@keystrokehq/platform 0.1.117 → 0.1.119

package/dist/{dist-Cj3RPKwD.mjs → dist-B2lPLfrR.mjs}

@@ -1,10 +1,10 @@
 import { createRequire } from "node:module";
-import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { DEFAULT_DATABASE_URL, claimDueTriggers, claimDueTriggersForOrg, claimNextJob, clearCredentialInstanceDefaults, createPostgresCancelChannel, decryptCredentialPayload, disableAllTriggerSchedules, disableTriggerSchedulesNotInSlugs, encryptCredentialPayload, enqueueJob, ensureOAuthCredentialInstance, failAgentSession, failWorkflowRun, getProjectScopeId, getServerTenantScopeId, inferDialect, isDatabaseInitialized, listCredentialAssignmentsByTarget, listEnabledScheduledTriggers, listExecutableAttachmentsByTriggerIds, markJobComplete, markJobFailed, requeueExpiredLeases, resolvePostgresUrlFromEnv, resolveProjectDatabaseUrlFromEnv, scheduleJobRetry, selectActiveEphemeralScheduledTriggerSlugs, selectCredentialInstancesByIds, selectCredentialInstancesForScope, selectCredentialInstancesForScopes, selectTriggerBySlug, setTriggerScheduleEnabled, triggerTimezoneFromConfig, upsertCredentialInstance, upsertTriggerScheduleFields } from "@keystrokehq/database";
 import EventEmitter$1, { EventEmitter } from "node:events";
 import { z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { deleteManagedServiceCredential, deleteSecretValuesForRef, ensureOAuthApp, getManagedServiceCredential, getOrganizationScopeId, insertManagedServiceCredential, saveOAuthConnection, selectSecretValue, updateManagedServiceCredentialValue, upsertSecretValue } from "@keystrokehq/platform-database";
+import { deleteManagedServiceCredential, deleteSecretValuesForRef, ensureOAuthApp, getDecryptedOAuthAppBySlug, getManagedServiceCredential, getOrganizationScopeId, insertManagedServiceCredential, putOAuthPendingState, saveOAuthConnection, selectSecretValue, takeOAuthPendingState, updateManagedServiceCredentialValue, upsertSecretValue } from "@keystrokehq/platform-database";
 import * as z$1 from "zod/v4";
 import "zod/v3";
 import * as z4mini from "zod/v4-mini";
@@ -10243,6 +10243,7 @@ function mcpProbeToAppTemplate(probe) {
 	};
 	return {
 		authKind: "api_key",
+		credentialScheme: "NO_AUTH",
 		credentialFields: {},
 		oauthScopes: [],
 		url
@@ -10743,10 +10744,10 @@ const CreateCredentialsRequestSchema = CredentialTargetsFieldsSchema.extend({
 		message: "OAuth credentials are created via the OAuth callback",
 		path: ["connectionKind"]
 	});
-	if (input.connectionKind === "none") ctx.addIssue({
+	if (input.connectionKind === "none" && input.value) ctx.addIssue({
 		code: "custom",
-		message: "No-auth credentials are created via the connect dialog",
-		path: ["connectionKind"]
+		message: "value is not allowed for no-auth connections",
+		path: ["value"]
 	});
 });
 /** Request body for `PATCH /api/credentials/:id`. */
@@ -13206,7 +13207,7 @@ function registerWorkflowRunGetter(fn) {
 }
 new AsyncLocalStorage();
 //#endregion
-//#region ../../packages/credentials/dist/store-C6DRzb2o.mjs
+//#region ../../packages/credentials/dist/store-B7IWQPwD.mjs
 function normalizeRow(row) {
 	const { projectId: _projectId, ...rest } = row;
 	return rest;
@@ -24862,21 +24863,29 @@ var StreamableHTTPClientTransport = class {
 };
 //#endregion
 //#region ../../packages/mcp/dist/index.mjs
-/** Union OAuth scope names from metadata sources, preserving first-seen order. */
-function mergeOAuthScopes(...lists) {
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const list of lists) {
-		if (!list?.length) continue;
-		for (const scope of list) {
-			const trimmed = scope.trim();
-			if (trimmed && !seen.has(trimmed)) {
-				seen.add(trimmed);
-				result.push(trimmed);
-			}
-		}
-	}
-	return result;
+function challengeParameter(value, name) {
+	const match = new RegExp(`(?:^|,)\\s*${name}\\s*=\\s*(?:"((?:[^"\\\\]|\\\\.)*)"|([^,\\s]+))`, "i").exec(value);
+	return (match?.[1] ?? match?.[2])?.replace(/\\(["\\])/g, "$1").trim() || void 0;
+}
+/** Parse the Bearer challenge even when another authentication scheme appears first. */
+function parseMcpBearerChallenge(response) {
+	const header = response.headers.get("www-authenticate");
+	if (!header) return {};
+	const bearer = /(?:^|,)\s*Bearer(?:\s+|$)/i.exec(header);
+	if (!bearer) return {};
+	const parameters = header.slice(bearer.index + bearer[0].length);
+	const resourceMetadata = challengeParameter(parameters, "resource_metadata");
+	const scope = challengeParameter(parameters, "scope");
+	const error = challengeParameter(parameters, "error");
+	let resourceMetadataUrl;
+	if (resourceMetadata) try {
+		resourceMetadataUrl = new URL(resourceMetadata);
+	} catch {}
+	return {
+		...resourceMetadataUrl ? { resourceMetadataUrl } : {},
+		...scope ? { scope } : {},
+		...error ? { error } : {}
+	};
 }
 /** Thrown when a URL is not safe for server-side outbound fetch (SSRF guard). */
 var PublicHttpUrlError = class extends Error {
@@ -24989,6 +24998,7 @@ function createPublicHttpFetch(fetchFn = fetch) {
 		});
 	};
 }
+const MCP_AUTHORIZATION_PROTOCOL_VERSION = "2025-11-25";
 function resourceNameFromMetadata(metadata) {
 	return metadata?.resource_name?.trim() || void 0;
 }
@@ -25008,6 +25018,74 @@ async function probeUnauthenticatedStatus(url, fetchFn) {
 		return {};
 	}
 }
+function assertHttps(value, label) {
+	if (new URL(value).protocol !== "https:") throw new Error(`${label} must use HTTPS`);
+}
+function assertPublicHttpsUrl(value, label) {
+	assertPublicHttpUrl(value);
+	assertHttps(value, label);
+}
+function assertResourceIdentity(serverUrl, resource) {
