSlugSchema;
+/** Default production platform origin when no env override is set. */
+const DEFAULT_CLOUD_PLATFORM_ORIGIN = "https://api.keystroke.ai";
+/**
+* JSON Schema draft 2020-12 for LLM tool inputs (not OpenAPI 3.0).
+*
+* Enforces an object root: Anthropic (and the AI SDK gateway path) reject any
+* tool whose `input_schema` is a bare union/array at the root with
+* `input_schema.type: Field required`, which silently kills the whole turn. A
+* top-level `z.discriminatedUnion`/`z.union` is the usual culprit — flatten it
+* into a single object (discriminator field + optional fields). Unions nested
+* under a property are fine.
+*/
+function toolParameters(schema) {
+	const json = z.toJSONSchema(schema, { target: "draft-2020-12" });
+	if (json.type !== "object") {
+		const root = json.type ?? Object.keys(json).find((key) => key === "anyOf" || key === "oneOf");
+		throw new Error(`Tool input schema root must be type:"object" (got ${JSON.stringify(root)}). Flatten top-level unions into one object with a discriminator field.`);
+	}
+	return json;
+}
+function isValidIanaTimezone(value) {
+	try {
+		Intl.DateTimeFormat(void 0, { timeZone: value });
+		return true;
+	} catch {
+		return false;
+	}
+}
+function formatAgentTimestampContext(now, timezone) {
+	const lines = [`Current date and time (UTC): ${now.toISOString()}`];
+	if (timezone && isValidIanaTimezone(timezone)) {
+		const local = new Intl.DateTimeFormat("en-US", {
+			timeZone: timezone,
+			dateStyle: "full",
+			timeStyle: "long"
+		}).format(now);
+		lines.push(`Current date and time (${timezone}): ${local}`);
+	}
+	return lines.join("\n");
+}
+const AGENT_CONTEXT_OPEN = "<keystroke-context>";
+const AGENT_CONTEXT_CLOSE = "</keystroke-context>";
+/** Wrap injected prompt context so the UI can strip it while the agent still reads it. */
+function wrapPromptContext(context) {
+	return `${AGENT_CONTEXT_OPEN}\n${context}\n${AGENT_CONTEXT_CLOSE}`;
+}
+/** Remove sentinel tag strings from user-controlled values before embedding them. */
+function sanitizePromptContextContent(text) {
+	return text.replaceAll(AGENT_CONTEXT_OPEN, "").replaceAll(AGENT_CONTEXT_CLOSE, "");
+}
+const CONTEXT_BLOCK = /<keystroke-context>[\s\S]*?<\/keystroke-context>\s*/g;
+/** Remove any wrapped context block(s) from a text string. */
+function stripPromptContext(text) {
+	return text.replace(CONTEXT_BLOCK, "").trimStart();
+}
+/** True when a message already carries the injected current-time context block. */
+function hasAgentTimestampContext(message) {
+	return message.match(/^<keystroke-context>\n([\s\S]*?)\n<\/keystroke-context>/)?.[1]?.includes("Current date and time (UTC):") ?? false;
+}
+/**
+* Prepend From + current time into one `<keystroke-context>` block so the UI can
+* strip it while the model still sees it. Keeps the system prompt cache-stable.
+*/
+function prependAgentUserContext(message, options = {}) {
+	const lines = [];
+	const name = sanitizePromptContextContent(options.user?.name?.trim() ?? "");
+	const email = sanitizePromptContextContent(options.user?.email?.trim() ?? "");
+	const label = name && email ? `${name} <${email}>` : name || email;
+	if (label) lines.push(`[From: ${label}]`);
+	lines.push(formatAgentTimestampContext(options.now ?? /* @__PURE__ */ new Date(), options.timezone));
+	return `${wrapPromptContext(lines.join("\n"))}\n\n${message}`;
+}
+/** Attached by {@link defineTool} for optional introspection (not on wire). */
+const AGENT_TOOL_INPUT = Symbol.for("keystroke.agentTool.inputSchema");
+/** Author an agent tool from Zod; converts to JSON Schema and validates input on every `execute`. */
+function defineTool(tool) {
+	const { parameters: inputSchema, execute, prepareArguments, ...rest } = tool;
+	return {
+		...rest,
+		parameters: toolParameters(inputSchema),
+		async execute(toolCallId, params, signal, onUpdate) {
+			const parsed = inputSchema.parse(params);
+			return execute(toolCallId, prepareArguments ? prepareArguments(parsed) : parsed, signal, onUpdate);
+		},
+		[AGENT_TOOL_INPUT]: inputSchema
+	};
+}
+/** How a credential instance is stored (`credential_instances.auth_kind`). */
+const CredentialAuthKindSchema = z.enum([
+	"api_key",
+	"oauth_managed",
+	"keystroke"
+]);
+/**
+* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
+* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
+* resolver tries the project default, then the org default, then throws.
+*/
+const CredentialScopeTypeSchema = z.enum([
+	"organization",
+	"project",
+	"user"
+]);
+CredentialAuthKindSchema.options;
+const CREDENTIAL_SCOPE_TYPES = CredentialScopeTypeSchema.options;
+/** Non-empty human-readable label or description (trimmed). */
+const requiredDisplayTextSchema = z.string().trim().min(1);
+/**
+* Structural workflow-canvas graph contract.
+*
+* This is the deterministic skeleton the deploy-time AST producer emits for a
+* workflow (nodes + edges), plus the manifest-derived trigger-source nodes. It
+* is the single source of truth shared by:
+* - the AST producer (emits it at deploy, stored with the manifest),
+* - the platform route that serves the canvas, and
+* - the SDK / web client that renders it (React Flow).
+*
+* Only the structural skeleton lives here. The LLM enrichment + run-overlay
+* envelope types live in `workflow-canvas-envelope.ts`; the SDK re-exports them.
+* See WORKFLOW.md (§4 grammar, §8 node ids, §9 caching).
+*/
+/**
+* Canvas node taxonomy — the single discriminator for every canvas node. The
+* client derives the React Flow component, icon, and per-node treatment from it
+* (no parallel `type` / `data.kind` fields), and the producer + fixtures emit it
+* directly, so the structural contract can never silently diverge across the
+* deploy → render boundary.
+* - Boundaries: `entry` (Start, owns input) · `exit` (Output, owns output) ·
+*   `error` (a terminal `throw` — an error output that ends the run on a branch)
+* - Callable: `step` (action / agent / llm / hook / child-workflow invocation) —
+*   the invocation flavor lives in {@link WorkflowCanvasCallKind}
+* - Structural control flow: `code-block` · `decision` · `merge` · `loop` ·
+*   `parallel` (group containers) · `loop-start` (the group body's entry marker,
+*   shared by loop + parallel)
+* - Upstream of entry: `trigger-source` (one per manifest trigger attachment)
+*
+* `Promise.all([...])` is modeled as a `parallel` group container: the branches
+* are stacked inside and the container itself is the single prong leaving the
+* wrapper (there is no separate fork/join pair).
+*
+* `exit` and `error` are both terminals: a `return` flows to the shared `exit`
+* (the workflow output), while a `throw` gets its own `error` terminal off the
+* branch so guard clauses (`if (bad) throw …`) read as a visible dead-end.
+*/
+const WorkflowCanvasNodeTypeSchema = z.enum([
+	"entry",
+	"exit",
+	"error",
+	"step",
+	"code-block",
+	"decision",
+	"merge",
+	"loop",
+	"parallel",
+	"loop-start",
+	"trigger-source"
+]);
+z.enum([
+	"workflow-step",
+	"agent",
+	"llm",
+	"wait",
+	"hook",
+	"tool",
+	"child-workflow"
+]);
+/** A labeled branch output on a decision-style node. */
+const WorkflowCanvasNodeOutputSchema = z.object({
+	id: z.string(),
+	label: z.string()
+});
+/**
+* One token of a step's call-site argument value as captured by the producer.
+*
+* Raw form, one per source-expression shape so the inspector can render each
+* distinctly instead of dumping raw text:
+* - `text` — a literal value (string/number/boolean) or inert template chunk.
+* - `reference` — an upstream node output; carries only the structural
+*   `sourceNodeId` + `field` (the human `sourceLabel` is filled by the platform
+*   metadata join).
+* - `variable` — a code identifier / property access that isn't an upstream
+*   reference (e.g. a `const`, a loop variable, `job.id`). `text` is the source
+*   name; the platform may attach a `resolvedValue` for known top-level consts.
+* - `call` — a function call; carries only the callee `name` (e.g.
+*   `buildPrompt`), never the full argument list.
+*/
+const WorkflowCanvasRawValueTokenSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("text"),
+		text: z.string()
+	}),
+	z.object({
+		kind: z.literal("reference"),
+		/** Upstream node id this value flows from; absent only for unresolved refs. */
+		sourceNodeId: z.string().optional(),
+		/** Output field of the source (dotted path); omitted = the whole output. */
+		field: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("variable"),
+		text: z.string()
+	}),
+	z.object({
+		kind: z.literal("call"),
+		name: z.string()
+	})
+]);
+/**
+* A step input's configured value at its call site, captured deterministically
+* by the producer from the call's argument object. The platform join turns this
+* into the inspector's {@link WorkflowNodeInputBinding} (filling display labels).
+*/
+const WorkflowCanvasRawBindingSchema = z.object({
+	tokens: z.array(WorkflowCanvasRawValueTokenSchema),
+	/** Render as a tall multi-line box (object/array/multiline template values). */
+	multiline: z.boolean().optional()
+});
+/**
+* Statically-captured `promptLlm` options for an `llm` step node. Literal-only:
+* dynamic/expression values (a computed model, a `system` built by a function) are
+* not captured; `system`/`outputSchema` record presence so the inspector can note
+* "a system prompt is configured" / "structured output" without their values.
+*/
+const WorkflowCanvasLlmOptionsSchema = z.object({
+	model: z.string().optional(),
+	maxTokens: z.number().optional(),
+	temperature: z.number().optional(),
+	thinkingLevel: z.string().optional(),
+	hasSystemPrompt: z.boolean().optional(),
+	hasOutputSchema: z.boolean().optional()
+});
+const WorkflowCanvasNodeDataSchema = z.object({
+	label: z.string(),
+	/** Set on group nodes (loop / parallel section containers). */
+	groupKind: z.enum([
+		"loop",
+		"parallel",
+		"conditional"
+	]).optional(),
+	description: z.string().optional(),
+	/** {@link WorkflowCanvasCallKind} or a looser raw call-site label. */
+	callKind: z.string().optional(),
+	/**
+	* App/integration slug for a `step` whose action/agent is imported directly
+	* from a `@keystrokehq/<app>` package (e.g. "slack", "apollo"). Lets the client
+	* badge the node with that app's logo; absent for custom (project-local)
+	* actions, which fall back to the call-kind icon.
+	*/
+	appSlug: z.string().optional(),
+	/** Cron/webhook/poll discriminator on trigger-source nodes. */
+	triggerType: z.string().optional(),
+	/** Branch outputs (decision nodes). */
+	outputs: z.array(WorkflowCanvasNodeOutputSchema).optional(),
+	/**
+	* Action/agent/workflow slug resolved at deploy time (via import → definition).
+	* Optional when the deploy build cannot resolve source (dist-only artifacts).
+	*/
+	slug: z.string().optional(),
+	/**
+	* Durable call-site ids nested inside an off-grammar `code-block` (same-file only).
+	* Used by the run overlay to light the block when any contained step executes.
+	*/
+	containedCallSiteIds: z.array(z.string()).optional(),
+	/**
+	* Per-input call-site value bindings for `step` nodes, keyed by input field name.
+	* Deterministically captured from the call's argument object; reference tokens point
+	* at the upstream node that produced the value. The platform join fills display labels.
+	*/
+	inputBindings: z.record(z.string(), WorkflowCanvasRawBindingSchema).optional(),
+	/**
+	* Static `promptLlm(prompt, options)` configuration captured at the call site for
+	* `llm` step nodes. Only literal values are captured (model/maxTokens/temperature/
+	* thinkingLevel); `system`/`outputSchema` are usually expressions, so only their
+	* presence is recorded. Absent when no options are statically resolvable.
+	*/
+	llmOptions: WorkflowCanvasLlmOptionsSchema.optional()
+});
+/**
+* A single structural node. This is the deploy artifact's shape: identity
+* (`id`), the canonical discriminator (`nodeType`), display `data`, and group
+* nesting (`parentId`). All layout/rendering — React Flow component key,
+* positions, sizes, `extent`, group box dimensions — is derived entirely
+* client-side from this structure, so it never leaks into the wire contract.
+*/
+const WorkflowCanvasGraphNodeSchema = z.object({
+	id: z.string(),
+	nodeType: WorkflowCanvasNodeTypeSchema,
+	data: WorkflowCanvasNodeDataSchema,
+	/** Set on children nested inside a group (loop / parallel) container. */
+	parentId: z.string().optional()
+});
+const WorkflowCanvasEdgeSchema = z.object({
+	id: z.string(),
+	source: z.string(),
+	target: z.string(),
+	type: z.string().optional(),
+	label: z.string().optional(),
+	sourceHandle: z.string().optional(),
+	targetHandle: z.string().optional(),
+	data: z.object({ branchKind: z.enum([
+		"then",
+		"else",
+		"parallel-branch",
+		"error"
+	]).optional() }).optional()
+});
+/** A statically-evaluable top-level `const` value (literal scalars only). */
+const WorkflowCanvasConstantValueSchema = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+/**
+* Top-level `const NAME = <literal>` declarations in the workflow source, captured
+* at deploy. Lets the platform resolve `variable` value tokens (e.g. a `model` set
+* to a named const) to their concrete value for display. Scalars only — computed,
+* function-local, or non-literal consts are intentionally omitted.
+*/
+const WorkflowCanvasConstantsSchema = z.record(z.string(), WorkflowCanvasConstantValueSchema);
+const WorkflowCanvasGraphSchema = z.object({
+	nodes: z.array(WorkflowCanvasGraphNodeSchema),
+	edges: z.array(WorkflowCanvasEdgeSchema),
+	/** Top-level literal constants from the workflow source (for value-token resolution). */
+	constants: WorkflowCanvasConstantsSchema.optional()
+});
+/**
+* Deploy-time summary of one credential a step requires, derived from the
+* action/agent-tool definition's `.credentials`. The workflow-canvas credential
+* overlay joins a step node's `slug` to these to resolve the bound instance.
+* `key` doubles as the app slug (matches `credential_instances.app_slug`).
