@keystrokehq/platform 0.1.116 → 0.1.118

package/dist/{dist-06B__3tk.mjs → dist-B2lPLfrR.mjs}

@@ -1,10 +1,10 @@
 import { createRequire } from "node:module";
-import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { DEFAULT_DATABASE_URL, claimDueTriggers, claimDueTriggersForOrg, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, decryptCredentialPayload, disableAllTriggerSchedules, disableTriggerSchedulesNotInSlugs, encryptCredentialPayload, enqueueJob, ensureOAuthCredentialInstance, failAgentSession, failWorkflowRun, getProjectScopeId, getServerTenantScopeId, inferDialect, isDatabaseInitialized, listCredentialAssignmentsByTarget, listEnabledScheduledTriggers, listExecutableAttachmentsByTriggerIds, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, selectActiveEphemeralScheduledTriggerSlugs, selectCredentialInstancesByIds, selectCredentialInstancesForScope, selectCredentialInstancesForScopes, selectTriggerBySlug, setTriggerScheduleEnabled, triggerTimezoneFromConfig, upsertCredentialInstance, upsertTriggerScheduleFields } from "@keystrokehq/database";
 import EventEmitter$1, { EventEmitter } from "node:events";
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { deleteManagedServiceCredential, deleteSecretValuesForRef, ensureOAuthApp, getManagedServiceCredential, getOrganizationScopeId, insertManagedServiceCredential, saveOAuthConnection, selectSecretValue, updateManagedServiceCredentialValue, upsertSecretValue } from "@keystrokehq/platform-database";
+import { deleteManagedServiceCredential, deleteSecretValuesForRef, ensureOAuthApp, getDecryptedOAuthAppBySlug, getManagedServiceCredential, getOrganizationScopeId, insertManagedServiceCredential, putOAuthPendingState, saveOAuthConnection, selectSecretValue, takeOAuthPendingState, updateManagedServiceCredentialValue, upsertSecretValue } from "@keystrokehq/platform-database";
 import * as z$1 from "zod/v4";
 import "zod/v3";
 import * as z4mini from "zod/v4-mini";
@@ -10026,12 +10026,13 @@ const AppAuthKindSchema = z.enum([
 	"api_key",
 	"keystroke"
 ]);
-/** Composio auth scheme for API-key style connections. */
+/** Composio auth scheme for API-key / no-auth style connections. */
 const AppCredentialSchemeSchema = z.enum([
 	"API_KEY",
 	"BEARER_TOKEN",
 	"BASIC",
-	"BASIC_WITH_JWT"
+	"BASIC_WITH_JWT",
+	"NO_AUTH"
 ]);
 /**
 * Where app metadata and execution are sourced (e.g. native, composio, pipedream, custom).
@@ -10153,7 +10154,9 @@ const AppCatalogSummarySchema = z.object({
 	/** Endpoint URL for MCP, OpenAPI, or GraphQL custom apps. */
 	url: z.string().url().nullable().optional(),
 	/** True when the app has a non-empty credential field template. */
-	hasCredentialFields: z.boolean().optional()
+	hasCredentialFields: z.boolean().optional(),
+	/** Composio auth scheme — present for API-key and NO_AUTH apps so the picker can choose a flow. */
+	credentialScheme: AppCredentialSchemeSchema.optional()
 });
 /**
 * Full connectable integration detail (scopes + credential template). An "app"
@@ -10163,7 +10166,7 @@ const AppCatalogEntrySchema = AppCatalogSummarySchema.extend({
 	oauthScopes: z.array(OAuthScopeOptionSchema),
 	/** Custom api_key apps — vault field template for connect UI and sync. */
 	credentialFields: AppCredentialFieldsSchema.optional(),
-	/** Composio auth scheme when credentialFields are present. */
+	/** Composio auth scheme for API-key or NO_AUTH connections. */
 	credentialScheme: AppCredentialSchemeSchema.optional(),
 	/** When present, the app supports agent gateway bindings (external channels). */
 	gateway: AppGatewaySchema.optional()
@@ -10240,6 +10243,7 @@ function mcpProbeToAppTemplate(probe) {
 	};
 	return {
 		authKind: "api_key",
+		credentialScheme: "NO_AUTH",
 		credentialFields: {},
 		oauthScopes: [],
 		url
@@ -10638,8 +10642,12 @@ const AppCredentialScopeSchema = z.enum([
 	"project",
 	"organization"
 ]);
-/** How the credential was connected (OAuth vs manual api-key entry). */
-const AppCredentialConnectionKindSchema = z.enum(["oauth", "manual"]);
+/** How the credential was connected (OAuth, manual api-key entry, or no-auth). */
+const AppCredentialConnectionKindSchema = z.enum([
+	"oauth",
+	"manual",
+	"none"
+]);
 /** Connect-dialog permission preset for OAuth scope selection. */
 const OAuthPermissionModeSchema = z.enum(["default", "restricted"]);
 const optionalTimestamp$1 = z.string().optional();
@@ -10736,6 +10744,11 @@ const CreateCredentialsRequestSchema = CredentialTargetsFieldsSchema.extend({
 		message: "OAuth credentials are created via the OAuth callback",
 		path: ["connectionKind"]
 	});
+	if (input.connectionKind === "none" && input.value) ctx.addIssue({
+		code: "custom",
+		message: "value is not allowed for no-auth connections",
+		path: ["value"]
+	});
 });
 /** Request body for `PATCH /api/credentials/:id`. */
 const UpdateCredentialRequestSchema = z.object({
@@ -13194,7 +13207,7 @@ function registerWorkflowRunGetter(fn) {
 }
 new AsyncLocalStorage();
 //#endregion
-//#region ../../packages/credentials/dist/store-C6DRzb2o.mjs
+//#region ../../packages/credentials/dist/store-B7IWQPwD.mjs
 function normalizeRow(row) {
 	const { projectId: _projectId, ...rest } = row;
 	return rest;
@@ -24850,21 +24863,29 @@ var StreamableHTTPClientTransport = class {
 };
 //#endregion
 //#region ../../packages/mcp/dist/index.mjs
-/** Union OAuth scope names from metadata sources, preserving first-seen order. */
-function mergeOAuthScopes(...lists) {
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const list of lists) {
-		if (!list?.length) continue;
-		for (const scope of list) {
-			const trimmed = scope.trim();
-			if (trimmed && !seen.has(trimmed)) {
-				seen.add(trimmed);
-				result.push(trimmed);
-			}
-		}
-	}
-	return result;
+function challengeParameter(value, name) {
+	const match = new RegExp(`(?:^|,)\\s*${name}\\s*=\\s*(?:"((?:[^"\\\\]|\\\\.)*)"|([^,\\s]+))`, "i").exec(value);
+	return (match?.[1] ?? match?.[2])?.replace(/\\(["\\])/g, "$1").trim() || void 0;
+}
+/** Parse the Bearer challenge even when another authentication scheme appears first. */
+function parseMcpBearerChallenge(response) {
+	const header = response.headers.get("www-authenticate");
+	if (!header) return {};
+	const bearer = /(?:^|,)\s*Bearer(?:\s+|$)/i.exec(header);
+	if (!bearer) return {};
+	const parameters = header.slice(bearer.index + bearer[0].length);
+	const resourceMetadata = challengeParameter(parameters, "resource_metadata");
+	const scope = challengeParameter(parameters, "scope");
+	const error = challengeParameter(parameters, "error");
+	let resourceMetadataUrl;
+	if (resourceMetadata) try {
+		resourceMetadataUrl = new URL(resourceMetadata);
+	} catch {}
+	return {
+		...resourceMetadataUrl ? { resourceMetadataUrl } : {},
+		...scope ? { scope } : {},
+		...error ? { error } : {}
+	};
 }