+	const resourceUrl = new URL(resource);
+	if (serverUrl.hash || resourceUrl.hash || resourceUrl.toString() !== serverUrl.toString()) throw new Error("MCP protected resource does not match the requested MCP server URL");
+}
+function validateAuthorizationServerMetadata(authorizationServerUrl, metadata) {
+	if (metadata.issuer !== authorizationServerUrl) throw new Error("MCP authorization server metadata issuer does not match authorization server");
+	if (!metadata.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP authorization server metadata is missing required endpoints");
+	assertPublicHttpsUrl(metadata.authorization_endpoint, "MCP authorization endpoint");
+	assertPublicHttpsUrl(metadata.token_endpoint, "MCP token endpoint");
+	if (metadata.registration_endpoint) assertPublicHttpsUrl(metadata.registration_endpoint, "MCP registration endpoint");
+}
+async function discoverMcpOAuthServerFromProbe(url, safeFetch, initial) {
+	const serverUrl = new URL(url);
+	assertHttps(serverUrl, "MCP server URL");
+	const { status } = initial;
+	const wwwAuthenticate = status === 401 ? initial.wwwAuthenticate : void 0;
+	let resourceMetadataUrl;
+	let challengeScope;
+	if (wwwAuthenticate) {
+		const params = parseMcpBearerChallenge(new Response(null, { headers: { "www-authenticate": wwwAuthenticate } }));
+		resourceMetadataUrl = params.resourceMetadataUrl;
+		challengeScope = params.scope?.trim() || void 0;
+		if (resourceMetadataUrl) {
+			assertPublicHttpUrl(resourceMetadataUrl.toString());
+			assertHttps(resourceMetadataUrl, "MCP resource metadata URL");
+		}
+	}
+	const resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, {
+		protocolVersion: MCP_AUTHORIZATION_PROTOCOL_VERSION,
+		...resourceMetadataUrl ? { resourceMetadataUrl } : {}
+	}, safeFetch);
+	if (!resourceMetadata.resource) throw new Error("MCP protected resource metadata is missing resource");
+	if (!resourceMetadata.authorization_servers?.length) throw new Error("MCP protected resource metadata is missing authorization_servers");
+	assertResourceIdentity(serverUrl, resourceMetadata.resource);
+	const authorizationServerUrl = resourceMetadata.authorization_servers[0];
+	if (!authorizationServerUrl) throw new Error("MCP protected resource metadata is missing authorization_servers");
+	assertPublicHttpsUrl(authorizationServerUrl, "MCP authorization server URL");
+	const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, {
+		fetchFn: safeFetch,
+		protocolVersion: MCP_AUTHORIZATION_PROTOCOL_VERSION
+	});
+	if (!authorizationServerMetadata) throw new Error("MCP authorization server metadata was not found");
+	validateAuthorizationServerMetadata(authorizationServerUrl, authorizationServerMetadata);
+	return {
+		authorizationServerUrl,
+		authorizationServerMetadata,
+		resourceMetadata,
+		...resourceMetadataUrl ? { resourceMetadataUrl: resourceMetadataUrl.toString() } : {},
+		...challengeScope ? { challengeScope } : {},
+		...status !== void 0 ? { unauthenticatedStatus: status } : {}
+	};
+}
+/**
+* Discover an MCP authorization server without the legacy origin fallback.
+* MCP 2025-11-25 requires protected-resource metadata for AS selection.
+*/
+async function discoverMcpOAuthServer(url, fetchFn = fetch) {
+	assertPublicHttpUrl(url);
+	const safeFetch = createPublicHttpFetch(fetchFn);
+	return discoverMcpOAuthServerFromProbe(url, safeFetch, await probeUnauthenticatedStatus(url, safeFetch));
+}
 function scopesFromMetadata(metadata) {
 	if (!metadata?.scopes_supported?.length) return [];
 	return metadata.scopes_supported;
@@ -25020,68 +25098,37 @@ function logProbeFallback(phase, error) {
 async function probeMcpAuth(url, fetchFn = fetch) {
 	assertPublicHttpUrl(url);
 	const safeFetch = createPublicHttpFetch(fetchFn);
-	const serverUrl = new URL(url);
-	const { status, wwwAuthenticate } = await probeUnauthenticatedStatus(url, safeFetch);
-	let resourceMetadataUrl;
-	if (wwwAuthenticate) {
-		resourceMetadataUrl = extractWWWAuthenticateParams(new Response(null, { headers: { "www-authenticate": wwwAuthenticate } })).resourceMetadataUrl?.toString();
-		if (resourceMetadataUrl) assertPublicHttpUrl(resourceMetadataUrl);
-	}
+	const initial = await probeUnauthenticatedStatus(url, safeFetch);
 	try {
-		const discovered = await discoverOAuthServerInfo(serverUrl, {
-			fetchFn: safeFetch,
-			...resourceMetadataUrl ? { resourceMetadataUrl: new URL(resourceMetadataUrl) } : {}
-		});
+		const discovered = await discoverMcpOAuthServerFromProbe(url, safeFetch, initial);
 		const metadata = discovered.authorizationServerMetadata;
 		if (metadata?.authorization_endpoint && metadata.token_endpoint) return {
 			url,
 			mode: "oauth",
-			unauthenticatedStatus: status,
+			unauthenticatedStatus: initial.status,
 			oauth: {
 				issuer: metadata.issuer,
 				authorizationEndpoint: metadata.authorization_endpoint,
 				tokenEndpoint: metadata.token_endpoint,
 				registrationEndpoint: metadata.registration_endpoint,
-				scopes: mergeOAuthScopes(scopesFromMetadata(metadata), scopesFromMetadata(discovered.resourceMetadata)),
+				scopes: discovered.challengeScope ? discovered.challengeScope.split(/\s+/).filter(Boolean) : scopesFromMetadata(discovered.resourceMetadata),
 				resource: discovered.resourceMetadata?.resource,
 				resourceName: resourceNameFromMetadata(discovered.resourceMetadata)
 			}
 		};
 	} catch (error) {
-		logProbeFallback("discoverOAuthServerInfo", error);
-	}
-	try {
-		const protectedResource = await discoverOAuthProtectedResourceMetadata(serverUrl, {}, safeFetch);