+*/
+const CredentialRequirementSummarySchema = z.object({
+	key: z.string(),
+	kind: CredentialAuthKindSchema,
+	/** Scope pinned via `.scope(...)`; absent means project-default → org-default. */
+	scope: CredentialScopeTypeSchema.optional()
+});
+const StoredRouteManifestSkillSchema = z.object({
+	slug: z.string(),
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema,
+	moduleFile: z.string()
+});
+const attachmentSchemasSchema = z.record(z.string(), z.object({
+	requestSchema: z.record(z.string(), z.unknown()),
+	filterSchema: z.record(z.string(), z.unknown()).optional()
+}));
+const attachmentMetaSchema = z.record(z.string(), z.object({
+	name: requiredDisplayTextSchema,
+	description: requiredDisplayTextSchema
+}));
+const storedRouteManifestEntryV2Schema = z.discriminatedUnion("kind", [
+	z.object({ kind: z.literal("health") }),
+	z.object({
+		kind: z.literal("agent"),
+		slug: z.string(),
+		moduleFile: z.string(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
+		model: z.string(),
+		compactionModel: z.string().optional(),
+		systemPrompt: z.string(),
+		toolCount: z.number().int().nonnegative(),
+		credentialCount: z.number().int().nonnegative(),
+		appSlugs: z.array(z.string()).default([]),
+		toolSlugs: z.array(z.string()).default([]),
+		/** Credential requirements per tool slug (the agent's credential consumer key). */
+		toolRequirements: z.record(z.string(), z.array(CredentialRequirementSummarySchema)).optional()
+	}),
+	z.object({
+		kind: z.literal("action"),
+		slug: z.string(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
+		moduleFile: z.string(),
+		/** App slug for actions imported from an integration package (`@keystrokehq/<app>/actions`). */
+		appSlug: z.string().optional(),
+		inputSchema: z.record(z.string(), z.unknown()),
+		outputSchema: z.record(z.string(), z.unknown()),
+		/** Credentials this action requires (for the canvas credential overlay). */
+		requirements: z.array(CredentialRequirementSummarySchema).optional()
+	}),
+	z.object({
+		kind: z.literal("workflow"),
+		slug: z.string(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema,
+		subscribable: z.boolean(),
+		moduleFile: z.string(),
+		requestSchema: z.record(z.string(), z.unknown()),
+		responseSchema: z.record(z.string(), z.unknown()).optional(),
+		/** Deterministic AST control-flow skeleton (deploy-time producer). */
+		flowGraph: WorkflowCanvasGraphSchema.optional(),
+		/** sha256 of the workflow source the `flowGraph` was produced from (staleness). */
+		flowGraphSourceHash: z.string().optional(),
+		/** sha256 of `JSON.stringify(flowGraph)` — baked at build so canvas polls skip re-hashing. */
+		flowGraphHash: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("trigger-webhook"),
+		endpoint: z.string(),
+		attachmentIds: z.array(z.string()),
+		moduleFile: z.string(),
+		/** sha256 of the trigger source file, baked at build time for overview change-detection. */
+		sourceHash: z.string().optional(),
+		attachmentSchemas: attachmentSchemasSchema,
+		attachmentMeta: attachmentMetaSchema.optional()
+	}),
+	z.object({
+		kind: z.literal("trigger-poll"),
+		attachmentId: z.string(),
+		attachmentIds: z.array(z.string()),
+		moduleFile: z.string(),
+		sourceHash: z.string().optional(),
+		schedule: z.string(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema
+	}),
+	z.object({
+		kind: z.literal("trigger-poll-group"),
+		pollId: z.string(),
+		attachmentIds: z.array(z.string()),
+		moduleFile: z.string(),
+		schedule: z.string()
+	}),
+	z.object({
+		kind: z.literal("cron-schedule"),
+		attachmentId: z.string(),
+		attachmentIds: z.array(z.string()),
+		moduleFile: z.string(),
+		sourceHash: z.string().optional(),
+		schedule: z.string(),
+		/** Static cron payload from `defineCronSource({ payload })` — omitted when the source has none. */
+		payload: z.unknown().optional(),
+		name: requiredDisplayTextSchema,
+		description: requiredDisplayTextSchema
+	})
+]);
+z.object({
+	version: z.literal(2),
+	entries: z.array(storedRouteManifestEntryV2Schema),
+	skills: z.array(StoredRouteManifestSkillSchema).default([]),
+	integrations: z.array(z.string()).optional()
+});
+const isoDateTime$6 = z.string().datetime();
+const subscriptionStatusSchema = z.enum([
+	"none",
+	"trialing",
+	"active",
+	"past_due",
+	"canceled"
+]);
+const CreditPackSchema = z.object({
+	id: z.string(),
+	usd: z.number(),
+	microCredits: z.number(),
+	label: z.string()
+});
+const AutoTopupSummarySchema = z.object({
+	enabled: z.boolean(),
+	thresholdMicroCredits: z.number().nullable(),
+	amountMicroCredits: z.number().nullable(),
+	/** A saved payment method exists to charge off-session. */
+	hasPaymentMethod: z.boolean(),
+	/** A top-up invoice payment is in flight. */
+	pending: z.boolean()
+});
+/**
+* The plan's resolved limits. Storage overage is billed from the wallet's
+* pushed-down `includedStorageGb`; concurrency, per-pass run timeouts, and
+* API/MCP rate limits are enforced from the wallet (timeouts/concurrency) or
+* plan preset (rate limits). Log retention is configured but not pruned yet.
+*/
+const PlanLimitsSchema = z.object({
+	includedStorageGb: z.number(),
+	concurrencyLimit: z.number(),
+	/** Max non-deleted projects; enforced on create only. */
+	maxProjects: z.number(),
+	agentTimeoutMs: z.number(),
+	workflowTimeoutMs: z.number(),
+	pollTimeoutMs: z.number(),
+	/** Configured retention window; pruning not implemented yet. */
+	logRetentionDays: z.number(),
+	apiRateLimitCapacity: z.number(),
+	apiRateLimitRefillPerSec: z.number(),
+	mcpRateLimitCapacity: z.number(),
+	mcpRateLimitRefillPerSec: z.number()
+});
+z.object({
+	planKey: z.string(),
+	subscriptionStatus: subscriptionStatusSchema,
+	/** Remaining plan-bucket balance this period (µc). */
+	planCreditMicroCredits: z.number(),
+	/** Remaining prepaid balance (µc). Never expires. */
+	prepaidCreditMicroCredits: z.number(),
+	/**
+	* Resolved monthly plan allotment (µc) — override ?? preset. Powers the
+	* credit-usage progress denominator (`used = allotment − remaining`).
+	*/
+	monthlyCreditMicroCredits: z.number(),
+	periodStart: isoDateTime$6.nullable(),
+	periodEnd: isoDateTime$6.nullable(),
+	autoTopup: AutoTopupSummarySchema,
+	creditPacks: z.array(CreditPackSchema),
+	limits: PlanLimitsSchema
+});
+const BillingUsageMeterSchema = z.object({
+	/** Meter key (`llm`, `vm_second`, …); null groups uncategorized rows. */
+	meterKey: z.string().nullable(),
+	/** Charged this period, µc. */
+	microCredits: z.number(),
+	/** Tracked-but-not-charged usage (e.g. BYOK LLM calls), display USD. */
+	unchargedUsd: z.number()
+});
+z.object({
+	periodStart: isoDateTime$6.nullable(),
+	periodEnd: isoDateTime$6.nullable(),
+	totalMicroCredits: z.number(),
+	byMeter: z.array(BillingUsageMeterSchema)
+});
+const billingLedgerEntryTypeSchema = z.enum([
+	"grant_plan",
+	"grant_prepaid",
+	"expire_plan",
+	"adjustment"
+]);
+const BillingActivityEntrySchema = z.object({
+	id: z.string(),
+	entryType: billingLedgerEntryTypeSchema,
+	label: z.string(),
+	/** Signed: positive grants, negative expirations/adjustments. */
+	microCredits: z.number(),
+	bucket: z.enum(["plan", "prepaid"]).nullable(),
+	/** Stripe invoice behind the entry, when there is one — powers "View invoice". */
+	stripeInvoiceId: z.string().nullable(),
+	createdAt: isoDateTime$6
+});
+z.object({
+	entries: z.array(BillingActivityEntrySchema),
+	/** Set only when the latest payment failure is newer than the latest successful payment. */
+	lastPaymentFailureAt: isoDateTime$6.nullable()
+});
+z.object({ 
+/** Web-app path to land on after Checkout (must be a path, not a URL). */
+returnPath: z.string().startsWith("/").max(512).optional() });
+z.object({
+	packId: z.string(),
+	returnPath: z.string().startsWith("/").max(512).optional()
+});
+z.object({ returnPath: z.string().startsWith("/").max(512).optional() });
+z.object({ url: z.string().url() });
+z.object({
+	/** Hosted invoice page (view, download, receipt). */
+	url: z.string().url(),
+	/** Direct PDF download when Stripe provides one. */
+	pdf: z.string().url().nullable()
+});
+z.object({ 
+/** Stripe Checkout Session id from the `session_id` success-URL param. */
+sessionId: z.string().min(1).max(255) });
+z.object({
+	/**
+	* `granted` — credits are in the wallet now; `processing` — payment not
+	* complete yet, the webhook will finish it; `ignored` — not a confirmable
+	* session for this org.
+	*/
+	status: z.enum([
+		"granted",
+		"processing",
+		"ignored"
+	]),
+	reason: z.string().optional()
+});
+z.object({
+	enabled: z.boolean(),
+	thresholdMicroCredits: z.number().int().positive().optional(),
+	packId: z.string().optional()
+});
+const BillingUsageEventSourceSchema = z.enum([
+	"ai_gateway",
+	"sandbox",
+	"web_proxy",
+	"storage",
+	"dispatch",
+	"poll"
+]);
+const BillingUsageMeterKeySchema = z.enum([
+	"llm",
+	"vm_second",
+	"web_search",
+	"web_fetch",
+	"workflow_run",
+	"agent_run",
+	"poll_trigger",
+	"tigris_storage"
+]);
+const BillingUsageKeySourceSchema = z.enum(["platform", "byok"]);
+const BillingUsageRunKindSchema = z.enum(["agent", "workflow"]);
+const SubmitBillingUsageEventSchema = z.object({
+	projectId: z.string().min(1).max(255).nullable().optional(),
+	runId: z.string().min(1).max(255).nullable().optional(),
+	runKind: BillingUsageRunKindSchema.nullable().optional(),
+	source: BillingUsageEventSourceSchema,
+	sourceEventId: z.string().min(1).max(512),
+	meterKey: BillingUsageMeterKeySchema,
+	quantity: z.number().finite().nonnegative(),
+	unit: z.string().min(1).max(64),
+	providerCostUsd: z.number().finite().nonnegative().nullable().optional(),
+	keySource: BillingUsageKeySourceSchema.nullable().optional(),
+	occurredAt: isoDateTime$6,
+	metadata: z.record(z.string(), z.unknown()).nullable().optional()
+}).strict();
+z.object({ events: z.array(SubmitBillingUsageEventSchema).min(1).max(100) }).strict();
+z.object({
+	accepted: z.number().int().nonnegative(),
+	inserted: z.number().int().nonnegative(),
+	duplicate: z.number().int().nonnegative(),
+	settledLedgerId: z.string().nullable(),
+	chargeMicroCredits: z.number().int().nonnegative()
+});
+/** Messaging platforms that support agent gateway bindings. */
+const ChannelPlatformKeySchema = z.enum(["slack"]);
+const ChannelReactionSupportSchema = z.enum([
+	"full",
+	"read-only",
+	"none"
+]);
+const ChannelCardSupportSchema = z.enum([
+	"full",
+	"partial",
+	"none"
+]);
+const ChannelStreamingSupportSchema = z.enum([
+	"native",
+	"post-edit",
+	"buffered",
+	"drafts",
+	"none"
+]);
+const ChannelCapabilitiesSchema = z.object({
+	mentions: z.boolean(),
+	reactions: ChannelReactionSupportSchema,
+	cards: ChannelCardSupportSchema,
+	modals: z.boolean(),
+	streaming: ChannelStreamingSupportSchema,
+	dms: z.boolean()
+});
+const ChannelListenModeSchema = z.enum([
+	"mention",
+	"all",
+	"dm"
+]);
+const ChannelBindingKindSchema = z.enum([
+	"public",
+	"private",
+	"dm",
+	"group",
+	"space"
+]);
+const AppGatewaySchema = z.object({
+	capabilities: ChannelCapabilitiesSchema,
+	supportedModes: z.array(ChannelListenModeSchema).min(1),
+	resourceNoun: z.object({
+		singular: z.string().min(1),
+		plural: z.string().min(1)
+	}),
+	supportsChannelDirectory: z.boolean(),
+	webhookPathHint: z.string().min(1),
+	/** Composio/keystroke app slug for Connect when it differs from the gateway platform key (e.g. slack → slackbot). */
+	connectAppId: z.string().min(1).optional(),
+	docsUrl: z.string().url().optional(),
+	tagline: z.string().min(1).optional()
+});
+/** Projected catalog row for the agent channels panel (derived from apps with `gateway`). */
+const ChannelPlatformSchema = z.object({
+	key: ChannelPlatformKeySchema,
+	name: z.string().min(1),
+	appLogoId: z.string().min(1),
+	fallbackDomain: z.string().min(1),
+	description: z.string().min(1),
+	tagline: z.string().min(1),
+	authKind: z.enum([
+		"oauth",
+		"api_key",
+		"keystroke"
+	]),
+	credentialFields: z.array(z.object({
+		key: z.string().min(1),
+		label: z.string().min(1),
+		placeholder: z.string().optional(),
+		helpText: z.string().optional(),
+		type: z.enum([
+			"text",
+			"password",
+			"textarea"
+		]),
+		required: z.boolean(),
+		prefix: z.string().optional()
+	})),
+	capabilities: ChannelCapabilitiesSchema,
+	supportedModes: z.array(ChannelListenModeSchema).min(1),
+	resourceNoun: z.object({
+		singular: z.string().min(1),
+		plural: z.string().min(1)
+	}),
+	webhookPathHint: z.string().min(1),
+	supportsChannelDirectory: z.boolean(),
+	connectAppId: z.string().min(1).optional(),
+	docsUrl: z.string().url().optional()
+});
+const ChannelBindingSchema = z.object({
+	id: z.string().min(1),
+	channelId: z.string().min(1),
+	channelName: z.string().min(1),
+	channelKind: ChannelBindingKindSchema,
+	mode: ChannelListenModeSchema,
+	subscribeOnMention: z.boolean(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+const ChannelConnectionSchema = z.object({
+	id: z.string().min(1),
+	platform: ChannelPlatformKeySchema,
+	agentId: z.string().min(1),
+	accountLabel: z.string().min(1),
+	accountId: z.string().min(1),
+	connectedAt: z.string(),
+	bindings: z.array(ChannelBindingSchema)
+});
+const ChannelDirectoryEntrySchema = z.object({
+	id: z.string().min(1),
+	name: z.string().min(1),
+	kind: ChannelBindingKindSchema,
+	memberCount: z.number().int().nonnegative().optional(),
+	isArchived: z.boolean().optional()
+});
+z.array(ChannelConnectionSchema);
+z.array(ChannelDirectoryEntrySchema);
+z.object({ teamName: z.string().min(1).optional() });
+/** OAuth workspace available for channel bindings (e.g. Slack team). */
+const ChannelAccountSchema = z.object({
+	id: z.string().min(1),
+	platform: ChannelPlatformKeySchema,
+	label: z.string().min(1),
+	connectedAt: z.string()
+});
+z.array(ChannelAccountSchema);
+const NewChannelBindingInputSchema = z.object({
+	channelId: z.string().min(1),
+	channelName: z.string().min(1),
+	channelKind: ChannelBindingKindSchema.optional(),
+	mode: ChannelListenModeSchema.optional(),
+	subscribeOnMention: z.boolean().optional()
+});
+z.object({
+	platform: ChannelPlatformKeySchema,
+	accountId: z.string().min(1),
+	binding: NewChannelBindingInputSchema
+});
+z.object({ patch: z.object({
+	mode: ChannelListenModeSchema.optional(),
+	subscribeOnMention: z.boolean().optional()
+}) });
+z.array(ChannelPlatformSchema);
+/**
+* Where a manual MCP API key is injected on each request. MCP servers don't
+* advertise API-key support in a discoverable way, so the user picks the
+* placement: a request header (optionally prefixed, e.g. `Bearer `) or a query
+* param (e.g. Exa's `exaApiKey`).
