@keystrokehq/platform 0.1.1 → 0.1.3

package/dist/dist-dELW1gaR.mjs

@@ -1,2845 +0,0 @@
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { spawnSync } from "node:child_process";
-import { tmpdir } from "node:os";
-import { z } from "zod";
-import { CreateBucketCommand, DeleteBucketCommand, DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutBucketAclCommand, PutBucketPolicyCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-//#region ../../packages/shared/dist/index.mjs
-const ACTIVE_ORG_HEADER = "x-keystroke-org-id";
-/** Auth, session, and account-entry URL segments. */
-const AUTH_ACCOUNT_SLUGS = [
-	"2fa",
-	"accept-invite",
-	"auth",
-	"authorize",
-	"callback",
-	"callbacks",
-	"confirm-email",
-	"confirmation",
-	"connect",
-	"device",
-	"email-verification",
-	"forgot-password",
-	"invite",
-	"invites",
-	"login",
-	"logout",
-	"magic-link",
-	"mfa",
-	"oauth",
-	"onboarding",
-	"password",
-	"recovery",
-	"register",
-	"reset-password",
-	"saml",
-	"session",
-	"sessions",
-	"sign-in",
-	"sign-up",
-	"signin",
-	"signout",
-	"signup",
-	"sso",
-	"token",
-	"tokens",
-	"unlink",
-	"verify",
-	"verify-email"
-];
-/** Org, workspace, billing, and account-management URL segments. */
-const ORG_ACCOUNT_SLUGS = [
-	"account",
-	"accounts",
-	"billing",
-	"console",
-	"invoice",
-	"invoices",
-	"member",
-	"members",
-	"me",
-	"org",
-	"organization",
-	"organizations",
-	"orgs",
-	"payment",
-	"payments",
-	"plan",
-	"plans",
-	"portal",
-	"preferences",
-	"profile",
-	"settings",
-	"subscription",
-	"subscriptions",
-	"team",
-	"teams",
-	"upgrade",
-	"usage",
-	"user",
-	"users",
-	"workspace",
-	"workspaces"
-];
-/** Product surfaces, resource types, and in-app navigation segments. */
-const PRODUCT_SLUGS = [
-	"action",
-	"actions",
-	"activity",
-	"agent",
-	"agents",
-	"analytics",
-	"app",
-	"apps",
-	"artifact",
-	"artifacts",
-	"assistant",
-	"assistants",
-	"audit",
-	"audit-log",
-	"automation",
-	"automations",
-	"branch",
-	"branches",
-	"canvas",
-	"chat",
-	"chats",
-	"connection",
-	"connections",
-	"create",
-	"credential",
-	"credentials",
-	"dashboard",
-	"deployment",
-	"deployments",
-	"examples",
-	"execute",
-	"execution",
-	"executions",
-	"explore",
-	"get-started",
-	"history",
-	"inbox",
-	"inspector",
-	"integration",
-	"integrations",
-	"library",
-	"logs",
-	"marketplace",
-	"mcp",
-	"mcps",
-	"new",
-	"notifications",
-	"observe",
-	"plugin",
-	"plugins",
-	"primitive",
-	"primitives",
-	"project",
-	"projects",
-	"recents",
-	"registry",
-	"reports",
-	"run",
-	"runs",
-	"runtime",
-	"runtimes",
-	"sandbox",
-	"sandboxes",
-	"search",
-	"skill",
-	"skills",
-	"templates",
-	"thread",
-	"threads",
-	"trigger",
-	"triggers",
-	"version",
-	"versions",
-	"workflow",
-	"workflows"
-];
-/** Marketing, docs, company, and go-to-market URL segments. */
-const MARKETING_SITE_SLUGS = [
-	"about",
-	"affiliates",
-	"ai",
-	"announcements",
-	"anthropic",
-	"blog",
-	"book-demo",
-	"brand",
-	"campaigns",
-	"career",
-	"careers",
-	"case-studies",
-	"casestudies",
-	"changelog",
-	"chatgpt",
-	"chrome-extension",
-	"claude",
-	"codex",
-	"community",
-	"company",
-	"compare",
-	"contact",
-	"contribute",
-	"creators",
-	"customers",
-	"demo",
-	"demos",
-	"discord",
-	"docs",
-	"documentation",
-	"download",
-	"downloads",
-	"dust",
-	"emerging-talent",
-	"engineering-blog",
-	"enterprise",
-	"events",
-	"experts",
-	"extension",
-	"faq",
-	"faqs",
-	"features",
-	"forum",
-	"glean",
-	"grok",
-	"guide",
-	"guides",
-	"gumloop",
-	"handbook",
-	"help",
-	"help-center",
-	"home",
-	"how-it-works",
-	"howitworks",
-	"inspo",
-	"intern",
-	"investors",
-	"jobs",
-	"legal",
-	"lindy",
-	"llm",
-	"llms",
-	"love",
-	"make",
-	"manifesto",
-	"media",
-	"merch",
-	"mission",
-	"mobile",
-	"models",
-	"n8n",
-	"news",
-	"newsroom",
-	"open",
-	"open-claw",
-	"open-source",
-	"openai",
-	"our-story",
-	"overview",
-	"partners",
-	"pi",
-	"pipedream",
-	"platform",
-	"press",
-	"press-kit",
-	"pricing",
-	"privacy",
-	"product",
-	"products",
-	"provider",
-	"providers",
-	"quick-start",
-	"quickstart",
-	"refer",
-	"relay",
-	"relay-app",
-	"reporting",
-	"request-demo",
-	"resources",
-	"roadmap",
-	"schedule-demo",
-	"security",
-	"solutions",
-	"stack-ai",
-	"stackai",
-	"startup",
-	"startups",
-	"status",
-	"stories",
-	"story",
-	"students",
-	"support",
-	"swag",
-	"switch",
-	"talent",
-	"terms",
-	"testimonials",
-	"thesis",
-	"tines",
-	"trust",
-	"tutorials",
-	"university",
-	"use-case",
-	"use-cases",
-	"usecases",
-	"versus",
-	"vellum",
-	"vs",
-	"webinars",
-	"workato",
-	"xai",
-	"yc",
-	"zapier"
-];
-/** Integrations, competitors, and partner brand slugs (marketing / integration pages). */
-const INTEGRATION_BRAND_SLUGS = [
-	"airtable",
-	"asana",
-	"aws",
-	"azure",
-	"bun",
-	"confluence",
-	"copilot",
-	"cursor",
-	"databricks",
-	"figma",
-	"firebase",
-	"fly",
-	"gcp",
-	"gemini",
-	"github",
-	"gitlab",
-	"gmail",
-	"heroku",
-	"hubspot",
-	"huggingface",
-	"jira",
-	"linear",
-	"mailchimp",
-	"meta",
-	"mistral",
-	"mixmax",
-	"monday",
-	"netlify",
-	"neon",
-	"notion",
-	"npm",
-	"outlook",
-	"outreach",
-	"perplexity",
-	"planetscale",
-	"pnpm",
-	"postmark",
-	"ramp",
-	"railway",
-	"render",
-	"resend",
-	"salesforce",
-	"segment",
-	"sendgrid",
-	"shopify",
-	"slack",
-	"snowflake",
-	"stripe",
-	"supabase",
-	"terraform",
-	"trello",
-	"turso",
-	"twilio",
-	"typeform",
-	"vercel",
-	"vscode",
-	"windsurf",
-	"yarn"
-];
-/** Company, team, and department landing-page segments. */
-const COMPANY_TEAM_SLUGS = [
-	"engineers",
-	"engineering",
-	"executives",
-	"hc",
-	"intern",
-	"it",
-	"leadership",
-	"marketing",
-	"ops",
-	"revops",
-	"sales",
-	"services",
-	"tech"
-];
-/** Legal, trust, compliance, and policy URL segments. */
-const LEGAL_TRUST_SLUGS = [
-	"accessibility",
-	"agreement",
-	"a11y",
-	"bug-bounty",
-	"compliance",
-	"cookie-policy",
-	"cookies",
-	"disclose",
-	"dpa",
-	"eula",
-	"gdpr",
-	"hipaa",
-	"iso",
-	"msa",
-	"pci",
-	"responsible-disclosure",
-	"sla",
-	"soc2",
-	"tos",
-	"trust-center",
-	"trustcenter",
-	"vulnerability"
-];
-/** Developer, API, CLI, and technical URL segments. */
-const DEVELOPER_TECH_SLUGS = [
-	"api",
-	"api-docs",
-	"cli",
-	"code",
-	"config",
-	"developer",
-	"developer-tools",
-	"developers",
-	"dev-tools",
-	"devtools",
-	"dev",
-	"dev-states",
-	"graphql",
-	"graphql-playground",
-	"mcp-server",
-	"mcp-servers",
-	"openapi",
-	"sdk",
-	"swagger"
-];
-/** Infra, ops, static assets, and system URL segments. */
-const INFRA_SYSTEM_SLUGS = [
-	"acme-challenge",
-	"admin",
-	"apple-app-site-association",
-	"assets",
-	"batch",
-	"cache",
-	"cdn",
-	"cron",
-	"debug",
-	"error",
-	"errors",
-	"favicon",
-	"feed",
-	"files",
-	"health",
-	"healthcheck",
-	"healthz",
-	"hooks",
-	"internal",
-	"item",
-	"manifest",
-	"metrics",
-	"null",
-	"ping",
-	"prod",
-	"public",
-	"redirect",
-	"robots",
-	"rpc",
-	"rss",
-	"sharer",
-	"sitemap",
-	"staging",
-	"static",
-	"storage",
-	"test",
-	"undefined",
-	"universal",
-	"webhooks",
-	"well-known",
-	"www"
-];
-/** Reserved slugs that are valid org names in theory but blocked for routing safety. */
-const ROUTING_SAFETY_SLUGS = [
-	"alpha",
-	"anonymous",
-	"archive",
-	"archived",
-	"beta",
-	"clone",
-	"copy",
-	"default",
-	"deleted",
-	"demo-org",
-	"draft",
-	"drafts",
-	"duplicate",
-	"early-access",
-	"embed",
-	"embedded",
-	"export",
-	"fork",
-	"free",
-	"guest",
-	"import",
-	"index",
-	"list",
-	"manage",
-	"moderator",
-	"newsletter",
-	"owner",
-	"preview",
-	"previews",
-	"private",
-	"pro",
-	"public-api",
-	"publish",
-	"published",
-	"queue",
-	"remove",
-	"root",
-	"sample",
-	"samples",
-	"selection",
-	"share",
-	"shared",
-	"sponsor",
-	"sponsors",
-	"sponsorship",
-	"subscribe",
-	"super",
-	"superuser",
-	"system",
-	"sys",
-	"test-org",
-	"trash",
-	"unpublish",
-	"unsubscribe",
-	"upload",
-	"uploads",
-	"waitlist",
-	"widget",
-	"widgets",
-	"worker",
-	"workers"
-];
-/**
-* URL segments reserved for global (non-org) routes — cannot be used as an org slug.
-* Prefer adding new entries to the category arrays above; the Set is the enforcement surface.
-*/
-const RESERVED_ORGANIZATION_SLUGS = new Set([
-	...AUTH_ACCOUNT_SLUGS,
-	...ORG_ACCOUNT_SLUGS,
-	...PRODUCT_SLUGS,
-	...MARKETING_SITE_SLUGS,
-	...INTEGRATION_BRAND_SLUGS,
-	...COMPANY_TEAM_SLUGS,
-	...LEGAL_TRUST_SLUGS,
-	...DEVELOPER_TECH_SLUGS,
-	...INFRA_SYSTEM_SLUGS,
-	...ROUTING_SAFETY_SLUGS
-]);
-/**
-* Base slug format: lowercase, 2-64 chars, alphanumeric + dashes.
-*
-* IMPORTANT: this is the schema for *reading* slugs (persisted rows, API
-* responses). It intentionally does NOT enforce the reserved-name list — an org
-* created before a name became reserved must still parse on read. Use
-* `ClaimableOrganizationSlugSchema` to validate slugs a user is trying to claim.
-*/
-const OrganizationSlugSchema = z.string().trim().toLowerCase().min(2, "Slug must be at least 2 characters").max(64, "Slug must be at most 64 characters").regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Use lowercase letters, numbers, and dashes only");
-/**
-* Slug validation for *claiming* a slug (organization create/rename). Adds the
-* reserved-name check on top of the base format. Never use this to parse
-* existing org data, or pre-existing orgs whose slug later became reserved would
-* fail to load.
