@keystrokehq/platform 0.1.121 → 0.1.123

package/dist/{start-C8A5Y1es.mjs → start-B3sE8bjc.mjs}

@@ -1,8 +1,8 @@
-import { $ as ChannelPlatformSchema, $n as TemplateKindSchema, $r as mapProjectSettings, $t as ListProjectDeploymentsResponseSchema, A as decodeOAuthState, An as ProjectSlugAvailabilityResponseSchema, Ar as WorkspaceTriggerDetailSchema, At as GetTemplateResponseSchema, B as readCredentialInstanceSecret, Bn as SkillSummaryDetailResponseSchema, Br as deriveCredentialInstanceSlug, Bt as InviteProjectMembersResponseSchema, C as userAvatarStorageKey, Cn as PresignProjectSourceResponseSchema, Cr as WorkflowFormResponseSchema, Ct as ErrorResponseSchema, D as McpOAuthConnectError, Dn as ProjectResponseSchema, Dr as WorkflowSummaryDetailResponseSchema, Dt as GetAppCatalogEntryResponseSchema, E as cronPayloadSchema, En as ProjectReachabilityResponseSchema, Er as WorkflowRunInputsSchema, Et as FinalizeCustomAppLogoResponseSchema, F as isDiscoveryError, Fn as PublicModelsResponseSchema, Fr as WorkspaceWorkflowOverviewSchema, Ft as HistoryRunListQuerySchema, G as ActiveOrganizationResponseSchema, Gn as StartMcpOAuthConnectionInputSchema, Gr as jsonSchemaToWorkflowInputSchema, Gt as ListChannelPlatformsResponseSchema, H as setManagedServiceCredential, Hn as SkillSummarySchema, Hr as isAllowedChatAttachmentMediaType, Ht as ListAgentWorkspaceFilesResponseSchema, I as withCredentialAssignments, In as PublishedFormListResponseSchema, Ir as agentMemoryFileId, It as HistoryRunListResponseSchema, J as AgentSummaryListResponseSchema, Jn as SubmitMarketingContactRequestSchema, Jr as mapOrganizationMember, Jt as ListManagedServiceCredentialsResponseSchema, K as AgentMemoryFileSummarySchema, Kn as StartMcpOAuthConnectionResultSchema, Kr as listenPortFromPublicUrl, Kt as ListCredentialsPageQuerySchema, L as PublicHttpUrlError, Ln as PublishedFormSchema, Lr as agentWorkspaceFileId, Lt as InviteOrganizationMembersRequestSchema, M as discoverGraphqlApp, Mn as PublicFormMetadataSchema, Mr as WorkspaceTriggerListResponseSchema, Mt as GraphqlDiscoverResponseSchema, N as discoverMcpApp, Nn as PublicFormSubmitBodySchema, Nr as WorkspaceTriggerOverviewSchema, Nt as HistoryRunCancelResponseSchema, O as beginMcpOAuthConnect, On as ProjectSettingsResponseSchema, Or as WorkflowSummaryListResponseSchema, Ot as GetCredentialResponseSchema, P as discoverOpenApiApp, Pn as PublicFormSubmitResponseSchema, Pr as WorkspaceTriggerRunListResponseSchema, Pt as HistoryRunDetailResponseSchema, Q as AppSlugAvailabilityResponseSchema, Qn as TemplateFilesResponseSchema, Qr as mapProjectMember, Qt as ListOrganizationsResponseSchema, R as deleteCredentialInstanceSecret, Rn as RecentResourceListResponseSchema, Rr as buildCredentialInstanceLabel, Rt as InviteOrganizationMembersResponseSchema, S as publicKeystrokeAssetsObjectUrl, Sn as PresignProjectSourceRequestSchema, Sr as WorkflowCanvasSchema, St as DuplicateCredentialsResponseSchema, T as defaultSchedulerPlugin, Tn as PresignUserAvatarResponseSchema, Tr as WorkflowRunInputsPutBodySchema, Tt as FinalizeCustomAppLogoRequestSchema, U as ACTIVE_ORG_HEADER, Un as SlugAvailabilityQuerySchema, Ur as isHelloWorldTemplateSlug, Ut as ListApiKeysResponseSchema, V as setCredentialInstanceSecret, Vn as SkillSummaryListResponseSchema, Vr as displayCredentialAppName, Vt as ListAgentMemoryFilesResponseSchema, W as AcceptOrganizationInvitationResponseSchema, Wn as SlugAvailabilityResponseSchema, Wr as isLlmProviderSlug, Wt as ListAppsResponseSchema, X as AgentWorkspaceFileSummarySchema, Xn as SubmitTeamRequestRequestSchema, Xr as mapProjectArtifact, Xt as ListOrganizationMembersPageQuerySchema, Y as AgentSummarySchema, Yn as SubmitMarketingContactResponseSchema, Yr as mapProject, Yt as ListOrganizationInvitationsResponseSchema, Z as AppSlugAvailabilityQuerySchema, Zn as SubmitTeamRequestResponseSchema, Zr as mapProjectDeployment, Zt as ListOrganizationMembersPageResponseSchema, _ as loadProjectSourceFiles, _i as validationErrorResponse, _n as PresignChatAttachmentResponseSchema, _r as UserAvatarSchema, _t as DbProxyQueryRequestSchema, a as ensureKeystrokeAssetsBucket, ai as organizationSlugErrorCodeFromMessage, an as MICRO_CREDITS_PER_CREDIT, ar as UpdateCredentialRequestSchema, at as CreateCredentialsResponseSchema, b as projectArtifactKey, bn as PresignOrgLogoRequestSchema, br as WorkflowCanvasCredentialBindingsSchema, bt as DownloadActiveProjectSourceResponseSchema, c as isChatAttachmentStorageKey, ci as projectFileId, cn as McpDiscoverRequestSchema, cr as UpdateOrganizationMemberResponseSchema, ct as CreateOrganizationRequestSchema, d as isOrgLogoStorageKey, di as resolveUniqueCredentialInstanceLabel, dn as OpenApiDiscoverResponseSchema, dr as UpdateProjectMemberResponseSchema, dt as CreateProjectRequestSchema, ei as mapUserOrganization, en as ListProjectFilesResponseSchema, er as TriggerAttachmentUpdateRequestSchema, et as CompleteProjectArtifactResponseSchema, f as isStorageBucketNotFoundError, fi as schemaHasFileFields, fn as OrganizationSidebarBrandingPatchSchema, fr as UpdateProjectRequestSchema, ft as CreateProjectResponseSchema, g as keystrokeAssetsOrgLogoKeyFromPublicUrl, gi as validateWorkflowRunInputValues, gn as PresignChatAttachmentRequestSchema, gr as UserAvatarPatchSchema, gt as DEFAULT_WORKFLOW_OVERVIEW_MODEL, h as keystrokeAssetsAvatarKeyFromPublicUrl, hi as validateFormFieldConfig, hn as PROJECT_SLUG_TAKEN_MESSAGE, hr as UploadProjectSourceResponseSchema, ht as DEFAULT_WORKFLOW_CANVAS_MODEL, i as createAssetsStorageClient, ii as organizationInvitationAcceptPath, in as ListTemplatesResponseSchema, ir as TriggerRunListQuerySchema, it as CreateCredentialsRequestSchema, j as describeCredentialBindings, jn as ProjectSourceResourcesSchema, jr as WorkspaceTriggerFileSchema, jt as GraphqlDiscoverRequestSchema, k as completeMcpOAuthConnect, kn as ProjectSlugAvailabilityQuerySchema, kr as WorkflowSummarySchema, kt as GetCustomAppResponseSchema, l as isKeystrokeAssetsAvatarPublicUrl, li as resolveExternalPlatformOrigin, ln as McpDiscoverResponseSchema, lr as UpdateOrganizationRequestSchema, lt as CreateOrganizationResponseSchema, m as isUserAvatarStorageKey, mi as validateCredentialValueAgainstFields, mn as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, mr as UploadProjectSourceManifestRequestSchema, mt as DEFAULT_TRIGGER_OVERVIEW_MODEL, n as appLogoStorageKey, ni as mergeUserPreferences, nn as ListProjectMetricsResponseSchema, nr as TriggerInvokeRequestSchema, nt as CreateApiKeyRequestSchema, o as extractRouteManifestFromArtifact, oi as parseAppSlug, on as ManagedServiceCredentialSchema, or as UpdateManagedServiceCredentialRequestSchema, ot as CreateCustomAppRequestSchema, p as isStorageNotFoundError$1, pi as