+*/
+const McpApiKeyPlacementSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("header"),
+	name: z.string().trim().min(1),
+	/** Prepended to the token, e.g. `"Bearer "` for `Authorization: Bearer <token>`. */
+	prefix: z.string().optional()
+}), z.object({
+	kind: z.literal("query"),
+	name: z.string().trim().min(1)
+})]);
+z.object({
+	token: z.string().trim().min(1),
+	placement: McpApiKeyPlacementSchema.default({
+		kind: "header",
+		name: "Authorization",
+		prefix: "Bearer "
+	})
+});
+/** Metadata for one vault field on a custom api_key app. */
+const AppCredentialFieldSchema = z.object({
+	label: z.string().trim().min(1).optional(),
+	secret: z.boolean().optional(),
+	optional: z.boolean().optional(),
+	description: z.string().trim().min(1).optional(),
+	default: z.string().optional(),
+	/** For direct MCP api-key apps: where this field's value is injected on the request. */
+	placement: McpApiKeyPlacementSchema.optional()
+});
+/** Credential template keyed by vault field name. */
+const AppCredentialFieldsSchema = z.record(z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/), AppCredentialFieldSchema).refine((fields) => Object.keys(fields).length > 0, { message: "At least one credential field is required" }).refine((fields) => Object.values(fields).some((field) => field.optional !== true), { message: "At least one credential field must be required" });
+/** A single OAuth scope an app can request, with human copy for connect UI. */
+const OAuthScopeOptionSchema = z.object({
+	name: z.string().min(1),
+	description: z.string().min(1),
+	defaultSelected: z.boolean().optional(),
+	required: z.boolean().optional()
+});
+/** How an app authenticates when connecting credentials. */
+const AppAuthKindSchema = z.enum([
+	"oauth",
+	"api_key",
+	"keystroke"
+]);
+/** Composio auth scheme for API-key style connections. */
+const AppCredentialSchemeSchema = z.enum([
+	"API_KEY",
+	"BEARER_TOKEN",
+	"BASIC",
+	"BASIC_WITH_JWT"
+]);
+/**
+* Where app metadata and execution are sourced (e.g. native, composio, pipedream, custom).
+* Opaque string — cloud/hosted entrypoints choose values; keystroke stays provider-agnostic.
+*/
+const AppSourceSchema = z.string().trim().min(1);
+z.object({
+	slug: z.string().trim().min(1),
+	name: z.string().min(1),
+	description: z.string().min(1),
+	category: z.string().min(1),
+	logo: z.string().url().optional(),
+	authKind: AppAuthKindSchema,
+	oauthScopes: z.array(OAuthScopeOptionSchema)
+}).extend({
+	source: AppSourceSchema,
+	credentialFields: AppCredentialFieldsSchema.optional(),
+	credentialScheme: AppCredentialSchemeSchema.optional()
+});
+const customAppNameSchema = z.string().trim().min(1, "Name is required");
+const AppSlugAvailabilityReasonSchema = ProjectSlugAvailabilityReasonSchema;
+z.object({
+	slug: z.string(),
+	available: z.boolean(),
+	reason: AppSlugAvailabilityReasonSchema.optional(),
+	suggestion: AppSlugSchema.optional()
+});
+z.object({ slug: z.string().trim().min(1) });
+/** Request body for creating an org custom app (api_key or direct MCP). */
+const optionalCredentialFieldsSchema = z.record(z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/), AppCredentialFieldSchema);
+z.object({
+	name: customAppNameSchema,
+	slug: AppSlugSchema,
+	description: z.string().trim().min(1),
+	source: z.enum([
+		"custom",
+		"mcp",
+		"openapi",
+		"graphql"
+	]).default("custom"),
+	url: z.string().url().optional(),
+	authKind: AppAuthKindSchema.optional(),
+	fields: optionalCredentialFieldsSchema.optional(),
+	credentialScheme: AppCredentialSchemeSchema.optional(),
+	oauthScopes: z.array(OAuthScopeOptionSchema).optional()
+}).superRefine((data, ctx) => {
+	if ((data.source === "mcp" || data.source === "openapi" || data.source === "graphql") && !data.url) ctx.addIssue({
+		code: "custom",
+		message: "url is required for this app source",
+		path: ["url"]
+	});
+	if (!(data.authKind ?? (data.source === "custom" ? "api_key" : void 0))) {
+		ctx.addIssue({
+			code: "custom",
+			message: "authKind is required",
+			path: ["authKind"]
+		});
+		return;
+	}
+	if (data.source === "custom") {
+		const parsed = AppCredentialFieldsSchema.safeParse(data.fields ?? {});
+		if (!parsed.success) for (const issue of parsed.error.issues) ctx.addIssue({
+			...issue,
+			path: ["fields", ...issue.path]
+		});
+	}
+});
+z.object({
+	id: z.string().min(1),
+	slug: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string().min(1),
+	category: z.string().min(1),
+	authKind: AppAuthKindSchema,
+	source: AppSourceSchema,
+	url: z.string().url().nullable().optional(),
+	credentialFields: optionalCredentialFieldsSchema.optional(),
+	credentialScheme: AppCredentialSchemeSchema.optional(),
+	oauthScopes: z.array(OAuthScopeOptionSchema).optional(),
+	createdAt: z.string().min(1),
+	updatedAt: z.string().min(1)
+});
+z.object({
+	id: z.string().min(1),
+	organizationId: z.string().min(1).nullable(),
+	slug: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string().min(1),
+	category: z.string().min(1),
+	logo: z.string().url().nullable(),
+	authKind: AppAuthKindSchema,
+	oauthScopes: z.array(OAuthScopeOptionSchema),
+	source: AppSourceSchema,
+	credentialFields: AppCredentialFieldsSchema.optional(),
+	credentialScheme: AppCredentialSchemeSchema.optional(),
+	url: z.string().url().nullable().optional(),
+	createdAt: z.string().min(1),
+	updatedAt: z.string().min(1)
+});
+/**
+* Slim connect-picker row for `GET /api/apps`. Omits oauthScopes / credential
+* templates (loaded via catalog detail) so the ~1k-app list stays small.
+*/
+const AppCatalogSummarySchema = z.object({
+	id: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string().min(1),
+	category: z.string().min(1),
+	integrationDescription: z.string().min(1),
+	logo: z.string().url().nullable().optional(),
+	authKind: AppAuthKindSchema,
+	/** Where app metadata and execution are sourced (e.g. composio, custom). */
+	source: AppSourceSchema,
+	/** Endpoint URL for MCP, OpenAPI, or GraphQL custom apps. */
+	url: z.string().url().nullable().optional(),
+	/** True when the app has a non-empty credential field template. */
+	hasCredentialFields: z.boolean().optional()
+});
+AppCatalogSummarySchema.extend({
+	oauthScopes: z.array(OAuthScopeOptionSchema),
+	/** Custom api_key apps — vault field template for connect UI and sync. */
+	credentialFields: AppCredentialFieldsSchema.optional(),
+	/** Composio auth scheme when credentialFields are present. */
+	credentialScheme: AppCredentialSchemeSchema.optional(),
+	/** When present, the app supports agent gateway bindings (external channels). */
+	gateway: AppGatewaySchema.optional()
+});
+z.array(AppCatalogSummarySchema);
+const McpAuthProbeModeSchema = z.enum([
+	"none",
+	"token",
+	"oauth"
+]);
+const McpAuthProbeOAuthSchema = z.object({
+	issuer: z.string().optional(),
+	authorizationEndpoint: z.string().url(),
+	tokenEndpoint: z.string().url(),
+	registrationEndpoint: z.string().url().optional(),
+	scopes: z.array(z.string()),
+	resource: z.string().optional(),
+	/** Human-readable label from OAuth protected-resource metadata (RFC 9728). */
+	resourceName: z.string().optional()
+});
+z.object({
+	url: z.string().url(),
+	mode: McpAuthProbeModeSchema,
+	unauthenticatedStatus: z.number().int().optional(),
+	scheme: AppCredentialSchemeSchema.optional(),
+	oauth: McpAuthProbeOAuthSchema.optional()
+});
+z.object({ url: z.string().url() });
+z.object({
+	detected: z.boolean(),
+	template: z.object({
+		authKind: AppAuthKindSchema,
+		credentialFields: z.record(z.string(), AppCredentialFieldSchema).optional(),
+		credentialScheme: AppCredentialSchemeSchema.optional(),
+		oauthScopes: z.array(OAuthScopeOptionSchema),
+		url: z.string().url(),
+		oauth: McpAuthProbeOAuthSchema.optional(),
+		serverName: z.string().optional(),
+		serverDescription: z.string().optional()
+	})
+});
+z.object({
+	appSlug: z.string().trim().min(1),
+	projects: z.array(z.string().trim().min(1)).optional(),
+	createOrganizationCredential: z.boolean().optional(),
+	createUserProvidedCredential: z.boolean().optional(),
+	label: z.string().trim().min(1).optional(),
+	credentialInstanceId: z.string().trim().min(1).optional(),
+	scopes: z.array(z.string()).optional()
+});
+z.object({ authorizeUrl: z.string().url() });
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parsedJsonRecord(value) {
+	try {
+		const parsed = JSON.parse(value);
+		return isRecord$2(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function mimeTypeFromBlock(part) {
+	if (typeof part.mimeType === "string" && part.mimeType.length > 0) return part.mimeType;
+	if (typeof part.mediaType === "string" && part.mediaType.length > 0) return part.mediaType;
+}
+function filenameFromUri(uri) {
+	const segment = uri.split("/").at(-1)?.split("?")[0]?.trim();
+	return segment && segment.length > 0 ? segment : void 0;
+}
+function looksLikeBase64ImageData(data) {
+	if (data.startsWith("data:image/")) return true;
+	return data.startsWith("iVBORw0KGgo") || data.startsWith("/9j/") || data.startsWith("R0lGOD") || data.startsWith("UklGR");
+}
+function imageMediaTypeFromData(data, explicit) {
+	if (explicit?.startsWith("image/")) return explicit;
+	if (data.startsWith("data:image/")) return /^data:(image\/[^;]+);/i.exec(data)?.[1] ?? "image/png";
+	if (data.startsWith("/9j/")) return "image/jpeg";
+	if (data.startsWith("R0lGOD")) return "image/gif";
+	if (data.startsWith("UklGR")) return "image/webp";
+	return "image/png";
+}
+function isProbablyBase64Payload(value) {
+	return value.length > 64 && /^[A-Za-z0-9+/=\r\n]+$/.test(value.slice(0, 256));
+}
+function isMcpImageBlock(part) {
+	const blockType = typeof part.type === "string" ? part.type : void 0;
+	if (blockType === "text" || blockType === "resource" || blockType === "resource_link" || blockType === "audio") return false;
+	if (typeof part.data !== "string" || part.data.length === 0) return false;
+	if (blockType === "image" || blockType === "image-data") return true;
+	const mimeType = mimeTypeFromBlock(part);
+	if (mimeType?.startsWith("image/")) return true;
+	if (looksLikeBase64ImageData(part.data)) return true;
+	if (!blockType && !mimeType && isProbablyBase64Payload(part.data)) return true;
+	return false;
+}
+/** Extract MCP `content` blocks from persisted tool output envelopes. */
+function mcpContentBlocksFromToolOutput(output) {
+	if (typeof output === "string") {
+		const parsed = parsedJsonRecord(output.trim());
+		return parsed ? mcpContentBlocksFromRecord(parsed) : [];
+	}
+	if (!isRecord$2(output)) return [];
+	if (output.type === "text" && typeof output.value === "string") return mcpContentBlocksFromToolOutput(output.value);
+	return mcpContentBlocksFromRecord(output);
+}
+function mcpContentBlocksFromRecord(record) {
+	if (record.type === "content" && Array.isArray(record.value)) return record.value;
+	if (record.type === "json" && isRecord$2(record.value) && Array.isArray(record.value.content)) return record.value.content;
+	if (isRecord$2(record.details) && Array.isArray(record.details.content)) return record.details.content;
+	if (Array.isArray(record.content)) return record.content;
+	return [];
+}
+/** Map MCP content blocks to AI SDK tool result parts for model consumption. */
+function mcpContentBlocksToAiSdkParts(blocks) {
+	const parts = [];
+	for (const block of blocks) {
+		if (!isRecord$2(block)) continue;
+		if (block.type === "text" && typeof block.text === "string") {
+			parts.push({
+				type: "text",
+				text: block.text
+			});
+			continue;
+		}
+		if (isMcpImageBlock(block) && typeof block.data === "string") {
+			parts.push({
+				type: "image-data",
+				data: block.data,
+				mediaType: imageMediaTypeFromData(block.data, mimeTypeFromBlock(block))
+			});
+			continue;
+		}
+		if (block.type === "resource" && isRecord$2(block.resource)) {
+			const resource = block.resource;
+			const blob = typeof resource.blob === "string" ? resource.blob : void 0;
+			const mediaType = mimeTypeFromBlock(resource);
+			if (!blob || !mediaType) continue;
+			const uri = typeof resource.uri === "string" ? resource.uri : void 0;
+			if (mediaType.startsWith("image/")) parts.push({
+				type: "image-data",
+				data: blob,
+				mediaType
+			});
+			else parts.push({
+				type: "file-data",
+				data: blob,
+				mediaType,
+				...uri ? { filename: filenameFromUri(uri) } : {}
+			});
+		}
+	}
+	return parts;
+}
+function isRedundantMcpJsonText(text, details) {
+	if (text.length === 0 || details == null) return false;
+	try {
+		return text === JSON.stringify(details);
+	} catch {
+		return false;
+	}
+}
+z.object({ url: z.string().url() });
+z.object({
+	detected: z.boolean(),
+	template: z.object({
+		authKind: AppAuthKindSchema,
+		credentialFields: z.record(z.string(), AppCredentialFieldSchema).optional(),
+		credentialScheme: AppCredentialSchemeSchema.optional(),
+		oauthScopes: z.array(OAuthScopeOptionSchema),
+		url: z.string().url(),
+		name: z.string().optional(),
+		description: z.string().optional(),
+		homepageUrl: z.string().optional()
+	})
+});
+z.object({ url: z.string().url() });
+z.object({
+	detected: z.boolean(),
+	template: z.object({
+		authKind: AppAuthKindSchema,
+		credentialFields: z.record(z.string(), AppCredentialFieldSchema).optional(),
+		credentialScheme: AppCredentialSchemeSchema.optional(),
+		oauthScopes: z.array(OAuthScopeOptionSchema),
+		url: z.string().url(),
+		name: z.string().optional(),
+		description: z.string().optional(),
+		homepageUrl: z.string().optional()
+	})
+});
+const CatalogAppSummarySchema = z.object({
+	name: z.string(),
+	description: z.string(),
+	package: z.string()
+});
+z.object({
+	items: z.array(CatalogAppSummarySchema),
+	nextCursor: z.string().optional()
+});
+z.object({
+	name: z.string(),
+	description: z.string(),
+	package: z.string(),
+	version: z.string().optional()
+});
+const CatalogActionSummarySchema = z.object({
+	slug: z.string(),
+	name: z.string(),
+	description: z.string().optional()
+});
+z.object({
+	toolkit: z.string().optional(),
+	items: z.array(CatalogActionSummarySchema),
+	nextCursor: z.string().optional()
+});
+z.object({
+	slug: z.string(),
+	name: z.string(),
+	description: z.string().optional(),
+	inputParameters: z.record(z.string(), z.unknown()).optional(),
+	outputParameters: z.record(z.string(), z.unknown()).optional(),
+	version: z.string().optional()
+});
+/** Web URL that opens the org apps page with a connect dialog for the given app. */
+function buildConnectDeeplink(options) {
+	const base = options.webUrl.replace(/\/+$/, "");
+	const params = new URLSearchParams({ connect: options.appSlug });
+	return `${base}/${options.orgSlug}/apps?${params.toString()}`;
+}
+/** Scope of a platform app credential (maps to `credential_instances.scope_type`). */
+const AppCredentialScopeSchema = z.enum([
+	"user",
+	"project",
+	"organization"
+]);
+/** How the credential was connected (OAuth vs manual api-key entry). */
+const AppCredentialConnectionKindSchema = z.enum(["oauth", "manual"]);
+/** Connect-dialog permission preset for OAuth scope selection. */
+const OAuthPermissionModeSchema = z.enum(["default", "restricted"]);
+const optionalTimestamp$1 = z.string().optional();
+const nullableOptionalTimestamp = z.string().nullable().optional();
+/**
+* Summary row for the apps/credentials table and credential detail page.