-*/
-const ClaimableOrganizationSlugSchema = OrganizationSlugSchema.refine((slug) => !RESERVED_ORGANIZATION_SLUGS.has(slug), "This slug is reserved");
-const ORGANIZATION_NAME_APOSTROPHE_PATTERN = /[''\u2018\u2019]/g;
-/** Normalize a display name into slug-shaped text (may be empty or too short to claim). */
-function normalizeOrganizationNameToSlugBase(name) {
-	return name.trim().toLowerCase().replace(ORGANIZATION_NAME_APOSTROPHE_PATTERN, "").replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-}
-/** Derive a URL slug from a display name (not guaranteed unique). */
-function slugifyOrganizationName(name) {
-	const base = normalizeOrganizationNameToSlugBase(name);
-	if (!base) return "org";
-	const parsed = OrganizationSlugSchema.safeParse(base);
-	return parsed.success ? parsed.data : "org";
-}
-/** Same format as organization slugs — org-scoped, no global reserved list. */
-const ProjectSlugSchema = OrganizationSlugSchema;
-/** Derive a URL slug from a project display name (not guaranteed unique within the org). */
-function slugifyProjectName(name) {
-	const base = normalizeOrganizationNameToSlugBase(name);
-	if (!base) return "project";
-	const parsed = ProjectSlugSchema.safeParse(base);
-	return parsed.success ? parsed.data : "project";
-}
-/** TCP port to bind for a local server, derived from a public URL. */
-function listenPortFromUrl(url, fallback) {
-	const parsed = new URL(url);
-	if (parsed.port) {
-		const port = Number(parsed.port);
-		if (Number.isFinite(port) && port > 0) return port;
-	}
-	if (parsed.protocol === "https:") return 443;
-	if (parsed.protocol === "http:") return 80;
-	return fallback;
-}
-/** Shorthand: listen port from `PUBLIC_*_URL` or fallback. */
-function listenPortFromPublicUrl(value, fallback) {
-	const trimmed = value?.trim();
-	if (!trimmed) return fallback;
-	try {
-		return listenPortFromUrl(trimmed, fallback);
-	} catch {
-		return fallback;
-	}
-}
-/** On-disk path under the project root (packed in deploy artifacts when present). */
-const ROUTE_MANIFEST_REL_PATH = "dist/.keystroke/route-manifest.json";
-const StoredRouteManifestSkillSchema = z.object({
-	slug: z.string(),
-	name: z.string().optional(),
-	description: z.string().optional(),
-	moduleFile: z.string()
-});
-const serializedRouteManifestEntrySchema = z.discriminatedUnion("kind", [
-	z.object({
-		kind: z.literal("health"),
-		method: z.literal("GET"),
-		path: z.literal("/health")
-	}),
-	z.object({
-		kind: z.literal("agent"),
-		method: z.literal("POST"),
-		path: z.string(),
-		agentSlug: z.string(),
-		moduleFile: z.string(),
-		name: z.string().optional(),
-		description: z.string().optional(),
-		model: z.string(),
-		systemPrompt: z.string(),
-		toolCount: z.number().int().nonnegative(),
-		credentialCount: z.number().int().nonnegative(),
-		requestSchema: z.record(z.string(), z.unknown()),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("agent-sessions-list"),
-		method: z.literal("GET"),
-		path: z.string(),
-		agentSlug: z.string(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("agent-session-detail"),
-		method: z.literal("GET"),
-		path: z.string(),
-		agentSlug: z.string(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("workflow"),
-		method: z.literal("POST"),
-		path: z.string(),
-		workflowSlug: z.string(),
-		workflowName: z.string().optional(),
-		description: z.string().optional(),
-		subscribable: z.boolean(),
-		moduleFile: z.string(),
-		requestSchema: z.record(z.string(), z.unknown()),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("workflow-runs-list"),
-		method: z.literal("GET"),
-		path: z.string(),
-		workflowSlug: z.string(),
-		workflowName: z.string().optional(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("workflow-run-detail"),
-		method: z.literal("GET"),
-		path: z.string(),
-		workflowSlug: z.string(),
-		workflowName: z.string().optional(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("trigger-webhook"),
-		method: z.literal("POST"),
-		path: z.string(),
-		attachmentIds: z.array(z.string()),
-		moduleFile: z.string(),
-		requestSchema: z.record(z.string(), z.unknown()),
-		attachmentSchemas: z.record(z.string(), z.object({
-			requestSchema: z.record(z.string(), z.unknown()),
-			filterSchema: z.record(z.string(), z.unknown()).optional()
-		})),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("trigger-poll"),
-		method: z.literal("POST"),
-		path: z.string(),
-		attachmentId: z.string(),
-		moduleFile: z.string(),
-		schedule: z.string(),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("trigger-poll-group"),
-		method: z.literal("POST"),
-		path: z.string(),
-		pollId: z.string(),
-		attachmentIds: z.array(z.string()),
-		moduleFile: z.string(),
-		schedule: z.string(),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("trigger-runs-list"),
-		method: z.literal("GET"),
-		path: z.string(),
-		attachmentId: z.string(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("trigger-run-detail"),
-		method: z.literal("GET"),
-		path: z.string(),
-		attachmentId: z.string(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("cron-schedule"),
-		attachmentId: z.string(),
-		moduleFile: z.string(),
-		schedule: z.string()
-	}),
-	z.object({
-		kind: z.literal("plugin"),
-		method: z.enum([
-			"GET",
-			"POST",
-			"PUT",
-			"PATCH",
-			"DELETE"
-		]),
-		path: z.string(),
-		plugin: z.string()
-	})
-]);
-const StoredRouteManifestSchema = z.object({
-	version: z.literal(1),
-	entries: z.array(serializedRouteManifestEntrySchema),
-	skills: z.array(StoredRouteManifestSkillSchema).default([]),
-	integrations: z.array(z.string()).optional()
-});
-function parseStoredRouteManifest(value) {
-	return StoredRouteManifestSchema.parse(value);
-}
-/** Messaging platforms that support agent gateway bindings. */
-const ChannelPlatformKeySchema = z.enum(["slack"]);
-const ChannelReactionSupportSchema = z.enum([
-	"full",
-	"read-only",
-	"none"
-]);
-const ChannelCardSupportSchema = z.enum([
-	"full",
-	"partial",
-	"none"
-]);
-const ChannelStreamingSupportSchema = z.enum([
-	"native",
-	"post-edit",
-	"buffered",
-	"drafts",
-	"none"
-]);
-const ChannelCapabilitiesSchema = z.object({
-	mentions: z.boolean(),
-	reactions: ChannelReactionSupportSchema,
-	cards: ChannelCardSupportSchema,
-	modals: z.boolean(),
-	streaming: ChannelStreamingSupportSchema,
-	dms: z.boolean()
-});
-const ChannelListenModeSchema = z.enum([
-	"mention",
-	"all",
-	"dm"
-]);
-const ChannelBindingKindSchema = z.enum([
-	"public",
-	"private",
-	"dm",
-	"group",
-	"space"
-]);
-const AppGatewaySchema = z.object({
-	capabilities: ChannelCapabilitiesSchema,
-	supportedModes: z.array(ChannelListenModeSchema).min(1),
-	resourceNoun: z.object({
-		singular: z.string().min(1),
-		plural: z.string().min(1)
-	}),
-	supportsChannelDirectory: z.boolean(),
-	webhookPathHint: z.string().min(1),
-	docsUrl: z.string().url().optional(),
-	tagline: z.string().min(1).optional()
-});
-z.object({
-	key: ChannelPlatformKeySchema,
-	name: z.string().min(1),
-	appLogoId: z.string().min(1),
-	fallbackDomain: z.string().min(1),
-	description: z.string().min(1),
-	tagline: z.string().min(1),
-	authKind: z.enum(["oauth", "api_key"]),
-	credentialFields: z.array(z.object({
-		key: z.string().min(1),
-		label: z.string().min(1),
-		placeholder: z.string().optional(),
-		helpText: z.string().optional(),
-		type: z.enum([
-			"text",
-			"password",
-			"textarea"
-		]),
-		required: z.boolean(),
-		prefix: z.string().optional()
-	})),
-	capabilities: ChannelCapabilitiesSchema,
-	supportedModes: z.array(ChannelListenModeSchema).min(1),
-	resourceNoun: z.object({
-		singular: z.string().min(1),
-		plural: z.string().min(1)
-	}),
-	webhookPathHint: z.string().min(1),
-	supportsChannelDirectory: z.boolean(),
-	docsUrl: z.string().url().optional()
-});
-const ChannelBindingSchema = z.object({
-	id: z.string().min(1),
-	channelId: z.string().min(1),
-	channelName: z.string().min(1),
-	channelKind: ChannelBindingKindSchema,
-	mode: ChannelListenModeSchema,
-	subscribeOnMention: z.boolean(),
-	createdAt: z.string(),
-	updatedAt: z.string()
-});
-const ChannelConnectionSchema = z.object({
-	id: z.string().min(1),
-	platform: ChannelPlatformKeySchema,
-	agentId: z.string().min(1),
-	accountLabel: z.string().min(1),
-	accountId: z.string().min(1),
-	connectedAt: z.string(),
-	bindings: z.array(ChannelBindingSchema)
-});
-const ChannelDirectoryEntrySchema = z.object({
-	id: z.string().min(1),
-	name: z.string().min(1),
-	kind: ChannelBindingKindSchema,
-	memberCount: z.number().int().nonnegative().optional(),
-	isArchived: z.boolean().optional()
-});
-z.object({ connections: z.array(ChannelConnectionSchema) });
-z.object({ channels: z.array(ChannelDirectoryEntrySchema) });
-z.object({ teamName: z.string().min(1).optional() });
-/** OAuth workspace available for channel bindings (e.g. Slack team). */
-const ChannelAccountSchema = z.object({
-	id: z.string().min(1),
-	platform: ChannelPlatformKeySchema,
-	label: z.string().min(1),
-	connectedAt: z.string()
-});
-z.object({ accounts: z.array(ChannelAccountSchema) });
-const NewChannelBindingInputSchema = z.object({
-	channelId: z.string().min(1),
-	channelName: z.string().min(1),
-	channelKind: ChannelBindingKindSchema.optional(),
-	mode: ChannelListenModeSchema.optional(),
-	subscribeOnMention: z.boolean().optional()
-});
-z.object({
-	platform: ChannelPlatformKeySchema,
-	accountId: z.string().min(1),
-	binding: NewChannelBindingInputSchema
-});
-z.object({ patch: z.object({
-	mode: ChannelListenModeSchema.optional(),
-	subscribeOnMention: z.boolean().optional()
-}) });
-/** A single OAuth scope an app can request, with human copy for connect UI. */
-const OAuthScopeOptionSchema = z.object({
-	name: z.string().min(1),
-	description: z.string().min(1),
-	defaultSelected: z.boolean().optional(),
-	required: z.boolean().optional()
-});
-/** How an app authenticates when connecting credentials. */
-const AppAuthKindSchema = z.enum([
-	"oauth",
-	"api_key",
-	"keystroke"
-]);
-/**
-* Where app metadata and execution are sourced (e.g. native, composio, pipedream, custom).
-* Opaque string — cloud/hosted entrypoints choose values; keystroke stays provider-agnostic.
-*/
-const AppSourceSchema = z.string().trim().min(1);
-z.object({
-	slug: z.string().trim().min(1),
-	name: z.string().min(1),
-	description: z.string().min(1),
-	category: z.string().min(1),
-	logo: z.string().url().optional(),
-	authKind: AppAuthKindSchema,
-	oauthScopes: z.array(OAuthScopeOptionSchema)
-}).extend({ source: AppSourceSchema });
-z.object({
-	id: z.string().min(1),
-	organizationId: z.string().min(1).nullable(),
-	slug: z.string().min(1),
-	name: z.string().min(1),
-	description: z.string().min(1),
-	category: z.string().min(1),
-	logo: z.string().url().nullable(),
-	authKind: AppAuthKindSchema,
-	oauthScopes: z.array(OAuthScopeOptionSchema),
-	source: AppSourceSchema,
-	createdAt: z.string().min(1),
-	updatedAt: z.string().min(1)
-});
-/**
-* A connectable integration shown in the "Connect an app" picker. An "app" is
-* an integration / credential set — connected state is whether a credential exists.
-*/
-const AppCatalogEntrySchema = z.object({
-	id: z.string().min(1),
-	name: z.string().min(1),
-	description: z.string().min(1),
-	category: z.string().min(1),
-	integrationDescription: z.string().min(1),
-	logo: z.string().url().nullable().optional(),
-	authKind: AppAuthKindSchema,
-	oauthScopes: z.array(OAuthScopeOptionSchema),
-	/** When present, the app supports agent gateway bindings (external channels). */
-	gateway: AppGatewaySchema.optional()
-});
-const ListAppsResponseSchema = z.object({ apps: z.array(AppCatalogEntrySchema) });
-/** How a credential instance is stored (`credential_instances.auth_kind`). */
-const CredentialAuthKindSchema = z.enum([
-	"api_key",
-	"oauth_managed",
-	"keystroke"
-]);
-/**
-* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
-* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
-* resolver tries the project default, then the org default, then throws.
-*/
-const CredentialScopeTypeSchema = z.enum([
-	"organization",
-	"project",
-	"user"
-]);
-CredentialAuthKindSchema.options;
-CredentialScopeTypeSchema.options;
-/** Human-readable app name from a credential slug (e.g. `google-drive` → `Google Drive`). */
-function displayCredentialAppName(appId) {
-	return appId.split(/[-_]+/).filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
-}
-function buildCredentialInstanceLabel(options) {
-	const appName = options.appName.trim();
-	switch (options.scopeType) {
-		case "organization": return `Organization ${appName}`;
-		case "user": return `Personal ${appName}`;
-		case "project": return `${appName} (${options.projectName?.trim() || "Project"})`;
-		default: return options.scopeType;
-	}
-}
-/** Pick a label that is unused within a credential scope, suffixing when needed. */
-function resolveUniqueCredentialInstanceLabel(options) {
-	const taken = new Set([...options.takenLabels].map((label) => label ?? null));
-	if (!taken.has(options.baseLabel)) return options.baseLabel;
-	const disambiguator = options.disambiguator?.trim();
-	if (disambiguator) {
-		const withDisambiguator = `${options.baseLabel} (${disambiguator})`;
-		if (!taken.has(withDisambiguator)) return withDisambiguator;
-	}
-	let suffix = 2;
-	while (taken.has(`${options.baseLabel} (${suffix})`)) suffix += 1;
-	return `${options.baseLabel} (${suffix})`;
-}
-/** Scope of a platform app credential (maps to `credential_instances.scope_type`). */
-const AppCredentialScopeSchema = z.enum([
-	"user",
-	"project",
-	"organization"
-]);
-/** How the credential was connected (OAuth vs manual api-key entry). */
-const AppCredentialConnectionKindSchema = z.enum(["oauth", "manual"]);
-/** Connect-dialog permission preset for OAuth scope selection. */
-const OAuthPermissionModeSchema = z.enum(["default", "restricted"]);
-const optionalTimestamp$1 = z.string().optional();
-const nullableOptionalTimestamp = z.string().nullable().optional();
-/**
-* Summary row for the apps/credentials table and credential detail page.