 /** Thrown when a URL is not safe for server-side outbound fetch (SSRF guard). */
 var PublicHttpUrlError = class extends Error {
@@ -24977,6 +24998,7 @@ function createPublicHttpFetch(fetchFn = fetch) {
 		});
 	};
 }
+const MCP_AUTHORIZATION_PROTOCOL_VERSION = "2025-11-25";
 function resourceNameFromMetadata(metadata) {
 	return metadata?.resource_name?.trim() || void 0;
 }
@@ -24996,6 +25018,74 @@ async function probeUnauthenticatedStatus(url, fetchFn) {
 		return {};
 	}
 }
+function assertHttps(value, label) {
+	if (new URL(value).protocol !== "https:") throw new Error(`${label} must use HTTPS`);
+}
+function assertPublicHttpsUrl(value, label) {
+	assertPublicHttpUrl(value);
+	assertHttps(value, label);
+}
+function assertResourceIdentity(serverUrl, resource) {
+	const resourceUrl = new URL(resource);
+	if (serverUrl.hash || resourceUrl.hash || resourceUrl.toString() !== serverUrl.toString()) throw new Error("MCP protected resource does not match the requested MCP server URL");
+}
+function validateAuthorizationServerMetadata(authorizationServerUrl, metadata) {
+	if (metadata.issuer !== authorizationServerUrl) throw new Error("MCP authorization server metadata issuer does not match authorization server");
+	if (!metadata.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP authorization server metadata is missing required endpoints");
+	assertPublicHttpsUrl(metadata.authorization_endpoint, "MCP authorization endpoint");
+	assertPublicHttpsUrl(metadata.token_endpoint, "MCP token endpoint");
+	if (metadata.registration_endpoint) assertPublicHttpsUrl(metadata.registration_endpoint, "MCP registration endpoint");
+}
+async function discoverMcpOAuthServerFromProbe(url, safeFetch, initial) {
+	const serverUrl = new URL(url);
+	assertHttps(serverUrl, "MCP server URL");
+	const { status } = initial;
+	const wwwAuthenticate = status === 401 ? initial.wwwAuthenticate : void 0;
+	let resourceMetadataUrl;
+	let challengeScope;
+	if (wwwAuthenticate) {
+		const params = parseMcpBearerChallenge(new Response(null, { headers: { "www-authenticate": wwwAuthenticate } }));
+		resourceMetadataUrl = params.resourceMetadataUrl;
+		challengeScope = params.scope?.trim() || void 0;
+		if (resourceMetadataUrl) {
+			assertPublicHttpUrl(resourceMetadataUrl.toString());
+			assertHttps(resourceMetadataUrl, "MCP resource metadata URL");
+		}
+	}
+	const resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {
+		protocolVersion: MCP_AUTHORIZATION_PROTOCOL_VERSION,
+		...resourceMetadataUrl ? { resourceMetadataUrl } : {}
+	}, safeFetch);
+	if (!resourceMetadata.resource) throw new Error("MCP protected resource metadata is missing resource");
+	if (!resourceMetadata.authorization_servers?.length) throw new Error("MCP protected resource metadata is missing authorization_servers");
+	assertResourceIdentity(serverUrl, resourceMetadata.resource);
+	const authorizationServerUrl = resourceMetadata.authorization_servers[0];
+	if (!authorizationServerUrl) throw new Error("MCP protected resource metadata is missing authorization_servers");
+	assertPublicHttpsUrl(authorizationServerUrl, "MCP authorization server URL");
+	const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, {
+		fetchFn: safeFetch,
+		protocolVersion: MCP_AUTHORIZATION_PROTOCOL_VERSION
+	});
+	if (!authorizationServerMetadata) throw new Error("MCP authorization server metadata was not found");
+	validateAuthorizationServerMetadata(authorizationServerUrl, authorizationServerMetadata);
+	return {
+		authorizationServerUrl,
+		authorizationServerMetadata,
+		resourceMetadata,
+		...resourceMetadataUrl ? { resourceMetadataUrl: resourceMetadataUrl.toString() } : {},
+		...challengeScope ? { challengeScope } : {},
+		...status !== void 0 ? { unauthenticatedStatus: status } : {}
+	};
+}
+/**
+* Discover an MCP authorization server without the legacy origin fallback.
+* MCP 2025-11-25 requires protected-resource metadata for AS selection.
+*/
+async function discoverMcpOAuthServer(url, fetchFn = fetch) {
+	assertPublicHttpUrl(url);
+	const safeFetch = createPublicHttpFetch(fetchFn);
+	return discoverMcpOAuthServerFromProbe(url, safeFetch, await probeUnauthenticatedStatus(url, safeFetch));
+}
 function scopesFromMetadata(metadata) {
 	if (!metadata?.scopes_supported?.length) return [];
 	return metadata.scopes_supported;
@@ -25008,68 +25098,37 @@ function logProbeFallback(phase, error) {
 async function probeMcpAuth(url, fetchFn = fetch) {
 	assertPublicHttpUrl(url);
 	const safeFetch = createPublicHttpFetch(fetchFn);
-	const serverUrl = new URL(url);
-	const { status, wwwAuthenticate } = await probeUnauthenticatedStatus(url, safeFetch);
-	let resourceMetadataUrl;
-	if (wwwAuthenticate) {
-		resourceMetadataUrl = extractWWWAuthenticateParams(new Response(null, { headers: { "www-authenticate": wwwAuthenticate } })).resourceMetadataUrl?.toString();
-		if (resourceMetadataUrl) assertPublicHttpUrl(resourceMetadataUrl);
-	}
+	const initial = await probeUnauthenticatedStatus(url, safeFetch);
 	try {
-		const discovered = await discoverOAuthServerInfo(serverUrl, {
-			fetchFn: safeFetch,
-			...resourceMetadataUrl ? { resourceMetadataUrl: new URL(resourceMetadataUrl) } : {}
-		});
+		const discovered = await discoverMcpOAuthServerFromProbe(url, safeFetch, initial);
 		const metadata = discovered.authorizationServerMetadata;
 		if (metadata?.authorization_endpoint && metadata.token_endpoint) return {
 			url,
 			mode: "oauth",
-			unauthenticatedStatus: status,
+			unauthenticatedStatus: initial.status,
 			oauth: {
 				issuer: metadata.issuer,
 				authorizationEndpoint: metadata.authorization_endpoint,
 				tokenEndpoint: metadata.token_endpoint,
 				registrationEndpoint: metadata.registration_endpoint,
-				scopes: mergeOAuthScopes(scopesFromMetadata(metadata), scopesFromMetadata(discovered.resourceMetadata)),
+				scopes: discovered.challengeScope ? discovered.challengeScope.split(/\s+/).filter(Boolean) : scopesFromMetadata(discovered.resourceMetadata),
 				resource: discovered.resourceMetadata?.resource,
 				resourceName: resourceNameFromMetadata(discovered.resourceMetadata)
 			}
 		};
 	} catch (error) {
-		logProbeFallback("discoverOAuthServerInfo", error);
-	}
-	try {
-		const protectedResource = await discoverOAuthProtectedResourceMetadata(serverUrl, {}, safeFetch);
-		const authorizationServerUrl = protectedResource.authorization_servers?.[0] ?? serverUrl.origin;
-		assertPublicHttpUrl(authorizationServerUrl);
-		const metadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: safeFetch });
-		if (metadata?.authorization_endpoint && metadata.token_endpoint) return {
-			url,
-			mode: "oauth",
-			unauthenticatedStatus: status,
-			oauth: {
-				issuer: metadata.issuer,
-				authorizationEndpoint: metadata.authorization_endpoint,
-				tokenEndpoint: metadata.token_endpoint,
-				registrationEndpoint: metadata.registration_endpoint,