+* Plaintext secrets are never returned — only masked `keyPreviews`.
+*/
+const AppCredentialSummarySchema = z.object({
+	id: z.string().min(1),
+	appId: z.string().min(1),
+	/** Stable per-scope identifier; pass to `--credential` to pin a specific instance. */
+	slug: z.string().min(1),
+	label: z.string().min(1),
+	scope: AppCredentialScopeSchema,
+	lastRefreshedAt: z.string().nullable(),
+	appName: z.string().min(1).optional(),
+	projectId: z.string().min(1).optional(),
+	projectName: z.string().min(1).optional(),
+	status: z.string().optional(),
+	createdAt: optionalTimestamp$1,
+	lastUsedAt: nullableOptionalTimestamp,
+	isDefault: z.boolean().optional(),
+	connectionKind: AppCredentialConnectionKindSchema.optional(),
+	ownerUserId: z.string().min(1).optional(),
+	ownerName: z.string().min(1).optional(),
+	ownerAvatarUrl: z.string().url().optional(),
+	grantedScopes: z.array(z.string().min(1)).optional(),
+	credentialKeys: z.array(z.string().min(1)).optional(),
+	keyPreviews: z.record(z.string(), z.string()).optional(),
+	expiresAt: optionalTimestamp$1
+});
+const credentialSecretValueSchema = z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" });
+function hasCredentialTarget(input) {
+	return input.projects.length > 0 || input.createOrganizationCredential || input.createUserProvidedCredential || Boolean(input.credentialInstanceId?.trim());
+}
+function addMissingCredentialTargetIssue(ctx, path = ["projects"]) {
+	ctx.addIssue({
+		code: "custom",
+		message: "At least one credential target is required",
+		path
+	});
+}
+/** Target fields shared by create and OAuth start flows. */
+const CredentialTargetsFieldsSchema = z.object({
+	projects: z.array(z.string().min(1)).default([]),
+	createOrganizationCredential: z.boolean().default(false),
+	createUserProvidedCredential: z.boolean().default(false),
+	/** Display label for created credential instances (apps table / detail page). */
+	label: z.string().trim().min(1).optional(),
+	/** When set, update this credential instance in place (reconnect) instead of creating a new row. */
+	credentialInstanceId: z.string().trim().min(1).optional()
+});
+CredentialTargetsFieldsSchema.extend({
+	appId: z.string().min(1),
+	scopes: z.array(z.string().min(1)),
+	permissionMode: OAuthPermissionModeSchema
+});
+z.object({
+	status: z.enum(["connected", "redirecting"]),
+	authorizeUrl: z.string().url().nullable()
+});
+CredentialTargetsFieldsSchema.extend({
+	app: z.string().trim().min(1),
+	value: credentialSecretValueSchema.optional()
+}).superRefine((input, ctx) => {
+	if (!hasCredentialTarget(input)) addMissingCredentialTargetIssue(ctx);
+});
+const connectedKeystrokeConnectionResultSchema = z.object({
+	status: z.literal("connected"),
+	connectionId: z.string().min(1)
+});
+const redirectingKeystrokeConnectionResultSchema = z.object({
+	status: z.literal("redirecting"),
+	authorizeUrl: z.string().url(),
+	connectionId: z.string().min(1)
+});
+z.discriminatedUnion("status", [connectedKeystrokeConnectionResultSchema, redirectingKeystrokeConnectionResultSchema]);
+CredentialTargetsFieldsSchema.extend({
+	appId: z.string().min(1),
+	connectionKind: AppCredentialConnectionKindSchema,
+	value: credentialSecretValueSchema.optional(),
+	scopes: z.array(z.string().min(1)).optional()
+}).superRefine((input, ctx) => {
+	if (!hasCredentialTarget(input)) addMissingCredentialTargetIssue(ctx);
+	if (input.connectionKind === "manual" && !input.value) ctx.addIssue({
+		code: "custom",
+		message: "value is required for manual connections",
+		path: ["value"]
+	});
+	if (input.connectionKind === "oauth") ctx.addIssue({
+		code: "custom",
+		message: "OAuth credentials are created via the OAuth callback",
+		path: ["connectionKind"]
+	});
+});
+z.object({
+	label: z.string().trim().min(1).optional(),
+	isDefault: z.boolean().optional(),
+	value: credentialSecretValueSchema.optional()
+}).refine((input) => input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0, { message: "At least one field is required" });
+z.array(AppCredentialSummarySchema);
+z.object({
+	limit: z.coerce.number().int().min(1).max(200).optional(),
+	cursor: z.string().min(1).optional()
+});
+z.object({
+	items: z.array(AppCredentialSummarySchema),
+	nextCursor: z.string().nullable()
+});
+z.array(AppCredentialSummarySchema);
+const CredentialAssignmentTargetTypeSchema = z.enum([
+	"workflow",
+	"agent",
+	"poll"
+]);
+const CredentialAssignmentRecordSchema = z.object({
+	id: z.string(),
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: z.string(),
+	consumerId: z.string(),
+	credentialSlug: z.string(),
+	instanceId: z.string(),
+	credential: z.string().optional(),
+	scopeType: z.enum([
+		"organization",
+		"project",
+		"user"
+	]).optional(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+z.object({ assignments: z.array(CredentialAssignmentRecordSchema) });
+z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: z.string().min(1),
+	/** Omit or '*' for wildcard assignment. */
+	consumerId: z.string().optional(),
+	credential: z.string().min(1)
+});
+z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: z.string().min(1)
+});
+z.object({
+	targetType: CredentialAssignmentTargetTypeSchema,
+	targetKey: z.string().min(1)
+});
+const CredentialConsumerSummarySchema = z.object({
+	consumerId: z.string(),
+	label: z.string(),
+	appSlugs: z.array(z.string())
+});
+z.object({ consumers: z.array(CredentialConsumerSummarySchema) });
+const McpConnectionStatusSchema = z.enum([
+	"INITIATED",
+	"ACTIVE",
+	"EXPIRED",
+	"FAILED",
+	"INACTIVE",
+	"REVOKED"
+]);
+const McpAppSchema = z.object({
+	slug: z.string(),
+	name: z.string(),
+	connected: z.boolean(),
+	connectionId: z.string().optional(),
+	status: McpConnectionStatusSchema.optional()
+});
+z.array(McpAppSchema);
+const MCP_ENTITY_PREFIX = {
+	user: "user",
+	organization: "org",
+	project: "proj"
+};
+/** MCP provider entity id for a credential scope subject (`user_<id>` / `org_<id>` / `proj_<id>`). */
+function mcpEntityId(scopeType, scopeId) {
+	return `${MCP_ENTITY_PREFIX[scopeType]}_${scopeId}`;
+}
+const KeystrokeCredentialSchema = z.object({
+	connectionId: z.string(),
+	entityId: z.string(),
+	instanceId: z.string()
+});
+const McpCredentialAssignmentTargetSchema = z.object({
+	type: CredentialAssignmentTargetTypeSchema,
+	key: z.string().trim().min(1)
+});
+z.object({
+	app: z.string().trim().min(1),
+	tool: z.string().trim().min(1),
+	arguments: z.record(z.string(), z.unknown()).default({}),
+	/** Pinned provider toolkit version, sourced from the app definition; forwarded to the provider. */
+	version: z.string().trim().min(1),
+	/** When set, platform MCP resolve checks credential assignments before scope defaults. */
+	assignmentTarget: McpCredentialAssignmentTargetSchema.optional(),
+	/** Tool/step consumer id for assignment lookup (action slug or workflow step correlation id). */
+	consumerId: z.string().trim().min(1).optional(),
+	/** Explicit credential instance slug; overrides default resolution to pick that instance. */
+	credentialSlug: z.string().trim().min(1).optional(),
+	/** Project slug (CLI --project); the platform resolves it to a project and binds that scope. */
+	projectSlug: z.string().trim().min(1).optional()
+});
+const ExecuteKeystrokeToolErrorCodeSchema = z.enum([
+	"not_found",
+	"forbidden",
+	"mcp_execute_failed"
+]);
+/** Platform MCP execute error body (422 for upstream tool failures, 404/403 for resolve/access). */
+const ExecuteKeystrokeToolErrorResponseSchema = z.object({
+	error: ExecuteKeystrokeToolErrorCodeSchema,
+	message: z.string()
+});
+/** Turn upstream provider JSON error strings into LLM-readable text. */
+function formatMcpToolErrorMessage(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return trimmed;
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (typeof parsed.detail === "string" && parsed.detail.trim()) return typeof parsed.code === "string" && parsed.code.trim() ? `${parsed.code}: ${parsed.detail.trim()}` : parsed.detail.trim();
+		if (typeof parsed.message === "string" && parsed.message.trim()) return typeof parsed.code === "string" && parsed.code.trim() ? `${parsed.code}: ${parsed.message.trim()}` : parsed.message.trim();
+	} catch {}
+	return trimmed;
+}
+const TeamRequestTypeSchema = z.enum([
+	"org-deletion",
+	"contact",
+	"enterprise-upgrade",
+	"verification",
+	"slack-connect"
+]);
+z.object({
+	type: TeamRequestTypeSchema,
+	message: z.string().trim().max(5e3).optional()
+});
+z.object({ ok: z.literal(true) });
+const MarketingContactCompanySizeSchema = z.enum([
+	"1-10",
+	"11-50",
+	"51-200",
+	"201-500",
+	"500+"
+]);
+z.object({
+	fullName: z.string().trim().min(1, "Full name is required").max(200),
+	workEmail: z.string().trim().email("Enter a valid email address").max(320),
+	companySize: MarketingContactCompanySizeSchema,
+	message: z.string().trim().min(1, "Message is required").max(5e3),
+	/** Honeypot — must stay empty; bots that fill it are ignored silently. */
+	companyWebsite: z.string().optional()
+});
+const PublicModelsResponseSchema = z.object({ models: z.array(z.string()) });
+function isCredentialInput(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.key === "string" && CredentialAuthKindSchema.safeParse(candidate.kind).success && candidate.schema instanceof z.ZodType;
+}
+const credentialInputSchema = z.custom((value) => isCredentialInput(value), "must be a credential requirement");
+function createRef(kind, key, schema, options) {
+	const tokenField = options?.tokenField;
+	return {
+		kind,
+		key,
+		schema,
+		...tokenField !== void 0 ? { tokenField } : {},
+		scope(scope) {
+			return {
+				key,
+				kind,
+				schema,
+				scope,
+				...tokenField !== void 0 ? { tokenField } : {}
+			};
+		}
+	};
+}
+function staticCredential(key, schema) {
+	return createRef("api_key", key, schema instanceof z.ZodType ? schema : z.object(schema));
+}
+function oauthCredential(key, options) {
+	const tokenField = options?.tokenField ?? "accessToken";
+	return createRef("oauth_managed", key, tokenField === "accessToken" ? z.object({ accessToken: z.string() }) : z.object({ [tokenField]: z.string() }), { tokenField });
+}
+function keystrokeCredential(key) {
+	return createRef("keystroke", key, KeystrokeCredentialSchema);
+}
+const credential = {
+	static: staticCredential,
+	oauth: oauthCredential,
+	keystroke: keystrokeCredential
+};
+function defineCredential(input) {
+	if (input.kind === "oauth") return input.tokenField !== void 0 ? credential.oauth(input.key, { tokenField: input.tokenField }) : credential.oauth(input.key);
+	if (input.kind === "keystroke") return credential.keystroke(input.key);
+	if ("schema" in input) return credential.static(input.key, input.schema);
+	return credential.static(input.key, input.fields);
+}
+function normalizeCredentialList(list) {
+	return list.map((item) => toCredentialRequirement(item));
+}
+function isCredentialRequirement(item) {
+	return typeof item.scope !== "function";
+}
+function toCredentialRequirement(item) {
+	if (isCredentialRequirement(item)) return item;
+	return {
+		key: item.key,
+		kind: item.kind,
+		schema: item.schema,
+		...item.tokenField !== void 0 ? { tokenField: item.tokenField } : {}
+	};
+}
+const ValidationErrorDetailSchema = z.object({
+	path: z.string(),
+	message: z.string()
+});
+/** Machine-readable codes returned in standard API error bodies. */
+const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(z.enum([
+	"needs_org_selection",
+	"org_unverified",
+	"connector_unavailable"
+]));
+z.object({
+	error: z.string(),
+	code: ErrorResponseCodeSchema.optional(),
+	message: z.string().optional(),
+	details: z.array(ValidationErrorDetailSchema).optional()
+});
+z.object({ message: z.string() });
+const CHAT_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
+/** Single source of truth for supported chat attachment types and their file extension. */
+const CHAT_ATTACHMENT_TYPES = [
+	{
+		mediaType: "image/png",
+		ext: "png"
+	},
+	{
+		mediaType: "image/jpeg",
+		ext: "jpg"
+	},
+	{
+		mediaType: "image/webp",
+		ext: "webp"
+	},
+	{
+		mediaType: "image/gif",
+		ext: "gif"
+	},
+	{
+		mediaType: "application/pdf",
+		ext: "pdf"
+	}
+];
+CHAT_ATTACHMENT_TYPES.map((type) => type.mediaType);
+/** Canonical file extension for an allowed attachment media type. */
+function chatAttachmentExtension(mediaType) {
+	return CHAT_ATTACHMENT_TYPES.find((type) => type.mediaType === mediaType)?.ext;