-* Plaintext secrets are never returned — only masked `keyPreviews`.
-*/
-const AppCredentialSummarySchema = z.object({
-	id: z.string().min(1),
-	appId: z.string().min(1),
-	label: z.string().min(1),
-	scope: AppCredentialScopeSchema,
-	lastRefreshedAt: z.string().nullable(),
-	appName: z.string().min(1).optional(),
-	projectId: z.string().min(1).optional(),
-	projectName: z.string().min(1).optional(),
-	status: z.string().optional(),
-	createdAt: optionalTimestamp$1,
-	lastUsedAt: nullableOptionalTimestamp,
-	isDefault: z.boolean().optional(),
-	connectionKind: AppCredentialConnectionKindSchema.optional(),
-	ownerUserId: z.string().min(1).optional(),
-	ownerName: z.string().min(1).optional(),
-	ownerAvatarUrl: z.string().url().optional(),
-	grantedScopes: z.array(z.string().min(1)).optional(),
-	credentialKeys: z.array(z.string().min(1)).optional(),
-	keyPreviews: z.record(z.string(), z.string()).optional(),
-	expiresAt: optionalTimestamp$1
-});
-const credentialSecretValueSchema = z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" });
-function hasCredentialTarget(input) {
-	return input.projects.length > 0 || input.createOrganizationCredential || input.createUserProvidedCredential;
-}
-function addMissingCredentialTargetIssue(ctx, path = ["projects"]) {
-	ctx.addIssue({
-		code: "custom",
-		message: "At least one credential target is required",
-		path
-	});
-}
-/** Target fields shared by create and OAuth start flows. */
-const CredentialTargetsFieldsSchema = z.object({
-	projects: z.array(z.string().min(1)).default([]),
-	createOrganizationCredential: z.boolean().default(false),
-	createUserProvidedCredential: z.boolean().default(false)
-});
-CredentialTargetsFieldsSchema.extend({
-	appId: z.string().min(1),
-	scopes: z.array(z.string().min(1)),
-	permissionMode: OAuthPermissionModeSchema
-});
-z.object({
-	status: z.enum(["connected", "redirecting"]),
-	authorizeUrl: z.string().url().nullable()
-});
-/** Request body for `POST /api/credentials` (manual api-key fan-out). */
-const CreateCredentialsRequestSchema = CredentialTargetsFieldsSchema.extend({
-	appId: z.string().min(1),
-	connectionKind: AppCredentialConnectionKindSchema,
-	value: credentialSecretValueSchema.optional(),
-	scopes: z.array(z.string().min(1)).optional()
-}).superRefine((input, ctx) => {
-	if (!hasCredentialTarget(input)) addMissingCredentialTargetIssue(ctx);
-	if (input.connectionKind === "manual" && !input.value) ctx.addIssue({
-		code: "custom",
-		message: "value is required for manual connections",
-		path: ["value"]
-	});
-	if (input.connectionKind === "oauth") ctx.addIssue({
-		code: "custom",
-		message: "OAuth credentials are created via the OAuth callback",
-		path: ["connectionKind"]
-	});
-});
-/** Request body for `PATCH /api/credentials/:id`. */
-const UpdateCredentialRequestSchema = z.object({
-	label: z.string().trim().min(1).optional(),
-	isDefault: z.boolean().optional(),
-	value: credentialSecretValueSchema.optional()
-}).refine((input) => input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0, { message: "At least one field is required" });
-const ListCredentialsResponseSchema = z.object({ credentials: z.array(AppCredentialSummarySchema) });
-const GetCredentialResponseSchema = z.object({ credential: AppCredentialSummarySchema });
-const CreateCredentialsResponseSchema = z.object({ credentials: z.array(AppCredentialSummarySchema) });
-const McpConnectionStatusSchema = z.enum([
-	"INITIATED",
-	"ACTIVE",
-	"EXPIRED",
-	"FAILED",
-	"INACTIVE",
-	"REVOKED"
-]);
-const McpAppSchema = z.object({
-	slug: z.string(),
-	name: z.string(),
-	connected: z.boolean(),
-	connectionId: z.string().optional(),
-	status: McpConnectionStatusSchema.optional()
-});
-z.object({ apps: z.array(McpAppSchema) });
-z.object({
-	connectionId: z.string(),
-	entityId: z.string(),
-	instanceId: z.string()
-});
-z.object({
-	app: z.string().trim().min(1),
-	tool: z.string().trim().min(1),
-	arguments: z.record(z.string(), z.unknown()).default({}),
-	/**
-	* Resolved credential instance to execute against. When set, the platform executes that exact
-	* connection (scoped to the caller's org); when omitted it resolves the app's instance by scope.
-	*/
-	instanceId: z.string().trim().min(1).optional(),
-	/** Pinned provider toolkit version, sourced from the app definition; forwarded to the provider. */
-	version: z.string().trim().min(1)
-});
-const TeamRequestTypeSchema = z.enum([
-	"org-deletion",
-	"contact",
-	"enterprise-upgrade"
-]);
-const SubmitTeamRequestRequestSchema = z.object({
-	type: TeamRequestTypeSchema,
-	message: z.string().trim().max(5e3).optional()
-});
-const SubmitTeamRequestResponseSchema = z.object({ ok: z.literal(true) });
-function isCredentialInput(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const candidate = value;
-	return typeof candidate.key === "string" && CredentialAuthKindSchema.safeParse(candidate.kind).success && candidate.schema instanceof z.ZodType;
-}
-const credentialInputSchema = z.custom((value) => isCredentialInput(value), "must be a credential requirement");
-/** Canonical copy for slug collision errors (API + UI). */
-const ORGANIZATION_SLUG_TAKEN_MESSAGE = "That slug is already taken.";
-const PROJECT_SLUG_TAKEN_MESSAGE = "That slug is already taken.";
-const OrganizationSlugErrorCodeSchema = z.enum([
-	"slug_taken",
-	"slug_reserved",
-	"slug_invalid"
-]);
-const SlugAvailabilityReasonSchema = z.enum([
-	"taken",
-	"reserved",
-	"invalid"
-]);
-const SlugAvailabilityResponseSchema = z.object({
-	slug: z.string(),
-	available: z.boolean(),
-	reason: SlugAvailabilityReasonSchema.optional(),
-	suggestion: OrganizationSlugSchema.optional()
-});
-const SlugAvailabilityQuerySchema = z.object({
-	slug: z.string().trim().min(1),
-	excludeOrganizationId: z.string().min(1).optional()
-});
-const ProjectSlugAvailabilityReasonSchema = z.enum(["taken", "invalid"]);
-const ProjectSlugAvailabilityResponseSchema = z.object({
-	slug: z.string(),
-	available: z.boolean(),
-	reason: ProjectSlugAvailabilityReasonSchema.optional(),
-	suggestion: ProjectSlugSchema.optional()
-});
-const ProjectSlugAvailabilityQuerySchema = z.object({
-	slug: z.string().trim().min(1),
-	excludeProjectId: z.string().min(1).optional()
-});
-function organizationSlugErrorCodeFromMessage(message) {
-	if (message === "That slug is already taken." || /already taken/i.test(message)) return "slug_taken";
-	if (/reserved/i.test(message)) return "slug_reserved";
-	return "slug_invalid";
-}
-const ProjectStatusSchema = z.enum([
-	"inactive",
-	"starting",
-	"active",
-	"failed"
-]);
-const OrganizationUserRoleSchema = z.enum([
-	"owner",
-	"admin",
-	"builder"
-]);
-const isoDateTime$5 = z.string().datetime();
-const OrganizationSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	slug: OrganizationSlugSchema,
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
-});
-const ProjectSchema = z.object({
-	id: z.string(),
-	organizationId: z.string(),
-	name: z.string(),
-	slug: ProjectSlugSchema,
-	description: z.string().nullable(),
-	status: ProjectStatusSchema,
-	baseUrl: z.string().nullable(),
-	runtimeId: z.string().nullable(),
-	lastError: z.string().nullable(),
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
-});
-const UserOrganizationSchema = z.object({
-	organization: OrganizationSchema,
-	role: OrganizationUserRoleSchema
-});
-const ActiveOrganizationResponseSchema = z.object({ organization: UserOrganizationSchema.nullable() });
-const ListOrganizationsResponseSchema = z.object({ organizations: z.array(UserOrganizationSchema) });
-const CreateOrganizationRequestSchema = z.object({
-	name: z.string().trim().min(1),
-	/** Format-only at the wire boundary; reserved-name checks run in platform-database. */
-	slug: OrganizationSlugSchema.optional()
-});
-const UpdateOrganizationRequestSchema = z.object({
-	name: z.string().trim().min(1).optional(),
-	slug: ClaimableOrganizationSlugSchema.optional()
-}).refine((data) => data.name !== void 0 || data.slug !== void 0, { message: "At least one field is required" });
-const CreateOrganizationResponseSchema = z.object({ organization: UserOrganizationSchema });
-const ListProjectsResponseSchema = z.object({ projects: z.array(ProjectSchema) });
-const ProjectListMetricsSchema = z.object({
-	agentCount: z.number(),
-	workflowCount: z.number(),
-	skillCount: z.number(),
-	credentialCount: z.number(),
-	lastDeploymentAt: isoDateTime$5.nullable()
-});
-const ListProjectMetricsResponseSchema = z.object({ metrics: z.record(z.string(), ProjectListMetricsSchema) });
-const CreateProjectRequestSchema = z.object({
-	name: z.string().trim().min(1),
-	description: z.string().trim().min(1).optional()
-});
-const UpdateProjectRequestSchema = z.object({
-	name: z.string().trim().min(1).optional(),
-	description: z.string().trim().optional(),
-	slug: ProjectSlugSchema.optional()
-}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.slug !== void 0, { message: "At least one field is required" });
-const CreateProjectResponseSchema = z.object({ project: ProjectSchema });
-const ProjectResponseSchema = z.object({ project: ProjectSchema });
-const ProjectReachabilityResponseSchema = z.object({ reachable: z.boolean() });
-const ValidationErrorDetailSchema = z.object({
-	path: z.string(),
-	message: z.string()
-});
-/** Machine-readable codes returned in standard API error bodies. */
-const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(z.enum(["needs_org_selection"]));
-/** Standard JSON error body returned by the HTTP API. */
-const ErrorResponseSchema = z.object({
-	error: z.string(),
-	code: ErrorResponseCodeSchema.optional(),
-	message: z.string().optional(),
-	details: z.array(ValidationErrorDetailSchema).optional()
-});
-/** Build the JSON body for HTTP 400 validation failures. */
-function validationErrorResponse(error, summary) {
-	return {
-		error: summary,
-		details: error.issues.map((issue) => ({
-			path: issue.path.join("."),
-			message: issue.message
-		}))
-	};
-}
-z.object({ message: z.string() });
-const CredentialRunContextSchema = z.object({
-	orgId: z.string().min(1).optional(),
-	projectId: z.string().min(1).optional(),
-	userId: z.string().min(1).optional(),
-	userIds: z.record(z.string(), z.string()).optional(),
-	selection: z.record(z.string(), z.string()).optional()
-});
-const ThinkingLevelSchema = z.enum([
-	"off",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh"
-]);
-z.object({
-	message: z.string().min(1),
-	sessionId: z.string().min(1).optional(),
-	subscriptionId: z.string().min(1).optional(),
-	context: CredentialRunContextSchema.optional(),
-	thinkingLevel: ThinkingLevelSchema.optional()
-});
-z.object({
-	sessionId: z.string(),
-	messages: z.array(z.record(z.string(), z.unknown())),
-	error: z.string().nullable()
-});
-const SkipResponseSchema = z.object({
-	ok: z.literal(true),
-	skipped: z.literal(true)
-});
-z.object({ ok: z.literal(true) });
-z.object({ service: z.string() });
-const ConnectProviderSchema = z.object({
-	key: z.string(),
-	mode: z.enum(["authorize-url", "browser-redirect"]),
-	path: z.string(),
-	requiresAuth: z.boolean()
-});
-z.object({ providers: z.array(ConnectProviderSchema) });
-z.object({ url: z.string() });
-z.object({ runId: z.string() });
-z.object({ sessionId: z.string() });
-z.object({
-	workflows: z.array(z.string().min(1)).optional(),
-	attachments: z.array(z.string().min(1)).optional()
-});