-				scopes: mergeOAuthScopes(scopesFromMetadata(metadata), scopesFromMetadata(protectedResource)),
-				resource: protectedResource.resource,
-				resourceName: resourceNameFromMetadata(protectedResource)
-			}
-		};
-	} catch (error) {
-		logProbeFallback("discoverOAuthProtectedResourceMetadata", error);
+		logProbeFallback("discoverMcpOAuthServer", error);
 	}
-	if (status === 401 || status === 403) return {
+	if (initial.status === 401 || initial.status === 403) return {
 		url,
 		mode: "token",
-		unauthenticatedStatus: status,
+		unauthenticatedStatus: initial.status,
 		scheme: "BEARER_TOKEN"
 	};
 	return {
 		url,
 		mode: "none",
-		unauthenticatedStatus: status
+		unauthenticatedStatus: initial.status
 	};
 }
 /** Best-effort server metadata for no-auth MCP servers (initialize handshake). */
@@ -31886,11 +31945,70 @@ async function describeCredentialBindings(requirements, context) {
 		preload
 	}, preload));
 }
-function encodeOAuthState(payload) {
-	return encryptCredentialPayload(JSON.stringify(payload));
-}
-function decodeOAuthState(state) {
-	return JSON.parse(decryptCredentialPayload(state));
+const DEFAULT_STATE_TTL_MS = 600 * 1e3;
+function defaultSigningKey() {
+	const secret = process.env.CREDENTIALS_ENCRYPTION_KEY?.trim();
+	if (!secret) throw new Error("CREDENTIALS_ENCRYPTION_KEY is required");
+	return secret;
+}
+function signPayload(payload, signingKey) {
+	return createHmac("sha256", signingKey()).update(payload).digest("base64url");
+}
+function createOAuthState(options = {}) {
+	const signingKey = options.signingKey ?? defaultSigningKey;
+	const payload = options.payload ?? {};
+	const payloadSegment = (options.serializePayload ?? (() => ""))(payload);
+	const id = randomBytes(16).toString("hex");
+	const expiresAt = Date.now() + (options.ttlMs ?? DEFAULT_STATE_TTL_MS);
+	const signedPayload = payloadSegment ? `${id}.${expiresAt}.${payloadSegment}` : `${id}.${expiresAt}`;
+	return {
+		state: `${signedPayload}.${signPayload(signedPayload, signingKey)}`,
+		payload,
+		id,
+		expiresAt
+	};
+}
+function verifyOAuthState(options, state) {
+	if (!state) return null;
+	const hasPayload = Boolean(options.deserializePayload);
+	const parts = state.split(".");
+	if (parts.length !== (hasPayload ? 4 : 3)) return null;
+	const [id, expiresRaw] = parts;
+	const signature = parts.at(-1);
+	if (!id || !expiresRaw || !signature) return null;
+	const payloadSegment = hasPayload ? parts[2] ?? "" : "";
+	const expected = signPayload(hasPayload ? `${id}.${expiresRaw}.${payloadSegment}` : `${id}.${expiresRaw}`, options.signingKey ?? defaultSigningKey);
+	const signatureBuffer = Buffer.from(signature);
+	const expectedBuffer = Buffer.from(expected);
+	if (signatureBuffer.length !== expectedBuffer.length || !timingSafeEqual(signatureBuffer, expectedBuffer)) return null;
+	const expiresAt = Number(expiresRaw);
+	if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) return null;
+	if (!hasPayload) return {};
+	return options.deserializePayload(payloadSegment);
+}
+async function encodeOAuthState(payload, ttlMs) {
+	const { state, id, expiresAt } = createOAuthState({
+		payload,
+		ttlMs
+	});
+	await putOAuthPendingState({
+		id,
+		payloadCiphertext: encryptCredentialPayload(JSON.stringify(payload)),
+		expiresAt: new Date(expiresAt)
+	});
+	return state;
+}
+async function decodeOAuthState(state) {
+	const verified = verifyOAuthState({}, state);
+	const id = state.split(".")[0];
+	if (!verified || !id) throw new Error("OAuth state is invalid or expired");
+	const ciphertext = await takeOAuthPendingState(id);
+	if (!ciphertext) throw new Error("OAuth state is invalid or expired");
+	try {
+		return JSON.parse(decryptCredentialPayload(ciphertext));
+	} catch {
+		throw new Error("OAuth state is invalid or expired");
+	}
 }
 function oauthAppMetadata(oauth, mcpUrl, options) {
 	return {
@@ -31901,7 +32019,9 @@ function oauthAppMetadata(oauth, mcpUrl, options) {
 		resource: oauth.resource,
 		issuer: oauth.issuer,
 		scopes: oauth.scopes,
-		...options?.tokenEndpointAuthMethod ? { tokenEndpointAuthMethod: options.tokenEndpointAuthMethod } : {}
+		...options?.tokenEndpointAuthMethod ? { tokenEndpointAuthMethod: options.tokenEndpointAuthMethod } : {},
+		...options?.clientRegistrationMode ? { clientRegistrationMode: options.clientRegistrationMode } : {},
+		...options?.redirectUri ? { redirectUri: options.redirectUri } : {}
 	};
 }
 function oauthClientSecretForStorage(clientSecret) {
@@ -31931,6 +32051,63 @@ async function discoverMcpApp(url) {
 		}
 	};
 }
+var McpOAuthConnectError = class extends Error {
+	phase;
+	diagnostics;
+	constructor(phase, message, diagnostics = {}) {
+		super(message);
+		this.phase = phase;
+		this.diagnostics = diagnostics;
+		this.name = "McpOAuthConnectError";
+	}
+};
+function oauthErrorCode(error) {
+	if (!error || typeof error !== "object" || !("errorCode" in error)) return;
+	const value = Reflect.get(error, "errorCode");
+	return typeof value === "string" && /^[a-z0-9_]+$/i.test(value) ? value : void 0;
+}
+const SUPPORTED_TOKEN_AUTH_METHODS = [
+	"client_secret_basic",
+	"client_secret_post",
+	"none"
+];
+function requireHttpsUrl(value, label) {
+	const url = new URL(value);
+	if (url.protocol !== "https:") throw new Error(`${label} must use HTTPS`);
+	return url;
+}
+function validateRedirectUri(value) {
+	const url = new URL(value);
+	const isLocalhost = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocalhost)) throw new Error("OAuth redirect URI must use HTTPS or HTTP localhost");
+}
+function validateMcpResource(mcpUrl, resourceUrl) {
+	const serverUrl = new URL(mcpUrl);
+	if (serverUrl.hash || resourceUrl.hash || resourceUrl.toString() !== serverUrl.toString()) throw new Error("MCP protected resource does not identify the requested MCP server");
+}
+function selectTokenEndpointAuthMethod(metadata) {
+	const advertised = metadata.token_endpoint_auth_methods_supported;
+	const supported = advertised?.length ? advertised : ["client_secret_basic"];
+	const selected = SUPPORTED_TOKEN_AUTH_METHODS.find((method) => supported.includes(method));
+	if (!selected) throw new Error(`MCP authorization server only supports unsupported token endpoint authentication methods: ${supported.join(", ")}`);
+	return selected;
+}
+function validateAuthorizationCapabilities(metadata) {
+	if (!metadata.response_types_supported?.includes("code")) throw new Error("MCP authorization server does not support the code response type");
+	if (metadata.grant_types_supported?.length && !metadata.grant_types_supported.includes("authorization_code")) throw new Error("MCP authorization server does not support authorization_code");
+	if (!metadata.code_challenge_methods_supported?.includes("S256")) throw new Error("MCP authorization server does not advertise PKCE S256 support");