schemaHasUnsupportedFormFields, pn as OrganizationSidebarBrandingSchema, pr as UpdateProjectSettingsRequestSchema, pt as DEFAULT_CLOUD_PLATFORM_ORIGIN, q as AgentSummaryDetailResponseSchema, qn as StoredProjectSourceManifestSchema, qr as mapOrganizationInvitation, qt as ListCredentialsPageResponseSchema, r as chatAttachmentStorageKey, ri as normalizeUserPreferences, rn as ListProjectsResponseSchema, rr as TriggerInvokeResponseSchema, rt as CreateApiKeyResponseSchema, s as isAppLogoStorageKey, si as parseStoredRouteManifest, sn as ManagedServiceKindSchema, sr as UpdateOrganizationMemberRequestSchema, st as CreateCustomAppResponseSchema, t as RouteManifestNotFoundError, ti as mcpEntityId, tn as ListProjectMembersResponseSchema, tr as TriggerInvokeInputsSchema, tt as ConnectManagedServiceCredentialRequestSchema, u as isKeystrokeAssetsOrgLogoPublicUrl, ui as resolvePublicFormFields, un as OpenApiDiscoverRequestSchema, ur as UpdateProjectMemberRequestSchema, ut as CreateProjectArtifactResponseSchema, vn as PresignCustomAppLogoRequestSchema, vr as UserPreferencesPatchSchema, vt as DeclineOrganizationInvitationResponseSchema, w as createJobQueue, wn as PresignUserAvatarRequestSchema, wr as WorkflowFormUpsertBodySchema, wt as FilePartSchema, x as projectSourceBlobKey, xn as PresignOrgLogoResponseSchema, xr as WorkflowCanvasRunSchema, xt as DuplicateCredentialRequestSchema, y as orgLogoStorageKey, yn as PresignCustomAppLogoResponseSchema, yr as UserPreferencesSchema, yt as DownloadActiveProjectArtifactResponseSchema, z as deleteManagedServiceCredential$1, zn as RecentResourceSchema, zr as chatAttachmentExtension, zt as InviteProjectMembersRequestSchema } from "./dist-B2lPLfrR.mjs";
-import { a as verifyOrgWorkerToken, i as pingProjectTarget, n as fetchDeployStatus, r as mintOrgWorkerToken } from "./dist-D_ICFiVc.mjs";
+import { $ as AppSlugAvailabilityResponseSchema, $n as SubmitTeamRequestRequestSchema, $r as mapProject, $t as ListOrganizationsResponseSchema, A as decodeOAuthState, An as ProjectSlugAvailabilityQuerySchema, Ar as WorkflowSummaryDetailResponseSchema, At as GetCustomAppResponseSchema, B as readCredentialInstanceSecret, Bn as RecentResourceSchema, Br as agentWorkspaceFileId, Bt as InviteProjectMembersRequestSchema, C as userAvatarStorageKey, Cn as PresignProjectSourceRequestSchema, Cr as WorkflowCanvasCredentialBindingsSchema, Ct as DuplicateCredentialsResponseSchema, D as McpOAuthConnectError, Dn as ProjectReachabilityResponseSchema, Dr as WorkflowFormUpsertBodySchema, Dt as FinalizeCustomAppLogoResponseSchema, E as cronPayloadSchema, En as PresignUserAvatarResponseSchema, Er as WorkflowFormResponseSchema, Et as FinalizeCustomAppLogoRequestSchema, F as isDiscoveryError, Fn as PublicFormSubmitResponseSchema, Fr as WorkspaceTriggerListResponseSchema, Ft as HistoryRunDetailResponseSchema, G as AcceptOrganizationInvitationResponseSchema, Gn as SlugAvailabilityResponseSchema, Gr as displayCredentialAppName, Gt as ListAppsResponseSchema, H as setCredentialInstanceSecretValue, Hn as SkillSummaryListResponseSchema, Hr as chatAttachmentExtension, Ht as ListAgentMemoryFilesResponseSchema, I as withCredentialAssignments, In as PublicModelsResponseSchema, Ir as WorkspaceTriggerOverviewSchema, It as HistoryRunListQuerySchema, J as AgentSummaryDetailResponseSchema, Jn as StoredProjectSourceManifestSchema, Jr as isLlmProviderSlug, Jt as ListCredentialsPageResponseSchema, K as ActiveOrganizationResponseSchema, Kn as StartMcpOAuthConnectionInputSchema, Kr as isAllowedChatAttachmentMediaType, Kt as ListChannelPlatformsResponseSchema, L as PublicHttpUrlError, Ln as PublishedFormListResponseSchema, Lr as WorkspaceTriggerRunListResponseSchema, Lt as HistoryRunListResponseSchema, M as discoverGraphqlApp, Mn as ProjectSourceResourcesSchema, Mr as WorkflowSummarySchema, Mt as GraphqlDiscoverRequestSchema, N as discoverMcpApp, Nn as PublicFormMetadataSchema, Nr as WorkspaceTriggerDetailSchema, Nt as GraphqlDiscoverResponseSchema, O as beginMcpOAuthConnect, On as ProjectResponseSchema, Or as WorkflowRunInputsPutBodySchema, Ot as GetAppCatalogEntryResponseSchema, P as discoverOpenApiApp, Pn as PublicFormSubmitBodySchema, Pr as WorkspaceTriggerFileSchema, Pt as HistoryRunCancelResponseSchema, Q as AppSlugAvailabilityQuerySchema, Qn as SubmitMarketingContactResponseSchema, Qr as mapOrganizationMember, Qt as ListOrganizationMembersPageResponseSchema, R as deleteCredentialInstanceSecret, Rn as PublishedFormSchema, Rr as WorkspaceWorkflowOverviewSchema, Rt as InviteOrganizationMembersRequestSchema, S as publicKeystrokeAssetsObjectUrl, Sn as PresignOrgLogoResponseSchema, Sr as UserPreferencesSchema, St as DuplicateCredentialRequestSchema, T as defaultSchedulerPlugin, Tn as PresignUserAvatarRequestSchema, Tr as WorkflowCanvasSchema, Tt as FilePartSchema, U as setManagedServiceCredential, Un as SkillSummarySchema, Ur as credentialInputSchema, Ut as ListAgentWorkspaceFilesResponseSchema, V as setCredentialInstanceSecret, Vn as SkillSummaryDetailResponseSchema, Vr as buildCredentialInstanceLabel, Vt as InviteProjectMembersResponseSchema, W as ACTIVE_ORG_HEADER, Wn as SlugAvailabilityQuerySchema, Wr as deriveCredentialInstanceSlug, Wt as ListApiKeysResponseSchema, X as AgentSummarySchema, Xn as SubmitAgentFeedbackResponseSchema, Xr as listenPortFromPublicUrl, Xt as ListOrganizationInvitationsResponseSchema, Y as AgentSummaryListResponseSchema, Yn as SubmitAgentFeedbackRequestSchema, Yr as jsonSchemaToWorkflowInputSchema, Yt as ListManagedServiceCredentialsResponseSchema, Z as AgentWorkspaceFileSummarySchema, Zn as SubmitMarketingContactRequestSchema, Zr as mapOrganizationInvitation, Zt as ListOrganizationMembersPageQuerySchema, _ as loadProjectSourceFiles, _i as schemaHasUnsupportedFormFields, _n as PresignChatAttachmentRequestSchema, _r as UploadProjectSourceManifestRequestSchema, _t as DEFAULT_WORKFLOW_OVERVIEW_MODEL, a as ensureKeystrokeAssetsBucket, ai as mcpEntityId, an as ListTemplatesResponseSchema, ar as TriggerInvokeRequestSchema, at as CreateCredentialsRequestSchema, b as projectArtifactKey, bi as validateWorkflowRunInputValues, bn as PresignCustomAppLogoResponseSchema, br as UserAvatarSchema, bt as DownloadActiveProjectArtifactResponseSchema, c as isChatAttachmentStorageKey, ci as organizationInvitationAcceptPath, cn as ManagedServiceKindSchema, cr as UpdateCredentialRequestSchema, ct as CreateCustomAppResponseSchema, d as isOrgLogoStorageKey, di as parseStoredRouteManifest, dn as OpenApiDiscoverRequestSchema, dr as UpdateOrganizationMemberResponseSchema, dt as CreateProjectArtifactResponseSchema, ei as mapProjectArtifact, en as ListProjectDeploymentsResponseSchema, er as SubmitTeamRequestResponseSchema, et as ChannelPlatformSchema, f as isStorageBucketNotFoundError, fi