-const PollAttachmentResultSchema = z.object({
-	attachmentKey: z.string(),
-	workflowKey: z.string(),
-	runId: z.string().optional(),
-	body: z.unknown().optional(),
-	queued: z.boolean(),
-	skipped: z.boolean().optional()
-});
-const PollRunMultiResponseSchema = z.object({ results: z.array(PollAttachmentResultSchema) });
-z.union([
-	z.record(z.string(), z.unknown()),
-	PollRunMultiResponseSchema,
-	SkipResponseSchema,
-	z.object({ runId: z.string() })
-]);
-const RunSourceKindSchema = z.enum([
-	"api",
-	"trigger",
-	"gateway",
-	"workflow",
-	"agent"
-]);
-z.object({
-	kind: RunSourceKindSchema,
-	id: z.string().nullable()
-});
-const WorkflowRunStatusSchema = z.enum([
-	"pending",
-	"running",
-	"sleeping",
-	"waiting_hook",
-	"completed",
-	"failed",
-	"canceled"
-]);
-const WorkflowRunTriggerSchema = z.enum([
-	"api",
-	"cron",
-	"webhook",
-	"poll",
-	"retry"
-]);
-z.enum([
-	"run_started",
-	"step_completed",
-	"step_failed",
-	"step_retrying",
-	"sleep_scheduled",
-	"sleep_completed",
-	"hook_created",
-	"hook_resumed",
-	"run_completed",
-	"run_failed",
-	"run_canceled"
-]);
-const WorkflowRunSummarySchema = z.object({
-	id: z.string(),
-	status: WorkflowRunStatusSchema,
-	trigger: WorkflowRunTriggerSchema,
-	triggeredAt: z.string(),
-	startedAt: z.string().nullable(),
-	finishedAt: z.string().nullable(),
-	sourceKind: RunSourceKindSchema,
-	sourceId: z.string().nullable(),
-	triggerRunId: z.string().nullable(),
-	attachmentId: z.string().nullable()
-});
-const WorkflowRunRecordSchema = z.object({
-	id: z.string(),
-	workflowSlug: z.string(),
-	status: WorkflowRunStatusSchema,
-	trigger: WorkflowRunTriggerSchema,
-	triggeredAt: z.string(),
-	startedAt: z.string().nullable(),
-	finishedAt: z.string().nullable(),
-	sourceKind: RunSourceKindSchema,
-	sourceId: z.string().nullable(),
-	triggerRunId: z.string().nullable(),
-	attachmentId: z.string().nullable(),
-	parentWorkflowRunId: z.string().nullable(),
-	parentSpanId: z.string().nullable(),
-	input: z.unknown().nullable(),
-	output: z.unknown().nullable(),
-	error: z.unknown().nullable()
-});
-z.object({
-	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
-	cursor: z.string().min(1).optional(),
-	status: WorkflowRunStatusSchema.optional(),
-	trigger: WorkflowRunTriggerSchema.optional()
-});
-z.object({
-	items: z.array(WorkflowRunSummarySchema),
-	nextCursor: z.string().nullable()
-});
-z.enum([
-	"trigger",
-	"steps",
-	"trace"
-]);
-z.object({ include: z.string().optional() });
-const TriggerRunDetailSchema = z.object({
-	id: z.string(),
-	attachmentId: z.string(),
-	attachmentSlug: z.string().nullable(),
-	triggerType: z.enum([
-		"cron",
-		"webhook",
-		"poll"
-	]),
-	sourcePath: z.string().nullable(),
-	payload: z.unknown().nullable(),
-	triggeredAt: z.string()
-});
-const WorkflowStepRunSchema = z.object({
-	id: z.string(),
-	actionKey: z.string(),
-	output: z.unknown(),
-	completedAt: z.string()
-});
-const TraceTriggerSummarySchema = z.object({
-	triggerType: z.string(),
-	triggerRunId: z.string(),
-	workflowSlug: z.string().optional(),
-	agentSlug: z.string().optional(),
-	attachmentId: z.string().nullable().optional(),
-	attachmentSlug: z.string().nullable().optional(),
-	route: z.string().optional(),
-	sourcePath: z.string().nullable().optional()
-}).nullable();
-const TraceGatewaySummarySchema = z.object({
-	gatewayAttachmentId: z.string(),
-	gatewayAttachmentKey: z.string(),
-	threadId: z.string().optional(),
-	channelId: z.string().optional(),
-	mode: z.string().optional()
-}).nullable();
-const TraceSpanSchema = z.object({
-	id: z.string(),
-	traceId: z.string(),
-	parentSpanId: z.string().nullable(),
-	kind: z.string(),
-	refId: z.string(),
-	name: z.string(),
-	status: z.string(),
-	startedAt: z.string(),
-	finishedAt: z.string().nullable(),
-	metadata: z.unknown().nullable(),
-	error: z.unknown().nullable()
-});
-const TraceLogSchema = z.object({
-	id: z.string(),
-	traceId: z.string(),
-	spanId: z.string(),
-	seq: z.number(),
-	level: z.string(),
-	message: z.string(),
-	data: z.unknown().nullable(),
-	source: z.string(),
-	createdAt: z.string()
-});
-const TraceResponseSchema = z.object({
-	traceId: z.string(),
-	trigger: TraceTriggerSummarySchema,
-	gateway: TraceGatewaySummarySchema,
-	spans: z.array(TraceSpanSchema),
-	logs: z.array(TraceLogSchema)
-});
-z.object({
-	run: WorkflowRunRecordSchema,
-	trigger: TriggerRunDetailSchema.nullable(),
-	steps: z.array(WorkflowStepRunSchema),
-	trace: TraceResponseSchema.nullable()
-});
-const AgentSessionStatusSchema = z.enum([
-	"running",
-	"completed",
-	"failed",
-	"canceled"
-]);
-const AgentSessionSummarySchema = z.object({
-	id: z.string(),
-	status: AgentSessionStatusSchema,
-	source: RunSourceKindSchema,
-	sourceId: z.string().nullable(),
-	createdAt: z.string(),
-	updatedAt: z.string(),
-	messageCount: z.number()
-});
-const AgentSessionRecordSchema = z.object({
-	id: z.string(),
-	agentSlug: z.string(),
-	status: AgentSessionStatusSchema,
-	source: RunSourceKindSchema,
-	sourceId: z.string().nullable(),
-	createdAt: z.string(),
-	updatedAt: z.string(),
-	parentSpanId: z.string().nullable(),
-	messageCount: z.number(),
-	error: z.unknown().nullable()
-});
-z.object({
-	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
-	cursor: z.string().min(1).optional(),
-	status: AgentSessionStatusSchema.optional(),
-	source: RunSourceKindSchema.optional()
-});
-z.object({
-	items: z.array(AgentSessionSummarySchema),
-	nextCursor: z.string().nullable()
-});
-z.enum([
-	"gateway",
-	"messages",
-	"events",
-	"trace"
-]);
-z.object({ include: z.string().optional() });
-const GatewaySessionDetailSchema = z.object({
-	threadId: z.string(),
-	attachmentId: z.string(),
-	attachmentSlug: z.string().nullable()
-});
-const AgentEventSchema = z.object({
-	id: z.string(),
-	sessionId: z.string(),
-	seq: z.number(),
-	eventType: z.string(),
-	payload: z.unknown(),
-	createdAt: z.string()
-});
-z.object({
-	session: AgentSessionRecordSchema,
-	gateway: GatewaySessionDetailSchema.nullable(),
-	messages: z.array(z.record(z.string(), z.unknown())),
-	events: z.array(AgentEventSchema),
-	trace: TraceResponseSchema.nullable()
-});
-const SlackGatewayModeSchema = z.enum([
-	"mention",
-	"channel",
-	"dm"
-]);
-const GatewayAttachmentSourceSchema = z.object({
-	kind: z.literal("slack"),
-	mode: SlackGatewayModeSchema,
-	credentialKey: z.string(),
-	channelIds: z.array(z.string()).optional(),
-	subscribeOnMention: z.boolean()
-});
-const GatewayAttachmentRecordSchema = z.object({
-	id: z.string(),
-	key: z.string(),
-	agentKey: z.string(),
-	channelId: z.string(),
-	teamId: z.string().nullable().optional(),
-	platform: z.string(),
-	source: GatewayAttachmentSourceSchema,
-	registeredAt: z.string(),
-	updatedAt: z.string()
-});
-z.object({ attachments: z.array(GatewayAttachmentRecordSchema) });
-z.object({
-	agentKey: z.string().min(1),
-	teamId: z.string().min(1).optional(),
-	mode: SlackGatewayModeSchema.optional(),
-	subscribeOnMention: z.boolean().optional()
-});
-const AgentListItemSchema = z.object({
-	key: z.string(),
-	name: z.string().optional(),
-	route: z.string()
-});
-z.object({ agents: z.array(AgentListItemSchema) });
-const HistoryRunKindSchema = z.enum(["workflow", "agent"]);
-const HistoryRunStatusSchema = z.enum([
-	"pending",
-	"running",
-	"sleeping",
-	"waiting_hook",
-	"completed",
-	"failed",
-	"canceled"
-]);
-const HistoryRunActorSchema = z.object({
-	userId: z.string(),
-	name: z.string(),
-	avatarUrl: z.string().nullable().optional()
-});
-const HistoryRunUsageLineItemSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	amountUsd: z.number()
-});
-const HistoryRunUsageSchema = z.object({
-	runDurationMs: z.number().nullable(),
-	lineItems: z.array(HistoryRunUsageLineItemSchema),
-	totalExcludingDurationUsd: z.number().nullable()
-});
-const HistoryRunSchema = z.object({
-	id: z.string(),
-	kind: HistoryRunKindSchema,
-	traceId: z.string().nullable(),
-	projectId: z.string(),
-	projectName: z.string(),
-	resourceKey: z.string(),
-	resourceId: z.string(),
-	resourceName: z.string(),
-	status: HistoryRunStatusSchema,
-	triggeredAt: z.string(),
-	timeInQueueMs: z.number().nullable(),
-	startedAt: z.string(),
-	finishedAt: z.string().nullable(),
-	durationMs: z.number().nullable(),
-	triggerLabel: z.string(),
-	triggerRaw: z.string(),
-	ranAs: HistoryRunActorSchema.nullable(),
-	modelsUsed: z.array(z.string()),
-	otherServicesUsed: z.array(z.string()),
-	totalCostUsd: z.number().nullable(),
-	messageCount: z.number().optional(),
-	stepCount: z.number().optional()
-});
-const HistoryTraceSpanSchema = z.object({
-	id: z.string(),
-	traceId: z.string(),
-	parentSpanId: z.string().nullable(),
-	kind: z.string(),
-	refId: z.string(),
-	name: z.string(),
-	status: z.string(),
-	startedAt: z.string(),
-	finishedAt: z.string().nullable(),
-	metadata: z.unknown().nullable(),
-	error: z.unknown().nullable()
-});
-const HistoryTraceLogSchema = z.object({
-	id: z.string(),
-	traceId: z.string(),
-	spanId: z.string(),
-	seq: z.number(),
-	level: z.string(),
-	message: z.string(),
-	data: z.unknown().nullable(),
-	source: z.string(),
-	createdAt: z.string()
-});
-const HistoryTraceTriggerSchema = z.object({
-	triggerType: z.string(),
-	triggerRunId: z.string(),
-	workflowKey: z.string().optional(),
-	agentKey: z.string().optional(),
-	attachmentId: z.string().nullable().optional(),
-	attachmentKey: z.string().nullable().optional(),
-	route: z.string().optional(),
-	sourcePath: z.string().nullable().optional()
-}).nullable();
-const HistoryTraceGatewaySchema = z.object({
-	gatewayAttachmentId: z.string(),
-	gatewayAttachmentKey: z.string(),
-	threadId: z.string().optional(),
-	channelId: z.string().optional(),
-	mode: z.string().optional()
-}).nullable();
-const HistoryTraceSchema = z.object({
-	traceId: z.string(),
-	trigger: HistoryTraceTriggerSchema,
-	gateway: HistoryTraceGatewaySchema,
-	spans: z.array(HistoryTraceSpanSchema),
-	logs: z.array(HistoryTraceLogSchema)
-});
-const HistoryWorkflowStepSchema = z.object({
-	id: z.string(),
-	actionKey: z.string(),
-	output: z.unknown(),
-	completedAt: z.string()
-});
-const HistoryWorkflowRunDetailSchema = z.object({
-	kind: z.literal("workflow"),
-	run: z.object({
-		id: z.string(),
-		workflowKey: z.string(),
-		status: HistoryRunStatusSchema,
-		trigger: z.string(),
-		triggeredAt: z.string(),
-		startedAt: z.string().nullable(),
-		finishedAt: z.string().nullable(),
-		input: z.unknown().nullable(),
-		output: z.unknown().nullable(),
-		error: z.unknown().nullable()
-	}),
-	trigger: z.object({
-		id: z.string(),
-		attachmentKey: z.string().nullable(),
-		triggerType: z.string(),
-		sourcePath: z.string().nullable(),
-		payload: z.unknown().nullable(),
-		triggeredAt: z.string()
-	}).nullable(),
-	steps: z.array(HistoryWorkflowStepSchema),
-	trace: HistoryTraceSchema.nullable(),
-	ranAs: HistoryRunActorSchema.nullable().optional(),
-	usage: HistoryRunUsageSchema.nullable().optional()
-});
-const HistoryAgentSessionDetailSchema = z.object({
-	kind: z.literal("agent"),
-	runId: z.string(),
-	session: z.object({
-		id: z.string(),
-		agentKey: z.string(),
-		status: HistoryRunStatusSchema,
-		source: z.enum([
-			"api",
-			"gateway",
-			"trigger",
-			"workflow",
-			"agent"
-		]),
-		sourceId: z.string().nullable(),
-		createdAt: z.string(),
-		updatedAt: z.string(),
-		messageCount: z.number(),
-		error: z.unknown().nullable()
-	}),