+}
+const ChatAttachmentInputSchema = z.object({
+	storageKey: z.string().min(1),
+	mediaType: z.string().min(1),
+	filename: z.string().optional()
+});
+/** JSON-safe file ref for workflow inputs, step outputs, and `agent.prompt({ files })`. */
+const FilePartSchema = z.object({
+	type: z.literal("file"),
+	mediaType: z.string().min(1),
+	url: z.string().min(1),
+	filename: z.string().optional()
+});
+z.object({
+	contentType: z.string().min(1),
+	filename: z.string().min(1),
+	size: z.number().int().positive().max(CHAT_ATTACHMENT_MAX_BYTES)
+});
+z.object({
+	uploadUrl: z.string().url(),
+	storageKey: z.string().min(1)
+});
+function modelSupportsMediaType(capabilities, mediaType) {
+	if (mediaType.startsWith("image/")) return capabilities.images;
+	return capabilities.files;
+}
+/** Canonical serve path for a chat attachment (stored in `FileUIPart.url`). */
+function chatAttachmentServePath(projectId, agentSlug, storageKey) {
+	const encodedKey = storageKey.split("/").map((segment) => encodeURIComponent(segment)).join("/");
+	return `/api/projects/${encodeURIComponent(projectId)}/agents/${encodeURIComponent(agentSlug)}/attachments/${encodedKey}`;
+}
+/** Parse a serve URL or path back to project, agent slug, and storage key. */
+function parseChatAttachmentServePath(url) {
+	let pathname;
+	try {
+		pathname = url instanceof URL ? url.pathname : new URL(url, "http://local").pathname;
+	} catch {
+		return null;
+	}
+	if (!pathname.startsWith("/api/projects/")) return null;
+	const match = pathname.slice(14).match(/^([^/]+)\/agents\/([^/]+)\/attachments\/(.+)$/);
+	if (!match) return null;
+	const [, projectId, agentSlug, encodedKey] = match;
+	if (!projectId || !agentSlug || !encodedKey) return null;
+	try {
+		const storageKey = encodedKey.split("/").map((segment) => decodeURIComponent(segment)).join("/");
+		return {
+			projectId: decodeURIComponent(projectId),
+			agentSlug: decodeURIComponent(agentSlug),
+			storageKey
+		};
+	} catch {
+		return null;
+	}
+}
+const CredentialRunContextSchema = z.object({
+	orgId: z.string().min(1).optional(),
+	projectId: z.string().min(1).optional(),
+	userId: z.string().min(1).optional(),
+	userIds: z.record(z.string(), z.string()).optional(),
+	selection: z.record(z.string(), z.string()).optional()
+});
+const ThinkingLevelSchema = z.enum([
+	"provider-default",
+	"none",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh"
+]);
+z.object({
+	message: z.string(),
+	sessionId: z.string().min(1).optional(),
+	subscriptionId: z.string().min(1).optional(),
+	context: CredentialRunContextSchema.optional(),
+	thinkingLevel: ThinkingLevelSchema.optional(),
+	files: z.array(ChatAttachmentInputSchema).max(5).optional()
+}).refine((data) => data.message.trim().length > 0 || (data.files?.length ?? 0) > 0, { message: "message or files is required" });
+z.object({
+	sessionId: z.string(),
+	messages: z.array(z.record(z.string(), z.unknown())),
+	text: z.string(),
+	error: z.string().nullable()
+});
+const SkipResponseSchema = z.object({
+	ok: z.literal(true),
+	skipped: z.literal(true)
+});
+z.object({ ok: z.literal(true) });
+z.object({ service: z.string() });
+const ConnectProviderSchema = z.object({
+	key: z.string(),
+	mode: z.enum(["authorize-url", "browser-redirect"]),
+	path: z.string(),
+	requiresAuth: z.boolean()
+});
+z.object({ providers: z.array(ConnectProviderSchema) });
+z.object({ url: z.string() });
+z.object({ runId: z.string() });
+z.object({
+	sessionId: z.string(),
+	runId: z.string()
+});
+z.object({
+	workflows: z.array(z.string().min(1)).optional(),
+	attachments: z.array(z.string().min(1)).optional()
+});
+const PollAttachmentResultSchema = z.object({
+	attachmentSlug: z.string(),
+	workflowKey: z.string(),
+	runId: z.string().optional(),
+	body: z.unknown().optional(),
+	queued: z.boolean(),
+	skipped: z.boolean().optional()
+});
+const PollRunMultiResponseSchema = z.object({ results: z.array(PollAttachmentResultSchema) });
+z.union([
+	z.record(z.string(), z.unknown()),
+	PollRunMultiResponseSchema,
+	SkipResponseSchema,
+	z.object({ runId: z.string() })
+]);
+z.object({
+	sql: z.string().min(1),
+	params: z.array(z.unknown()).default([]),
+	method: z.string().min(1).optional()
+});
+const DbProxyMigrationSchema = z.object({
+	sql: z.array(z.string().min(1)),
+	hash: z.string().min(1),
+	folderMillis: z.number()
+});
+z.object({ migrations: z.array(DbProxyMigrationSchema) });
+const DbProxyQueryResponseSchema = z.object({ rows: z.array(z.unknown()) });
+z.object({ results: z.array(DbProxyQueryResponseSchema) });
+const RunSourceKindSchema = z.enum([
+	"api",
+	"trigger",
+	"gateway",
+	"workflow",
+	"agent"
+]);
+z.object({
+	kind: RunSourceKindSchema,
+	id: z.string().nullable()
+});
+const AgentTriggerOriginSchema = z.enum(["project", "ephemeral"]);
+const AgentTriggerStatusSchema = z.enum([
+	"active",
+	"disabled",
+	"completed"
+]);
+const AgentTriggerTypeSchema = z.enum([
+	"webhook",
+	"cron",
+	"poll"
+]);
+const AgentTriggerSummarySchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	name: z.string().nullable().optional(),
+	description: z.string().nullable().optional(),
+	type: AgentTriggerTypeSchema,
+	schedule: z.string().nullable(),
+	endpoint: z.string().nullable(),
+	origin: AgentTriggerOriginSchema,
+	prompt: z.string().nullable(),
+	status: AgentTriggerStatusSchema,
+	executionCount: z.number().int().nonnegative(),
+	until: z.string().nullable(),
+	attachmentId: z.string(),
+	attachmentSlug: z.string()
+});
+z.array(AgentTriggerSummarySchema);
+const HistoryRunKindSchema = z.enum(["workflow", "agent"]);
+const HistoryRunStatusSchema = z.enum([
+	"pending",
+	"running",
+	"sleeping",
+	"waiting_hook",
+	"waiting_children",
+	"completed",
+	"failed",
+	"canceled"
+]);
+const HistoryRunActorSchema = z.object({
+	userId: z.string(),
+	name: z.string(),
+	avatarUrl: z.string().nullable().optional()
+});
+const HistoryRunUsageLineItemSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	/** Amount debited from the org's Keystroke balance for this line. */
+	billedUsd: z.number(),
+	/** Provider cost for LLM usage on the org's API key (informational; not billed by Keystroke). */
+	providerCostUsd: z.number().nullable().optional(),
+	keySource: z.enum(["byok", "platform"]).nullable().optional()
+});
+const HistoryRunUsageSchema = z.object({
+	runDurationMs: z.number().nullable(),
+	lineItems: z.array(HistoryRunUsageLineItemSchema),
+	/** Sum of `billedUsd` — what Keystroke charged for this run. */
+	totalBilledUsd: z.number().nullable(),
+	/** Sum of BYOK LLM provider costs (billed externally by the org's provider). */
+	externalProviderCostUsd: z.number().nullable().optional()
+});
+const HistoryRunSchema = z.object({
+	id: z.string(),
+	kind: HistoryRunKindSchema,
+	traceId: z.string().nullable(),
+	projectId: z.string(),
+	projectName: z.string(),
+	resourceKey: z.string(),
+	resourceId: z.string(),
+	resourceName: z.string(),
+	status: HistoryRunStatusSchema,
+	triggeredAt: z.string(),
+	timeInQueueMs: z.number().nullable(),
+	startedAt: z.string(),
+	finishedAt: z.string().nullable(),
+	durationMs: z.number().nullable(),
+	triggerLabel: z.string(),
+	triggerRaw: z.string(),
+	ranAs: HistoryRunActorSchema.nullable(),
+	modelsUsed: z.array(z.string()),
+	otherServicesUsed: z.array(z.string()),
+	totalCostUsd: z.number().nullable(),
+	messageCount: z.number().optional(),
+	stepCount: z.number().optional()
+});
+const HistoryTraceSpanSchema = z.object({
+	id: z.string(),
+	traceId: z.string(),
+	parentSpanId: z.string().nullable(),
+	kind: z.string(),
+	refId: z.string(),
+	name: z.string(),
+	status: z.string(),
+	startedAt: z.string(),
+	finishedAt: z.string().nullable(),
+	metadata: z.unknown().nullable(),
+	error: z.unknown().nullable()
+});
+const HistoryTraceLogSchema = z.object({
+	id: z.string(),
+	traceId: z.string(),
+	spanId: z.string(),
+	seq: z.number(),
+	level: z.string(),
+	message: z.string(),
+	data: z.unknown().nullable(),
+	source: z.string(),
+	createdAt: z.string()
+});
+const HistoryTraceTriggerSchema = z.object({
+	triggerType: z.string(),
+	triggerRunId: z.string(),
+	workflowKey: z.string().optional(),
+	agentKey: z.string().optional(),
+	attachmentId: z.string().nullable().optional(),
+	attachmentSlug: z.string().nullable().optional(),
+	route: z.string().optional(),
+	sourcePath: z.string().nullable().optional()
+}).nullable();
+const HistoryTraceGatewaySchema = z.object({
+	gatewayAttachmentId: z.string(),
+	gatewayAttachmentKey: z.string(),
+	threadId: z.string().optional(),
+	channelId: z.string().optional(),
+	mode: z.string().optional()
+}).nullable();
+const HistoryTraceSchema = z.object({
+	traceId: z.string(),
+	trigger: HistoryTraceTriggerSchema,
+	gateway: HistoryTraceGatewaySchema,
+	spans: z.array(HistoryTraceSpanSchema),
+	logs: z.array(HistoryTraceLogSchema)
+});
+const HistoryWorkflowStepSchema = z.object({
+	id: z.string(),
+	actionKey: z.string(),
+	output: z.unknown(),
+	completedAt: z.string()
+});
+const HistoryWorkflowRunDetailSchema = z.object({
+	kind: z.literal("workflow"),
+	run: z.object({
+		id: z.string(),
+		workflowKey: z.string(),
+		status: HistoryRunStatusSchema,
+		trigger: z.string(),
+		triggeredAt: z.string(),
+		startedAt: z.string().nullable(),
+		finishedAt: z.string().nullable(),
+		input: z.unknown().nullable(),
+		output: z.unknown().nullable(),
+		error: z.unknown().nullable()
+	}),
+	trigger: z.object({
+		id: z.string(),
+		attachmentSlug: z.string().nullable(),
+		triggerType: z.string(),
+		sourcePath: z.string().nullable(),
+		payload: z.unknown().nullable(),
+		triggeredAt: z.string()
+	}).nullable(),
+	steps: z.array(HistoryWorkflowStepSchema),
+	trace: HistoryTraceSchema.nullable(),
+	ranAs: HistoryRunActorSchema.nullable().optional(),
+	usage: HistoryRunUsageSchema.nullable().optional()
+});
+const HistoryAgentCompactionEventSchema = z.object({
+	seq: z.number(),
+	createdAt: z.string(),
+	compactionModel: z.string(),
+	sourceModel: z.string(),
+	estimatedBeforeTokens: z.number().optional(),
+	retainedTailEstimate: z.number().optional(),
+	durable: z.boolean()
+});
+const HistoryAgentSessionDetailSchema = z.object({
+	kind: z.literal("agent"),
+	runId: z.string(),
+	session: z.object({
+		id: z.string(),
+		agentKey: z.string(),
+		status: HistoryRunStatusSchema,
+		source: z.enum([
+			"api",
+			"gateway",
+			"trigger",
+			"workflow",
+			"agent"
+		]),
+		sourceId: z.string().nullable(),
+		createdAt: z.string(),
+		updatedAt: z.string(),
+		messageCount: z.number(),
+		error: z.unknown().nullable()
+	}),
+	gateway: z.object({
+		threadId: z.string(),
+		attachmentSlug: z.string().nullable()
+	}).nullable(),
+	messages: z.array(z.record(z.string(), z.unknown())),
+	/** Sanitized context-compaction markers for the conversation timeline. */
+	compactionEvents: z.array(HistoryAgentCompactionEventSchema).default([]),
+	trace: HistoryTraceSchema.nullable(),
+	ranAs: HistoryRunActorSchema.nullable().optional(),
+	usage: HistoryRunUsageSchema.nullable().optional()
+});
+const HistoryRunDetailSchema = z.discriminatedUnion("kind", [HistoryWorkflowRunDetailSchema, HistoryAgentSessionDetailSchema]);
+z.object({
+	project: z.string().min(1).optional(),
+	status: HistoryRunStatusSchema.optional(),
+	kind: HistoryRunKindSchema.optional(),
+	limit: z.coerce.number().int().min(1).max(200).optional()
+});
+z.array(HistoryRunSchema);
+HistoryRunDetailSchema.nullable();
+HistoryRunSchema.nullable();
+const WorkflowRunStatusSchema = z.enum([
+	"pending",
+	"running",
+	"sleeping",
+	"waiting_hook",
+	"waiting_children",
+	"completed",
+	"failed",
+	"canceled"
+]);
+const WorkflowRunTriggerSchema = z.enum([
+	"api",
+	"cron",
+	"webhook",
+	"poll",
+	"retry"
+]);
+z.enum([
+	"run_started",
+	"step_completed",
+	"step_failed",
+	"step_retrying",
+	"sleep_scheduled",
+	"sleep_completed",
+	"hook_created",
+	"hook_resumed",
+	"child_dispatched",
+	"run_completed",
+	"run_failed",
+	"run_canceled"
+]);
+const WorkflowRunSummarySchema = z.object({
+	id: z.string(),
+	status: WorkflowRunStatusSchema,
+	trigger: WorkflowRunTriggerSchema,
+	triggeredAt: z.string(),
+	startedAt: z.string().nullable(),
+	finishedAt: z.string().nullable(),
+	sourceKind: RunSourceKindSchema,
+	sourceId: z.string().nullable(),
+	triggerRunId: z.string().nullable(),
+	attachmentId: z.string().nullable()
+});
+const WorkflowRunRecordSchema = z.object({
+	id: z.string(),