-		const authorizationServerUrl = protectedResource.authorization_servers?.[0] ?? serverUrl.origin;
-		assertPublicHttpUrl(authorizationServerUrl);
-		const metadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: safeFetch });
-		if (metadata?.authorization_endpoint && metadata.token_endpoint) return {
-			url,
-			mode: "oauth",
-			unauthenticatedStatus: status,
-			oauth: {
-				issuer: metadata.issuer,
-				authorizationEndpoint: metadata.authorization_endpoint,
-				tokenEndpoint: metadata.token_endpoint,
-				registrationEndpoint: metadata.registration_endpoint,
-				scopes: mergeOAuthScopes(scopesFromMetadata(metadata), scopesFromMetadata(protectedResource)),
-				resource: protectedResource.resource,
-				resourceName: resourceNameFromMetadata(protectedResource)
-			}
-		};
-	} catch (error) {
-		logProbeFallback("discoverOAuthProtectedResourceMetadata", error);
+		logProbeFallback("discoverMcpOAuthServer", error);
 	}
-	if (status === 401 || status === 403) return {
+	if (initial.status === 401 || initial.status === 403) return {
 		url,
 		mode: "token",
-		unauthenticatedStatus: status,
+		unauthenticatedStatus: initial.status,
 		scheme: "BEARER_TOKEN"
 	};
 	return {
 		url,
 		mode: "none",
-		unauthenticatedStatus: status
+		unauthenticatedStatus: initial.status
 	};
 }
 /** Best-effort server metadata for no-auth MCP servers (initialize handshake). */
@@ -31898,11 +31945,70 @@ async function describeCredentialBindings(requirements, context) {
 		preload
 	}, preload));
 }
-function encodeOAuthState(payload) {
-	return encryptCredentialPayload(JSON.stringify(payload));
-}
-function decodeOAuthState(state) {
-	return JSON.parse(decryptCredentialPayload(state));
+const DEFAULT_STATE_TTL_MS = 600 * 1e3;
+function defaultSigningKey() {
+	const secret = process.env.CREDENTIALS_ENCRYPTION_KEY?.trim();
+	if (!secret) throw new Error("CREDENTIALS_ENCRYPTION_KEY is required");
+	return secret;
+}
+function signPayload(payload, signingKey) {
+	return createHmac("sha256", signingKey()).update(payload).digest("base64url");
+}
+function createOAuthState(options = {}) {
+	const signingKey = options.signingKey ?? defaultSigningKey;
+	const payload = options.payload ?? {};
+	const payloadSegment = (options.serializePayload ?? (() => ""))(payload);
+	const id = randomBytes(16).toString("hex");
+	const expiresAt = Date.now() + (options.ttlMs ?? DEFAULT_STATE_TTL_MS);
+	const signedPayload = payloadSegment ? `${id}.${expiresAt}.${payloadSegment}` : `${id}.${expiresAt}`;
+	return {
+		state: `${signedPayload}.${signPayload(signedPayload, signingKey)}`,
+		payload,
+		id,
+		expiresAt
+	};
+}
+function verifyOAuthState(options, state) {
+	if (!state) return null;
+	const hasPayload = Boolean(options.deserializePayload);
+	const parts = state.split(".");
+	if (parts.length !== (hasPayload ? 4 : 3)) return null;
+	const [id, expiresRaw] = parts;
+	const signature = parts.at(-1);
+	if (!id || !expiresRaw || !signature) return null;
+	const payloadSegment = hasPayload ? parts[2] ?? "" : "";
+	const expected = signPayload(hasPayload ? `${id}.${expiresRaw}.${payloadSegment}` : `${id}.${expiresRaw}`, options.signingKey ?? defaultSigningKey);
+	const signatureBuffer = Buffer.from(signature);
+	const expectedBuffer = Buffer.from(expected);
+	if (signatureBuffer.length !== expectedBuffer.length || !timingSafeEqual(signatureBuffer, expectedBuffer)) return null;
+	const expiresAt = Number(expiresRaw);
+	if (!Number.isFinite(expiresAt) || expiresAt < Date.now()) return null;
+	if (!hasPayload) return {};
+	return options.deserializePayload(payloadSegment);
+}
+async function encodeOAuthState(payload, ttlMs) {
+	const { state, id, expiresAt } = createOAuthState({
+		payload,
+		ttlMs
+	});
+	await putOAuthPendingState({
+		id,
+		payloadCiphertext: encryptCredentialPayload(JSON.stringify(payload)),
+		expiresAt: new Date(expiresAt)
+	});
+	return state;
+}
+async function decodeOAuthState(state) {
+	const verified = verifyOAuthState({}, state);
+	const id = state.split(".")[0];
+	if (!verified || !id) throw new Error("OAuth state is invalid or expired");
+	const ciphertext = await takeOAuthPendingState(id);
+	if (!ciphertext) throw new Error("OAuth state is invalid or expired");
+	try {
+		return JSON.parse(decryptCredentialPayload(ciphertext));
+	} catch {
+		throw new Error("OAuth state is invalid or expired");
+	}
 }
 function oauthAppMetadata(oauth, mcpUrl, options) {
 	return {
@@ -31913,7 +32019,9 @@ function oauthAppMetadata(oauth, mcpUrl, options) {
 		resource: oauth.resource,
 		issuer: oauth.issuer,
 		scopes: oauth.scopes,
-		...options?.tokenEndpointAuthMethod ? { tokenEndpointAuthMethod: options.tokenEndpointAuthMethod } : {}
+		...options?.tokenEndpointAuthMethod ? { tokenEndpointAuthMethod: options.tokenEndpointAuthMethod } : {},
+		...options?.clientRegistrationMode ? { clientRegistrationMode: options.clientRegistrationMode } : {},
+		...options?.redirectUri ? { redirectUri: options.redirectUri } : {}
 	};
 }
 function oauthClientSecretForStorage(clientSecret) {
@@ -31944,14 +32052,62 @@ async function discoverMcpApp(url) {
 	};
 }
 var McpOAuthConnectError = class extends Error {
+	phase;
 	diagnostics;
-	phase = "dynamic_client_registration";
-	constructor(cause, diagnostics) {
-		super(cause instanceof Error ? cause.message : "Dynamic client registration failed", { cause });
+	constructor(phase, message, diagnostics = {}) {
+		super(message);
+		this.phase = phase;
 		this.diagnostics = diagnostics;
 		this.name = "McpOAuthConnectError";
 	}
 };
+function oauthErrorCode(error) {