-	gateway: z.object({
-		threadId: z.string(),
-		attachmentKey: z.string().nullable()
-	}).nullable(),
-	messages: z.array(z.record(z.string(), z.unknown())),
-	trace: HistoryTraceSchema.nullable(),
-	ranAs: HistoryRunActorSchema.nullable().optional(),
-	usage: HistoryRunUsageSchema.nullable().optional()
-});
-const HistoryRunDetailSchema = z.discriminatedUnion("kind", [HistoryWorkflowRunDetailSchema, HistoryAgentSessionDetailSchema]);
-const HistoryRunListQuerySchema = z.object({
-	project: z.string().min(1).optional(),
-	status: HistoryRunStatusSchema.optional(),
-	kind: HistoryRunKindSchema.optional()
-});
-const HistoryRunListResponseSchema = z.array(HistoryRunSchema);
-const HistoryRunDetailResponseSchema = HistoryRunDetailSchema.nullable();
-const HistoryRunCancelResponseSchema = HistoryRunSchema.nullable();
-const WorkflowSubscriptionRecordSchema = z.object({
-	id: z.string(),
-	workflowKey: z.string(),
-	userId: z.string(),
-	enabled: z.boolean(),
-	createdAt: z.string(),
-	updatedAt: z.string()
-});
-z.object({ subscriptions: z.array(WorkflowSubscriptionRecordSchema) });
-z.object({
-	userId: z.string().min(1).optional(),
-	enabled: z.boolean().optional()
-});
-const CredentialInstanceRecordSchema = z.object({
-	id: z.string(),
-	key: z.string(),
-	scopeType: CredentialScopeTypeSchema,
-	scopeId: z.string().nullable(),
-	label: z.string().nullable(),
-	isDefault: z.boolean(),
-	authKind: CredentialAuthKindSchema
-});
-z.object({ instances: z.array(CredentialInstanceRecordSchema) });
-z.object({
-	key: z.string().min(1),
-	scopeType: CredentialScopeTypeSchema,
-	scopeId: z.string().nullable().optional(),
-	label: z.string().nullable().optional(),
-	isDefault: z.boolean().optional(),
-	value: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" })
-});
-z.object({
-	label: z.string().nullable().optional(),
-	isDefault: z.boolean().optional(),
-	value: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" }).optional()
-});
-const TriggerRunTypeSchema = z.enum([
-	"cron",
-	"webhook",
-	"poll"
-]);
-const TriggerRunWorkflowSummarySchema = z.object({
-	id: z.string(),
-	status: WorkflowRunStatusSchema,
-	workflowSlug: z.string()
-});
-const TriggerRunAgentSessionSummarySchema = z.object({
-	id: z.string(),
-	agentSlug: z.string()
-});
-const TriggerRunSummarySchema = z.object({
-	id: z.string(),
-	triggerType: TriggerRunTypeSchema,
-	triggeredAt: z.string(),
-	sourcePath: z.string().nullable(),
-	workflowRun: TriggerRunWorkflowSummarySchema.nullable(),
-	agentSession: TriggerRunAgentSessionSummarySchema.nullable()
-});
-const TriggerRunRecordSchema = z.object({
-	id: z.string(),
-	attachmentId: z.string(),
-	attachmentSlug: z.string(),
-	triggerType: TriggerRunTypeSchema,
-	sourcePath: z.string().nullable(),
-	payload: z.unknown().nullable(),
-	triggeredAt: z.string()
-});
-z.object({
-	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
-	cursor: z.string().min(1).optional(),
-	triggerType: TriggerRunTypeSchema.optional()
-});
-z.object({
-	items: z.array(TriggerRunSummarySchema),
-	nextCursor: z.string().nullable()
-});
-z.enum([
-	"workflows",
-	"agents",
-	"trace"
-]);
-z.object({ include: z.string().optional() });
-const TriggerRunAgentSessionDetailSchema = z.object({
-	id: z.string(),
-	agentSlug: z.string()
-});
-z.object({
-	run: TriggerRunRecordSchema,
-	workflowRuns: z.array(WorkflowRunSummarySchema),
-	agentSessions: z.array(TriggerRunAgentSessionDetailSchema),
-	trace: TraceResponseSchema.nullable()
-});
-const TriggerTypeSchema = z.enum([
-	"webhook",
-	"poll",
-	"cron"
-]);
-const TriggerTargetKindSchema = z.enum(["workflow", "agent"]);
-const TriggerListItemSchema = z.object({
-	key: z.string(),
-	type: TriggerTypeSchema,
-	route: z.string().optional(),
-	webhookUrl: z.string().url().optional(),
-	targetKind: TriggerTargetKindSchema,
-	workflowKey: z.string().optional(),
-	agentKey: z.string().optional()
-});
-z.object({ triggers: z.array(TriggerListItemSchema) });
-z.object({ endpoint: z.string().min(1).optional() });
-const OrganizationMemberRoleSchema = z.enum([
-	"owner",
-	"admin",
-	"builder"
-]);
-const OrganizationMemberStatusSchema = z.enum([
-	"invited",
-	"active",
-	"rejected",
-	"suspended"
-]);
-const InvitableOrganizationMemberRoleSchema = z.enum(["admin", "builder"]);
-const isoDateTime$4 = z.string().datetime();
-const OrganizationMemberSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	email: z.string().email(),
-	role: OrganizationMemberRoleSchema,
-	status: OrganizationMemberStatusSchema,
-	avatarUrl: z.string().optional(),
-	joinedAt: isoDateTime$4.optional(),
-	lastActiveAt: isoDateTime$4.nullable().optional()
-});
-const ListOrganizationMembersResponseSchema = z.object({ members: z.array(OrganizationMemberSchema) });
-const InviteOrganizationMembersRequestSchema = z.object({
-	emails: z.array(z.string().trim().email()).min(1),
-	role: InvitableOrganizationMemberRoleSchema
-});
-const InviteOrganizationMemberResultStatusSchema = z.enum([
-	"sent",
-	"already_member",
-	"pending",
-	"invalid"
-]);
-const InviteOrganizationMemberResultSchema = z.object({
-	email: z.string(),
-	status: InviteOrganizationMemberResultStatusSchema,
-	invitationId: z.string().optional()
-});
-const InviteOrganizationMembersResponseSchema = z.object({ results: z.array(InviteOrganizationMemberResultSchema) });
-const UpdateOrganizationMemberRequestSchema = z.object({ role: InvitableOrganizationMemberRoleSchema });
-const UpdateOrganizationMemberResponseSchema = z.object({ member: OrganizationMemberSchema });
-const OrganizationInvitationSchema = z.object({
-	id: z.string(),
-	organizationName: z.string(),
-	organizationSlug: OrganizationSlugSchema,
-	invitedByName: z.string().optional(),
-	invitedByEmail: z.string().email().optional(),
-	role: OrganizationMemberRoleSchema
-});
-const ListOrganizationInvitationsResponseSchema = z.object({ invitations: z.array(OrganizationInvitationSchema) });
-const AcceptOrganizationInvitationResponseSchema = z.object({ organization: UserOrganizationSchema });
-const DeclineOrganizationInvitationResponseSchema = z.object({ success: z.literal(true) });
-/** Web path to auto-accept an invitation after sign-in (used in invite emails). */
-function organizationInvitationAcceptPath(invitationId) {
-	return `/organization/invitations?${new URLSearchParams({ accept: invitationId }).toString()}`;
-}
-const isoDateTime$3 = z.string().datetime();
-const ApiKeyCreatorSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	email: z.string().email().optional(),
-	avatarUrl: z.string().optional(),
-	/** True when the creator user row no longer exists. */
-	deleted: z.boolean().optional()
-});
-const ApiKeySummarySchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	keyPreview: z.string(),
-	createdAt: isoDateTime$3,
-	createdBy: ApiKeyCreatorSchema,
-	isCreatedByCurrentUser: z.boolean()
-});
-const ListApiKeysResponseSchema = z.object({ apiKeys: z.array(ApiKeySummarySchema) });
-const CreateApiKeyRequestSchema = z.object({ name: z.string().trim().min(1).max(128) });
-const CreateApiKeyResponseSchema = ApiKeySummarySchema.extend({ secret: z.string() });
-const ProjectUserRoleSchema = z.enum(["admin", "builder"]);
-const ProjectInvitePermissionSchema = z.enum(["admin", "all"]);
-const ProjectMemberStatusSchema = z.enum(["active", "invited"]);
-const isoDateTime$2 = z.string().datetime();
-const ProjectMemberSchema = z.object({
-	id: z.string(),
-	projectId: z.string(),
-	name: z.string(),
-	email: z.string().email(),
-	role: ProjectUserRoleSchema,
-	status: ProjectMemberStatusSchema,
-	image: z.string().nullable(),
-	createdAt: isoDateTime$2,
-	isCurrentUser: z.boolean().optional()
-});
-const ListProjectMembersResponseSchema = z.object({ members: z.array(ProjectMemberSchema) });
-const InviteProjectMembersRequestSchema = z.object({
-	emails: z.array(z.string().trim().email()).min(1),
-	role: ProjectUserRoleSchema
-});
-const InviteProjectMemberResultStatusSchema = z.enum([
-	"added",
-	"already_member",
-	"not_org_member",
-	"invalid"
-]);
-const InviteProjectMemberResultSchema = z.object({
-	email: z.string(),
-	status: InviteProjectMemberResultStatusSchema
-});
-const InviteProjectMembersResponseSchema = z.object({ results: z.array(InviteProjectMemberResultSchema) });
-const UpdateProjectMemberRequestSchema = z.object({ role: ProjectUserRoleSchema });
-const UpdateProjectMemberResponseSchema = z.object({ member: ProjectMemberSchema });
-const ProjectSettingsSchema = z.object({
-	description: z.string(),
-	defaultRole: ProjectUserRoleSchema,
-	invitePermission: ProjectInvitePermissionSchema
-});
-const UpdateProjectSettingsRequestSchema = z.object({
-	description: z.string().optional(),
-	defaultRole: ProjectUserRoleSchema.optional(),
-	invitePermission: ProjectInvitePermissionSchema.optional()
-}).refine((data) => data.description !== void 0 || data.defaultRole !== void 0 || data.invitePermission !== void 0, { message: "At least one field is required" });
-const ProjectSettingsResponseSchema = z.object({ settings: ProjectSettingsSchema });
-/** Custom avatar override; null means fall back to OAuth `users.image`. */
-const UserAvatarSchema = z.object({ url: z.url().nullable() });
-const UserAvatarPatchSchema = z.object({ 
-/** Storage key returned from presign; null removes the custom override. */
-storageKey: z.string().min(1).nullable() });
-const PresignUserAvatarRequestSchema = z.object({ contentType: z.string().trim().min(1) });
-const PresignUserAvatarResponseSchema = z.object({
-	uploadUrl: z.url(),
-	storageKey: z.string().min(1)
-});
-const UserInterfaceThemeSchema = z.enum([
-	"system",
-	"light",
-	"dark"
-]);
-const UserSurfaceContrastSchema = z.enum(["off", "on"]);
-const UserWorkspaceLayoutModeSchema = z.enum(["default", "linear"]);
-const UserWorkspaceFontSizeSchema = z.enum(["default", "large"]);
-const UserSidebarNavIconVisibilitySchema = z.enum(["hidden", "visible"]);
-const UserSidebarFooterChatRowVisibilitySchema = z.enum(["hidden", "visible"]);
-const UserWorkspaceFavoriteKindSchema = z.enum([
-	"agent",
-	"workflow",
-	"skill",
-	"run"
-]);
-const UserWorkspaceFavoriteSchema = z.object({
-	kind: UserWorkspaceFavoriteKindSchema,
-	resourceId: z.string().min(1)
-});
-const UserSidebarPreferencesSchema = z.object({
-	navIconVisibility: UserSidebarNavIconVisibilitySchema,
-	footerChatRowVisibility: UserSidebarFooterChatRowVisibilitySchema,
-	hiddenNavItemIds: z.array(z.string()),
-	topNavItemOrderIds: z.array(z.string()),
-	workspaceNavItemOrderIds: z.array(z.string())
-});
-const UserPreferencesSchema = z.object({
-	interfaceTheme: UserInterfaceThemeSchema,
-	surfaceContrast: UserSurfaceContrastSchema,
-	layoutMode: UserWorkspaceLayoutModeSchema,
-	fontSize: UserWorkspaceFontSizeSchema,
-	sidebar: UserSidebarPreferencesSchema,
-	favorites: z.array(UserWorkspaceFavoriteSchema),
-	projectOrderIds: z.array(z.string()),
-	projectDotColors: z.record(z.string(), z.string()),
-	onboardingTabVisible: z.boolean()
-});
-const UserSidebarPreferencesPatchSchema = z.object({
-	navIconVisibility: UserSidebarNavIconVisibilitySchema.optional(),
-	footerChatRowVisibility: UserSidebarFooterChatRowVisibilitySchema.optional(),
-	hiddenNavItemIds: z.array(z.string()).optional(),
-	topNavItemOrderIds: z.array(z.string()).optional(),
-	workspaceNavItemOrderIds: z.array(z.string()).optional()
-});
-const UserPreferencesPatchSchema = z.object({