+	workflowSlug: z.string(),
+	status: WorkflowRunStatusSchema,
+	trigger: WorkflowRunTriggerSchema,
+	triggeredAt: z.string(),
+	startedAt: z.string().nullable(),
+	finishedAt: z.string().nullable(),
+	sourceKind: RunSourceKindSchema,
+	sourceId: z.string().nullable(),
+	triggerRunId: z.string().nullable(),
+	attachmentId: z.string().nullable(),
+	parentWorkflowRunId: z.string().nullable(),
+	parentSpanId: z.string().nullable(),
+	input: z.unknown().nullable(),
+	output: z.unknown().nullable(),
+	error: z.unknown().nullable()
+});
+z.object({
+	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
+	cursor: z.string().min(1).optional(),
+	status: WorkflowRunStatusSchema.optional(),
+	trigger: WorkflowRunTriggerSchema.optional()
+});
+z.object({
+	items: z.array(WorkflowRunSummarySchema),
+	nextCursor: z.string().nullable()
+});
+z.enum([
+	"trigger",
+	"steps",
+	"trace"
+]);
+z.object({ include: z.string().optional() });
+const TriggerRunDetailSchema = z.object({
+	id: z.string(),
+	triggerId: z.string(),
+	attachmentSlug: z.string().nullable(),
+	triggerType: z.enum([
+		"cron",
+		"webhook",
+		"poll"
+	]),
+	sourcePath: z.string().nullable(),
+	payload: z.unknown().nullable(),
+	triggeredAt: z.string()
+});
+const WorkflowStepRunSchema = z.object({
+	id: z.string(),
+	actionKey: z.string(),
+	output: z.unknown(),
+	completedAt: z.string()
+});
+const TraceTriggerSummarySchema = z.object({
+	triggerType: z.string(),
+	triggerRunId: z.string(),
+	workflowSlug: z.string().optional(),
+	agentSlug: z.string().optional(),
+	attachmentId: z.string().nullable().optional(),
+	attachmentSlug: z.string().nullable().optional(),
+	route: z.string().optional(),
+	sourcePath: z.string().nullable().optional()
+}).nullable();
+const TraceGatewaySummarySchema = z.object({
+	gatewayAttachmentId: z.string(),
+	gatewayAttachmentKey: z.string(),
+	threadId: z.string().optional(),
+	channelId: z.string().optional(),
+	mode: z.string().optional()
+}).nullable();
+const TraceSpanSchema = z.object({
+	id: z.string(),
+	traceId: z.string(),
+	parentSpanId: z.string().nullable(),
+	kind: z.string(),
+	refId: z.string(),
+	name: z.string(),
+	status: z.string(),
+	startedAt: z.string(),
+	finishedAt: z.string().nullable(),
+	metadata: z.unknown().nullable(),
+	error: z.unknown().nullable()
+});
+const TraceLogSchema = z.object({
+	id: z.string(),
+	traceId: z.string(),
+	spanId: z.string(),
+	seq: z.number(),
+	level: z.string(),
+	message: z.string(),
+	data: z.unknown().nullable(),
+	source: z.string(),
+	createdAt: z.string()
+});
+const TraceResponseSchema = z.object({
+	traceId: z.string(),
+	trigger: TraceTriggerSummarySchema,
+	gateway: TraceGatewaySummarySchema,
+	spans: z.array(TraceSpanSchema),
+	logs: z.array(TraceLogSchema)
+});
+z.object({
+	run: WorkflowRunRecordSchema,
+	trigger: TriggerRunDetailSchema.nullable(),
+	steps: z.array(WorkflowStepRunSchema),
+	trace: TraceResponseSchema.nullable()
+});
+const WorkflowHookStatusSchema = z.enum(["waiting", "resumed"]);
+const WorkflowHookSummarySchema = z.object({
+	token: z.string(),
+	correlationId: z.string(),
+	status: WorkflowHookStatusSchema,
+	createdAt: z.string(),
+	resumeUrl: z.string().nullable()
+});
+z.object({ items: z.array(WorkflowHookSummarySchema) });
+const AgentSessionStatusSchema = z.enum([
+	"running",
+	"completed",
+	"failed",
+	"canceled"
+]);
+const AgentSessionSummarySchema = z.object({
+	id: z.string(),
+	status: AgentSessionStatusSchema,
+	source: RunSourceKindSchema,
+	sourceId: z.string().nullable(),
+	title: z.string().nullable(),
+	ranByUserName: z.string().nullable(),
+	gatewayPlatform: z.string().nullable(),
+	triggerType: AgentTriggerTypeSchema.nullable(),
+	createdAt: z.string(),
+	updatedAt: z.string(),
+	messageCount: z.number()
+});
+const AgentSessionRecordSchema = z.object({
+	id: z.string(),
+	agentSlug: z.string(),
+	status: AgentSessionStatusSchema,
+	source: RunSourceKindSchema,
+	sourceId: z.string().nullable(),
+	title: z.string().nullable(),
+	createdAt: z.string(),
+	updatedAt: z.string(),
+	parentSpanId: z.string().nullable(),
+	messageCount: z.number(),
+	error: z.unknown().nullable()
+});
+z.object({
+	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
+	cursor: z.string().min(1).optional(),
+	status: AgentSessionStatusSchema.optional(),
+	source: RunSourceKindSchema.optional()
+});
+z.object({
+	items: z.array(AgentSessionSummarySchema),
+	nextCursor: z.string().nullable()
+});
+z.enum([
+	"gateway",
+	"messages",
+	"events",
+	"trace"
+]);
+z.object({ include: z.string().optional() });
+const GatewaySessionDetailSchema = z.object({
+	threadId: z.string(),
+	attachmentId: z.string(),
+	attachmentSlug: z.string().nullable()
+});
+const AgentEventSchema = z.object({
+	id: z.string(),
+	sessionId: z.string(),
+	seq: z.number(),
+	eventType: z.string(),
+	payload: z.unknown(),
+	createdAt: z.string()
+});
+z.object({
+	session: AgentSessionRecordSchema,
+	activeRunId: z.string().nullable().default(null),
+	gateway: GatewaySessionDetailSchema.nullable(),
+	messages: z.array(z.record(z.string(), z.unknown())),
+	events: z.array(AgentEventSchema),
+	/**
+	* Sanitized context-compaction markers, populated alongside `messages`.
+	* A cheap indexed lookup (session_id + event_type) — never the full event
+	* log. Defaulted so older servers remain compatible.
+	*/
+	compactionEvents: z.array(HistoryAgentCompactionEventSchema).default([]),
+	trace: TraceResponseSchema.nullable()
+});
+const SlackGatewayModeSchema = z.enum([
+	"mention",
+	"channel",
+	"dm"
+]);
+const GatewayAttachmentSourceSchema = z.object({
+	kind: z.literal("slack"),
+	mode: SlackGatewayModeSchema,
+	credentialKey: z.string(),
+	channelIds: z.array(z.string()).optional(),
+	subscribeOnMention: z.boolean()
+});
+const GatewayAttachmentRecordSchema = z.object({
+	id: z.string(),
+	key: z.string(),
+	agentKey: z.string(),
+	channelId: z.string(),
+	teamId: z.string().nullable().optional(),
+	platform: z.string(),
+	source: GatewayAttachmentSourceSchema,
+	registeredAt: z.string(),
+	updatedAt: z.string()
+});
+z.object({ attachments: z.array(GatewayAttachmentRecordSchema) });
+z.object({
+	agentKey: z.string().min(1),
+	teamId: z.string().min(1).optional(),
+	mode: SlackGatewayModeSchema.optional(),
+	subscribeOnMention: z.boolean().optional()
+});
+const AgentListItemSchema = z.object({
+	key: z.string(),
+	name: z.string().optional(),
+	route: z.string()
+});
+z.object({ agents: z.array(AgentListItemSchema) });
+const WorkflowSubscriptionRecordSchema = z.object({
+	id: z.string(),
+	workflowKey: z.string(),
+	userId: z.string(),
+	enabled: z.boolean(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+z.object({ subscriptions: z.array(WorkflowSubscriptionRecordSchema) });
+z.object({
+	userId: z.string().min(1).optional(),
+	enabled: z.boolean().optional()
+});
+const CredentialInstanceRecordSchema = z.object({
+	id: z.string(),
+	appSlug: z.string(),
+	slug: z.string(),
+	name: z.string().nullable(),
+	scopeType: CredentialScopeTypeSchema,
+	scopeId: z.string().nullable(),
+	label: z.string().nullable(),
+	isDefault: z.boolean(),
+	authKind: CredentialAuthKindSchema
+});
+z.object({ instances: z.array(CredentialInstanceRecordSchema) });
+z.object({
+	key: z.string().min(1),
+	slug: z.string().min(1).optional(),
+	name: z.string().nullable().optional(),
+	scopeType: CredentialScopeTypeSchema,
+	scopeId: z.string().nullable().optional(),
+	label: z.string().nullable().optional(),
+	isDefault: z.boolean().optional(),
+	value: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" })
+});
+z.object({
+	slug: z.string().min(1).optional(),
+	name: z.string().nullable().optional(),
+	label: z.string().nullable().optional(),
+	isDefault: z.boolean().optional(),
+	value: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" }).optional()
+});
+const TriggerRunTypeSchema = z.enum([
+	"cron",
+	"webhook",
+	"poll"
+]);
+const TriggerRunOutcomeSchema = z.enum([
+	"dispatched",
+	"skipped",
+	"failed"
+]);
+const TriggerRunReasonSchema = z.enum([
+	"filter_rejected",
+	"transform_undefined",
+	"invalid_payload",
+	"source_error",
+	"handler_error"
+]);
+const TriggerRunWorkflowSummarySchema = z.object({
+	id: z.string(),
+	status: WorkflowRunStatusSchema,
+	workflowSlug: z.string()
+});
+const TriggerRunAgentSessionSummarySchema = z.object({
+	id: z.string(),
+	agentSlug: z.string()
+});
+const TriggerRunSummarySchema = z.object({
+	id: z.string(),
+	triggerType: TriggerRunTypeSchema,
+	triggeredAt: z.string(),
+	sourcePath: z.string().nullable(),
+	outcome: TriggerRunOutcomeSchema,
+	reason: TriggerRunReasonSchema.nullable(),
+	detail: z.string().nullable(),
+	/** Workflow runs dispatched by this fire (fan-out → one per matched workflow attachment). */
+	workflowRuns: z.array(TriggerRunWorkflowSummarySchema),
+	/** Agent sessions dispatched by this fire (fan-out → one per matched agent attachment). */
+	agentSessions: z.array(TriggerRunAgentSessionSummarySchema)
+});
+const TriggerRunRecordSchema = z.object({
+	id: z.string(),
+	triggerId: z.string(),
+	attachmentSlug: z.string(),
+	triggerType: TriggerRunTypeSchema,
+	sourcePath: z.string().nullable(),
+	outcome: TriggerRunOutcomeSchema,
+	reason: TriggerRunReasonSchema.nullable(),
+	detail: z.string().nullable(),
+	payload: z.unknown().nullable(),
+	triggeredAt: z.string()
+});
+z.object({
+	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
+	cursor: z.string().min(1).optional(),
+	triggerType: TriggerRunTypeSchema.optional(),
+	outcome: TriggerRunOutcomeSchema.optional()
+});
+z.object({
+	items: z.array(TriggerRunSummarySchema),
+	nextCursor: z.string().nullable()
+});
+z.enum([
+	"workflows",
+	"agents",
+	"trace"
+]);
+z.object({ include: z.string().optional() });
+const TriggerRunAgentSessionDetailSchema = z.object({
+	id: z.string(),
+	agentSlug: z.string()
+});
+z.object({
+	run: TriggerRunRecordSchema,
+	workflowRuns: z.array(WorkflowRunSummarySchema),
+	agentSessions: z.array(TriggerRunAgentSessionDetailSchema),
+	trace: TraceResponseSchema.nullable()
+});
+const TriggerTypeSchema = z.enum([
+	"webhook",
+	"poll",
+	"cron"
+]);
+const TriggerTargetKindSchema = z.enum(["workflow", "agent"]);
+const TriggerStatusSchema = z.enum(["active", "disabled"]);
+const TriggerAttachmentStatusSchema = z.enum(["active", "disabled"]);
+const TriggerListItemSchema = z.object({
+	slug: z.string(),
+	name: z.string().optional(),
+	description: z.string().optional(),
+	type: TriggerTypeSchema,
+	status: TriggerStatusSchema.optional(),
+	schedule: z.string().nullable().optional(),
+	sourcePath: z.string().optional(),
+	route: z.string().optional(),
+	webhookUrl: z.string().url().optional(),
+	targetKind: TriggerTargetKindSchema,
+	workflowKey: z.string().optional(),
+	agentKey: z.string().optional()
+});
+z.object({ triggers: z.array(TriggerListItemSchema) });
+z.object({ endpoint: z.string().min(1).optional() });
+const TriggerAssignmentSchema = z.object({
+	kind: TriggerTargetKindSchema,
+	id: z.string(),
+	slug: z.string(),
+	name: z.string(),
+	attachmentId: z.string(),
+	attachmentSlug: z.string(),
+	status: TriggerAttachmentStatusSchema,
+	disabledAt: z.string().nullable()
+});
+/** Status of the downstream run/session a dispatched fire produced. */
+const WorkspaceTriggerRunStatusSchema = z.enum([
+	"completed",
+	"running",
+	"failed"
+]);
+/**
+* Categorical reason a fire was recorded but produced no downstream run. These map
+* from the persisted `trigger_runs.reason` enum onto the labels the UI renders.
+*/
+const WorkspaceTriggerSkipReasonSchema = z.enum([
+	"filtered",
+	"no_new_data",
+	"transform_undefined",
+	"payload_mismatch"
+]);
+/**
+* A single downstream run/session a dispatched fire produced. A fan-out fire can
+* dispatch several of these (multiple workflows and/or agents off one source event).
+*/
+const WorkspaceTriggerRunTargetSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("workflow"),
+	runId: z.string(),
+	workflowId: z.string(),
+	status: WorkspaceTriggerRunStatusSchema,
+	name: z.string()
+}), z.object({
+	kind: z.literal("agent"),
+	sessionId: z.string(),
+	agentId: z.string(),
+	status: WorkspaceTriggerRunStatusSchema,
+	name: z.string()
+})]);
+/**
+* Outcome of a single trigger fire — drives the run-history row presentation. Every
+* recorded fire either dispatched one or more workflow/agent targets, was skipped by
+* trigger logic, or failed before any target ran.