as projectFileId, fn as OpenApiDiscoverResponseSchema, fr as UpdateOrganizationRequestSchema, ft as CreateProjectRequestSchema, g as keystrokeAssetsOrgLogoKeyFromPublicUrl, gi as schemaHasFileFields, gn as PROJECT_SLUG_TAKEN_MESSAGE, gr as UpdateProjectSettingsRequestSchema, gt as DEFAULT_WORKFLOW_CANVAS_MODEL, h as keystrokeAssetsAvatarKeyFromPublicUrl, hi as resolveUniqueCredentialInstanceLabel, hn as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, hr as UpdateProjectRequestSchema, ht as DEFAULT_TRIGGER_OVERVIEW_MODEL, i as createAssetsStorageClient, ii as mapUserOrganization, in as ListProjectsResponseSchema, ir as TriggerInvokeInputsSchema, it as CreateApiKeyResponseSchema, j as describeCredentialBindings, jn as ProjectSlugAvailabilityResponseSchema, jr as WorkflowSummaryListResponseSchema, jt as GetTemplateResponseSchema, k as completeMcpOAuthConnect, kn as ProjectSettingsResponseSchema, kr as WorkflowRunInputsSchema, kt as GetCredentialResponseSchema, l as isKeystrokeAssetsAvatarPublicUrl, li as organizationSlugErrorCodeFromMessage, ln as McpDiscoverRequestSchema, lr as UpdateManagedServiceCredentialRequestSchema, lt as CreateOrganizationRequestSchema, m as isUserAvatarStorageKey, mi as resolvePublicFormFields, mn as OrganizationSidebarBrandingSchema, mr as UpdateProjectMemberResponseSchema, mt as DEFAULT_CLOUD_PLATFORM_ORIGIN, n as appLogoStorageKey, ni as mapProjectMember, nn as ListProjectMembersResponseSchema, nr as TemplateKindSchema, nt as ConnectManagedServiceCredentialRequestSchema, o as extractRouteManifestFromArtifact, oi as mergeUserPreferences, on as MICRO_CREDITS_PER_CREDIT, or as TriggerInvokeResponseSchema, ot as CreateCredentialsResponseSchema, p as isStorageNotFoundError$1, pi as resolveExternalPlatformOrigin, pn as OrganizationSidebarBrandingPatchSchema, pr as UpdateProjectMemberRequestSchema, pt as CreateProjectResponseSchema, q as AgentMemoryFileSummarySchema, qn as StartMcpOAuthConnectionResultSchema, qr as isHelloWorldTemplateSlug, qt as ListCredentialsPageQuerySchema, r as chatAttachmentStorageKey, ri as mapProjectSettings, rn as ListProjectMetricsResponseSchema, rr as TriggerAttachmentUpdateRequestSchema, rt as CreateApiKeyRequestSchema, s as isAppLogoStorageKey, si as normalizeUserPreferences, sn as ManagedServiceCredentialSchema, sr as TriggerRunListQuerySchema, st as CreateCustomAppRequestSchema, t as RouteManifestNotFoundError, ti as mapProjectDeployment, tn as ListProjectFilesResponseSchema, tr as TemplateFilesResponseSchema, tt as CompleteProjectArtifactResponseSchema, u as isKeystrokeAssetsOrgLogoPublicUrl, ui as parseAppSlug, un as McpDiscoverResponseSchema, ur as UpdateOrganizationMemberRequestSchema, ut as CreateOrganizationResponseSchema, vi as validateCredentialValueAgainstFields, vn as PresignChatAttachmentResponseSchema, vr as UploadProjectSourceResponseSchema, vt as DbProxyQueryRequestSchema, w as createJobQueue, wn as PresignProjectSourceResponseSchema, wr as WorkflowCanvasRunSchema, wt as ErrorResponseSchema, x as projectSourceBlobKey, xi as validationErrorResponse, xn as PresignOrgLogoRequestSchema, xr as UserPreferencesPatchSchema, xt as DownloadActiveProjectSourceResponseSchema, y as orgLogoStorageKey, yi as validateFormFieldConfig, yn as PresignCustomAppLogoRequestSchema, yr as UserAvatarPatchSchema, yt as DeclineOrganizationInvitationResponseSchema, z as deleteManagedServiceCredential$1, zn as RecentResourceListResponseSchema, zr as agentMemoryFileId, zt as InviteOrganizationMembersResponseSchema } from "./dist-BbcFUrLU.mjs";
+import { a as verifyOrgWorkerToken, i as pingProjectTarget, n as fetchDeployStatus, r as mintOrgWorkerToken } from "./dist-DCg7fFyO.mjs";
 import "./chunk-BZUGFHVS-B2NchobP.mjs";
 import { n as d$4, t as _$1 } from "./chunk-TN7HHBQW-B8PYcKz5.mjs";
-import { n as readWorkerTokenFromRequest, r as requireWorkerToken, t as withProjectScope } from "./with-project-scope-DkQ6P3hm.mjs";
+import { n as readWorkerTokenFromRequest, r as requireWorkerToken, t as withProjectScope } from "./with-project-scope-CyJ2jypd.mjs";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import "node:fs/promises";
@@ -18,7 +18,7 @@ import { AUTH_API_PATH, createAuth, createDefaultAuthJwtVerifier, extractWebhook
 import { buildWebhookUrl, createCredentialMaterializeHandler, enqueueWebhookIngress, enqueueWorkflowRunByKey, extractWebhookRoutesFromManifest, formatIssuesDetail, matchWebhookPayload, seedOAuthAppsFromEnvForAllOrganizations, seedOAuthAppsFromEnvForOrganization, syncRegistryFromStoredManifest, webhookAttachmentSchemasFromStoredSource, withProjectId } from "@keystrokehq/runtime";
 import "node:url";
 import "typescript";
-import { createApp, externalPlatformOrigin, getProjectScheduler, platformWebhookOrigin, postPipelineSlackWebhook, postTeamSlackWebhook, resolveMcpEntityId } from "@keystrokehq/http";
+import { createApp, externalPlatformOrigin, getProjectScheduler, platformWebhookOrigin, postAgentFeedbackSlackWebhook, postPipelineSlackWebhook, postTeamSlackWebhook, resolveMcpEntityId } from "@keystrokehq/http";
 import { Hono } from "hono";
 import "hono/http-exception";
 import "hono/route";
@@ -100,7 +100,7 @@ z.object({
 	content: z.string().describe("Content to write to the file")
 });
 //#endregion
-//#region ../../packages/sandbox/dist/files-EBXCAi4v.mjs
+//#region ../../packages/sandbox/dist/files-DHxVXA0l.mjs
 const SandboxModeSchema = z.enum(["in-process", "vm"]);
 const SandboxFileContentSchema = z.object({
 	path: z.string(),
@@ -118,16 +118,74 @@ const SandboxFileSchema = z.object({
 const SandboxProjectFilesSchema = z.union([z.literal(true), z.string()]);
 /** Author-facing sandbox files: inline entries or a project file set. */
 const SandboxFilesInputSchema = z.union([z.array(SandboxFileSchema), SandboxProjectFilesSchema]);
+const GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const SandboxGitUserSchema = z.object({
+	name: z.string().trim().min(1),
+	email: z.string().trim().min(1)
+});
+const SandboxGitCloneSchema = z.object({
+	repository: z.string().trim().min(1).regex(GITHUB_REPOSITORY_PATTERN, "repository must be \"owner/repo\""),
+	credential: z.string().trim().min(1),
+	branch: z.string().trim().min(1).optional(),
+	path: z.string().trim().min(1).optional()
+});
+const SandboxGitSchema = z.object({
+	clone: SandboxGitCloneSchema,
+	user: SandboxGitUserSchema.optional()
+});
+const SandboxEnvFnSchema = z.custom((value) => typeof value === "function", "env must be a function");
+/** Author-facing first-session setup commands (`defineSandbox({ setup })`). */
+const SandboxSetupSchema = z.array(z.string().trim().min(1)).min(1);
 z.object({
 	key: z.string().optional(),
 	/** Sandbox execution mode. Defaults to in-process when omitted. */