-	interfaceTheme: UserInterfaceThemeSchema.optional(),
-	surfaceContrast: UserSurfaceContrastSchema.optional(),
-	layoutMode: UserWorkspaceLayoutModeSchema.optional(),
-	fontSize: UserWorkspaceFontSizeSchema.optional(),
-	sidebar: UserSidebarPreferencesPatchSchema.optional(),
-	favorites: z.array(UserWorkspaceFavoriteSchema).optional(),
-	projectOrderIds: z.array(z.string()).optional(),
-	projectDotColors: z.record(z.string(), z.string()).optional(),
-	onboardingTabVisible: z.boolean().optional()
-}).refine((value) => value.interfaceTheme !== void 0 || value.surfaceContrast !== void 0 || value.layoutMode !== void 0 || value.fontSize !== void 0 || value.sidebar !== void 0 || value.favorites !== void 0 || value.projectOrderIds !== void 0 || value.projectDotColors !== void 0 || value.onboardingTabVisible !== void 0, { message: "At least one preference field is required" });
-const DEFAULT_USER_SIDEBAR_PREFERENCES = {
-	navIconVisibility: "visible",
-	footerChatRowVisibility: "visible",
-	hiddenNavItemIds: ["registry"],
-	topNavItemOrderIds: [],
-	workspaceNavItemOrderIds: []
-};
-const DEFAULT_USER_PREFERENCES = {
-	interfaceTheme: "system",
-	surfaceContrast: "on",
-	layoutMode: "linear",
-	fontSize: "default",
-	sidebar: DEFAULT_USER_SIDEBAR_PREFERENCES,
-	favorites: [],
-	projectOrderIds: [],
-	projectDotColors: {},
-	onboardingTabVisible: true
-};
-function normalizeInterfaceTheme(value) {
-	if (value === "light" || value === "dark") return value;
-	return "system";
-}
-function normalizeSurfaceContrast(value) {
-	return value === "off" ? "off" : "on";
-}
-function normalizeLayoutMode(value) {
-	return value === "default" ? "default" : "linear";
-}
-function normalizeFontSize(value) {
-	return value === "large" ? "large" : "default";
-}
-function normalizeStringList(value) {
-	if (!Array.isArray(value)) return [];
-	return Array.from(new Set(value.filter((item) => typeof item === "string")));
-}
-function normalizeHiddenNavItemIds(value) {
-	if (!Array.isArray(value)) return DEFAULT_USER_SIDEBAR_PREFERENCES.hiddenNavItemIds;
-	return normalizeStringList(value);
-}
-function normalizeSidebarPreferences(value) {
-	if (!value || typeof value !== "object") return DEFAULT_USER_SIDEBAR_PREFERENCES;
-	const sidebar = value;
-	return {
-		navIconVisibility: sidebar.navIconVisibility === "visible" ? "visible" : "hidden",
-		footerChatRowVisibility: sidebar.footerChatRowVisibility === "hidden" ? "hidden" : "visible",
-		hiddenNavItemIds: normalizeHiddenNavItemIds(sidebar.hiddenNavItemIds),
-		topNavItemOrderIds: normalizeStringList(sidebar.topNavItemOrderIds),
-		workspaceNavItemOrderIds: normalizeStringList(sidebar.workspaceNavItemOrderIds)
-	};
-}
-function isWorkspaceFavoriteKind(value) {
-	return value === "agent" || value === "workflow" || value === "skill" || value === "run";
-}
-function normalizeFavorites(value) {
-	if (!Array.isArray(value)) return [];
-	const seenKeys = /* @__PURE__ */ new Set();
-	const favorites = [];
-	for (const item of value) {
-		if (!item || typeof item !== "object") continue;
-		const favorite = item;
-		if (typeof favorite.kind !== "string" || !isWorkspaceFavoriteKind(favorite.kind) || typeof favorite.resourceId !== "string" || favorite.resourceId.length === 0) continue;
-		const key = `${favorite.kind}:${favorite.resourceId}`;
-		if (seenKeys.has(key)) continue;
-		seenKeys.add(key);
-		favorites.push({
-			kind: favorite.kind,
-			resourceId: favorite.resourceId
-		});
-	}
-	return favorites;
-}
-function normalizeProjectDotColors(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[0] === "string" && typeof entry[1] === "string"));
-}
-function normalizeOnboardingTabVisible(value) {
-	return typeof value === "boolean" ? value : DEFAULT_USER_PREFERENCES.onboardingTabVisible;
-}
-function normalizeUserPreferences(value) {
-	if (!value || typeof value !== "object") return DEFAULT_USER_PREFERENCES;
-	const preferences = value;
-	return UserPreferencesSchema.parse({
-		interfaceTheme: normalizeInterfaceTheme(preferences.interfaceTheme),
-		surfaceContrast: normalizeSurfaceContrast(preferences.surfaceContrast),
-		layoutMode: normalizeLayoutMode(preferences.layoutMode),
-		fontSize: normalizeFontSize(preferences.fontSize),
-		sidebar: normalizeSidebarPreferences(preferences.sidebar),
-		favorites: normalizeFavorites(preferences.favorites),
-		projectOrderIds: normalizeStringList(preferences.projectOrderIds),
-		projectDotColors: normalizeProjectDotColors(preferences.projectDotColors),
-		onboardingTabVisible: normalizeOnboardingTabVisible(preferences.onboardingTabVisible)
-	});
-}
-function mergeUserPreferences(current, patch) {
-	return normalizeUserPreferences({
-		...current,
-		...patch,
-		sidebar: patch.sidebar ? {
-			...current.sidebar,
-			...patch.sidebar
-		} : current.sidebar
-	});
-}
-const OrganizationLogoVariantSchema = z.enum(["light", "dark"]);
-const OrganizationSidebarBrandingSchema = z.object({
-	customLogoEnabled: z.boolean(),
-	customLogoExplicitlyDisabled: z.boolean(),
-	logoLightUrl: z.url().nullable(),
-	logoDarkUrl: z.url().nullable(),
-	logoHeightPx: z.number().int().min(14).max(32)
-});
-const OrganizationSidebarBrandingPatchSchema = z.object({
-	customLogoEnabled: z.boolean().optional(),
-	customLogoExplicitlyDisabled: z.boolean().optional(),
-	logoLightStorageKey: z.string().min(1).nullable().optional(),
-	logoDarkStorageKey: z.string().min(1).nullable().optional(),
-	logoHeightPx: z.number().int().min(14).max(32).optional()
-}).refine((value) => value.customLogoEnabled !== void 0 || value.customLogoExplicitlyDisabled !== void 0 || value.logoLightStorageKey !== void 0 || value.logoDarkStorageKey !== void 0 || value.logoHeightPx !== void 0, { message: "At least one branding field is required" });
-const PresignOrgLogoRequestSchema = z.object({
-	variant: OrganizationLogoVariantSchema,
-	contentType: z.string().trim().min(1)
-});
-const PresignOrgLogoResponseSchema = z.object({
-	uploadUrl: z.url(),
-	storageKey: z.string().min(1)
-});
-const DEFAULT_ORGANIZATION_SIDEBAR_BRANDING = {
-	customLogoEnabled: false,
-	customLogoExplicitlyDisabled: false,
-	logoLightUrl: null,
-	logoDarkUrl: null,
-	logoHeightPx: 20
-};
-function normalizeLogoUrl(value) {
-	if (typeof value !== "string") return null;
-	try {
-		const url = new URL(value);
-		if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-		return url.toString();
-	} catch {
-		return null;
-	}
-}
-function normalizeCustomLogoEnabled(value, branding) {
-	const hasCustomLogo = Boolean(normalizeLogoUrl(branding.logoLightUrl) || normalizeLogoUrl(branding.logoDarkUrl));
-	if (branding.customLogoExplicitlyDisabled === true) return false;
-	if (typeof value === "boolean") return value || hasCustomLogo;
-	return hasCustomLogo;
-}
-function normalizeLogoHeightPx(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) return DEFAULT_ORGANIZATION_SIDEBAR_BRANDING.logoHeightPx;
-	return Math.min(32, Math.max(14, Math.round(value)));
-}
-function normalizeOrganizationSidebarBranding(value) {
-	if (!value || typeof value !== "object") return DEFAULT_ORGANIZATION_SIDEBAR_BRANDING;
-	const branding = value;
-	return OrganizationSidebarBrandingSchema.parse({
-		customLogoEnabled: normalizeCustomLogoEnabled(branding.customLogoEnabled, branding),
-		customLogoExplicitlyDisabled: branding.customLogoExplicitlyDisabled === true,
-		logoLightUrl: normalizeLogoUrl(branding.logoLightUrl),
-		logoDarkUrl: normalizeLogoUrl(branding.logoDarkUrl),
-		logoHeightPx: normalizeLogoHeightPx(branding.logoHeightPx)
-	});
-}
-const ProjectArtifactStatusSchema = z.enum(["pending", "ready"]);
-const isoDateTime$1 = z.string().datetime();
-const ProjectArtifactSchema = z.object({
-	id: z.string(),
-	projectId: z.string(),
-	storageKey: z.string(),
-	status: ProjectArtifactStatusSchema,
-	createdAt: isoDateTime$1,
-	updatedAt: isoDateTime$1
-});
-const CreateProjectArtifactResponseSchema = z.object({
-	artifact: ProjectArtifactSchema,
-	uploadUrl: z.string().url(),
-	expiresInSeconds: z.number().int().positive()
-});
-const CompleteProjectArtifactResponseSchema = z.object({
-	artifact: ProjectArtifactSchema,
-	project: ProjectSchema
-});
-const DownloadActiveProjectArtifactResponseSchema = z.object({
-	artifactId: z.string(),
-	downloadUrl: z.string().url(),
-	expiresInSeconds: z.number().int().positive()
-});
-const ProjectDeploymentSchema = z.object({
-	id: z.string(),
-	projectId: z.string(),
-	version: z.number().int().positive(),
-	deployedBy: z.string().nullable(),
-	deployedByEmail: z.string().optional(),
-	deployedByAvatarUrl: z.string().optional(),
-	createdAt: isoDateTime$1,
-	active: z.boolean()
-});
-const ListProjectDeploymentsResponseSchema = z.object({ deployments: z.array(ProjectDeploymentSchema) });
-const PLATFORM_RESOURCE_UNSUPPORTED_TEXT = "Not Supported";
-const optionalCount = z.number().int().nonnegative().nullable().optional();
-const optionalTimestamp = z.string().nullable().optional();
-const AgentSummarySchema = z.object({
-	id: z.string().min(1),
-	slug: z.string().min(1),
-	name: z.string().min(1),
-	projectId: z.string().min(1),
-	updatedAt: z.string().min(1),
-	description: z.string().optional(),
-	sourcePath: z.string().min(1).optional(),
-	model: z.string().optional(),
-	toolCount: optionalCount,
-	credentialCount: optionalCount,
-	lastRunAt: optionalTimestamp
-});
-const WorkflowSummarySchema = z.object({
-	id: z.string().min(1),
-	slug: z.string().min(1),
-	name: z.string().min(1),
-	projectId: z.string().min(1),
-	updatedAt: z.string().min(1),
-	description: z.string().optional(),
-	sourcePath: z.string().min(1).optional(),
-	lastRunAt: optionalTimestamp
-});
-const SkillSummarySchema = z.object({
-	id: z.string().min(1),
-	slug: z.string().min(1),
-	name: z.string().min(1),
-	projectId: z.string().min(1),
-	updatedAt: z.string().min(1),
-	description: z.string().optional(),
-	sourcePath: z.string().min(1).optional()
-});
-const AgentSummaryListResponseSchema = z.array(AgentSummarySchema);
-const AgentSummaryDetailResponseSchema = AgentSummarySchema.nullable();
-const WorkflowSummaryListResponseSchema = z.array(WorkflowSummarySchema);
-const WorkflowSummaryDetailResponseSchema = WorkflowSummarySchema.nullable();
-const SkillSummaryListResponseSchema = z.array(SkillSummarySchema);
-const SkillSummaryDetailResponseSchema = SkillSummarySchema.nullable();
-const RecentResourceKindSchema = z.enum([
-	"agent",
-	"workflow",
-	"skill"
-]);
-const RecentResourceSourceSchema = z.enum(["owned", "shared"]);
-const RecentResourceSchema = z.object({
-	id: z.string().min(1),
-	resourceKind: RecentResourceKindSchema,
-	resourceId: z.string().min(1),
-	name: z.string().min(1),
-	description: z.string().optional(),
-	projectId: z.string().min(1),
-	projectName: z.string().min(1),
-	sourcePath: z.string().min(1).optional(),
-	source: RecentResourceSourceSchema,
-	lastOpenedAt: z.string().min(1),
-	lastModifiedAt: z.string().min(1)
-});
-const RecentResourceListResponseSchema = z.array(RecentResourceSchema);
-const isoDateTime = z.string().datetime();
-const sha256Hex = z.string().regex(/^[a-f0-9]{64}$/, "Expected a lowercase hex sha256 digest");
-/**
-* A single entry in a deploy's file tree, as served to the dashboard. Carries
-* no contents: `id` is a stable, path-derived handle used for selection and
-* `?file=` deep links; `hash` is the content address used to fetch the bytes
-* lazily and to cache them immutably in the browser.