+*/
+const WorkspaceTriggerRunOutcomeSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("dispatched"),
+		targets: z.array(WorkspaceTriggerRunTargetSchema)
+	}),
+	z.object({
+		kind: z.literal("skipped"),
+		reason: WorkspaceTriggerSkipReasonSchema,
+		/** One-line Zod issue summary when reason is payload_mismatch. */
+		detail: z.string().nullable().optional()
+	}),
+	z.object({
+		kind: z.literal("failed"),
+		error: z.string()
+	})
+]);
+const WorkspaceTriggerSummarySchema = z.object({
+	/** `triggers.id` UUID for the trigger row. */
+	id: z.string(),
+	slug: z.string(),
+	name: z.string(),
+	description: z.string().min(1),
+	type: TriggerTypeSchema,
+	status: TriggerStatusSchema,
+	projectId: z.string(),
+	projectName: z.string(),
+	/** Webhook ingress URL (webhook triggers only). */
+	webhookUrl: z.string().nullable(),
+	/** Cron expression or poll cadence label (cron/poll triggers only). */
+	schedule: z.string().nullable(),
+	/** Workflows + agents currently bound to this source. */
+	assignments: z.array(TriggerAssignmentSchema),
+	lastFiredAt: z.string().nullable(),
+	fireCount: z.number().int().nonnegative(),
+	createdAt: z.string()
+});
+WorkspaceTriggerSummarySchema.extend({ 
+/** Source module file path, relative to the project root. */
+sourcePath: z.string() });
+z.array(WorkspaceTriggerSummarySchema);
+const WorkspaceTriggerRunSummarySchema = z.object({
+	id: z.string(),
+	triggerType: TriggerTypeSchema,
+	triggeredAt: z.string(),
+	/** Poll/webhook source path or endpoint that produced the fire. */
+	sourcePath: z.string().nullable(),
+	outcome: WorkspaceTriggerRunOutcomeSchema
+});
+z.object({
+	items: z.array(WorkspaceTriggerRunSummarySchema),
+	nextCursor: z.string().nullable()
+});
+z.object({
+	path: z.string(),
+	contents: z.string()
+});
+/** Whether the LLM overview is still being produced, finished, or errored. */
+const WorkspaceTriggerOverviewStatusSchema = z.enum([
+	"generating",
+	"ready",
+	"failed"
+]);
+z.object({
+	status: WorkspaceTriggerOverviewStatusSchema,
+	markdown: z.string(),
+	hash: z.string(),
+	generatedAt: z.string().nullable(),
+	model: z.string()
+});
+/** Inputs the worker feeds the LLM to generate a trigger overview. */
+const TriggerOverviewInputSchema = z.object({
+	name: z.string(),
+	description: z.string().nullable(),
+	type: TriggerTypeSchema,
+	schedule: z.string().nullable(),
+	sourcePath: z.string(),
+	sourceContents: z.string(),
+	assignments: z.array(TriggerAssignmentSchema)
+});
+z.object({
+	triggerId: z.string(),
+	projectId: z.string(),
+	triggerHash: z.string(),
+	model: z.string(),
+	input: TriggerOverviewInputSchema
+});
+z.object({ enabled: z.boolean() });
+z.object({
+	input: z.unknown().optional(),
+	workflow: z.string().min(1).optional(),
+	agent: z.string().min(1).optional()
+});
+z.object({ runId: z.string().min(1) });
+/** One attachment's invoke-form metadata for the dashboard. */
+const TriggerInvokeAttachmentSchema = z.object({
+	attachmentSlug: z.string().min(1),
+	kind: TriggerTargetKindSchema,
+	targetSlug: z.string().min(1),
+	targetName: z.string().min(1),
+	enabled: z.boolean(),
+	/** Webhook attachment JSON Schema used to drive the invoke form. */
+	requestSchema: z.record(z.string(), z.unknown()).optional()
+});
+z.object({
+	type: TriggerTypeSchema,
+	attachments: z.array(TriggerInvokeAttachmentSchema),
+	/** Cron source static payload — display only; never overridden on invoke. */
+	staticPayload: z.unknown().optional()
+});
+z.object({
+	manual: z.literal(true),
+	attachments: z.array(z.string().min(1)).optional()
+});
+const OrganizationMemberRoleSchema = z.enum([
+	"owner",
+	"admin",
+	"builder"
+]);
+const OrganizationMemberStatusSchema = z.enum([
+	"invited",
+	"active",
+	"rejected",
+	"suspended"
+]);
+const InvitableOrganizationMemberRoleSchema = z.enum(["admin", "builder"]);
+const isoDateTime$5 = z.string().datetime();
+const OrganizationMemberSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	email: z.string().email(),
+	role: OrganizationMemberRoleSchema,
+	status: OrganizationMemberStatusSchema,
+	avatarUrl: z.string().optional(),
+	joinedAt: isoDateTime$5.optional(),
+	lastActiveAt: isoDateTime$5.nullable().optional()
+});
+z.array(OrganizationMemberSchema);
+z.object({
+	limit: z.coerce.number().int().min(1).max(200).optional(),
+	cursor: z.string().min(1).optional()
+});
+z.object({
+	items: z.array(OrganizationMemberSchema),
+	nextCursor: z.string().nullable()
+});
+z.object({
+	emails: z.array(z.string().trim().email()).min(1),
+	role: InvitableOrganizationMemberRoleSchema
+});
+const InviteOrganizationMemberResultStatusSchema = z.enum([
+	"sent",
+	"already_member",
+	"pending",
+	"invalid"
+]);
+const InviteOrganizationMemberResultSchema = z.object({
+	email: z.string(),
+	status: InviteOrganizationMemberResultStatusSchema,
+	invitationId: z.string().optional()
+});
+z.array(InviteOrganizationMemberResultSchema);
+z.object({ role: InvitableOrganizationMemberRoleSchema });
+const OrganizationInvitationSchema = z.object({
+	id: z.string(),
+	organizationName: z.string(),
+	organizationSlug: OrganizationSlugSchema,
+	invitedByName: z.string().optional(),
+	invitedByEmail: z.string().email().optional(),
+	role: OrganizationMemberRoleSchema
+});
+z.array(OrganizationInvitationSchema);
+z.object({ success: z.literal(true) });
+const isoDateTime$4 = z.string().datetime();
+const ApiKeyCreatorSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	email: z.string().email().optional(),
+	avatarUrl: z.string().optional(),
+	/** True when the creator user row no longer exists. */
+	deleted: z.boolean().optional()
+});
+const ApiKeySummarySchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	keyPreview: z.string(),
+	createdAt: isoDateTime$4,
+	createdBy: ApiKeyCreatorSchema,
+	isCreatedByCurrentUser: z.boolean()
+});
+z.array(ApiKeySummarySchema);
+z.object({ name: z.string().trim().min(1).max(128) });
+ApiKeySummarySchema.extend({ secret: z.string() });
+const isoDateTime$3 = z.string().datetime();
+const ManagedServiceKindSchema = z.enum(["llm"]);
+z.enum([
+	"openai",
+	"anthropic",
+	"google",
+	"groq",
+	"xai"
+]);
+const ManagedServiceCredentialSchema = z.object({
+	id: z.string(),
+	kind: ManagedServiceKindSchema,
+	provider: z.string(),
+	keyPreview: z.string(),
+	createdAt: isoDateTime$3,
+	updatedAt: isoDateTime$3,
+	createdBy: ApiKeyCreatorSchema,
+	isCreatedByCurrentUser: z.boolean()
+});
+z.array(ManagedServiceCredentialSchema);
+z.object({
+	kind: ManagedServiceKindSchema.default("llm"),
+	provider: z.string().trim().min(1),
+	apiKey: z.string().trim().min(1)
+});
+z.object({ apiKey: z.string().trim().min(1) });
+const ProjectUserRoleSchema = z.enum(["admin", "builder"]);
+const ProjectInvitePermissionSchema = z.enum(["admin", "all"]);
+const ProjectMemberStatusSchema = z.enum(["active", "invited"]);
+const isoDateTime$2 = z.string().datetime();
+const ProjectMemberSchema = z.object({
+	id: z.string(),
+	projectId: z.string(),
+	name: z.string(),
+	email: z.string().email(),
+	role: ProjectUserRoleSchema,
+	status: ProjectMemberStatusSchema,
+	image: z.string().nullable(),
+	createdAt: isoDateTime$2,
+	isCurrentUser: z.boolean().optional()
+});
+z.array(ProjectMemberSchema);
+z.object({
+	emails: z.array(z.string().trim().email()).min(1),
+	role: ProjectUserRoleSchema
+});
+const InviteProjectMemberResultStatusSchema = z.enum([
+	"added",
+	"already_member",
+	"not_org_member",
+	"invalid"
+]);
+const InviteProjectMemberResultSchema = z.object({
+	email: z.string(),
+	status: InviteProjectMemberResultStatusSchema
+});
+z.array(InviteProjectMemberResultSchema);
+z.object({ role: ProjectUserRoleSchema });
+z.object({
+	description: z.string(),
+	defaultRole: ProjectUserRoleSchema,
+	invitePermission: ProjectInvitePermissionSchema
+});
+z.object({
+	description: z.string().optional(),
+	defaultRole: ProjectUserRoleSchema.optional(),
+	invitePermission: ProjectInvitePermissionSchema.optional()
+}).refine((data) => data.description !== void 0 || data.defaultRole !== void 0 || data.invitePermission !== void 0, { message: "At least one field is required" });
+z.object({ url: z.url().nullable() });
+z.object({ 
+/** Storage key returned from presign; null removes the custom override. */
+storageKey: z.string().min(1).nullable() });
+z.object({ contentType: z.string().trim().min(1) });
+z.object({
+	uploadUrl: z.url(),
+	storageKey: z.string().min(1)
+});
+const UserInterfaceThemeSchema = z.enum([
+	"system",
+	"light",
+	"dark"
+]);
+const UserSurfaceContrastSchema = z.enum(["off", "on"]);
+const UserWorkspaceLayoutModeSchema = z.enum(["default", "linear"]);
+const UserWorkspaceFontSizeSchema = z.enum(["default", "large"]);
+const UserSidebarNavIconVisibilitySchema = z.enum(["hidden", "visible"]);
+const UserSidebarFooterChatRowVisibilitySchema = z.enum(["hidden", "visible"]);
+const UserWorkspaceFavoriteKindSchema = z.enum([
+	"agent",
+	"workflow",
+	"skill",
+	"run"
+]);
+const UserWorkspaceFavoriteSchema = z.object({
+	kind: UserWorkspaceFavoriteKindSchema,
+	resourceId: z.string().min(1)
+});
+const UserSidebarPreferencesSchema = z.object({
+	navIconVisibility: UserSidebarNavIconVisibilitySchema,
+	footerChatRowVisibility: UserSidebarFooterChatRowVisibilitySchema,
+	hiddenNavItemIds: z.array(z.string()),
+	topNavItemOrderIds: z.array(z.string()),
+	workspaceNavItemOrderIds: z.array(z.string())
+});
+const UserTimezoneSchema = z.string().refine(isValidIanaTimezone, { message: "Invalid IANA timezone" });
+z.object({
+	interfaceTheme: UserInterfaceThemeSchema,
+	surfaceContrast: UserSurfaceContrastSchema,
+	layoutMode: UserWorkspaceLayoutModeSchema,
+	fontSize: UserWorkspaceFontSizeSchema,
+	sidebar: UserSidebarPreferencesSchema,
+	favorites: z.array(UserWorkspaceFavoriteSchema),
+	projectOrderIds: z.array(z.string()),
+	projectDotColors: z.record(z.string(), z.string()),
+	onboardingTabVisible: z.boolean(),
+	timezone: z.union([UserTimezoneSchema, z.null()])
+});
+const UserSidebarPreferencesPatchSchema = z.object({
+	navIconVisibility: UserSidebarNavIconVisibilitySchema.optional(),
+	footerChatRowVisibility: UserSidebarFooterChatRowVisibilitySchema.optional(),
+	hiddenNavItemIds: z.array(z.string()).optional(),
+	topNavItemOrderIds: z.array(z.string()).optional(),
+	workspaceNavItemOrderIds: z.array(z.string()).optional()
+});
+z.object({
+	interfaceTheme: UserInterfaceThemeSchema.optional(),
+	surfaceContrast: UserSurfaceContrastSchema.optional(),
+	layoutMode: UserWorkspaceLayoutModeSchema.optional(),
+	fontSize: UserWorkspaceFontSizeSchema.optional(),
+	sidebar: UserSidebarPreferencesPatchSchema.optional(),
+	favorites: z.array(UserWorkspaceFavoriteSchema).optional(),
+	projectOrderIds: z.array(z.string()).optional(),
+	projectDotColors: z.record(z.string(), z.string()).optional(),
+	onboardingTabVisible: z.boolean().optional(),
+	timezone: z.union([UserTimezoneSchema, z.null()]).optional()
+}).refine((value) => value.interfaceTheme !== void 0 || value.surfaceContrast !== void 0 || value.layoutMode !== void 0 || value.fontSize !== void 0 || value.sidebar !== void 0 || value.favorites !== void 0 || value.projectOrderIds !== void 0 || value.projectDotColors !== void 0 || value.onboardingTabVisible !== void 0 || value.timezone !== void 0, { message: "At least one preference field is required" });
+const OrganizationLogoVariantSchema = z.enum(["light", "dark"]);
+z.object({
+	customLogoEnabled: z.boolean(),
+	customLogoExplicitlyDisabled: z.boolean(),
+	logoLightUrl: z.url().nullable(),
+	logoDarkUrl: z.url().nullable(),
+	logoHeightPx: z.number().int().min(14).max(32)
+});
+z.object({
+	customLogoEnabled: z.boolean().optional(),
+	customLogoExplicitlyDisabled: z.boolean().optional(),
+	logoLightStorageKey: z.string().min(1).nullable().optional(),
+	logoDarkStorageKey: z.string().min(1).nullable().optional(),
+	logoHeightPx: z.number().int().min(14).max(32).optional()
+}).refine((value) => value.customLogoEnabled !== void 0 || value.customLogoExplicitlyDisabled !== void 0 || value.logoLightStorageKey !== void 0 || value.logoDarkStorageKey !== void 0 || value.logoHeightPx !== void 0, { message: "At least one branding field is required" });
+z.object({
+	variant: OrganizationLogoVariantSchema,
+	contentType: z.string().trim().min(1)
+});
+z.object({
+	uploadUrl: z.url(),
+	storageKey: z.string().min(1)
+});
+const ProjectArtifactStatusSchema = z.enum(["pending", "ready"]);
+const isoDateTime$1 = z.string().datetime();
+const ProjectArtifactSchema = z.object({
+	id: z.string(),
+	projectId: z.string(),
+	storageKey: z.string(),
+	status: ProjectArtifactStatusSchema,
+	createdAt: isoDateTime$1,
+	updatedAt: isoDateTime$1
+});
+z.object({
+	artifact: ProjectArtifactSchema,
+	uploadUrl: z.string().url(),
+	expiresInSeconds: z.number().int().positive()
+});
+z.object({
+	artifact: ProjectArtifactSchema,
+	project: ProjectSchema
+});
+z.object({
+	artifactId: z.string(),
+	downloadUrl: z.string().url(),
+	expiresInSeconds: z.number().int().positive()
+});
+const ProjectDeploymentSchema = z.object({
+	id: z.string(),
+	projectId: z.string(),
+	version: z.number().int().positive(),
+	deployedBy: z.string().nullable(),
+	deployedByEmail: z.string().optional(),
+	deployedByAvatarUrl: z.string().optional(),
+	createdAt: isoDateTime$1,
+	active: z.boolean()
+});
+z.array(ProjectDeploymentSchema);
+const optionalCount = z.number().int().nonnegative().nullable().optional();
+const optionalTimestamp = z.string().nullable().optional();
+const AgentSummarySchema = z.object({
+	id: z.string().min(1),
+	slug: z.string().min(1),
+	name: z.string().min(1),
+	projectId: z.string().min(1),
+	updatedAt: z.string().min(1),
+	description: z.string().min(1),
+	sourcePath: z.string().min(1).optional(),
+	model: z.string().optional(),
+	capabilities: z.object({
+		images: z.boolean(),
+		files: z.boolean()
+	}).optional(),
+	systemPrompt: z.string().optional(),
+	toolCount: optionalCount,
+	credentialCount: optionalCount,
+	apps: z.array(z.object({
+		id: z.string(),
+		label: z.string()
+	})).optional(),
+	lastRunAt: optionalTimestamp
+});
+const WorkflowSummarySchema = z.object({
+	id: z.string().min(1),
+	slug: z.string().min(1),
+	name: z.string().min(1),
+	projectId: z.string().min(1),
+	updatedAt: z.string().min(1),
+	description: z.string().min(1),
+	sourcePath: z.string().min(1).optional(),
+	lastRunAt: optionalTimestamp
+});
+const SkillSummarySchema = z.object({
+	id: z.string().min(1),
+	slug: z.string().min(1),
+	name: z.string().min(1),
+	projectId: z.string().min(1),
+	updatedAt: z.string().min(1),
+	description: z.string().min(1),
+	sourcePath: z.string().min(1).optional()
+});
+z.array(AgentSummarySchema);
+AgentSummarySchema.nullable();
+z.array(WorkflowSummarySchema);
+WorkflowSummarySchema.nullable();
+z.array(SkillSummarySchema);
+SkillSummarySchema.nullable();
+const RecentResourceKindSchema = z.enum([
+	"agent",
+	"workflow",
+	"skill"
+]);
+const RecentResourceSourceSchema = z.enum(["owned", "shared"]);
+const RecentResourceSchema = z.object({
+	id: z.string().min(1),
+	resourceKind: RecentResourceKindSchema,
+	resourceId: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string().optional(),
+	projectId: z.string().min(1),
+	projectName: z.string().min(1),
+	sourcePath: z.string().min(1).optional(),
+	source: RecentResourceSourceSchema,
+	lastOpenedAt: z.string().min(1),
+	lastModifiedAt: z.string().min(1)
+});
+z.array(RecentResourceSchema);
+const isoDateTime = z.string().datetime();
+const sha256Hex = z.string().regex(/^[a-f0-9]{64}$/, "Expected a lowercase hex sha256 digest");
+/**
+* A single entry in a deploy's file tree, as served to the dashboard. Carries
+* no contents: `id` is a stable, path-derived handle used for selection and
+* `?file=` deep links; `hash` is the content address used to fetch the bytes
+* lazily and to cache them immutably in the browser.