 	mode: SandboxModeSchema.optional(),
-	files: SandboxFilesInputSchema.optional()
+	files: SandboxFilesInputSchema.optional(),
+	credentials: z.array(credentialInputSchema).optional(),
+	env: SandboxEnvFnSchema.optional(),
+	git: SandboxGitSchema.optional(),
+	setup: SandboxSetupSchema.optional()
+}).superRefine((value, ctx) => {
+	if ((value.credentials !== void 0 || value.env !== void 0 || value.git !== void 0 || value.setup !== void 0) && value.mode !== "vm") ctx.addIssue({
+		code: "custom",
+		message: "sandbox credentials, env, git, and setup require mode: \"vm\"",
+		path: ["mode"]
+	});
+	if ((value.env !== void 0 || value.git !== void 0) && !value.credentials?.length) ctx.addIssue({
+		code: "custom",
+		message: "sandbox env and git require a non-empty credentials list",
+		path: ["credentials"]
+	});
+	if (value.credentials) {
+		const keys = value.credentials.map((item) => item.key);
+		const seen = /* @__PURE__ */ new Set();
+		for (const key of keys) {
+			if (seen.has(key)) ctx.addIssue({
+				code: "custom",
+				message: `duplicate sandbox credential key "${key}"`,
+				path: ["credentials"]
+			});
+			seen.add(key);
+		}
+		if (value.git && !seen.has(value.git.clone.credential)) ctx.addIssue({
+			code: "custom",
+			message: `git.clone.credential "${value.git.clone.credential}" must be declared in credentials`,
+			path: [
+				"git",
+				"clone",
+				"credential"
+			]
+		});
+	}
 });
 z.object({
 	key: z.string().optional(),
 	mode: SandboxModeSchema.optional(),
-	files: z.array(SandboxFileSchema).optional()
+	files: z.array(SandboxFileSchema).optional(),
+	credentials: z.array(credentialInputSchema).optional(),
+	env: SandboxEnvFnSchema.optional(),
+	git: SandboxGitSchema.optional(),
+	setup: SandboxSetupSchema.optional()
 });
 new AsyncLocalStorage();
 //#endregion
@@ -22932,43 +22990,43 @@ var tt = [
 	},
 	{
 		name: "cat",
-		load: async () => (await import("./cat-TSFMZVYS-19ZMdpAq.mjs")).catCommand
+		load: async () => (await import("./cat-TSFMZVYS-EOSJ_gzj.mjs")).catCommand
 	},
 	{
 		name: "printf",
-		load: async () => (await import("./printf-TWGXF445-Dt9gKujx.mjs")).printfCommand
+		load: async () => (await import("./printf-TWGXF445-r3qhlsv5.mjs")).printfCommand
 	},
 	{
 		name: "ls",
-		load: async () => (await import("./ls-ZJGQER7M-EzhpSJMB.mjs")).lsCommand
+		load: async () => (await import("./ls-ZJGQER7M-fzilJj5j.mjs")).lsCommand
 	},
 	{
 		name: "mkdir",
-		load: async () => (await import("./mkdir-MEPGZOB6-B54I-co9.mjs")).mkdirCommand
+		load: async () => (await import("./mkdir-MEPGZOB6-0RKW2lRs.mjs")).mkdirCommand
 	},
 	{
 		name: "rmdir",
-		load: async () => (await import("./rmdir-OC4ZLPYA-Vs8pjIJ4.mjs")).rmdirCommand
+		load: async () => (await import("./rmdir-OC4ZLPYA-B4-LzLc2.mjs")).rmdirCommand
 	},
 	{
 		name: "touch",
-		load: async () => (await import("./touch-UA33VN3N-BvdCDNvh.mjs")).touchCommand
+		load: async () => (await import("./touch-UA33VN3N-Dotlnikw.mjs")).touchCommand
 	},
 	{
 		name: "rm",
-		load: async () => (await import("./rm-SSGETQVQ-D3OzLKaR.mjs")).rmCommand
+		load: async () => (await import("./rm-SSGETQVQ-BvdJ3-kd.mjs")).rmCommand
 	},
 	{
 		name: "cp",
-		load: async () => (await import("./cp-BISAAS7A-aP1UYqJd.mjs")).cpCommand
+		load: async () => (await import("./cp-BISAAS7A-QoODzq_y.mjs")).cpCommand
 	},
 	{
 		name: "mv",
-		load: async () => (await import("./mv-W5BIQ646-BOGImyXG.mjs")).mvCommand
+		load: async () => (await import("./mv-W5BIQ646-YdlzzXCv.mjs")).mvCommand
 	},
 	{
 		name: "ln",
-		load: async () => (await import("./ln-4LGSXXGD-Bm1sddvE.mjs")).lnCommand
+		load: async () => (await import("./ln-4LGSXXGD-QwxdpvJS.mjs")).lnCommand
 	},
 	{
 		name: "chmod",
@@ -22984,15 +23042,15 @@ var tt = [
 	},
 	{
 		name: "head",
-		load: async () => (await import("./head-442HYESI-DYhCEt04.mjs")).headCommand
+		load: async () => (await import("./head-442HYESI-BHKs27wD.mjs")).headCommand
 	},
 	{
 		name: "tail",
-		load: async () => (await import("./tail-R4PCA2C4-BrONSl6R.mjs")).tailCommand
+		load: async () => (await import("./tail-R4PCA2C4-mxBFiByP.mjs")).tailCommand
 	},
 	{
 		name: "wc",
-		load: async () => (await import("./wc-LF7NU4LA-DRj3yyc9.mjs")).wcCommand
+		load: async () => (await import("./wc-LF7NU4LA-5fJsZ37R.mjs")).wcCommand
 	},
 	{
 		name: "stat",
@@ -23000,95 +23058,95 @@ var tt = [
 	},
 	{
 		name: "grep",
-		load: async () => (await import("./grep-V3LQVMRQ-DN1wiZly.mjs")).grepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-B21nky3U.mjs")).grepCommand
 	},
 	{
 		name: "fgrep",
-		load: async () => (await import("./grep-V3LQVMRQ-DN1wiZly.mjs")).fgrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-B21nky3U.mjs")).fgrepCommand
 	},
 	{
 		name: "egrep",
-		load: async () => (await import("./grep-V3LQVMRQ-DN1wiZly.mjs")).egrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-B21nky3U.mjs")).egrepCommand
 	},
 	{
 		name: "rg",
-		load: async () => (await import("./rg-S4FXYXWB-DpNsd4K9.mjs")).rgCommand
+		load: async () => (await import("./rg-S4FXYXWB-B0WvYOCl.mjs")).rgCommand
 	},
 	{
 		name: "sed",
-		load: async () => (await import("./sed-S5UIK574-DyJHugnM.mjs")).sedCommand
+		load: async () => (await import("./sed-S5UIK574-tv8TCVhp.mjs")).sedCommand
 	},
 	{
 		name: "awk",
-		load: async () => (await import("./awk2-LA3USKJP-C_uJ9UTC.mjs")).awkCommand2
+		load: async () => (await import("./awk2-LA3USKJP-B0I2s5WK.mjs")).awkCommand2
 	},
 	{
 		name: "sort",
-		load: async () => (await import("./sort-SW2YEO5B-BIld1500.mjs")).sortCommand
+		load: async () => (await import("./sort-SW2YEO5B-BaVI4IMc.mjs")).sortCommand
 	},
 	{
 		name: "uniq",
-		load: async () => (await import("./uniq-XSIZR6PB-3tHE1GmH.mjs")).uniqCommand
+		load: async () => (await import("./uniq-XSIZR6PB-gvgCEeBQ.mjs")).uniqCommand
 	},
 	{
 		name: "comm",
-		load: async () => (await import("./comm-VV2LDX2J-C3W7A-jn.mjs")).commCommand
+		load: async () => (await import("./comm-VV2LDX2J-Dsyf6e56.mjs")).commCommand
 	},
 	{
 		name: "cut",
-		load: async () => (await import("./cut-OKARJCCV-DfCVAblN.mjs")).cutCommand
+		load: async () => (await import("./cut-OKARJCCV-CuyLMhz8.mjs")).cutCommand
 	},
 	{
 		name: "paste",
-		load: async () => (await import("./paste-7JC6S4DX-CQu-heii.mjs")).pasteCommand
+		load: async () => (await import("./paste-7JC6S4DX-DyGi5wYF.mjs")).pasteCommand
 	},
 	{
 		name: "tr",
-		load: async () => (await import("./tr-36LHWFRQ-DQL-CWbQ.mjs")).trCommand
+		load: async () => (await import("./tr-36LHWFRQ-CmAcddQN.mjs")).trCommand
 	},
 	{
 		name: "rev",
-		load: async () => (await import("./rev-5EHFX4EJ-Da-_OtYp.mjs")).rev
+		load: async () => (await import("./rev-5EHFX4EJ-qcwp1b76.mjs")).rev
 	},
 	{
 		name: "nl",