+}
+function validateRegisteredClientInformation(clientInformation, requestedMethod, advertisedMethods) {
+	const assignedMethod = clientInformation.token_endpoint_auth_method ?? requestedMethod;
+	if (!SUPPORTED_TOKEN_AUTH_METHODS.includes(assignedMethod)) throw new Error(`MCP authorization server assigned unsupported token endpoint authentication method: ${assignedMethod}`);
+	if (!advertisedMethods.includes(assignedMethod)) throw new Error(`MCP authorization server assigned an unadvertised token endpoint authentication method: ${assignedMethod}`);
+	if (assignedMethod !== "none" && !clientInformation.client_secret?.trim()) throw new Error(`MCP authorization server assigned ${assignedMethod} without a client_secret`);
+	return {
+		...clientInformation,
+		token_endpoint_auth_method: assignedMethod,
+		registrationMode: "dcr"
+	};
+}
 /**
 * Prefer CIMD (URL client_id) when the AS advertises support and we have an
 * HTTPS metadata URL; otherwise DCR. Localhost HTTP cannot be a CIMD client_id
@@ -31941,58 +32118,141 @@ async function discoverMcpApp(url) {
 */
 async function resolveMcpOAuthClientInformation(options) {
 	const supportsCimd = options.metadata.client_id_metadata_document_supported === true;
-	if (supportsCimd && Boolean(options.clientMetadataUrl) && isHttpsUrl(options.clientMetadataUrl) && options.clientMetadataUrl) return {
+	const supportsPublicClient = options.metadata.token_endpoint_auth_methods_supported?.includes("none") === true;
+	if (supportsCimd && supportsPublicClient && Boolean(options.clientMetadataUrl) && isHttpsUrl(options.clientMetadataUrl) && options.clientMetadataUrl) return {
 		client_id: options.clientMetadataUrl,
-		token_endpoint_auth_method: "none"
-	};
-	if (options.metadata.registration_endpoint) return registerClient(options.authorizationServerUrl, {
-		metadata: options.metadata,
-		clientMetadata: {
-			client_name: "Keystroke",
-			redirect_uris: [options.redirectUri],
-			grant_types: ["authorization_code", "refresh_token"],
-			response_types: ["code"],
-			token_endpoint_auth_method: "client_secret_post"
-		},
-		scope: options.scope
-	});
-	if (supportsCimd) throw new Error("Authorization server requires Client ID Metadata Documents, but Keystroke has no HTTPS client metadata URL configured (set PUBLIC_PLATFORM_URL or PUBLIC_PLATFORM_PROXY_URL to an HTTPS origin)");
+		token_endpoint_auth_method: "none",
+		registrationMode: "cimd"
+	};
+	if (options.metadata.registration_endpoint) {
+		const grantTypes = ["authorization_code", ...options.metadata.grant_types_supported?.includes("refresh_token") ? ["refresh_token"] : []];
+		const tokenEndpointAuthMethod = selectTokenEndpointAuthMethod(options.metadata);
+		const currentlySupportedAuthMethods = options.metadata.token_endpoint_auth_methods_supported?.length ? options.metadata.token_endpoint_auth_methods_supported : ["client_secret_basic"];
+		const existing = await getDecryptedOAuthAppBySlug(options.appSlug);
+		if (existing?.provider === "mcp" && existing.metadata?.clientRegistrationMode === "dcr" && existing.metadata.issuer === options.metadata.issuer && existing.metadata.registrationEndpoint === options.metadata.registration_endpoint && existing.metadata.resource === options.resource && existing.metadata.redirectUri === options.redirectUri && existing.metadata.tokenEndpointAuthMethod && SUPPORTED_TOKEN_AUTH_METHODS.includes(existing.metadata.tokenEndpointAuthMethod) && currentlySupportedAuthMethods.includes(existing.metadata.tokenEndpointAuthMethod)) return {
+			client_id: existing.clientId,
+			...existing.clientSecret ? { client_secret: existing.clientSecret } : {},
+			token_endpoint_auth_method: existing.metadata.tokenEndpointAuthMethod,
+			registrationMode: "dcr"
+		};
+		let providerHttpStatus;
+		try {
+			const safeFetch = createPublicHttpFetch();
+			return validateRegisteredClientInformation(await registerClient(options.authorizationServerUrl, {
+				metadata: options.metadata,
+				clientMetadata: {
+					client_name: "Keystroke",
+					redirect_uris: [options.redirectUri],
+					grant_types: grantTypes,
+					response_types: ["code"],
+					token_endpoint_auth_method: tokenEndpointAuthMethod
+				},
+				scope: options.scope,
+				fetchFn: async (input, init) => {
+					const response = await safeFetch(input, init);
+					providerHttpStatus = response.status;
+					return response;
+				}
+			}), tokenEndpointAuthMethod, currentlySupportedAuthMethods);
+		} catch (error) {
+			throw new McpOAuthConnectError("client_registration", providerHttpStatus === 403 ? "MCP server rejected dynamic client registration; it may require a pre-approved OAuth client" : "MCP OAuth client registration failed", {
+				correlationId: options.correlationId,
+				authorizationServerUrl: options.authorizationServerUrl,
+				registrationEndpoint: options.metadata.registration_endpoint,
+				grantTypes,
+				tokenEndpointAuthMethod,
+				...providerHttpStatus ? { providerHttpStatus } : {},
+				...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
+			});
+		}
+	}
+	if (supportsCimd) throw new Error("Authorization server supports Client ID Metadata Documents, but not Keystroke's public-client authentication or HTTPS metadata URL");
 	throw new Error("MCP authorization server does not support Client ID Metadata Documents or Dynamic Client Registration");
 }
 async function beginMcpOAuthConnect(options) {
 	const appUrl = options.app.url?.trim();
 	if (!appUrl || options.app.source !== "mcp" || options.app.authKind !== "oauth") throw new Error("App is not a direct MCP OAuth app");
-	const discovered = await discoverOAuthServerInfo(new URL(appUrl), {});
+	const correlationId = crypto.randomUUID();
+	let discovered;
+	try {
+		validateRedirectUri(options.redirectUri);
+		requireHttpsUrl(appUrl, "MCP server URL");
+		discovered = await discoverMcpOAuthServer(appUrl);
+	} catch {
+		throw new McpOAuthConnectError("resource_discovery", "Failed to discover MCP OAuth protected-resource metadata", { correlationId });
+	}
 	const metadata = discovered.authorizationServerMetadata;
-	if (!metadata?.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP server does not expose OAuth authorization metadata");
+	try {
+		if (!metadata?.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP server does not expose OAuth authorization metadata");
+		validateAuthorizationCapabilities(metadata);
+		requireHttpsUrl(discovered.authorizationServerUrl, "OAuth authorization server URL");
+		requireHttpsUrl(metadata.authorization_endpoint, "OAuth authorization endpoint");
+		requireHttpsUrl(metadata.token_endpoint, "OAuth token endpoint");
+		if (metadata.registration_endpoint) requireHttpsUrl(metadata.registration_endpoint, "OAuth registration endpoint");
+	} catch {