+*/
+const ProjectFileSummarySchema = z.object({
+	id: z.string(),
+	path: z.string().min(1),
+	hash: sha256Hex
+});
+/** Maps a runtime resource slug (agent/workflow/skill) to its source file path. */
+const ProjectSourceResourceRefSchema = z.object({
+	slug: z.string().min(1),
+	path: z.string().min(1)
+});
+const ProjectSourceResourcesSchema = z.object({
+	agents: z.array(ProjectSourceResourceRefSchema).default([]),
+	workflows: z.array(ProjectSourceResourceRefSchema).default([]),
+	skills: z.array(ProjectSourceResourceRefSchema).default([])
+});
+const emptyResources = () => ({
+	agents: [],
+	workflows: [],
+	skills: []
+});
+z.object({
+	artifactId: z.string().nullable(),
+	files: z.array(ProjectFileSummarySchema),
+	resources: ProjectSourceResourcesSchema.default(emptyResources())
+});
+z.object({
+	path: z.string().min(1),
+	contents: z.string(),
+	hash: sha256Hex
+});
+/** A blob the CLI may need to upload, keyed by content hash. */
+const SourceBlobRefSchema = z.object({
+	hash: sha256Hex,
+	size: z.number().int().nonnegative()
+});
+z.object({ blobs: z.array(SourceBlobRefSchema) });
+const PresignedBlobUploadSchema = z.object({
+	hash: sha256Hex,
+	url: z.string().url()
+});
+z.object({ uploads: z.array(PresignedBlobUploadSchema) });
+/** A file reference in a manifest upload: where the path's content lives. */
+const ManifestFileRefSchema = z.object({
+	path: z.string().min(1),
+	hash: sha256Hex
+});
+z.object({ files: z.array(ManifestFileRefSchema) });
+z.object({
+	ok: z.literal(true),
+	fileCount: z.number().int().nonnegative()
+});
+/** A file entry as persisted in the stored manifest (path-derived id added). */
+const StoredManifestFileSchema = z.object({
+	id: z.string(),
+	path: z.string().min(1),
+	hash: sha256Hex
+});
+z.object({
+	files: z.array(StoredManifestFileSchema),
+	generatedAt: isoDateTime
+});
+/** A single source file returned by the bulk active-source download endpoint. */
+const DownloadActiveProjectSourceFileSchema = z.object({
+	path: z.string().min(1),
+	contents: z.string()
+});
+z.object({
+	artifactId: z.string(),
+	files: z.array(DownloadActiveProjectSourceFileSchema)
+});
+z.object({
+	projectId: z.string(),
+	artifactId: z.string(),
+	pulledAt: z.string().datetime()
+});
+/** A single memory file exposed to the dashboard (no contents in list responses). */
+const AgentMemoryFileSummarySchema = z.object({
+	id: z.string(),
+	path: z.string().min(1)
+});
+z.object({ files: z.array(AgentMemoryFileSummarySchema) });
+/** A single workspace file exposed to the dashboard (no contents in list responses). */
+const AgentWorkspaceFileSummarySchema = z.object({
+	id: z.string(),
+	path: z.string().min(1)
+});
+z.object({ files: z.array(AgentWorkspaceFileSummarySchema) });
+/** Whether the overview is still being produced or finished. */
+const WorkflowOverviewStatusSchema = z.enum(["generating", "ready"]);
+/** One phase of the guided-tour overview. */
+const WorkflowPhaseSchema = z.object({
+	id: z.string(),
+	title: z.string(),
+	copy: z.string(),
+	nodeIds: z.array(z.string())
+});
+z.object({
+	status: WorkflowOverviewStatusSchema,
+	summary: z.string(),
+	phases: z.array(WorkflowPhaseSchema),
+	hash: z.string(),
+	generatedAt: z.string().nullable(),
+	model: z.string()
+});
+/** Subset of JSON-Schema field types the dashboard form renders inline. */
+const WorkflowInputFieldTypeSchema = z.enum([
+	"string",
+	"number",
+	"boolean",
+	"enum",
+	"object",
+	"array",
+	"file"
+]);
+const WorkflowInputFieldSchema = z.lazy(() => z.object({
+	key: z.string(),
+	label: z.string(),
+	type: WorkflowInputFieldTypeSchema,
+	required: z.boolean(),
+	description: z.string().optional(),
+	placeholder: z.string().optional(),
+	options: z.array(z.string()).optional(),
+	default: z.union([
+		z.string(),
+		z.number(),
+		z.boolean()
+	]).optional(),
+	children: z.array(WorkflowInputFieldSchema).optional(),
+	format: z.string().optional()
+}));
+/** Flat, render-ready view of a workflow's input schema. */
+const WorkflowInputSchemaSchema = z.object({ fields: z.array(WorkflowInputFieldSchema) });
+z.object({
+	schema: WorkflowInputSchemaSchema,
+	values: z.record(z.string(), z.unknown()).nullable()
+});
+z.object({ runId: z.string() });
+/** Annotation lifecycle: "generating" while the LLM pass streams in, then "ready". */
+const WorkflowCanvasStatusSchema = z.enum(["generating", "ready"]);
+/** LLM-produced enrichment for a single skeleton node. */
+const WorkflowCanvasAnnotationSchema = z.object({
+	label: z.string().optional(),
+	description: z.string().optional()
+});
+/**
+* One token of a configured input value (inspector form). Mirrors the producer's
+* raw token kinds, with display fields filled by the platform join: `reference`
+* gains a human `sourceLabel`; `variable` may gain a `resolvedValue` when the name
+* matches a known top-level constant.
+*/
+const WorkflowNodeValueTokenSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("text"),
+		text: z.string()
+	}),
+	z.object({
+		kind: z.literal("reference"),
+		sourceNodeId: z.string().optional(),
+		sourceLabel: z.string(),
+		field: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("variable"),
+		text: z.string(),
+		/** Concrete value when `text` resolves to a top-level literal constant. */
+		resolvedValue: z.string().optional()
+	}),
+	z.object({
+		kind: z.literal("call"),
+		name: z.string()
+	})
+]);
+/** The configured value of one input at this call site. */
+const WorkflowNodeInputBindingSchema = z.object({
+	tokens: z.array(WorkflowNodeValueTokenSchema),
+	multiline: z.boolean().optional()
+});
+/** An inspector input with optional call-site binding. */
+const WorkflowCanvasNodeInputSchema = WorkflowInputFieldSchema.and(z.object({
+	binding: WorkflowNodeInputBindingSchema.optional(),
+	additional: z.boolean().optional()
+}));
+/** Authored, deterministic metadata for a single node. */
+const WorkflowCanvasNodeMetaSchema = z.object({
+	kind: z.enum([
+		"action",
+		"agent",
+		"workflow",
+		"llm",
+		"trigger",
+		"boundary"
+	]),
+	slug: z.string(),
+	name: z.string(),
+	description: z.string().optional(),
+	appSlug: z.string().optional(),
+	inputs: z.array(WorkflowCanvasNodeInputSchema),
+	outputs: z.array(WorkflowInputFieldSchema),
+	requiredApps: z.array(z.string()).optional(),
+	model: z.string().optional(),
+	toolCount: z.number().int().nonnegative().optional()
+});
+z.object({
+	graph: WorkflowCanvasGraphSchema,
+	nodeMetadata: z.record(z.string(), WorkflowCanvasNodeMetaSchema),
+	annotations: z.record(z.string(), WorkflowCanvasAnnotationSchema),
+	status: WorkflowCanvasStatusSchema,
+	hash: z.string(),
+	generatedAt: z.string().nullable(),
+	model: z.string()
+});
+/** Per-node execution state for a single run. */
+const WorkflowCanvasNodeRunStatusSchema = z.enum([
+	"pending",
+	"running",
+	"succeeded",
+	"failed",
+	"skipped"
+]);
+const WorkflowCanvasNodeRunStateSchema = z.object({
+	status: WorkflowCanvasNodeRunStatusSchema,
+	iteration: z.object({
+		index: z.number().int().nonnegative(),
+		total: z.number().int().nonnegative()
+	}).optional()
+});
+/** Overall lifecycle of a run as the canvas animates it. */
+const WorkflowCanvasRunStatusSchema = z.enum([
+	"running",
+	"succeeded",
+	"failed",
+	"canceled"
+]);
+z.object({
+	runId: z.string(),
+	status: WorkflowCanvasRunStatusSchema,
+	startedAt: z.string(),
+	finishedAt: z.string().nullable(),
+	nodeStates: z.record(z.string(), WorkflowCanvasNodeRunStateSchema)
+});
+/** Scope a credential instance lives in. */
+const WorkflowCredentialScopeSchema = z.enum([
+	"organization",
+	"project",
+	"user"
+]);
+/** The concrete credential instance a binding currently resolves to. */
+const WorkflowResolvedCredentialSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	scope: WorkflowCredentialScopeSchema,
+	appSlug: z.string().optional(),
+	isDefault: z.boolean().optional(),
+	projectId: z.string().optional(),
+	projectName: z.string().optional()
+});
+z.record(z.string(), WorkflowCanvasAnnotationSchema);
+/** One opaque code-block the annotation pass should label, keyed by its canvas node id. */
+const WorkflowCanvasAnnotationCodeBlockSchema = z.object({
+	nodeId: z.string(),
+	/** The raw source snippet (the node's label) the LLM turns into human copy. */
+	source: z.string()
+});
+/** Inputs the worker feeds the LLM for the gated code-block annotation pass. */
+const WorkflowCanvasAnnotationsInputSchema = z.object({
+	workflowName: z.string(),
+	workflowDescription: z.string().nullable(),
+	codeBlocks: z.array(WorkflowCanvasAnnotationCodeBlockSchema)
+});
+z.object({
+	workflowId: z.string(),
+	projectId: z.string(),
+	hash: z.string(),
+	model: z.string(),
+	input: WorkflowCanvasAnnotationsInputSchema
+});
+/** One node as the overview LLM sees it (derived from the canvas node metadata + graph). */
+const WorkflowOverviewNodeSchema = z.object({
+	nodeId: z.string(),
+	label: z.string(),
+	kind: z.string(),
+	description: z.string().optional(),
+	/** App/integration slug for steps imported from a `@keystrokehq/<app>` package. */
+	appSlug: z.string().optional(),
+	/** Authored input field keys (from the action/agent/workflow definition). */
+	inputs: z.array(z.string()).optional(),
+	/** Authored output field keys. */
+	outputs: z.array(z.string()).optional(),
+	/** Agent-only: the model the agent runs on. */
+	model: z.string().optional(),
+	/** Agent-only: number of tools available to the agent. */
+	toolCount: z.number().int().nonnegative().optional()
+});
+/** Inputs the worker feeds the LLM to produce the workflow overview (summary + phases). */
+const WorkflowOverviewInputSchema = z.object({
+	workflowName: z.string(),
+	workflowDescription: z.string().nullable(),
+	/** Display labels of the trigger sources upstream of the workflow (read-only context). */
+	triggers: z.array(z.string()),
+	nodes: z.array(WorkflowOverviewNodeSchema),
+	/** The workflow's TypeScript source (best-effort; null when the deploy has no source snapshot). */
+	source: z.string().nullable()
+});
+z.object({
+	workflowId: z.string(),
+	projectId: z.string(),
+	hash: z.string(),
+	model: z.string(),
+	input: WorkflowOverviewInputSchema
+});
+const WorkflowCanvasCredentialBindingBaseSchema = z.object({
+	credentialKey: z.string(),
+	label: z.string(),
+	appSlug: z.string().optional()
+});
+/** How one credential requirement on a step currently resolves. */
+const WorkflowCanvasCredentialBindingSchema = z.union([
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: z.enum([
+			"project-default",
+			"org-default",
+			"assigned"
+		]),
+		instance: WorkflowResolvedCredentialSchema
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: z.literal("scope-pinned"),
+		pinnedScope: WorkflowCredentialScopeSchema,
+		instance: WorkflowResolvedCredentialSchema
+	}),
+	WorkflowCanvasCredentialBindingBaseSchema.extend({
+		policy: z.literal("unresolved"),
+		reason: z.enum(["needs-selection", "missing"]),
+		pinnedScope: WorkflowCredentialScopeSchema.optional()
+	})
+]);
+z.record(z.string(), z.array(WorkflowCanvasCredentialBindingSchema));
+z.record(z.string(), z.unknown());
+//#endregion
+export { stripPromptContext as A, mcpContentBlocksToAiSdkParts as C, parseChatAttachmentServePath as D, normalizeCredentialList as E, prependAgentUserContext as O, mcpContentBlocksFromToolOutput as S, modelSupportsMediaType as T, defineTool as _, FilePartSchema as a, isCredentialInput as b, LLM_RUN_KIND_HEADER as c, buildConnectDeeplink as d, chatAttachmentExtension as f, defineCredential as g, credentialInputSchema as h, ExecuteKeystrokeToolErrorResponseSchema as i, toCredentialRequirement as j, requiredDisplayTextSchema as k, LLM_SKIP_USAGE_HEADER as l, credential as m, CREDENTIAL_SCOPE_TYPES as n, LLM_KEY_SOURCE_HEADER as o, chatAttachmentServePath as p, DEFAULT_CLOUD_PLATFORM_ORIGIN as r, LLM_RUN_ID_HEADER as s, CHAT_ATTACHMENT_MAX_BYTES as t, PublicModelsResponseSchema as u, formatMcpToolErrorMessage as v, mcpEntityId as w, isRedundantMcpJsonText as x, hasAgentTimestampContext as y };
+
+//# sourceMappingURL=dist-D0P3wUQe.mjs.map