-		load: async () => (await import("./nl-WSDW7I4O-C5Tn3qyh.mjs")).nl
+		load: async () => (await import("./nl-WSDW7I4O-A0T6QLHV.mjs")).nl
 	},
 	{
 		name: "fold",
-		load: async () => (await import("./fold-4TQNYMSW-B8TGVC7j.mjs")).fold
+		load: async () => (await import("./fold-4TQNYMSW-BhOfytEa.mjs")).fold
 	},
 	{
 		name: "expand",
-		load: async () => (await import("./expand-JSPG6VOP-DUj7F9Cu.mjs")).expand
+		load: async () => (await import("./expand-JSPG6VOP-x4oQXcDy.mjs")).expand
 	},
 	{
 		name: "unexpand",
-		load: async () => (await import("./unexpand-CADSA4VO-BlcDiLij.mjs")).unexpand
+		load: async () => (await import("./unexpand-CADSA4VO-C7s1nWRV.mjs")).unexpand
 	},
 	{
 		name: "strings",
-		load: async () => (await import("./strings-6WDHLGMX-DfgljZYU.mjs")).strings
+		load: async () => (await import("./strings-6WDHLGMX-C2Nuw6WT.mjs")).strings
 	},
 	{
 		name: "split",
-		load: async () => (await import("./split-4KKZZXXE-C682TL18.mjs")).split
+		load: async () => (await import("./split-4KKZZXXE-BfB9q-OP.mjs")).split
 	},
 	{
 		name: "column",
-		load: async () => (await import("./column-XT6UFXNQ-B8k4MbkY.mjs")).column
+		load: async () => (await import("./column-XT6UFXNQ-j93nOJhW.mjs")).column
 	},
 	{
 		name: "join",
-		load: async () => (await import("./join-TBRGI3LQ-DavcUkrI.mjs")).join
+		load: async () => (await import("./join-TBRGI3LQ-Detqm78p.mjs")).join
 	},
 	{
 		name: "tee",
-		load: async () => (await import("./tee-YUZ2FKCJ-DBlSS73M.mjs")).teeCommand
+		load: async () => (await import("./tee-YUZ2FKCJ-C3CDSTkz.mjs")).teeCommand
 	},
 	{
 		name: "find",
-		load: async () => (await import("./find-INTH3OLC-CxFHfo_D.mjs")).findCommand
+		load: async () => (await import("./find-INTH3OLC-D7w3zTvw.mjs")).findCommand
 	},
 	{
 		name: "basename",
@@ -23100,19 +23158,19 @@ var tt = [
 	},
 	{
 		name: "tree",
-		load: async () => (await import("./tree-YLD52CNT-LmR2Tdyi.mjs")).treeCommand
+		load: async () => (await import("./tree-YLD52CNT-CyZ9gID6.mjs")).treeCommand
 	},
 	{
 		name: "du",
-		load: async () => (await import("./du-572XNP42-B724WDI9.mjs")).duCommand
+		load: async () => (await import("./du-572XNP42-lB6Kzq8E.mjs")).duCommand
 	},
 	{
 		name: "env",
-		load: async () => (await import("./env-36M5BO7M-BLMWIQAH.mjs")).envCommand
+		load: async () => (await import("./env-36M5BO7M-ESR8eI72.mjs")).envCommand
 	},
 	{
 		name: "printenv",
-		load: async () => (await import("./env-36M5BO7M-BLMWIQAH.mjs")).printenvCommand
+		load: async () => (await import("./env-36M5BO7M-ESR8eI72.mjs")).printenvCommand
 	},
 	{
 		name: "alias",
@@ -23128,7 +23186,7 @@ var tt = [
 	},
 	{
 		name: "xargs",
-		load: async () => (await import("./xargs-MGZPH7AX-Bokgq8NQ.mjs")).xargsCommand
+		load: async () => (await import("./xargs-MGZPH7AX-6RyGvkuL.mjs")).xargsCommand
 	},
 	{
 		name: "true",
@@ -23144,23 +23202,23 @@ var tt = [
 	},
 	{
 		name: "bash",
-		load: async () => (await import("./bash-YZ33HQZQ-0OgzIjsV.mjs")).bashCommand
+		load: async () => (await import("./bash-YZ33HQZQ-luMyh6vQ.mjs")).bashCommand
 	},
 	{
 		name: "sh",
-		load: async () => (await import("./bash-YZ33HQZQ-0OgzIjsV.mjs")).shCommand
+		load: async () => (await import("./bash-YZ33HQZQ-luMyh6vQ.mjs")).shCommand
 	},
 	{
 		name: "jq",
-		load: async () => (await import("./jq-4XLYLOS5-BIRMGhL2.mjs")).jqCommand
+		load: async () => (await import("./jq-4XLYLOS5-D3Hv5NPh.mjs")).jqCommand
 	},
 	{
 		name: "base64",
-		load: async () => (await import("./base64-C2AIWVNC-Dj_3ikno.mjs")).base64Command
+		load: async () => (await import("./base64-C2AIWVNC-DJIlIJyA.mjs")).base64Command
 	},
 	{
 		name: "diff",
-		load: async () => (await import("./diff-MWJFIG7X-Db23ZFvu.mjs")).diffCommand
+		load: async () => (await import("./diff-MWJFIG7X-DnU8lxvv.mjs")).diffCommand
 	},
 	{
 		name: "date",
@@ -23168,15 +23226,15 @@ var tt = [
 	},
 	{
 		name: "sleep",
-		load: async () => (await import("./sleep-X22JJINO-DCiATAgx.mjs")).sleepCommand
+		load: async () => (await import("./sleep-X22JJINO-BXynmGAQ.mjs")).sleepCommand
 	},
 	{
 		name: "timeout",
-		load: async () => (await import("./timeout-YDCRSLPQ-V4Gc33PA.mjs")).timeoutCommand
+		load: async () => (await import("./timeout-YDCRSLPQ-K6Njm0v3.mjs")).timeoutCommand
 	},
 	{
 		name: "time",
-		load: async () => (await import("./time-D4LNBSWX-7MVmAtQo.mjs")).timeCommand
+		load: async () => (await import("./time-D4LNBSWX-CKKOkAsd.mjs")).timeCommand
 	},
 	{
 		name: "seq",
@@ -23184,19 +23242,19 @@ var tt = [
 	},
 	{
 		name: "expr",
-		load: async () => (await import("./expr-5JAACS4X-CfrWhuNY.mjs")).exprCommand
+		load: async () => (await import("./expr-5JAACS4X-DoNrHw-x.mjs")).exprCommand
 	},
 	{
 		name: "md5sum",
-		load: async () => (await import("./md5sum-SPU24VSG-DuY3W47X.mjs")).md5sumCommand
+		load: async () => (await import("./md5sum-SPU24VSG-CPMIT1Bm.mjs")).md5sumCommand
 	},
 	{
 		name: "sha1sum",
-		load: async () => (await import("./sha1sum-2PTOAFR6-BNMNnH4a.mjs")).sha1sumCommand
+		load: async () => (await import("./sha1sum-2PTOAFR6-B_oiePQj.mjs")).sha1sumCommand
 	},
 	{
 		name: "sha256sum",
-		load: async () => (await import("./sha256sum-NS7D3IXX-DCiObRGK.mjs")).sha256sumCommand
+		load: async () => (await import("./sha256sum-NS7D3IXX-DEmVydlk.mjs")).sha256sumCommand
 	},
 	{
 		name: "file",
@@ -23204,11 +23262,11 @@ var tt = [
 	},
 	{
 		name: "html-to-markdown",
-		load: async () => (await import("./html-to-markdown-JW4MSQZO-CezmhFZv.mjs")).htmlToMarkdownCommand
+		load: async () => (await import("./html-to-markdown-JW4MSQZO-Dxn3G_u0.mjs")).htmlToMarkdownCommand
 	},
 	{
 		name: "help",
-		load: async () => (await import("./help-HZ6M2CKN-WHmZpsJe.mjs")).helpCommand
+		load: async () => (await import("./help-HZ6M2CKN-NJxruCvX.mjs")).helpCommand
 	},
 	{
 		name: "which",
@@ -23216,7 +23274,7 @@ var tt = [
 	},
 	{
 		name: "tac",
-		load: async () => (await import("./tac-2STMMJYW-B3AcXTdf.mjs")).tac
+		load: async () => (await import("./tac-2STMMJYW-CwL11Mhc.mjs")).tac
 	},
 	{
 		name: "hostname",
@@ -23228,49 +23286,49 @@ var tt = [
 	},
 	{
 		name: "od",
-		load: async () => (await import("./od-WOKFDJTP-Dhall4HD.mjs")).od
+		load: async () => (await import("./od-WOKFDJTP-KJiVwF6Z.mjs")).od
 	},
 	{
 		name: "gzip",
-		load: async () => (await import("./gzip-O5ASJAFY-C7v6CBdm.mjs")).gzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-TYcsb_J5.mjs")).gzipCommand
 	},
 	{
 		name: "gunzip",
-		load: async () => (await import("./gzip-O5ASJAFY-C7v6CBdm.mjs")).gunzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-TYcsb_J5.mjs")).gunzipCommand
 	},
 	{
 		name: "zcat",
-		load: async () => (await import("./gzip-O5ASJAFY-C7v6CBdm.mjs")).zcatCommand