+		throw new McpOAuthConnectError("authorization_server_discovery", "MCP authorization server metadata is incompatible", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl
+		});
+	}
+	let resourceUrl;
+	try {
+		resourceUrl = requireHttpsUrl(discovered.resourceMetadata.resource, "MCP protected resource");
+		if (resourceUrl.hash) throw new Error("MCP protected resource must not include a fragment");
+		validateMcpResource(appUrl, resourceUrl);
+	} catch {
+		throw new McpOAuthConnectError("resource_discovery", "MCP protected-resource metadata contains an invalid resource", { correlationId });
+	}
 	const oauth = {
 		issuer: metadata.issuer,
 		authorizationEndpoint: metadata.authorization_endpoint,
 		tokenEndpoint: metadata.token_endpoint,
 		registrationEndpoint: metadata.registration_endpoint,
-		scopes: mergeOAuthScopes(metadata.scopes_supported, discovered.resourceMetadata?.scopes_supported, options.app.oauthScopes.map((scope) => scope.name)),
-		resource: discovered.resourceMetadata?.resource,
+		scopes: discovered.challengeScope ? discovered.challengeScope.split(/\s+/).filter(Boolean) : discovered.resourceMetadata.scopes_supported ?? [],
+		resource: resourceUrl.toString(),
 		resourceName: discovered.resourceMetadata?.resource_name?.trim() || void 0
 	};
-	const defaultScopeNames = options.app.oauthScopes.flatMap((entry) => entry.defaultSelected !== false ? [entry.name] : []);
-	const scope = options.input.scopes?.join(" ") || (defaultScopeNames.length > 0 ? defaultScopeNames.join(" ") : oauth.scopes.join(" "));
-	const clientInformation = await resolveMcpOAuthClientInformation({
-		authorizationServerUrl: discovered.authorizationServerUrl,
-		metadata,
-		redirectUri: options.redirectUri,
-		scope: scope || void 0,
-		clientMetadataUrl: options.clientMetadataUrl
-	});
-	await ensureOAuthApp({
-		slug: options.app.slug,
-		provider: "mcp",
-		tokenStrategy: "refresh",
-		clientId: clientInformation.client_id,
-		clientSecret: oauthClientSecretForStorage(clientInformation.client_secret),
-		metadata: oauthAppMetadata(oauth, appUrl, { tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method })
-	});
-	const resourceUrl = oauth.resource ? new URL(oauth.resource) : new URL(appUrl);
+	const requestedScopes = options.input.scopes?.map((value) => value.trim()).filter(Boolean) ?? [];
+	const challengedScopes = discovered.challengeScope?.split(/\s+/).filter(Boolean) ?? [];
+	const selectedScopes = challengedScopes.length > 0 ? [...new Set([...challengedScopes, ...requestedScopes])] : requestedScopes.length > 0 ? requestedScopes : discovered.resourceMetadata.scopes_supported ?? [];
+	const scope = selectedScopes.length > 0 ? selectedScopes.join(" ") : void 0;
+	let clientInformation;
+	try {
+		clientInformation = await resolveMcpOAuthClientInformation({
+			appSlug: options.app.slug,
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl,
+			metadata,
+			resource: resourceUrl.toString(),
+			redirectUri: options.redirectUri,
+			scope,
+			clientMetadataUrl: options.clientMetadataUrl
+		});
+	} catch (error) {
+		if (error instanceof McpOAuthConnectError) throw error;
+		throw new McpOAuthConnectError("client_registration", "MCP authorization server does not support a compatible client registration", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl
+		});
+	}
+	try {
+		await ensureOAuthApp({
+			slug: options.app.slug,
+			provider: "mcp",
+			tokenStrategy: "refresh",
+			clientId: clientInformation.client_id,
+			clientSecret: oauthClientSecretForStorage(clientInformation.client_secret),
+			metadata: oauthAppMetadata(oauth, appUrl, {
+				tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method,
+				clientRegistrationMode: clientInformation.registrationMode,
+				redirectUri: options.redirectUri
+			})
+		});
+	} catch {
+		throw new McpOAuthConnectError("credential_persistence", "Failed to save MCP OAuth client registration", { correlationId });
+	}
 	const statePayload = {
+		correlationId,
 		codeVerifier: "",
 		appSlug: options.app.slug,
 		organizationId: options.organizationId,
@@ -32004,76 +32264,107 @@ async function beginMcpOAuthConnect(options) {
 		authorizationServerUrl: discovered.authorizationServerUrl,
 		resource: oauth.resource,
 		oauthMetadata: oauth,
+		authorizationServerMetadata: metadata,
 		mcpUrl: appUrl,
 		redirectUri: options.redirectUri,
 		clientId: clientInformation.client_id,
 		clientSecret: clientInformation.client_secret,
 		tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method,
+		clientRegistrationMode: clientInformation.registrationMode,
 		label: options.input.label,
 		credentialInstanceId: options.input.credentialInstanceId
 	};
-	const { authorizationUrl, codeVerifier } = await startAuthorization(discovered.authorizationServerUrl, {
-		metadata,
-		clientInformation,
-		redirectUrl: options.redirectUri,
-		scope: scope || void 0,
-		resource: resourceUrl
-	});
+	let authorizationUrl;
+	let codeVerifier;
+	try {
+		({authorizationUrl, codeVerifier} = await startAuthorization(discovered.authorizationServerUrl, {
+			metadata,
+			clientInformation,
+			redirectUrl: options.redirectUri,
+			scope,
+			resource: resourceUrl
+		}));
+	} catch (error) {
+		throw new McpOAuthConnectError("authorization_start", "Failed to start MCP authorization", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl,
+			...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
+		});
+	}
 	statePayload.codeVerifier = codeVerifier;
-	const state = encodeOAuthState(statePayload);
+	const state = await encodeOAuthState(statePayload);
 	authorizationUrl.searchParams.set("state", state);
 	return { authorizeUrl: authorizationUrl.toString() };
 }
 async function completeMcpOAuthConnect(options) {
-	const payload = decodeOAuthState(options.state);
-	const metadata = {
-		issuer: payload.oauthMetadata.issuer ?? payload.authorizationServerUrl,
-		authorization_endpoint: payload.oauthMetadata.authorizationEndpoint,
-		token_endpoint: payload.oauthMetadata.tokenEndpoint,
-		registration_endpoint: payload.oauthMetadata.registrationEndpoint,
-		scopes_supported: payload.oauthMetadata.scopes,
-		response_types_supported: ["code"],
-		code_challenge_methods_supported: ["S256"]
-	};
+	const { payload } = options;
 	const resourceUrl = payload.resource ? new URL(payload.resource) : void 0;
-	const tokens = await exchangeAuthorization(payload.authorizationServerUrl, {
-		metadata,
-		clientInformation: {
-			client_id: payload.clientId,
-			...payload.clientSecret ? { client_secret: payload.clientSecret } : {},
-			...payload.tokenEndpointAuthMethod ? { token_endpoint_auth_method: payload.tokenEndpointAuthMethod } : {}
-		},
-		authorizationCode: options.code,
-		codeVerifier: payload.codeVerifier,
-		redirectUri: payload.redirectUri,
-		resource: resourceUrl
-	});
-	const { id: oauthAppId } = await ensureOAuthApp({
-		slug: payload.appSlug,
-		provider: "mcp",
-		tokenStrategy: "refresh",