+	if (!error || typeof error !== "object" || !("errorCode" in error)) return;
+	const value = Reflect.get(error, "errorCode");
+	return typeof value === "string" && /^[a-z0-9_]+$/i.test(value) ? value : void 0;
+}
+const SUPPORTED_TOKEN_AUTH_METHODS = [
+	"client_secret_basic",
+	"client_secret_post",
+	"none"
+];
+function requireHttpsUrl(value, label) {
+	const url = new URL(value);
+	if (url.protocol !== "https:") throw new Error(`${label} must use HTTPS`);
+	return url;
+}
+function validateRedirectUri(value) {
+	const url = new URL(value);
+	const isLocalhost = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocalhost)) throw new Error("OAuth redirect URI must use HTTPS or HTTP localhost");
+}
+function validateMcpResource(mcpUrl, resourceUrl) {
+	const serverUrl = new URL(mcpUrl);
+	if (serverUrl.hash || resourceUrl.hash || resourceUrl.toString() !== serverUrl.toString()) throw new Error("MCP protected resource does not identify the requested MCP server");
+}
+function selectTokenEndpointAuthMethod(metadata) {
+	const advertised = metadata.token_endpoint_auth_methods_supported;
+	const supported = advertised?.length ? advertised : ["client_secret_basic"];
+	const selected = SUPPORTED_TOKEN_AUTH_METHODS.find((method) => supported.includes(method));
+	if (!selected) throw new Error(`MCP authorization server only supports unsupported token endpoint authentication methods: ${supported.join(", ")}`);
+	return selected;
+}
+function validateAuthorizationCapabilities(metadata) {
+	if (!metadata.response_types_supported?.includes("code")) throw new Error("MCP authorization server does not support the code response type");
+	if (metadata.grant_types_supported?.length && !metadata.grant_types_supported.includes("authorization_code")) throw new Error("MCP authorization server does not support authorization_code");
+	if (!metadata.code_challenge_methods_supported?.includes("S256")) throw new Error("MCP authorization server does not advertise PKCE S256 support");
+}
+function validateRegisteredClientInformation(clientInformation, requestedMethod, advertisedMethods) {
+	const assignedMethod = clientInformation.token_endpoint_auth_method ?? requestedMethod;
+	if (!SUPPORTED_TOKEN_AUTH_METHODS.includes(assignedMethod)) throw new Error(`MCP authorization server assigned unsupported token endpoint authentication method: ${assignedMethod}`);
+	if (!advertisedMethods.includes(assignedMethod)) throw new Error(`MCP authorization server assigned an unadvertised token endpoint authentication method: ${assignedMethod}`);
+	if (assignedMethod !== "none" && !clientInformation.client_secret?.trim()) throw new Error(`MCP authorization server assigned ${assignedMethod} without a client_secret`);
+	return {
+		...clientInformation,
+		token_endpoint_auth_method: assignedMethod,
+		registrationMode: "dcr"
+	};
+}
 /**
 * Prefer CIMD (URL client_id) when the AS advertises support and we have an
 * HTTPS metadata URL; otherwise DCR. Localhost HTTP cannot be a CIMD client_id
@@ -31962,15 +32118,27 @@ var McpOAuthConnectError = class extends Error {
 */
 async function resolveMcpOAuthClientInformation(options) {
 	const supportsCimd = options.metadata.client_id_metadata_document_supported === true;
-	if (supportsCimd && Boolean(options.clientMetadataUrl) && isHttpsUrl(options.clientMetadataUrl) && options.clientMetadataUrl) return {
+	const supportsPublicClient = options.metadata.token_endpoint_auth_methods_supported?.includes("none") === true;
+	if (supportsCimd && supportsPublicClient && Boolean(options.clientMetadataUrl) && isHttpsUrl(options.clientMetadataUrl) && options.clientMetadataUrl) return {
 		client_id: options.clientMetadataUrl,
-		token_endpoint_auth_method: "none"
+		token_endpoint_auth_method: "none",
+		registrationMode: "cimd"
 	};
 	if (options.metadata.registration_endpoint) {
-		const grantTypes = ["authorization_code", "refresh_token"];
-		const tokenEndpointAuthMethod = "client_secret_post";
+		const grantTypes = ["authorization_code", ...options.metadata.grant_types_supported?.includes("refresh_token") ? ["refresh_token"] : []];
+		const tokenEndpointAuthMethod = selectTokenEndpointAuthMethod(options.metadata);
+		const currentlySupportedAuthMethods = options.metadata.token_endpoint_auth_methods_supported?.length ? options.metadata.token_endpoint_auth_methods_supported : ["client_secret_basic"];
+		const existing = await getDecryptedOAuthAppBySlug(options.appSlug);
+		if (existing?.provider === "mcp" && existing.metadata?.clientRegistrationMode === "dcr" && existing.metadata.issuer === options.metadata.issuer && existing.metadata.registrationEndpoint === options.metadata.registration_endpoint && existing.metadata.resource === options.resource && existing.metadata.redirectUri === options.redirectUri && existing.metadata.tokenEndpointAuthMethod && SUPPORTED_TOKEN_AUTH_METHODS.includes(existing.metadata.tokenEndpointAuthMethod) && currentlySupportedAuthMethods.includes(existing.metadata.tokenEndpointAuthMethod)) return {
+			client_id: existing.clientId,
+			...existing.clientSecret ? { client_secret: existing.clientSecret } : {},
+			token_endpoint_auth_method: existing.metadata.tokenEndpointAuthMethod,
+			registrationMode: "dcr"
+		};
+		let providerHttpStatus;
 		try {
-			return await registerClient(options.authorizationServerUrl, {
+			const safeFetch = createPublicHttpFetch();
+			return validateRegisteredClientInformation(await registerClient(options.authorizationServerUrl, {
 				metadata: options.metadata,
 				clientMetadata: {
 					client_name: "Keystroke",