+		load: async () => (await import("./gzip-O5ASJAFY-TYcsb_J5.mjs")).zcatCommand
 	}
 ];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (tt.push({
 	name: "tar",
-	load: async () => (await import("./tar-STHHZTZ6-BAXlUOR5.mjs")).tarCommand
+	load: async () => (await import("./tar-STHHZTZ6-hlJ3WqnQ.mjs")).tarCommand
 }), tt.push({
 	name: "yq",
-	load: async () => (await import("./yq-4QJW3EQG-D-gf6DFH.mjs")).yqCommand
+	load: async () => (await import("./yq-4QJW3EQG-lZUtQEHq.mjs")).yqCommand
 }), tt.push({
 	name: "xan",
-	load: async () => (await import("./xan-Y6WF3IRG-Bk9GoBFW.mjs")).xanCommand
+	load: async () => (await import("./xan-Y6WF3IRG-x7xglQiG.mjs")).xanCommand
 }), tt.push({
 	name: "sqlite3",
-	load: async () => (await import("./sqlite3-CGOEFJAO-BCIPkSxm.mjs")).sqlite3Command
+	load: async () => (await import("./sqlite3-CGOEFJAO-C8O67MY7.mjs")).sqlite3Command
 }));
 var Yt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Yt.push({
 	name: "python3",
-	load: async () => (await import("./python3-POMOR4OA-CudEUuqu.mjs")).python3Command
+	load: async () => (await import("./python3-POMOR4OA-A_1Rtauo.mjs")).python3Command
 }), Yt.push({
 	name: "python",
-	load: async () => (await import("./python3-POMOR4OA-CudEUuqu.mjs")).pythonCommand
+	load: async () => (await import("./python3-POMOR4OA-A_1Rtauo.mjs")).pythonCommand
 }));
 var Qt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Qt.push({
 	name: "js-exec",
-	load: async () => (await import("./js-exec-N5KEZBH7-CENniwUd.mjs")).jsExecCommand
+	load: async () => (await import("./js-exec-N5KEZBH7-IeT7kUb4.mjs")).jsExecCommand
 }), Qt.push({
 	name: "node",
-	load: async () => (await import("./js-exec-N5KEZBH7-CENniwUd.mjs")).nodeStubCommand
+	load: async () => (await import("./js-exec-N5KEZBH7-IeT7kUb4.mjs")).nodeStubCommand
 }));
 new TextEncoder();
 Object.freeze({
@@ -23685,6 +23743,18 @@ Object.freeze({
     option is given.`]]
 ]).keys()].sort();
 new TextDecoder("utf-8", { fatal: !0 });
+z.object({
+	clone: z.object({
+		repository: z.string().trim().min(1),
+		credential: z.string().trim().min(1),
+		branch: z.string().trim().min(1).optional(),
+		path: z.string().trim().min(1).optional()
+	}),
+	user: z.object({
+		name: z.string().trim().min(1).optional(),
+		email: z.string().trim().min(1).optional()
+	}).optional()
+});
 JSON.stringify({
 	messages: [],
 	results: [],
@@ -25932,7 +26002,7 @@ function withOrganizationProjectDatabase() {
 trace.getTracer("keystroke.http");
 //#endregion
 //#region src/routes/account/users/me/avatar/GET.ts
-const handler$110 = async (c) => {
+const handler$111 = async (c) => {
 	const dbUser = await selectUserById(c.get("user").id);
 	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
 	return c.json(UserAvatarSchema.parse({ url: dbUser.image ?? null }));
@@ -25951,7 +26021,7 @@ function avatarExtensionForContentType(contentType) {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/presign/POST.ts
-const handler$109 = async (c) => {
+const handler$110 = async (c) => {
 	const parsed = PresignUserAvatarRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -25991,7 +26061,7 @@ async function deleteStoredImageIfOwned(input) {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/PATCH.ts
-const handler$108 = async (c) => {
+const handler$109 = async (c) => {
 	const parsed = UserAvatarPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar update" }), 400);
 	const user = c.get("user");
@@ -26033,14 +26103,14 @@ const handler$108 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/users/me/preferences/GET.ts
-const handler$107 = async (c) => {
+const handler$108 = async (c) => {
 	const dbUser = await selectUserById(c.get("user").id);
 	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
 	return c.json(UserPreferencesSchema.parse(normalizeUserPreferences(dbUser.preferences)));
 };
 //#endregion
 //#region src/routes/account/users/me/preferences/PATCH.ts
-const handler$106 = async (c) => {
+const handler$107 = async (c) => {
 	const parsed = UserPreferencesPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid preferences update" }), 400);
 	const user = c.get("user");
@@ -26055,7 +26125,7 @@ const handler$106 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/GET.ts
-const handler$105 = async (c) => {
+const handler$106 = async (c) => {
 	const memberships = await selectUserOrganizations(c.get("user").id);
 	return c.json(ListOrganizationsResponseSchema.parse(memberships.map(mapUserOrganization)));
 };
@@ -26178,7 +26248,7 @@ function createOrganizationHandler(deps) {
 }
 //#endregion
 //#region src/routes/account/organizations/slug-available/GET.ts
-const handler$104 = async (c) => {
+const handler$105 = async (c) => {
 	const parsed = SlugAvailabilityQuerySchema.safeParse({
 		slug: c.req.query("slug"),
 		excludeOrganizationId: c.req.query("excludeOrganizationId")
@@ -26189,7 +26259,7 @@ const handler$104 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/GET.ts
-const handler$103 = async (c) => {
+const handler$104 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
 	if (!membership) throw new Error(`Organization membership missing after param guard: ${organizationId}`);
@@ -26197,7 +26267,7 @@ const handler$103 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/PATCH.ts
-const handler$102 = async (c) => {
+const handler$103 = async (c) => {
 	const organization = c.get("organization");
 	const body = await c.req.json().catch(() => null);
 	const parsed = UpdateOrganizationRequestSchema.safeParse(body);
@@ -26222,7 +26292,7 @@ const handler$102 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/branding/GET.ts
-const handler$101 = async (c) => {
+const handler$102 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
 	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
@@ -26271,7 +26341,7 @@ async function finalizeOrgLogoVariant(input) {
 		publicUrl: finalized.publicUrl
 	};
 }
-const handler$100 = async (c) => {
+const handler$101 = async (c) => {
 	const parsed = OrganizationSidebarBrandingPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid branding update" }), 400);
 	const { organizationId } = c.get("organization");
@@ -26299,7 +26369,7 @@ const handler$100 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/branding/logo/presign/POST.ts
-const handler$99 = async (c) => {
+const handler$100 = async (c) => {
 	const parsed = PresignOrgLogoRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid logo upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -26509,7 +26579,7 @@ function buildPlatformHistoryUsage(events, durationMs) {
 }
 //#endregion
 //#region src/routes/account/history/GET.ts
-const handler$98 = async (c) => {
+const handler$99 = async (c) => {
 	const organization = c.get("organization");