-		clientId: payload.clientId,
-		clientSecret: oauthClientSecretForStorage(payload.clientSecret),
-		metadata: oauthAppMetadata(payload.oauthMetadata, payload.mcpUrl, { tokenEndpointAuthMethod: payload.tokenEndpointAuthMethod })
-	});
-	const connectionId = await saveOAuthConnection({
-		appId: oauthAppId,
-		externalId: payload.userId,
-		accessToken: tokens.access_token,
-		refreshToken: tokens.refresh_token,
-		accessTokenExpiresAt: accessTokenExpiresAt(tokens.expires_in),
-		grantedScopes: grantedScopesFromToken(tokens.scope, payload.oauthMetadata.scopes),
-		metadata: { mcpUrl: payload.oauthMetadata.resource }
-	});
-	await ensureOAuthCredentialInstance({
-		credentialKey: payload.appSlug,
-		connectionId,
-		accountLabel: payload.label,
-		externalId: payload.userId,
-		userLabel: payload.label,
-		targets: payload.scopeTargets,
-		credentialInstanceId: payload.credentialInstanceId
-	});
+	if (!resourceUrl) throw new McpOAuthConnectError("authorization_callback", "OAuth callback state is missing the MCP resource", { correlationId: payload.correlationId });
+	let tokens;
+	let providerHttpStatus;
+	try {
+		const safeFetch = createPublicHttpFetch();
+		tokens = await exchangeAuthorization(payload.authorizationServerUrl, {
+			metadata: payload.authorizationServerMetadata,
+			clientInformation: {
+				client_id: payload.clientId,
+				...payload.clientSecret ? { client_secret: payload.clientSecret } : {},
+				...payload.tokenEndpointAuthMethod ? { token_endpoint_auth_method: payload.tokenEndpointAuthMethod } : {}
+			},
+			authorizationCode: options.code,
+			codeVerifier: payload.codeVerifier,
+			redirectUri: payload.redirectUri,
+			resource: resourceUrl,
+			fetchFn: async (input, init) => {
+				const response = await safeFetch(input, init);
+				providerHttpStatus = response.status;
+				return response;
+			}
+		});
+	} catch (error) {
+		throw new McpOAuthConnectError("token_exchange", "MCP OAuth token exchange failed", {
+			correlationId: payload.correlationId,
+			authorizationServerUrl: payload.authorizationServerUrl,
+			...providerHttpStatus ? { providerHttpStatus } : {},
+			...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
+		});
+	}
+	let oauthAppId;
+	let connectionId;
+	try {
+		({id: oauthAppId} = await ensureOAuthApp({
+			slug: payload.appSlug,
+			provider: "mcp",
+			tokenStrategy: "refresh",
+			clientId: payload.clientId,
+			clientSecret: oauthClientSecretForStorage(payload.clientSecret),
+			metadata: oauthAppMetadata(payload.oauthMetadata, payload.mcpUrl, {
+				tokenEndpointAuthMethod: payload.tokenEndpointAuthMethod,
+				clientRegistrationMode: payload.clientRegistrationMode,
+				redirectUri: payload.redirectUri
+			})
+		}));
+		connectionId = await saveOAuthConnection({
+			appId: oauthAppId,
+			externalId: payload.userId,
+			accessToken: tokens.access_token,
+			refreshToken: tokens.refresh_token,
+			accessTokenExpiresAt: accessTokenExpiresAt(tokens.expires_in),
+			grantedScopes: grantedScopesFromToken(tokens.scope, payload.oauthMetadata.scopes),
+			metadata: { mcpUrl: payload.oauthMetadata.resource }
+		});
+		await ensureOAuthCredentialInstance({
+			credentialKey: payload.appSlug,
+			connectionId,
+			accountLabel: payload.label,
+			externalId: payload.userId,
+			userLabel: payload.label,
+			targets: payload.scopeTargets,
+			credentialInstanceId: payload.credentialInstanceId
+		});
+	} catch {
+		throw new McpOAuthConnectError("credential_persistence", "Failed to save the MCP OAuth credential", { correlationId: payload.correlationId });
+	}
 	return {
 		appSlug: payload.appSlug,
 		connectionId,
@@ -37704,6 +37995,6 @@ function minioStoragePlugin(options = {}) {
 	};
 }
 //#endregion
-export { CompleteProjectArtifactResponseSchema as $, TriggerAttachmentUpdateRequestSchema as $n, mapUserOrganization as $r, ListProjectFilesResponseSchema as $t, describeCredentialBindings as A, ProjectSourceResourcesSchema as An, WorkspaceTriggerFileSchema as Ar, GraphqlDiscoverRequestSchema as At, setCredentialInstanceSecret as B, SkillSummaryListResponseSchema as Bn, displayCredentialAppName as Br, ListAgentMemoryFilesResponseSchema as Bt, userAvatarStorageKey as C, PresignUserAvatarRequestSchema as Cn, WorkflowFormUpsertBodySchema as Cr, FilePartSchema as Ct, beginMcpOAuthConnect as D, ProjectSettingsResponseSchema as Dn, WorkflowSummaryListResponseSchema as Dr, GetCredentialResponseSchema as Dt, cronPayloadSchema as E, ProjectResponseSchema as En, WorkflowSummaryDetailResponseSchema as Er, GetAppCatalogEntryResponseSchema as Et, withCredentialAssignments as F, PublishedFormListResponseSchema as Fn, agentMemoryFileId as Fr, HistoryRunListResponseSchema as Ft, AgentMemoryFileSummarySchema as G, StartMcpOAuthConnectionResultSchema as Gn, listenPortFromPublicUrl as Gr, ListCredentialsPageQuerySchema as Gt, ACTIVE_ORG_HEADER as H, SlugAvailabilityQuerySchema as Hn, isHelloWorldTemplateSlug as Hr, ListApiKeysResponseSchema as Ht, PublicHttpUrlError as I, PublishedFormSchema as In, agentWorkspaceFileId as Ir, InviteOrganizationMembersRequestSchema as It, AgentSummarySchema as J, SubmitMarketingContactResponseSchema as Jn, mapProject as Jr, ListOrganizationInvitationsResponseSchema as Jt, AgentSummaryDetailResponseSchema as K, StoredProjectSourceManifestSchema as Kn, mapOrganizationInvitation as Kr, ListCredentialsPageResponseSchema as Kt, deleteCredentialInstanceSecret as L, RecentResourceListResponseSchema as Ln, buildCredentialInstanceLabel as Lr, InviteOrganizationMembersResponseSchema as Lt, discoverMcpApp as M, PublicFormSubmitBodySchema as Mn, WorkspaceTriggerOverviewSchema as Mr, HistoryRunCancelResponseSchema as Mt, discoverOpenApiApp as N, PublicFormSubmitResponseSchema as Nn, WorkspaceTriggerRunListResponseSchema as Nr, HistoryRunDetailResponseSchema as Nt, completeMcpOAuthConnect as O, ProjectSlugAvailabilityQuerySchema as On, WorkflowSummarySchema as Or, GetCustomAppResponseSchema as Ot, isDiscoveryError as P, PublicModelsResponseSchema as Pn, WorkspaceWorkflowOverviewSchema as Pr, HistoryRunListQuerySchema as Pt, ChannelPlatformSchema as Q, TemplateKindSchema as Qn, mapProjectSettings as Qr, ListProjectDeploymentsResponseSchema as Qt, deleteManagedServiceCredential$1 as R, RecentResourceSchema as Rn, chatAttachmentExtension as Rr, InviteProjectMembersRequestSchema as Rt, publicKeystrokeAssetsObjectUrl as S, PresignProjectSourceResponseSchema as Sn, WorkflowFormResponseSchema as Sr, ErrorResponseSchema as St, defaultSchedulerPlugin as T, ProjectReachabilityResponseSchema as Tn, WorkflowRunInputsSchema as Tr, FinalizeCustomAppLogoResponseSchema as Tt, AcceptOrganizationInvitationResponseSchema as U, SlugAvailabilityResponseSchema as Un, isLlmProviderSlug as Ur, ListAppsResponseSchema as Ut, setManagedServiceCredential as V, SkillSummarySchema as