@@ -31979,54 +32147,112 @@ async function resolveMcpOAuthClientInformation(options) {
 					response_types: ["code"],
 					token_endpoint_auth_method: tokenEndpointAuthMethod
 				},
-				scope: options.scope
-			});
+				scope: options.scope,
+				fetchFn: async (input, init) => {
+					const response = await safeFetch(input, init);
+					providerHttpStatus = response.status;
+					return response;
+				}
+			}), tokenEndpointAuthMethod, currentlySupportedAuthMethods);
 		} catch (error) {
-			throw new McpOAuthConnectError(error, {
+			throw new McpOAuthConnectError("client_registration", providerHttpStatus === 403 ? "MCP server rejected dynamic client registration; it may require a pre-approved OAuth client" : "MCP OAuth client registration failed", {
+				correlationId: options.correlationId,
 				authorizationServerUrl: options.authorizationServerUrl,
 				registrationEndpoint: options.metadata.registration_endpoint,
 				grantTypes,
-				tokenEndpointAuthMethod
+				tokenEndpointAuthMethod,
+				...providerHttpStatus ? { providerHttpStatus } : {},
+				...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
 			});
 		}
 	}
-	if (supportsCimd) throw new Error("Authorization server requires Client ID Metadata Documents, but Keystroke has no HTTPS client metadata URL configured (set PUBLIC_PLATFORM_URL or PUBLIC_PLATFORM_PROXY_URL to an HTTPS origin)");
+	if (supportsCimd) throw new Error("Authorization server supports Client ID Metadata Documents, but not Keystroke's public-client authentication or HTTPS metadata URL");
 	throw new Error("MCP authorization server does not support Client ID Metadata Documents or Dynamic Client Registration");
 }
 async function beginMcpOAuthConnect(options) {
 	const appUrl = options.app.url?.trim();
 	if (!appUrl || options.app.source !== "mcp" || options.app.authKind !== "oauth") throw new Error("App is not a direct MCP OAuth app");
-	const discovered = await discoverOAuthServerInfo(new URL(appUrl), {});
+	const correlationId = crypto.randomUUID();
+	let discovered;
+	try {
+		validateRedirectUri(options.redirectUri);
+		requireHttpsUrl(appUrl, "MCP server URL");
+		discovered = await discoverMcpOAuthServer(appUrl);
+	} catch {
+		throw new McpOAuthConnectError("resource_discovery", "Failed to discover MCP OAuth protected-resource metadata", { correlationId });
+	}
 	const metadata = discovered.authorizationServerMetadata;
-	if (!metadata?.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP server does not expose OAuth authorization metadata");
+	try {
+		if (!metadata?.authorization_endpoint || !metadata.token_endpoint) throw new Error("MCP server does not expose OAuth authorization metadata");
+		validateAuthorizationCapabilities(metadata);
+		requireHttpsUrl(discovered.authorizationServerUrl, "OAuth authorization server URL");
+		requireHttpsUrl(metadata.authorization_endpoint, "OAuth authorization endpoint");
+		requireHttpsUrl(metadata.token_endpoint, "OAuth token endpoint");
+		if (metadata.registration_endpoint) requireHttpsUrl(metadata.registration_endpoint, "OAuth registration endpoint");
+	} catch {
+		throw new McpOAuthConnectError("authorization_server_discovery", "MCP authorization server metadata is incompatible", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl
+		});
+	}
+	let resourceUrl;
+	try {
+		resourceUrl = requireHttpsUrl(discovered.resourceMetadata.resource, "MCP protected resource");
+		if (resourceUrl.hash) throw new Error("MCP protected resource must not include a fragment");
+		validateMcpResource(appUrl, resourceUrl);
+	} catch {
+		throw new McpOAuthConnectError("resource_discovery", "MCP protected-resource metadata contains an invalid resource", { correlationId });
+	}
 	const oauth = {
 		issuer: metadata.issuer,
 		authorizationEndpoint: metadata.authorization_endpoint,
 		tokenEndpoint: metadata.token_endpoint,
 		registrationEndpoint: metadata.registration_endpoint,
-		scopes: mergeOAuthScopes(metadata.scopes_supported, discovered.resourceMetadata?.scopes_supported, options.app.oauthScopes.map((scope) => scope.name)),
-		resource: discovered.resourceMetadata?.resource,
+		scopes: discovered.challengeScope ? discovered.challengeScope.split(/\s+/).filter(Boolean) : discovered.resourceMetadata.scopes_supported ?? [],
+		resource: resourceUrl.toString(),
 		resourceName: discovered.resourceMetadata?.resource_name?.trim() || void 0
 	};
-	const defaultScopeNames = options.app.oauthScopes.flatMap((entry) => entry.defaultSelected !== false ? [entry.name] : []);
-	const scope = options.input.scopes?.join(" ") || (defaultScopeNames.length > 0 ? defaultScopeNames.join(" ") : oauth.scopes.join(" "));
-	const clientInformation = await resolveMcpOAuthClientInformation({
-		authorizationServerUrl: discovered.authorizationServerUrl,
-		metadata,
-		redirectUri: options.redirectUri,
-		scope: scope || void 0,
-		clientMetadataUrl: options.clientMetadataUrl
-	});
-	await ensureOAuthApp({
-		slug: options.app.slug,
-		provider: "mcp",
-		tokenStrategy: "refresh",
-		clientId: clientInformation.client_id,
-		clientSecret: oauthClientSecretForStorage(clientInformation.client_secret),
-		metadata: oauthAppMetadata(oauth, appUrl, { tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method })
-	});
-	const resourceUrl = oauth.resource ? new URL(oauth.resource) : new URL(appUrl);
+	const requestedScopes = options.input.scopes?.map((value) => value.trim()).filter(Boolean) ?? [];
+	const challengedScopes = discovered.challengeScope?.split(/\s+/).filter(Boolean) ?? [];