 	const ctx = accessContext(c);
 	const query = HistoryRunListQuerySchema.parse({
@@ -26534,7 +26604,7 @@ const handler$98 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/history/[runId]/GET.ts
-const handler$97 = async (c) => {
+const handler$98 = async (c) => {
 	const runId = c.req.param("runId") ?? "";
 	if (!runId) return c.json(null, 404);
 	const core = await findHistoryRunCore(runId);
@@ -26594,7 +26664,7 @@ function toAgentSummary(row, options) {
 }
 //#endregion
 //#region src/routes/account/agents/GET.ts
-const handler$96 = async (c) => {
+const handler$97 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, agentListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(AgentSummaryListResponseSchema.parse([]));
 	const rows = await listActiveAgents(filter);
@@ -26608,7 +26678,7 @@ function touchResourceActivityBestEffort(options) {
 }
 //#endregion
 //#region src/routes/account/agents/[agentId]/GET.ts
-const handler$95 = async (c) => {
+const handler$96 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(AgentSummaryDetailResponseSchema.parse(null));
@@ -26631,7 +26701,7 @@ const handler$95 = async (c) => {
 function relativePathsFromStorageKeys(prefix, keys) {
 	return keys.filter((key) => key.startsWith(prefix) && key.endsWith(".md")).map((key) => key.slice(prefix.length)).filter((path) => !path.startsWith(".") && !path.includes("/."));
 }
-const handler$94 = async (c) => {
+const handler$95 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(ListAgentMemoryFilesResponseSchema.parse({ files: [] }), 404);
@@ -26656,7 +26726,7 @@ function isStorageNotFoundError(error) {
 	const status = typeof record.$metadata === "object" && record.$metadata !== null ? record.$metadata.httpStatusCode : void 0;
 	return name === "NoSuchKey" || code === "NoSuchKey" || code === "NotFound" || status === 404;
 }
-const handler$93 = async (c) => {
+const handler$94 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const path = c.req.query("path");
 	if (!path) return c.json(ErrorResponseSchema.parse({ error: "File path is required" }), 400);
@@ -26710,7 +26780,7 @@ function workspaceRelativePathsFromStorageKeys(keys) {
 }
 //#endregion
 //#region src/routes/account/agents/[agentId]/workspace/files/GET.ts
-const handler$92 = async (c) => {
+const handler$93 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(ListAgentWorkspaceFilesResponseSchema.parse({ files: [] }), 404);
@@ -26733,7 +26803,7 @@ const handler$92 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/agents/[agentId]/workspace/files/content/GET.ts
-const handler$91 = async (c) => {
+const handler$92 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const path = c.req.query("path");
 	if (!path) return c.json(ErrorResponseSchema.parse({ error: "File path is required" }), 400);
@@ -26785,7 +26855,7 @@ async function cancelHistoryRun(c, kind, cancel) {
 }
 //#endregion
 //#region src/routes/account/agents/sessions/[sessionId]/cancel/POST.ts
-const handler$90 = (c) => cancelHistoryRun(c, "agent", cancelAgentSession);
+const handler$91 = (c) => cancelHistoryRun(c, "agent", cancelAgentSession);
 //#endregion
 //#region src/routes/account/resources/workflows.ts
 function toWorkflowSummary(row, options) {
@@ -26802,7 +26872,7 @@ function toWorkflowSummary(row, options) {
 }
 //#endregion
 //#region src/routes/account/workflows/GET.ts
-const handler$89 = async (c) => {
+const handler$90 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, workflowListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(WorkflowSummaryListResponseSchema.parse([]));
 	const rows = await listActiveWorkflows(filter);
@@ -26816,7 +26886,7 @@ function buildPublicFormUrl(token) {
 }
 //#endregion
 //#region src/routes/account/workflows/forms/GET.ts
-const handler$88 = async (c) => {
+const handler$89 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const filter = await resolveListProjectIds(c, listScope(c, workflowListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(PublishedFormListResponseSchema.parse([]));
@@ -26836,7 +26906,7 @@ const handler$88 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/GET.ts
-const handler$87 = async (c) => {
+const handler$88 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	const row = workflowId ? await selectActiveWorkflowById(workflowId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessWorkflow)) return c.json(WorkflowSummaryDetailResponseSchema.parse(null));
@@ -27311,7 +27381,7 @@ function buildWorkflowCanvas(input) {
 //#region src/routes/account/workflows/[workflowId]/canvas/GET.ts
 /** Bumped when the annotation prompt/model changes, so cached annotations invalidate. */
 const ANNOTATIONS_GENERATOR_VERSION = "wf-canvas-annotations-v1";
-const handler$86 = async (c) => {
+const handler$87 = async (c) => {
 	const organization = c.get("organization");
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
@@ -27485,7 +27555,7 @@ function toBinding(key, description) {
 * each of its requirements currently binds to (read-only, no decryption). Not
 * content-hash cached — credential state changes without a redeploy.
 */
-const handler$85 = async (c) => {
+const handler$86 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
 	const resolved = await resolveWorkflow(c, workflowId);
@@ -27644,7 +27714,7 @@ function toCanvasRunStatus(status) {
 	if (status === "canceled") return "canceled";
 	return "running";
 }
-const handler$84 = async (c) => {
+const handler$85 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	const runId = c.req.param("runId") ?? "";
 	if (!workflowId.trim() || !runId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow or run id" }), 400);
@@ -27699,7 +27769,7 @@ async function loadWorkflowSource(organization, projectId, sourcePath) {
 		return null;
 	}
 }
-const handler$83 = async (c) => {
+const handler$84 = async (c) => {
 	const organization = c.get("organization");
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
@@ -27800,7 +27870,7 @@ const handler$83 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/run-inputs/GET.ts
-const handler$82 = async (c) => {
+const handler$83 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
 	const resolved = await resolveWorkflow(c, workflowId);
@@ -27815,7 +27885,7 @@ const handler$82 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/run-inputs/PUT.ts
-const handler$81 = async (c) => {
+const handler$82 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
 	const resolved = await resolveWorkflow(c, workflowId);
@@ -27847,7 +27917,7 @@ function parseRunInput$1(requestSchema, input) {
 * the workflow row's request schema, creates a pending run, and enqueues it on
 * the project's queue (drained by the project runtime worker). Returns the run id.