Vn, isAllowedChatAttachmentMediaType as Vr, ListAgentWorkspaceFilesResponseSchema as Vt, ActiveOrganizationResponseSchema as W, StartMcpOAuthConnectionInputSchema as Wn, jsonSchemaToWorkflowInputSchema as Wr, ListChannelPlatformsResponseSchema as Wt, AppSlugAvailabilityQuerySchema as X, SubmitTeamRequestResponseSchema as Xn, mapProjectDeployment as Xr, ListOrganizationMembersPageResponseSchema as Xt, AgentWorkspaceFileSummarySchema as Y, SubmitTeamRequestRequestSchema as Yn, mapProjectArtifact as Yr, ListOrganizationMembersPageQuerySchema as Yt, AppSlugAvailabilityResponseSchema as Z, TemplateFilesResponseSchema as Zn, mapProjectMember as Zr, ListOrganizationsResponseSchema as Zt, loadProjectSourceFiles as _, __commonJSMin as _i, PresignCustomAppLogoRequestSchema as _n, UserPreferencesPatchSchema as _r, DeclineOrganizationInvitationResponseSchema as _t, ensureKeystrokeAssetsBucket as a, parseAppSlug as ai, ManagedServiceCredentialSchema as an, UpdateManagedServiceCredentialRequestSchema as ar, CreateCustomAppRequestSchema as at, projectArtifactKey as b, PresignOrgLogoResponseSchema as bn, WorkflowCanvasRunSchema as br, DuplicateCredentialRequestSchema as bt, isChatAttachmentStorageKey as c, resolveExternalPlatformOrigin as ci, McpDiscoverResponseSchema as cn, UpdateOrganizationRequestSchema as cr, CreateOrganizationResponseSchema as ct, isOrgLogoStorageKey as d, schemaHasFileFields as di, OrganizationSidebarBrandingPatchSchema as dn, UpdateProjectRequestSchema as dr, CreateProjectResponseSchema as dt, mcpEntityId as ei, ListProjectMembersResponseSchema as en, TriggerInvokeInputsSchema as er, ConnectManagedServiceCredentialRequestSchema as et, isStorageBucketNotFoundError as f, schemaHasUnsupportedFormFields as fi, OrganizationSidebarBrandingSchema as fn, UpdateProjectSettingsRequestSchema as fr, DEFAULT_CLOUD_PLATFORM_ORIGIN as ft, keystrokeAssetsOrgLogoKeyFromPublicUrl as g, validationErrorResponse as gi, PresignChatAttachmentResponseSchema as gn, UserAvatarSchema as gr, DbProxyQueryRequestSchema as gt, keystrokeAssetsAvatarKeyFromPublicUrl as h, validateWorkflowRunInputValues as hi, PresignChatAttachmentRequestSchema as hn, UserAvatarPatchSchema as hr, DEFAULT_WORKFLOW_OVERVIEW_MODEL as ht, createAssetsStorageClient as i, organizationSlugErrorCodeFromMessage as ii, MICRO_CREDITS_PER_CREDIT as in, UpdateCredentialRequestSchema as ir, CreateCredentialsResponseSchema as it, discoverGraphqlApp as j, PublicFormMetadataSchema as jn, WorkspaceTriggerListResponseSchema as jr, GraphqlDiscoverResponseSchema as jt, decodeOAuthState as k, ProjectSlugAvailabilityResponseSchema as kn, WorkspaceTriggerDetailSchema as kr, GetTemplateResponseSchema as kt, isKeystrokeAssetsAvatarPublicUrl as l, resolvePublicFormFields as li, OpenApiDiscoverRequestSchema as ln, UpdateProjectMemberRequestSchema as lr, CreateProjectArtifactResponseSchema as lt, isUserAvatarStorageKey as m, validateFormFieldConfig as mi, PROJECT_SLUG_TAKEN_MESSAGE as mn, UploadProjectSourceResponseSchema as mr, DEFAULT_WORKFLOW_CANVAS_MODEL as mt, appLogoStorageKey as n, normalizeUserPreferences as ni, ListProjectsResponseSchema as nn, TriggerInvokeResponseSchema as nr, CreateApiKeyResponseSchema as nt, extractRouteManifestFromArtifact as o, parseStoredRouteManifest as oi, ManagedServiceKindSchema as on, UpdateOrganizationMemberRequestSchema as or, CreateCustomAppResponseSchema as ot, isStorageNotFoundError as p, validateCredentialValueAgainstFields as pi, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as pn, UploadProjectSourceManifestRequestSchema as pr, DEFAULT_TRIGGER_OVERVIEW_MODEL as pt, AgentSummaryListResponseSchema as q, SubmitMarketingContactRequestSchema as qn, mapOrganizationMember as qr, ListManagedServiceCredentialsResponseSchema as qt, chatAttachmentStorageKey as r, organizationInvitationAcceptPath as ri, ListTemplatesResponseSchema as rn, TriggerRunListQuerySchema as rr, CreateCredentialsRequestSchema as rt, isAppLogoStorageKey as s, projectFileId as si, McpDiscoverRequestSchema as sn, UpdateOrganizationMemberResponseSchema as sr, CreateOrganizationRequestSchema as st, RouteManifestNotFoundError as t, mergeUserPreferences as ti, ListProjectMetricsResponseSchema as tn, TriggerInvokeRequestSchema as tr, CreateApiKeyRequestSchema as tt, isKeystrokeAssetsOrgLogoPublicUrl as u, resolveUniqueCredentialInstanceLabel as ui, OpenApiDiscoverResponseSchema as un, UpdateProjectMemberResponseSchema as ur, CreateProjectRequestSchema as ut, minioStoragePlugin as v, __require as vi, PresignCustomAppLogoResponseSchema as vn, UserPreferencesSchema as vr, DownloadActiveProjectArtifactResponseSchema as vt, createJobQueue as w, PresignUserAvatarResponseSchema as wn, WorkflowRunInputsPutBodySchema as wr, FinalizeCustomAppLogoRequestSchema as wt, projectSourceBlobKey as x, PresignProjectSourceRequestSchema as xn, WorkflowCanvasSchema as xr, DuplicateCredentialsResponseSchema as xt, orgLogoStorageKey as y, __toESM as yi, PresignOrgLogoRequestSchema as yn, WorkflowCanvasCredentialBindingsSchema as yr, DownloadActiveProjectSourceResponseSchema as yt, readCredentialInstanceSecret as z, SkillSummaryDetailResponseSchema as zn, deriveCredentialInstanceSlug as zr, InviteProjectMembersResponseSchema as zt };
+export { ChannelPlatformSchema as $, TemplateKindSchema as $n, mapProjectSettings as $r, ListProjectDeploymentsResponseSchema as $t, decodeOAuthState as A, ProjectSlugAvailabilityResponseSchema as An, WorkspaceTriggerDetailSchema as Ar, GetTemplateResponseSchema as At, readCredentialInstanceSecret as B, SkillSummaryDetailResponseSchema as Bn, deriveCredentialInstanceSlug as Br, InviteProjectMembersResponseSchema as Bt, userAvatarStorageKey as C, PresignProjectSourceResponseSchema as Cn, WorkflowFormResponseSchema as Cr, ErrorResponseSchema as Ct, McpOAuthConnectError as D, ProjectResponseSchema as Dn, WorkflowSummaryDetailResponseSchema as Dr, GetAppCatalogEntryResponseSchema as Dt, cronPayloadSchema as E, ProjectReachabilityResponseSchema as En, WorkflowRunInputsSchema as Er, FinalizeCustomAppLogoResponseSchema as Et, isDiscoveryError as F, PublicModelsResponseSchema as Fn, WorkspaceWorkflowOverviewSchema as Fr, HistoryRunListQuerySchema as Ft, ActiveOrganizationResponseSchema as G, StartMcpOAuthConnectionInputSchema as Gn, jsonSchemaToWorkflowInputSchema as Gr, ListChannelPlatformsResponseSchema as Gt, setManagedServiceCredential as H, SkillSummarySchema as Hn, isAllowedChatAttachmentMediaType as Hr, ListAgentWorkspaceFilesResponseSchema as Ht, withCredentialAssignments as I, PublishedFormListResponseSchema as In, agentMemoryFileId as Ir, HistoryRunListResponseSchema as It, AgentSummaryListResponseSchema as J, SubmitMarketingContactRequestSchema as Jn, mapOrganizationMember as Jr, ListManagedServiceCredentialsResponseSchema as Jt, AgentMemoryFileSummarySchema as K, StartMcpOAuthConnectionResultSchema