+	const selectedScopes = challengedScopes.length > 0 ? [...new Set([...challengedScopes, ...requestedScopes])] : requestedScopes.length > 0 ? requestedScopes : discovered.resourceMetadata.scopes_supported ?? [];
+	const scope = selectedScopes.length > 0 ? selectedScopes.join(" ") : void 0;
+	let clientInformation;
+	try {
+		clientInformation = await resolveMcpOAuthClientInformation({
+			appSlug: options.app.slug,
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl,
+			metadata,
+			resource: resourceUrl.toString(),
+			redirectUri: options.redirectUri,
+			scope,
+			clientMetadataUrl: options.clientMetadataUrl
+		});
+	} catch (error) {
+		if (error instanceof McpOAuthConnectError) throw error;
+		throw new McpOAuthConnectError("client_registration", "MCP authorization server does not support a compatible client registration", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl
+		});
+	}
+	try {
+		await ensureOAuthApp({
+			slug: options.app.slug,
+			provider: "mcp",
+			tokenStrategy: "refresh",
+			clientId: clientInformation.client_id,
+			clientSecret: oauthClientSecretForStorage(clientInformation.client_secret),
+			metadata: oauthAppMetadata(oauth, appUrl, {
+				tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method,
+				clientRegistrationMode: clientInformation.registrationMode,
+				redirectUri: options.redirectUri
+			})
+		});
+	} catch {
+		throw new McpOAuthConnectError("credential_persistence", "Failed to save MCP OAuth client registration", { correlationId });
+	}
 	const statePayload = {
+		correlationId,
 		codeVerifier: "",
 		appSlug: options.app.slug,
 		organizationId: options.organizationId,
@@ -32038,76 +32264,107 @@ async function beginMcpOAuthConnect(options) {
 		authorizationServerUrl: discovered.authorizationServerUrl,
 		resource: oauth.resource,
 		oauthMetadata: oauth,
+		authorizationServerMetadata: metadata,
 		mcpUrl: appUrl,
 		redirectUri: options.redirectUri,
 		clientId: clientInformation.client_id,
 		clientSecret: clientInformation.client_secret,
 		tokenEndpointAuthMethod: clientInformation.token_endpoint_auth_method,
+		clientRegistrationMode: clientInformation.registrationMode,
 		label: options.input.label,
 		credentialInstanceId: options.input.credentialInstanceId
 	};
-	const { authorizationUrl, codeVerifier } = await startAuthorization(discovered.authorizationServerUrl, {
-		metadata,
-		clientInformation,
-		redirectUrl: options.redirectUri,
-		scope: scope || void 0,
-		resource: resourceUrl
-	});
+	let authorizationUrl;
+	let codeVerifier;
+	try {
+		({authorizationUrl, codeVerifier} = await startAuthorization(discovered.authorizationServerUrl, {
+			metadata,
+			clientInformation,
+			redirectUrl: options.redirectUri,
+			scope,
+			resource: resourceUrl
+		}));
+	} catch (error) {
+		throw new McpOAuthConnectError("authorization_start", "Failed to start MCP authorization", {
+			correlationId,
+			authorizationServerUrl: discovered.authorizationServerUrl,
+			...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
+		});
+	}
 	statePayload.codeVerifier = codeVerifier;
-	const state = encodeOAuthState(statePayload);
+	const state = await encodeOAuthState(statePayload);
 	authorizationUrl.searchParams.set("state", state);
 	return { authorizeUrl: authorizationUrl.toString() };
 }
 async function completeMcpOAuthConnect(options) {
-	const payload = decodeOAuthState(options.state);
-	const metadata = {
-		issuer: payload.oauthMetadata.issuer ?? payload.authorizationServerUrl,
-		authorization_endpoint: payload.oauthMetadata.authorizationEndpoint,
-		token_endpoint: payload.oauthMetadata.tokenEndpoint,
-		registration_endpoint: payload.oauthMetadata.registrationEndpoint,
-		scopes_supported: payload.oauthMetadata.scopes,
-		response_types_supported: ["code"],
-		code_challenge_methods_supported: ["S256"]
-	};
+	const { payload } = options;
 	const resourceUrl = payload.resource ? new URL(payload.resource) : void 0;
-	const tokens = await exchangeAuthorization(payload.authorizationServerUrl, {
-		metadata,
-		clientInformation: {
-			client_id: payload.clientId,
-			...payload.clientSecret ? { client_secret: payload.clientSecret } : {},
-			...payload.tokenEndpointAuthMethod ? { token_endpoint_auth_method: payload.tokenEndpointAuthMethod } : {}
-		},
-		authorizationCode: options.code,
-		codeVerifier: payload.codeVerifier,
-		redirectUri: payload.redirectUri,
-		resource: resourceUrl
-	});
-	const { id: oauthAppId } = await ensureOAuthApp({
-		slug: payload.appSlug,
-		provider: "mcp",
-		tokenStrategy: "refresh",
-		clientId: payload.clientId,
-		clientSecret: oauthClientSecretForStorage(payload.clientSecret),
-		metadata: oauthAppMetadata(payload.oauthMetadata, payload.mcpUrl, { tokenEndpointAuthMethod: payload.tokenEndpointAuthMethod })
-	});
-	const connectionId = await saveOAuthConnection({
-		appId: oauthAppId,
-		externalId: payload.userId,
-		accessToken: tokens.access_token,
-		refreshToken: tokens.refresh_token,
-		accessTokenExpiresAt: accessTokenExpiresAt(tokens.expires_in),
-		grantedScopes: grantedScopesFromToken(tokens.scope, payload.oauthMetadata.scopes),
-		metadata: { mcpUrl: payload.oauthMetadata.resource }
-	});
-	await ensureOAuthCredentialInstance({
-		credentialKey: payload.appSlug,
-		connectionId,
-		accountLabel: payload.label,
-		externalId: payload.userId,
-		userLabel: payload.label,
-		targets: payload.scopeTargets,
-		credentialInstanceId: payload.credentialInstanceId
-	});
+	if (!resourceUrl) throw new McpOAuthConnectError("authorization_callback", "OAuth callback state is missing the MCP resource", { correlationId: payload.correlationId });