-*/
-const ProjectFileSummarySchema = z.object({
-	id: z.string(),
-	path: z.string().min(1),
-	hash: sha256Hex
-});
-/** Maps a runtime resource slug (agent/workflow/skill) to its source file path. */
-const ProjectSourceResourceRefSchema = z.object({
-	slug: z.string().min(1),
-	path: z.string().min(1)
-});
-const ProjectSourceResourcesSchema = z.object({
-	agents: z.array(ProjectSourceResourceRefSchema).default([]),
-	workflows: z.array(ProjectSourceResourceRefSchema).default([]),
-	skills: z.array(ProjectSourceResourceRefSchema).default([])
-});
-const emptyResources = () => ({
-	agents: [],
-	workflows: [],
-	skills: []
-});
-/** Response for the file-tree listing of a project's active deploy. */
-const ListProjectFilesResponseSchema = z.object({
-	artifactId: z.string().nullable(),
-	files: z.array(ProjectFileSummarySchema),
-	resources: ProjectSourceResourcesSchema.default(emptyResources())
-});
-z.object({
-	path: z.string().min(1),
-	contents: z.string(),
-	hash: sha256Hex
-});
-/** A blob the CLI may need to upload, keyed by content hash. */
-const SourceBlobRefSchema = z.object({
-	hash: sha256Hex,
-	size: z.number().int().nonnegative()
-});
-/** Request: ask the platform which blobs are missing and get presigned PUTs. */
-const PresignProjectSourceRequestSchema = z.object({ blobs: z.array(SourceBlobRefSchema) });
-const PresignedBlobUploadSchema = z.object({
-	hash: sha256Hex,
-	url: z.string().url()
-});
-/** Response: presigned PUTs for the subset of blobs not already stored. */
-const PresignProjectSourceResponseSchema = z.object({ uploads: z.array(PresignedBlobUploadSchema) });
-/** A file reference in a manifest upload: where the path's content lives. */
-const ManifestFileRefSchema = z.object({
-	path: z.string().min(1),
-	hash: sha256Hex
-});
-/** Request body the CLI sends to finalize a deploy's source manifest. */
-const UploadProjectSourceManifestRequestSchema = z.object({ files: z.array(ManifestFileRefSchema) });
-const UploadProjectSourceResponseSchema = z.object({
-	ok: z.literal(true),
-	fileCount: z.number().int().nonnegative()
-});
-/** A file entry as persisted in the stored manifest (path-derived id added). */
-const StoredManifestFileSchema = z.object({
-	id: z.string(),
-	path: z.string().min(1),
-	hash: sha256Hex
-});
-/** The immutable per-deploy manifest persisted to object storage. */
-const StoredProjectSourceManifestSchema = z.object({
-	files: z.array(StoredManifestFileSchema),
-	generatedAt: isoDateTime
-});
-/** Stable, path-derived file id (used by the web for selection + deep links). */
-function projectFileId(path) {
-	return `file-${path.trim().replace(/^\.?\/+/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase()}`;
-}
-function mapOrganization(row) {
-	return OrganizationSchema.parse({
-		id: row.id,
-		name: row.name,
-		slug: row.slug,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	});
-}
-function mapProject(row) {
-	return ProjectSchema.parse({
-		id: row.id,
-		organizationId: row.organizationId,
-		name: row.name,
-		slug: row.slug,
-		description: row.description,
-		status: row.status,
-		baseUrl: row.baseUrl,
-		runtimeId: row.runtimeId,
-		lastError: row.lastError,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	});
-}
-function mapUserOrganization(row) {
-	return UserOrganizationSchema.parse({
-		organization: mapOrganization(row.organization),
-		role: row.role
-	});
-}
-function mapOrganizationMember(row) {
-	return OrganizationMemberSchema.parse({
-		id: row.id,
-		name: row.name,
-		email: row.email,
-		role: row.role,
-		status: row.status,
-		...row.image ? { avatarUrl: row.image } : {},
-		joinedAt: row.createdAt.toISOString(),
-		lastActiveAt: null
-	});
-}
-function mapOrganizationInvitation(row) {
-	return OrganizationInvitationSchema.parse({
-		id: row.id,
-		organizationName: row.organizationName,
-		organizationSlug: row.organizationSlug,
-		role: row.role,
-		...row.invitedByName ? { invitedByName: row.invitedByName } : {},
-		...row.invitedByEmail ? { invitedByEmail: row.invitedByEmail } : {}
-	});
-}
-function mapProjectMember(row, options) {
-	return ProjectMemberSchema.parse({
-		id: row.id,
-		projectId: row.projectId,
-		name: row.name,
-		email: row.email,
-		role: row.role,
-		status: row.status,
-		image: row.image,
-		createdAt: row.createdAt.toISOString(),
-		isCurrentUser: options?.isCurrentUser
-	});
-}
-function mapProjectSettings(row) {
-	return {
-		description: row.description ?? "",
-		defaultRole: row.defaultMemberRole,
-		invitePermission: row.invitePermission
-	};
-}
-function mapProjectArtifact(row) {
-	return ProjectArtifactSchema.parse({
-		id: row.id,
-		projectId: row.projectId,
-		storageKey: row.storageKey,
-		status: row.status,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	});
-}
-function mapProjectDeployment(row) {
-	return ProjectDeploymentSchema.parse({
-		id: row.id,
-		projectId: row.projectId,
-		version: row.version,
-		deployedBy: row.deployedByName,
-		...row.deployedByEmail ? { deployedByEmail: row.deployedByEmail } : {},
-		...row.deployedByAvatarUrl ? { deployedByAvatarUrl: row.deployedByAvatarUrl } : {},
-		createdAt: row.createdAt.toISOString(),
-		active: row.active
-	});
-}
-//#endregion
-//#region ../../packages/storage/dist/index.mjs
-function readEnv$1(env, ...keys) {
-	for (const key of keys) {
-		const value = env[key]?.trim();
-		if (value) return value;
-	}
-}
-function requireEnv(env, keys) {
-	const candidates = Array.isArray(keys) ? keys : [keys];
-	const value = readEnv$1(env, ...candidates);
-	if (!value) throw new Error(`${candidates[0]} is required`);
-	return value;
-}
-/** Admin S3 credentials for storage plugins (bucket is per-org, not from env). */
-function storageAdminConfigFromEnv(env = process.env) {
-	const accessKeyId = requireEnv(env, ["STORAGE_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"]);
-	const secretAccessKey = requireEnv(env, ["STORAGE_SECRET_ACCESS_KEY", "AWS_SECRET_ACCESS_KEY"]);
-	const endpoint = requireEnv(env, [
-		"STORAGE_ENDPOINT",
-		"AWS_ENDPOINT_URL_S3",
-		"AWS_S3_ENDPOINT"
-	]);
-	return {
-		region: readEnv$1(env, "STORAGE_REGION", "AWS_REGION") ?? "us-east-1",
-		accessKeyId,
-		secretAccessKey,
-		endpoint,
-		forcePathStyle: env.STORAGE_FORCE_PATH_STYLE === void 0 ? true : env.STORAGE_FORCE_PATH_STYLE === "true"
-	};
-}
-/** Endpoint for presigned URLs fetched inside project-server containers (e.g. `http://minio:9000`). */
-function containerPresignEndpointFromEnv(hostEndpoint, env = process.env) {
-	const override = readEnv$1(env, "STORAGE_CONTAINER_ENDPOINT");
-	if (override) return override;
-	try {
-		const url = new URL(hostEndpoint);
-		if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-			const port = url.port || (url.protocol === "https:" ? "443" : "9000");
-			return `${url.protocol}//minio:${port}`;
-		}
-	} catch {}
-	return hostEndpoint;
-}
-const DEFAULT_PRESIGN_TTL_SECONDS = 900;
-function createStorage(config) {
-	const client = new S3Client(toClientConfig(config));
-	return {
-		async putObject(input) {
-			await client.send(new PutObjectCommand({
-				Bucket: config.bucket,
-				Key: input.key,
-				Body: input.body,
-				ContentType: input.contentType
-			}));
-		},
-		async getObject(key) {
-			const response = await client.send(new GetObjectCommand({
-				Bucket: config.bucket,
-				Key: key
-			}));
-			if (!response.Body) throw new Error(`Object body missing for key ${key}`);
-			return response.Body.transformToByteArray();
-		},
-		async headObject(key) {
-			try {
-				return { contentLength: (await client.send(new HeadObjectCommand({
-					Bucket: config.bucket,
-					Key: key
-				}))).ContentLength ?? 0 };
-			} catch (error) {
-				if (isNotFoundError(error)) return;
-				throw error;
-			}
-		},
-		async presignGet(input) {
-			return getSignedUrl(client, new GetObjectCommand({
-				Bucket: config.bucket,
-				Key: input.key
-			}), { expiresIn: input.expiresInSeconds ?? DEFAULT_PRESIGN_TTL_SECONDS });
-		},
-		async presignPut(input) {
-			return getSignedUrl(client, new PutObjectCommand({
-				Bucket: config.bucket,
-				Key: input.key,
-				ContentType: input.contentType ?? "application/gzip"
-			}), { expiresIn: input.expiresInSeconds ?? DEFAULT_PRESIGN_TTL_SECONDS });
-		},
-		async deleteObject(key) {
-			await client.send(new DeleteObjectCommand({
-				Bucket: config.bucket,
-				Key: key
-			}));
-		}
-	};
-}
-function toClientConfig(config) {
-	return {
-		region: config.region,
-		credentials: {
-			accessKeyId: config.accessKeyId,
-			secretAccessKey: config.secretAccessKey
-		},
-		endpoint: config.endpoint,
-		forcePathStyle: config.forcePathStyle
-	};
-}
-function isNotFoundError(error) {
-	if (!error || typeof error !== "object") return false;
-	const name = "name" in error ? String(error.name) : "";
-	const status = "$metadata" in error ? error.$metadata : void 0;
-	return name === "NotFound" || name === "NoSuchKey" || status?.httpStatusCode === 404;
-}
-var RouteManifestNotFoundError = class extends Error {
-	constructor(message = `Route manifest missing in artifact (${ROUTE_MANIFEST_REL_PATH})`) {
-		super(message);
-		this.name = "RouteManifestNotFoundError";
-	}
-};
-/** Read `.keystroke/route-manifest.json` from a packed project artifact tarball. */
-function extractRouteManifestFromArtifact(archive) {
-	const tempDir = mkdtempSync(join(tmpdir(), "keystroke-artifact-"));
-	const archivePath = join(tempDir, "artifact.tgz");
-	try {
-		writeFileSync(archivePath, archive);
-		if (spawnSync("tar", [
-			"-xzf",
-			archivePath,
-			"-C",
-			tempDir,
-			"dist/.keystroke/route-manifest.json"
-		], { encoding: "utf8" }).status !== 0) throw new RouteManifestNotFoundError();
-		const raw = readFileSync(join(tempDir, ROUTE_MANIFEST_REL_PATH), "utf8");
-		return JSON.parse(raw);
-	} catch (error) {
-		if (error instanceof RouteManifestNotFoundError) throw error;
-		throw new RouteManifestNotFoundError(error instanceof Error ? error.message : "Failed to extract route manifest");
-	} finally {
-		rmSync(tempDir, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-/** Object key for a built project artifact tarball. */
-function projectArtifactKey(projectId, version) {
-	return `projects/${projectId}/artifacts/${version}.tgz`;
-}
-const SHA256_HEX = /^[a-f0-9]{64}$/;
-/** True when `hash` is a lowercase hex sha256 digest (64 chars). */
-function isSourceBlobHash(hash) {
-	return SHA256_HEX.test(hash);
-}
-/**
-* Content-addressed key for a single source file's contents, deduped across all
-* of a project's deploys. `hash` is a lowercase hex sha256 of the file bytes.