as Kn, listenPortFromPublicUrl as Kr, ListCredentialsPageQuerySchema as Kt, PublicHttpUrlError as L, PublishedFormSchema as Ln, agentWorkspaceFileId as Lr, InviteOrganizationMembersRequestSchema as Lt, discoverGraphqlApp as M, PublicFormMetadataSchema as Mn, WorkspaceTriggerListResponseSchema as Mr, GraphqlDiscoverResponseSchema as Mt, discoverMcpApp as N, PublicFormSubmitBodySchema as Nn, WorkspaceTriggerOverviewSchema as Nr, HistoryRunCancelResponseSchema as Nt, beginMcpOAuthConnect as O, ProjectSettingsResponseSchema as On, WorkflowSummaryListResponseSchema as Or, GetCredentialResponseSchema as Ot, discoverOpenApiApp as P, PublicFormSubmitResponseSchema as Pn, WorkspaceTriggerRunListResponseSchema as Pr, HistoryRunDetailResponseSchema as Pt, AppSlugAvailabilityResponseSchema as Q, TemplateFilesResponseSchema as Qn, mapProjectMember as Qr, ListOrganizationsResponseSchema as Qt, deleteCredentialInstanceSecret as R, RecentResourceListResponseSchema as Rn, buildCredentialInstanceLabel as Rr, InviteOrganizationMembersResponseSchema as Rt, publicKeystrokeAssetsObjectUrl as S, PresignProjectSourceRequestSchema as Sn, WorkflowCanvasSchema as Sr, DuplicateCredentialsResponseSchema as St, defaultSchedulerPlugin as T, PresignUserAvatarResponseSchema as Tn, WorkflowRunInputsPutBodySchema as Tr, FinalizeCustomAppLogoRequestSchema as Tt, ACTIVE_ORG_HEADER as U, SlugAvailabilityQuerySchema as Un, isHelloWorldTemplateSlug as Ur, ListApiKeysResponseSchema as Ut, setCredentialInstanceSecret as V, SkillSummaryListResponseSchema as Vn, displayCredentialAppName as Vr, ListAgentMemoryFilesResponseSchema as Vt, AcceptOrganizationInvitationResponseSchema as W, SlugAvailabilityResponseSchema as Wn, isLlmProviderSlug as Wr, ListAppsResponseSchema as Wt, AgentWorkspaceFileSummarySchema as X, SubmitTeamRequestRequestSchema as Xn, mapProjectArtifact as Xr, ListOrganizationMembersPageQuerySchema as Xt, AgentSummarySchema as Y, SubmitMarketingContactResponseSchema as Yn, mapProject as Yr, ListOrganizationInvitationsResponseSchema as Yt, AppSlugAvailabilityQuerySchema as Z, SubmitTeamRequestResponseSchema as Zn, mapProjectDeployment as Zr, ListOrganizationMembersPageResponseSchema as Zt, loadProjectSourceFiles as _, validationErrorResponse as _i, PresignChatAttachmentResponseSchema as _n, UserAvatarSchema as _r, DbProxyQueryRequestSchema as _t, ensureKeystrokeAssetsBucket as a, organizationSlugErrorCodeFromMessage as ai, MICRO_CREDITS_PER_CREDIT as an, UpdateCredentialRequestSchema as ar, CreateCredentialsResponseSchema as at, projectArtifactKey as b, __toESM as bi, PresignOrgLogoRequestSchema as bn, WorkflowCanvasCredentialBindingsSchema as br, DownloadActiveProjectSourceResponseSchema as bt, isChatAttachmentStorageKey as c, projectFileId as ci, McpDiscoverRequestSchema as cn, UpdateOrganizationMemberResponseSchema as cr, CreateOrganizationRequestSchema as ct, isOrgLogoStorageKey as d, resolveUniqueCredentialInstanceLabel as di, OpenApiDiscoverResponseSchema as dn, UpdateProjectMemberResponseSchema as dr, CreateProjectRequestSchema as dt, mapUserOrganization as ei, ListProjectFilesResponseSchema as en, TriggerAttachmentUpdateRequestSchema as er, CompleteProjectArtifactResponseSchema as et, isStorageBucketNotFoundError as f, schemaHasFileFields as fi, OrganizationSidebarBrandingPatchSchema as fn, UpdateProjectRequestSchema as fr, CreateProjectResponseSchema as ft, keystrokeAssetsOrgLogoKeyFromPublicUrl as g, validateWorkflowRunInputValues as gi, PresignChatAttachmentRequestSchema as gn, UserAvatarPatchSchema as gr, DEFAULT_WORKFLOW_OVERVIEW_MODEL as gt, keystrokeAssetsAvatarKeyFromPublicUrl as h, validateFormFieldConfig as hi, PROJECT_SLUG_TAKEN_MESSAGE as hn, UploadProjectSourceResponseSchema as hr, DEFAULT_WORKFLOW_CANVAS_MODEL as ht, createAssetsStorageClient as i, organizationInvitationAcceptPath as ii, ListTemplatesResponseSchema as in, TriggerRunListQuerySchema as ir, CreateCredentialsRequestSchema as it, describeCredentialBindings as j, ProjectSourceResourcesSchema as jn, WorkspaceTriggerFileSchema as jr, GraphqlDiscoverRequestSchema as jt, completeMcpOAuthConnect as k, ProjectSlugAvailabilityQuerySchema as kn, WorkflowSummarySchema as kr, GetCustomAppResponseSchema as kt, isKeystrokeAssetsAvatarPublicUrl as l, resolveExternalPlatformOrigin as li, McpDiscoverResponseSchema as ln, UpdateOrganizationRequestSchema as lr, CreateOrganizationResponseSchema as lt, isUserAvatarStorageKey as m, validateCredentialValueAgainstFields as mi, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as mn, UploadProjectSourceManifestRequestSchema as mr, DEFAULT_TRIGGER_OVERVIEW_MODEL as mt, appLogoStorageKey as n, mergeUserPreferences as ni, ListProjectMetricsResponseSchema as nn, TriggerInvokeRequestSchema as nr, CreateApiKeyRequestSchema as nt, extractRouteManifestFromArtifact as o, parseAppSlug as oi, ManagedServiceCredentialSchema as on, UpdateManagedServiceCredentialRequestSchema as or, CreateCustomAppRequestSchema as ot, isStorageNotFoundError as p, schemaHasUnsupportedFormFields as pi, OrganizationSidebarBrandingSchema as pn, UpdateProjectSettingsRequestSchema as pr, DEFAULT_CLOUD_PLATFORM_ORIGIN as pt, AgentSummaryDetailResponseSchema as q, StoredProjectSourceManifestSchema as qn, mapOrganizationInvitation as qr, ListCredentialsPageResponseSchema as qt, chatAttachmentStorageKey as r, normalizeUserPreferences as ri, ListProjectsResponseSchema as rn, TriggerInvokeResponseSchema as rr, CreateApiKeyResponseSchema as rt, isAppLogoStorageKey as s, parseStoredRouteManifest as si, ManagedServiceKindSchema as sn, UpdateOrganizationMemberRequestSchema as sr, CreateCustomAppResponseSchema as st, RouteManifestNotFoundError as t, mcpEntityId as ti, ListProjectMembersResponseSchema as tn, TriggerInvokeInputsSchema as tr, ConnectManagedServiceCredentialRequestSchema as tt, isKeystrokeAssetsOrgLogoPublicUrl as u, resolvePublicFormFields as ui, OpenApiDiscoverRequestSchema as un, UpdateProjectMemberRequestSchema as ur, CreateProjectArtifactResponseSchema as ut, minioStoragePlugin as v, __commonJSMin as vi, PresignCustomAppLogoRequestSchema as vn, UserPreferencesPatchSchema as vr, DeclineOrganizationInvitationResponseSchema as vt, createJobQueue as w, PresignUserAvatarRequestSchema as wn, WorkflowFormUpsertBodySchema as wr, FilePartSchema as wt, projectSourceBlobKey as x, PresignOrgLogoResponseSchema as xn, WorkflowCanvasRunSchema as xr, DuplicateCredentialRequestSchema as xt, orgLogoStorageKey as y, __require as yi, PresignCustomAppLogoResponseSchema as yn, UserPreferencesSchema as yr, DownloadActiveProjectArtifactResponseSchema as yt, deleteManagedServiceCredential$1 as z, RecentResourceSchema as zn, chatAttachmentExtension as zr, InviteProjectMembersRequestSchema as zt };
 
-//# sourceMappingURL=dist-06B__3tk.mjs.map
+//# sourceMappingURL=dist-B2lPLfrR.mjs.map