+	let tokens;
+	let providerHttpStatus;
+	try {
+		const safeFetch = createPublicHttpFetch();
+		tokens = await exchangeAuthorization(payload.authorizationServerUrl, {
+			metadata: payload.authorizationServerMetadata,
+			clientInformation: {
+				client_id: payload.clientId,
+				...payload.clientSecret ? { client_secret: payload.clientSecret } : {},
+				...payload.tokenEndpointAuthMethod ? { token_endpoint_auth_method: payload.tokenEndpointAuthMethod } : {}
+			},
+			authorizationCode: options.code,
+			codeVerifier: payload.codeVerifier,
+			redirectUri: payload.redirectUri,
+			resource: resourceUrl,
+			fetchFn: async (input, init) => {
+				const response = await safeFetch(input, init);
+				providerHttpStatus = response.status;
+				return response;
+			}
+		});
+	} catch (error) {
+		throw new McpOAuthConnectError("token_exchange", "MCP OAuth token exchange failed", {
+			correlationId: payload.correlationId,
+			authorizationServerUrl: payload.authorizationServerUrl,
+			...providerHttpStatus ? { providerHttpStatus } : {},
+			...oauthErrorCode(error) ? { oauthError: oauthErrorCode(error) } : {}
+		});
+	}
+	let oauthAppId;
+	let connectionId;
+	try {
+		({id: oauthAppId} = await ensureOAuthApp({
+			slug: payload.appSlug,
+			provider: "mcp",
+			tokenStrategy: "refresh",
+			clientId: payload.clientId,
+			clientSecret: oauthClientSecretForStorage(payload.clientSecret),
+			metadata: oauthAppMetadata(payload.oauthMetadata, payload.mcpUrl, {
+				tokenEndpointAuthMethod: payload.tokenEndpointAuthMethod,
+				clientRegistrationMode: payload.clientRegistrationMode,
+				redirectUri: payload.redirectUri
+			})
+		}));
+		connectionId = await saveOAuthConnection({
+			appId: oauthAppId,
+			externalId: payload.userId,
+			accessToken: tokens.access_token,
+			refreshToken: tokens.refresh_token,
+			accessTokenExpiresAt: accessTokenExpiresAt(tokens.expires_in),
+			grantedScopes: grantedScopesFromToken(tokens.scope, payload.oauthMetadata.scopes),
+			metadata: { mcpUrl: payload.oauthMetadata.resource }
+		});
+		await ensureOAuthCredentialInstance({
+			credentialKey: payload.appSlug,
+			connectionId,
+			accountLabel: payload.label,
+			externalId: payload.userId,
+			userLabel: payload.label,
+			targets: payload.scopeTargets,
+			credentialInstanceId: payload.credentialInstanceId
+		});
+	} catch {
+		throw new McpOAuthConnectError("credential_persistence", "Failed to save the MCP OAuth credential", { correlationId: payload.correlationId });
+	}
 	return {
 		appSlug: payload.appSlug,
 		connectionId,
@@ -37740,4 +37997,4 @@ function minioStoragePlugin(options = {}) {
 //#endregion
 export { ChannelPlatformSchema as $, TemplateKindSchema as $n, mapProjectSettings as $r, ListProjectDeploymentsResponseSchema as $t, decodeOAuthState as A, ProjectSlugAvailabilityResponseSchema as An, WorkspaceTriggerDetailSchema as Ar, GetTemplateResponseSchema as At, readCredentialInstanceSecret as B, SkillSummaryDetailResponseSchema as Bn, deriveCredentialInstanceSlug as Br, InviteProjectMembersResponseSchema as Bt, userAvatarStorageKey as C, PresignProjectSourceResponseSchema as Cn, WorkflowFormResponseSchema as Cr, ErrorResponseSchema as Ct, McpOAuthConnectError as D, ProjectResponseSchema as Dn, WorkflowSummaryDetailResponseSchema as Dr, GetAppCatalogEntryResponseSchema as Dt, cronPayloadSchema as E, ProjectReachabilityResponseSchema as En, WorkflowRunInputsSchema as Er, FinalizeCustomAppLogoResponseSchema as Et, isDiscoveryError as F, PublicModelsResponseSchema as Fn, WorkspaceWorkflowOverviewSchema as Fr, HistoryRunListQuerySchema as Ft, ActiveOrganizationResponseSchema as G, StartMcpOAuthConnectionInputSchema as Gn, jsonSchemaToWorkflowInputSchema as Gr, ListChannelPlatformsResponseSchema as Gt, setManagedServiceCredential as H, SkillSummarySchema as Hn, isAllowedChatAttachmentMediaType as Hr, ListAgentWorkspaceFilesResponseSchema as Ht, withCredentialAssignments as I, PublishedFormListResponseSchema as In, agentMemoryFileId as Ir, HistoryRunListResponseSchema as It, AgentSummaryListResponseSchema as J, SubmitMarketingContactRequestSchema as Jn, mapOrganizationMember as Jr, ListManagedServiceCredentialsResponseSchema as Jt, AgentMemoryFileSummarySchema as K, StartMcpOAuthConnectionResultSchema as Kn, listenPortFromPublicUrl as Kr, ListCredentialsPageQuerySchema as Kt, PublicHttpUrlError as L, PublishedFormSchema as Ln, agentWorkspaceFileId as Lr, InviteOrganizationMembersRequestSchema as Lt, discoverGraphqlApp as M, PublicFormMetadataSchema as Mn, WorkspaceTriggerListResponseSchema as Mr, GraphqlDiscoverResponseSchema as Mt, discoverMcpApp as N, PublicFormSubmitBodySchema as Nn, WorkspaceTriggerOverviewSchema as Nr, HistoryRunCancelResponseSchema as Nt, beginMcpOAuthConnect as O, ProjectSettingsResponseSchema as On, WorkflowSummaryListResponseSchema as Or, GetCredentialResponseSchema as Ot, discoverOpenApiApp as P, PublicFormSubmitResponseSchema as Pn, WorkspaceTriggerRunListResponseSchema as Pr, HistoryRunDetailResponseSchema as Pt, AppSlugAvailabilityResponseSchema as Q, TemplateFilesResponseSchema as Qn, mapProjectMember as Qr, ListOrganizationsResponseSchema as Qt, deleteCredentialInstanceSecret as R, RecentResourceListResponseSchema as Rn, buildCredentialInstanceLabel as Rr, InviteOrganizationMembersResponseSchema as Rt, publicKeystrokeAssetsObjectUrl as S, PresignProjectSourceRequestSchema as Sn, WorkflowCanvasSchema as Sr, DuplicateCredentialsResponseSchema as St, defaultSchedulerPlugin as T, PresignUserAvatarResponseSchema as