-*/
-function projectSourceBlobKey(projectId, hash) {
-	if (!isSourceBlobHash(hash)) throw new Error("Invalid source blob hash");
-	return `projects/${projectId}/sources/blobs/${hash}`;
-}
-const AVATAR_EXTENSION = /^[a-z0-9]+$/;
-/** Object key for a user's custom profile avatar in the shared keystroke-users bucket. */
-function userAvatarStorageKey(userId, extension) {
-	const ext = extension.replace(/^\./, "").toLowerCase();
-	if (!AVATAR_EXTENSION.test(ext)) throw new Error("Invalid avatar extension");
-	return `avatars/${userId}/avatar.${ext}`;
-}
-/** True when `key` is the canonical avatar object for `userId`. */
-function isUserAvatarStorageKey(key, userId) {
-	const prefix = `avatars/${userId}/avatar.`;
-	if (!key.startsWith(prefix)) return false;
-	const ext = key.slice(prefix.length);
-	return AVATAR_EXTENSION.test(ext);
-}
-/** Object key for an org logo in the shared keystroke-assets bucket. */
-function orgLogoStorageKey(organizationId, variant, extension) {
-	const ext = extension.replace(/^\./, "").toLowerCase();
-	if (!AVATAR_EXTENSION.test(ext)) throw new Error("Invalid org logo extension");
-	return `org-logos/${organizationId}/logo-${variant}.${ext}`;
-}
-/** True when `key` is the canonical logo object for `organizationId` and `variant`. */
-function isOrgLogoStorageKey(key, organizationId, variant) {
-	const prefix = `org-logos/${organizationId}/logo-${variant}.`;
-	if (!key.startsWith(prefix)) return false;
-	const ext = key.slice(prefix.length);
-	return AVATAR_EXTENSION.test(ext);
-}
-function isBucketAlreadyExistsError(error) {
-	if (!error || typeof error !== "object") return false;
-	const name = "name" in error ? String(error.name) : "";
-	const code = "Code" in error ? String(error.Code) : "";
-	return name === "BucketAlreadyOwnedByYou" || code === "BucketAlreadyOwnedByYou" || name === "BucketAlreadyExists" || code === "BucketAlreadyExists";
-}
-/** Shared bucket for cross-org public assets (avatars, org sidebar logos). */
-const KEYSTROKE_ASSETS_BUCKET = "keystroke-assets";
-/** Env var for the browser-facing origin of public asset objects (no trailing slash). */
-const KEYSTROKE_ASSETS_PUBLIC_URL_BASE_ENV = "KEYSTROKE_ASSETS_PUBLIC_URL_BASE";
-const KEYSTROKE_ASSETS_AVATAR_PREFIX = "avatars/";
-const KEYSTROKE_ASSETS_ORG_LOGO_PREFIX = "org-logos/";
-function readEnv(env, key) {
-	return env[key]?.trim() || void 0;
-}
-/** Default path-style base when `KEYSTROKE_ASSETS_PUBLIC_URL_BASE` is unset (local MinIO). */
-function defaultKeystrokeAssetsPublicUrlBase(env = process.env) {
-	return `${storageAdminConfigFromEnv(env).endpoint.replace(/\/+$/, "")}/${KEYSTROKE_ASSETS_BUCKET}`;
-}
-/** Public URL prefix for asset objects — configured base or local path-style default. */
-function keystrokeAssetsPublicUrlBase(env = process.env) {
-	const configured = readEnv(env, KEYSTROKE_ASSETS_PUBLIC_URL_BASE_ENV);
-	if (configured) return configured.replace(/\/+$/, "");
-	return defaultKeystrokeAssetsPublicUrlBase(env);
-}
-function keystrokeAssetsPublicUrlPrefixes(env = process.env) {
-	const prefixes = [keystrokeAssetsPublicUrlBase(env)];
-	if (readEnv(env, "KEYSTROKE_ASSETS_PUBLIC_URL_BASE")) prefixes.push(defaultKeystrokeAssetsPublicUrlBase(env));
-	return [...new Set(prefixes)];
-}
-function createAssetsStorageClient(env = process.env) {
-	return createStorage({
-		...storageAdminConfigFromEnv(env),
-		bucket: KEYSTROKE_ASSETS_BUCKET
-	});
-}
-/** Stable public URL for an object in the keystroke-assets bucket. */
-function publicKeystrokeAssetsObjectUrl(key, env = process.env) {
-	return `${keystrokeAssetsPublicUrlBase(env)}/${key}`;
-}
-/** Extract the object key from a public keystroke-assets URL when it matches `requiredPrefix`. */
-function keystrokeAssetsKeyFromPublicUrl(url, requiredPrefix, env = process.env) {
-	for (const prefix of keystrokeAssetsPublicUrlPrefixes(env)) {
-		const normalizedPrefix = `${prefix.replace(/\/+$/, "")}/`;
-		if (!url.startsWith(normalizedPrefix)) continue;
-		const key = decodeURIComponent(url.slice(normalizedPrefix.length).split("?")[0] ?? "");
-		if (key.startsWith(requiredPrefix)) return key;
-	}
-	return null;
-}
-function isKeystrokeAssetsAvatarPublicUrl(url, env = process.env) {
-	return keystrokeAssetsKeyFromPublicUrl(url, KEYSTROKE_ASSETS_AVATAR_PREFIX, env) !== null;
-}
-function keystrokeAssetsAvatarKeyFromPublicUrl(url, env = process.env) {
-	return keystrokeAssetsKeyFromPublicUrl(url, KEYSTROKE_ASSETS_AVATAR_PREFIX, env);
-}
-function isKeystrokeAssetsOrgLogoPublicUrl(url, env = process.env) {
-	return keystrokeAssetsKeyFromPublicUrl(url, KEYSTROKE_ASSETS_ORG_LOGO_PREFIX, env) !== null;
-}
-function keystrokeAssetsOrgLogoKeyFromPublicUrl(url, env = process.env) {
-	return keystrokeAssetsKeyFromPublicUrl(url, KEYSTROKE_ASSETS_ORG_LOGO_PREFIX, env);
-}
-async function ensureKeystrokeAssetsBucket(env = process.env) {
-	const adminConfig = storageAdminConfigFromEnv(env);
-	const adminClient = new S3Client({
-		region: adminConfig.region,
-		credentials: {
-			accessKeyId: adminConfig.accessKeyId,
-			secretAccessKey: adminConfig.secretAccessKey
-		},
-		endpoint: adminConfig.endpoint,
-		forcePathStyle: adminConfig.forcePathStyle
-	});
-	await createAssetsBucketIfNeeded(adminClient, KEYSTROKE_ASSETS_BUCKET);
-	await applyPublicAssetsBucketAcl(adminClient, KEYSTROKE_ASSETS_BUCKET);
-	await applyPublicAssetsBucketPolicy(adminClient, KEYSTROKE_ASSETS_BUCKET);
-}
-async function createAssetsBucketIfNeeded(adminClient, bucket) {
-	try {
-		await adminClient.send(new CreateBucketCommand({
-			Bucket: bucket,
-			ACL: "public-read"
-		}));
-		return;
-	} catch (error) {
-		if (isBucketAlreadyExistsError(error)) return;
-	}
-	try {
-		await adminClient.send(new CreateBucketCommand({ Bucket: bucket }));
-	} catch (error) {
-		if (!isBucketAlreadyExistsError(error)) throw error;
-	}
-}
-async function applyPublicAssetsBucketAcl(adminClient, bucket) {
-	try {
-		await adminClient.send(new PutBucketAclCommand({
-			Bucket: bucket,
-			ACL: "public-read"
-		}));
-	} catch (error) {
-		if (!isUnsupportedStorageFeatureError(error)) console.warn("[storage] PutBucketAcl failed (continuing):", error);
-	}
-}
-async function applyPublicAssetsBucketPolicy(adminClient, bucket) {
-	try {
-		await adminClient.send(new PutBucketPolicyCommand({
-			Bucket: bucket,
-			Policy: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Effect: "Allow",
-					Principal: "*",
-					Action: ["s3:GetObject"],
-					Resource: [`arn:aws:s3:::${bucket}/${KEYSTROKE_ASSETS_AVATAR_PREFIX}*`, `arn:aws:s3:::${bucket}/${KEYSTROKE_ASSETS_ORG_LOGO_PREFIX}*`]
-				}]
-			})
-		}));
-	} catch (error) {
-		if (!isUnsupportedStorageFeatureError(error)) console.warn("[storage] PutBucketPolicy failed (continuing):", error);
-	}
-}
-function isUnsupportedStorageFeatureError(error) {
-	if (!error || typeof error !== "object") return false;
-	const name = "name" in error ? String(error.name) : "";
-	const code = "Code" in error ? String(error.Code) : "";
-	return name === "NotImplemented" || code === "NotImplemented" || code === "NotSupported";
-}
-const DEFAULT_BUCKET_NAME_PREFIX = "ks";
-function orgStorageBucketName(input, prefix = DEFAULT_BUCKET_NAME_PREFIX) {
-	return `${prefix.trim().replace(/-+$/g, "")}-${input.organizationId.toLowerCase()}`;
-}
-function minioStoragePlugin(options = {}) {
-	const adminConfig = storageAdminConfigFromEnv(options.env ?? process.env);
-	const adminClient = new S3Client({
-		region: adminConfig.region,
-		credentials: {
-			accessKeyId: adminConfig.accessKeyId,
-			secretAccessKey: adminConfig.secretAccessKey
-		},
-		endpoint: adminConfig.endpoint,
-		forcePathStyle: adminConfig.forcePathStyle
-	});
-	return {
-		async provisionOrganization(input) {
-			const bucket = orgStorageBucketName(input, options.bucketNamePrefix);
-			try {
-				await adminClient.send(new CreateBucketCommand({ Bucket: bucket }));
-			} catch (error) {
-				if (!isBucketAlreadyExistsError(error)) throw error;
-			}
-			return {
-				bucket,
-				endpoint: adminConfig.endpoint,
-				accessKeyId: adminConfig.accessKeyId,
-				secretAccessKey: adminConfig.secretAccessKey,
-				region: adminConfig.region,
-				forcePathStyle: adminConfig.forcePathStyle
-			};
-		},
-		async deprovisionOrganization(result) {
-			const client = new S3Client({
-				region: result.region ?? adminConfig.region,
-				credentials: {
-					accessKeyId: result.accessKeyId,
-					secretAccessKey: result.secretAccessKey
-				},
-				endpoint: result.endpoint,
-				forcePathStyle: result.forcePathStyle ?? true
-			});
-			if (((await client.send(new ListObjectsV2Command({
-				Bucket: result.bucket,
-				MaxKeys: 1
-			}))).KeyCount ?? 0) > 0) throw new Error(`Refusing to delete non-empty storage bucket ${result.bucket}`);
-			await client.send(new DeleteBucketCommand({ Bucket: result.bucket }));
-		}
-	};
-}
-//#endregion
-export { ListOrganizationsResponseSchema as $, credentialInputSchema as $t, CreateCredentialsResponseSchema as A, SlugAvailabilityQuerySchema as At, HistoryRunCancelResponseSchema as B, UpdateProjectMemberResponseSchema as Bt, AgentSummaryListResponseSchema as C, ProjectSourceResourcesSchema as Ct, CreateApiKeyRequestSchema as D, SkillSummaryDetailResponseSchema as Dt, CompleteProjectArtifactResponseSchema as E, RecentResourceSchema as Et, CreateProjectResponseSchema as F, UpdateCredentialRequestSchema as Ft, InviteOrganizationMembersResponseSchema as G, UserAvatarPatchSchema as Gt, HistoryRunListQuerySchema as H, UpdateProjectSettingsRequestSchema as Ht, DeclineOrganizationInvitationResponseSchema as I, UpdateOrganizationMemberRequestSchema as It, ListApiKeysResponseSchema as J, UserPreferencesSchema as Jt, InviteProjectMembersRequestSchema as K, UserAvatarSchema as Kt, DownloadActiveProjectArtifactResponseSchema as L, UpdateOrganizationMemberResponseSchema as Lt, CreateOrganizationResponseSchema as M, StoredProjectSourceManifestSchema as Mt, CreateProjectArtifactResponseSchema as N, SubmitTeamRequestRequestSchema as Nt, CreateApiKeyResponseSchema as O, SkillSummaryListResponseSchema as Ot, CreateProjectRequestSchema as P, SubmitTeamRequestResponseSchema as Pt, ListOrganizationMembersResponseSchema as Q, buildCredentialInstanceLabel as Qt, ErrorResponseSchema as R, UpdateOrganizationRequestSchema as Rt, AgentSummaryDetailResponseSchema as S, ProjectSlugSchema as St, ClaimableOrganizationSlugSchema as T, RecentResourceListResponseSchema as Tt, HistoryRunListResponseSchema as U, UploadProjectSourceManifestRequestSchema as Ut, HistoryRunDetailResponseSchema as V, UpdateProjectRequestSchema as Vt, InviteOrganizationMembersRequestSchema as W, UploadProjectSourceResponseSchema as Wt, ListCredentialsResponseSchema as X, WorkflowSummaryListResponseSchema as Xt, ListAppsResponseSchema as Y, WorkflowSummaryDetailResponseSchema as Yt, ListOrganizationInvitationsResponseSchema as Z, WorkflowSummarySchema as Zt, publicKeystrokeAssetsObjectUrl as _, resolveUniqueCredentialInstanceLabel as _n, ProjectReachabilityResponseSchema as _t, ensureKeystrokeAssetsBucket as a, mapProjectArtifact as an, ORGANIZATION_SLUG_TAKEN_MESSAGE as at, AcceptOrganizationInvitationResponseSchema as b, validationErrorResponse as bn, ProjectSlugAvailabilityQuerySchema as bt, isKeystrokeAssetsOrgLogoPublicUrl as c, mapProjectSettings as cn, OrganizationSlugSchema as ct, keystrokeAssetsAvatarKeyFromPublicUrl as d, normalizeOrganizationSidebarBranding as dn, PresignOrgLogoRequestSchema as dt, displayCredentialAppName as en, ListProjectDeploymentsResponseSchema as et, keystrokeAssetsOrgLogoKeyFromPublicUrl as f, normalizeUserPreferences as fn, PresignOrgLogoResponseSchema as ft, projectSourceBlobKey as g, projectFileId as gn, PresignUserAvatarResponseSchema as gt, projectArtifactKey as h, parseStoredRouteManifest as hn, PresignUserAvatarRequestSchema as ht, createStorage as i, mapProject as in, ListProjectsResponseSchema as it, CreateOrganizationRequestSchema as j, SlugAvailabilityResponseSchema as jt, CreateCredentialsRequestSchema as k, SkillSummarySchema as kt, isOrgLogoStorageKey as l, mapUserOrganization as ln, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as lt, orgLogoStorageKey as m, organizationSlugErrorCodeFromMessage as mn, PresignProjectSourceResponseSchema as mt, containerPresignEndpointFromEnv as n, mapOrganizationInvitation as nn, ListProjectMembersResponseSchema as nt, extractRouteManifestFromArtifact as o, mapProjectDeployment as on, OrganizationSidebarBrandingPatchSchema as ot, minioStoragePlugin as p, organizationInvitationAcceptPath as pn, PresignProjectSourceRequestSchema as pt, InviteProjectMembersResponseSchema as q, UserPreferencesPatchSchema as qt, createAssetsStorageClient as r, mapOrganizationMember as rn, ListProjectMetricsResponseSchema as rt, isKeystrokeAssetsAvatarPublicUrl as s, mapProjectMember as sn, OrganizationSidebarBrandingSchema as st, RouteManifestNotFoundError as t, listenPortFromPublicUrl as tn, ListProjectFilesResponseSchema as tt, isUserAvatarStorageKey as u, mergeUserPreferences as un, PROJECT_SLUG_TAKEN_MESSAGE as ut, userAvatarStorageKey as v, slugifyOrganizationName as vn, ProjectResponseSchema as vt, AgentSummarySchema as w, RESERVED_ORGANIZATION_SLUGS as wt, ActiveOrganizationResponseSchema as x, ProjectSlugAvailabilityResponseSchema as xt, ACTIVE_ORG_HEADER as y, slugifyProjectName as yn, ProjectSettingsResponseSchema as yt, GetCredentialResponseSchema as z, UpdateProjectMemberRequestSchema as zt };
-
-//# sourceMappingURL=dist-dELW1gaR.mjs.map