Tn, WorkflowRunInputsPutBodySchema as Tr, FinalizeCustomAppLogoRequestSchema as Tt, ACTIVE_ORG_HEADER as U, SlugAvailabilityQuerySchema as Un, isHelloWorldTemplateSlug as Ur, ListApiKeysResponseSchema as Ut, setCredentialInstanceSecret as V, SkillSummaryListResponseSchema as Vn, displayCredentialAppName as Vr, ListAgentMemoryFilesResponseSchema as Vt, AcceptOrganizationInvitationResponseSchema as W, SlugAvailabilityResponseSchema as Wn, isLlmProviderSlug as Wr, ListAppsResponseSchema as Wt, AgentWorkspaceFileSummarySchema as X, SubmitTeamRequestRequestSchema as Xn, mapProjectArtifact as Xr, ListOrganizationMembersPageQuerySchema as Xt, AgentSummarySchema as Y, SubmitMarketingContactResponseSchema as Yn, mapProject as Yr, ListOrganizationInvitationsResponseSchema as Yt, AppSlugAvailabilityQuerySchema as Z, SubmitTeamRequestResponseSchema as Zn, mapProjectDeployment as Zr, ListOrganizationMembersPageResponseSchema as Zt, loadProjectSourceFiles as _, validationErrorResponse as _i, PresignChatAttachmentResponseSchema as _n, UserAvatarSchema as _r, DbProxyQueryRequestSchema as _t, ensureKeystrokeAssetsBucket as a, organizationSlugErrorCodeFromMessage as ai, MICRO_CREDITS_PER_CREDIT as an, UpdateCredentialRequestSchema as ar, CreateCredentialsResponseSchema as at, projectArtifactKey as b, __toESM as bi, PresignOrgLogoRequestSchema as bn, WorkflowCanvasCredentialBindingsSchema as br, DownloadActiveProjectSourceResponseSchema as bt, isChatAttachmentStorageKey as c, projectFileId as ci, McpDiscoverRequestSchema as cn, UpdateOrganizationMemberResponseSchema as cr, CreateOrganizationRequestSchema as ct, isOrgLogoStorageKey as d, resolveUniqueCredentialInstanceLabel as di, OpenApiDiscoverResponseSchema as dn, UpdateProjectMemberResponseSchema as dr, CreateProjectRequestSchema as dt, mapUserOrganization as ei, ListProjectFilesResponseSchema as en, TriggerAttachmentUpdateRequestSchema as er, CompleteProjectArtifactResponseSchema as et, isStorageBucketNotFoundError as f, schemaHasFileFields as fi, OrganizationSidebarBrandingPatchSchema as fn, UpdateProjectRequestSchema as fr, CreateProjectResponseSchema as ft, keystrokeAssetsOrgLogoKeyFromPublicUrl as g, validateWorkflowRunInputValues as gi, PresignChatAttachmentRequestSchema as gn, UserAvatarPatchSchema as gr, DEFAULT_WORKFLOW_OVERVIEW_MODEL as gt, keystrokeAssetsAvatarKeyFromPublicUrl as h, validateFormFieldConfig as hi, PROJECT_SLUG_TAKEN_MESSAGE as hn, UploadProjectSourceResponseSchema as hr, DEFAULT_WORKFLOW_CANVAS_MODEL as ht, createAssetsStorageClient as i, organizationInvitationAcceptPath as ii, ListTemplatesResponseSchema as in, TriggerRunListQuerySchema as ir, CreateCredentialsRequestSchema as it, describeCredentialBindings as j, ProjectSourceResourcesSchema as jn, WorkspaceTriggerFileSchema as jr, GraphqlDiscoverRequestSchema as jt, completeMcpOAuthConnect as k, ProjectSlugAvailabilityQuerySchema as kn, WorkflowSummarySchema as kr, GetCustomAppResponseSchema as kt, isKeystrokeAssetsAvatarPublicUrl as l, resolveExternalPlatformOrigin as li, McpDiscoverResponseSchema as ln, UpdateOrganizationRequestSchema as lr, CreateOrganizationResponseSchema as lt, isUserAvatarStorageKey as m, validateCredentialValueAgainstFields as mi, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as mn, UploadProjectSourceManifestRequestSchema as mr, DEFAULT_TRIGGER_OVERVIEW_MODEL as mt, appLogoStorageKey as n, mergeUserPreferences as ni, ListProjectMetricsResponseSchema as nn, TriggerInvokeRequestSchema as nr, CreateApiKeyRequestSchema as nt, extractRouteManifestFromArtifact as o, parseAppSlug as oi, ManagedServiceCredentialSchema as on, UpdateManagedServiceCredentialRequestSchema as or, CreateCustomAppRequestSchema as ot, isStorageNotFoundError as p, schemaHasUnsupportedFormFields as pi, OrganizationSidebarBrandingSchema as pn, UpdateProjectSettingsRequestSchema as pr, DEFAULT_CLOUD_PLATFORM_ORIGIN as pt, AgentSummaryDetailResponseSchema as q, StoredProjectSourceManifestSchema as qn, mapOrganizationInvitation as qr, ListCredentialsPageResponseSchema as qt, chatAttachmentStorageKey as r, normalizeUserPreferences as ri, ListProjectsResponseSchema as rn, TriggerInvokeResponseSchema as rr, CreateApiKeyResponseSchema as rt, isAppLogoStorageKey as s, parseStoredRouteManifest as si, ManagedServiceKindSchema as sn, UpdateOrganizationMemberRequestSchema as sr, CreateCustomAppResponseSchema as st, RouteManifestNotFoundError as t, mcpEntityId as ti, ListProjectMembersResponseSchema as tn, TriggerInvokeInputsSchema as tr, ConnectManagedServiceCredentialRequestSchema as tt, isKeystrokeAssetsOrgLogoPublicUrl as u, resolvePublicFormFields as ui, OpenApiDiscoverRequestSchema as un, UpdateProjectMemberRequestSchema as ur, CreateProjectArtifactResponseSchema as ut, minioStoragePlugin as v, __commonJSMin as vi, PresignCustomAppLogoRequestSchema as vn, UserPreferencesPatchSchema as vr, DeclineOrganizationInvitationResponseSchema as vt, createJobQueue as w, PresignUserAvatarRequestSchema as wn, WorkflowFormUpsertBodySchema as wr, FilePartSchema as wt, projectSourceBlobKey as x, PresignOrgLogoResponseSchema as xn, WorkflowCanvasRunSchema as xr, DuplicateCredentialRequestSchema as xt, orgLogoStorageKey as y, __require as yi, PresignCustomAppLogoResponseSchema as yn, UserPreferencesSchema as yr, DownloadActiveProjectArtifactResponseSchema as yt, deleteManagedServiceCredential$1 as z, RecentResourceSchema as zn, chatAttachmentExtension as zr, InviteProjectMembersRequestSchema as zt };
 
-//# sourceMappingURL=dist-Cj3RPKwD.mjs.map
+//# sourceMappingURL=dist-B2lPLfrR.mjs.map