 */
-const handler$80 = async (c) => {
+const handler$81 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
@@ -27921,7 +27991,7 @@ async function resolvePublishableInputSchema(projectId, row) {
 }
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/form/GET.ts
-const handler$79 = async (c) => {
+const handler$80 = async (c) => {
 	const resolved = await resolveFormWorkflow(c);
 	if (resolved instanceof Response) return resolved;
 	const { organizationId } = c.get("organization");
@@ -27930,7 +28000,7 @@ const handler$79 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/form/PUT.ts
-const handler$78 = async (c) => {
+const handler$79 = async (c) => {
 	const resolved = await resolveFormWorkflow(c, { requireManageAccess: true });
 	if (resolved instanceof Response) return resolved;
 	const body = WorkflowFormUpsertBodySchema.safeParse(await c.req.json().catch(() => null));
@@ -27959,7 +28029,7 @@ const handler$78 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/form/DELETE.ts
-const handler$77 = async (c) => {
+const handler$78 = async (c) => {
 	const resolved = await resolveFormWorkflow(c, { requireManageAccess: true });
 	if (resolved instanceof Response) return resolved;
 	const { organizationId } = c.get("organization");
@@ -27969,7 +28039,7 @@ const handler$77 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/form/rotate/POST.ts
-const handler$76 = async (c) => {
+const handler$77 = async (c) => {
 	const resolved = await resolveFormWorkflow(c, { requireManageAccess: true });
 	if (resolved instanceof Response) return resolved;
 	const { organizationId } = c.get("organization");
@@ -27991,7 +28061,7 @@ function extensionFromUpload$1(contentType, filename) {
 * hydration reads by project id + storage key, so runs read the file the same
 * way `storeFile` output does.
 */
-const handler$75 = async (c) => {
+const handler$76 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
@@ -28016,7 +28086,7 @@ const handler$75 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/runs/GET.ts
-const handler$74 = async (c) => {
+const handler$75 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
 	const resolved = await resolveWorkflow(c, workflowId);
@@ -28039,7 +28109,7 @@ const handler$74 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/runs/[runId]/cancel/POST.ts
-const handler$73 = (c) => cancelHistoryRun(c, "workflow", cancelWorkflowRun);
+const handler$74 = (c) => cancelHistoryRun(c, "workflow", cancelWorkflowRun);
 //#endregion
 //#region src/routes/account/resources/skills.ts
 function toSkillSummary(row) {
@@ -28056,7 +28126,7 @@ function toSkillSummary(row) {
 }
 //#endregion
 //#region src/routes/account/skills/GET.ts
-const handler$72 = async (c) => {
+const handler$73 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, skillListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(SkillSummaryListResponseSchema.parse([]));
 	const rows = await listActiveSkills(filter);
@@ -28064,7 +28134,7 @@ const handler$72 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/skills/[skillId]/GET.ts
-const handler$71 = async (c) => {
+const handler$72 = async (c) => {
 	const skillId = c.req.param("skillId") ?? "";
 	const row = skillId ? await selectActiveSkillById(skillId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessSkill)) return c.json(SkillSummaryDetailResponseSchema.parse(null));
@@ -28173,7 +28243,7 @@ function toWorkspaceTriggerRunSummary(item, assignments) {
 }
 //#endregion
 //#region src/routes/account/triggers/GET.ts
-const handler$70 = async (c) => {
+const handler$71 = async (c) => {
 	const organization = c.get("organization");
 	const scope = listScope(c, projectListScope(accessContext(c)));
 	const filter = await resolveListProjectIds(c, scope, c.req.query("projectId"));
@@ -28185,7 +28255,7 @@ const handler$70 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/triggers/[triggerId]/GET.ts
-const handler$69 = async (c) => {
+const handler$70 = async (c) => {
 	const organization = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
@@ -28201,7 +28271,7 @@ const handler$69 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/triggers/[triggerId]/runs/GET.ts
-const handler$68 = async (c) => {
+const handler$69 = async (c) => {
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
 	const filter = await resolveListProjectIds(c, listScope(c, projectListScope(accessContext(c))));
@@ -28230,7 +28300,7 @@ const handler$68 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/triggers/[triggerId]/file/GET.ts
-const handler$67 = async (c) => {
+const handler$68 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
@@ -28267,7 +28337,7 @@ function envelope(row, status, hash) {
 		model: row.overviewModel ?? "deepseek/deepseek-v4-flash"
 	});
 }
-const handler$66 = async (c) => {
+const handler$67 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
@@ -28349,7 +28419,7 @@ async function syncNativeTriggerSchedule(organization, trigger) {
 	}
 	await scheduler.removeTriggerSchedule?.(trigger.slug, trigger.projectId);
 }
-const handler$65 = async (c) => {
+const handler$66 = async (c) => {
 	const organization = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	const attachmentId = c.req.param("attachmentId") ?? "";
@@ -28421,7 +28491,7 @@ var InvokeHttpError = class extends Error {
 * Manually invoke a trigger from the dashboard or CLI. Validates webhook input against
 * stored attachment schemas, then enqueues a trigger job on the project's queue.
 */
-const handler$64 = async (c) => {
+const handler$65 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
@@ -28494,7 +28564,7 @@ const handler$64 = async (c) => {
 * Form metadata for the dashboard invoke popover: webhook request schemas and
 * cron's read-only static payload.
 */
-const handler$63 = async (c) => {
+const handler$64 = async (c) => {
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
 	const filter = await resolveListProjectIds(c, listScope(c, projectListScope(accessContext(c))));
@@ -28560,7 +28630,7 @@ function latestRecentInteractionAt(recent) {
 //#endregion
 //#region src/routes/account/recents/GET.ts
 const RECENTS_LIMIT = 50;
-const handler$62 = async (c) => {
+const handler$63 = async (c) => {
 	const userId = c.get("user").id;
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, { kind: "member-only" });
@@ -28586,7 +28656,7 @@ const handler$62 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/GET.ts
-const handler$61 = async (c) => {
+const handler$62 = async (c) => {
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
 	const projects = await selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList });
@@ -28612,7 +28682,7 @@ function mergeProjectListMetrics(input) {
 }
 //#endregion
 //#region src/routes/account/projects/metrics/GET.ts
-const handler$60 = async (c) => {
+const handler$61 = async (c) => {
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
 	const [resourceCounts, lastDeploymentAtByProject] = await Promise.all([selectProjectResourceCounts(grantedProjectIdsList !== void 0 ? { projectIds: grantedProjectIdsList } : void 0), selectLastDeploymentAtByProject(organization.organizationId)]);
@@ -28657,7 +28727,7 @@ function createCreateProjectHandler(projectQuotaGate) {
 }
 //#endregion
 //#region src/routes/account/projects/slug-available/GET.ts
-const handler$58 = async (c) => {
+const handler$59 = async (c) => {
 	const organization = c.get("organization");
 	const parsed = ProjectSlugAvailabilityQuerySchema.safeParse({
 		slug: c.req.query("slug"),
@@ -28669,12 +28739,12 @@ const handler$58 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/GET.ts
-const handler$57 = async (c) => {
+const handler$58 = async (c) => {
 	return c.json(ProjectResponseSchema.parse(routeProject(c.get("project"))));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/PATCH.ts
-const handler$56 = async (c) => {
+const handler$57 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -28692,7 +28762,7 @@ const handler$56 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/DELETE.ts
-const handler$55 = async (c) => {
+const handler$56 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	if (!await deleteProjectForOrganization(organization.organizationId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
@@ -28700,7 +28770,7 @@ const handler$55 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/deployments/GET.ts
-const handler$54 = async (c) => {
+const handler$55 = async (c) => {
 	const rows = await selectProjectDeployments(c.get("project").id);
 	return c.json(ListProjectDeploymentsResponseSchema.parse(rows.map(mapProjectDeployment)));
 };
@@ -28708,7 +28778,7 @@ const handler$54 = async (c) => {
 //#region src/routes/account/projects/[projectId]/artifacts/POST.ts
 const DEFAULT_PRESIGN_TTL_SECONDS$1 = 900;
 const ARTIFACT_CONTENT_TYPE = "application/gzip";
-const handler$53 = async (c) => {
+const handler$54 = async (c) => {
 	const project = c.get("project");
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
@@ -28736,7 +28806,7 @@ const handler$53 = async (c) => {
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/active/download/GET.ts
 const DEFAULT_PRESIGN_TTL_SECONDS = 900;
-const handler$52 = async (c) => {
+const handler$53 = async (c) => {
 	const project = c.get("project");
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
@@ -28755,7 +28825,7 @@ const handler$52 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/active/source/GET.ts
-const handler$51 = async (c) => {
+const handler$52 = async (c) => {
 	const project = c.get("project");
 	const active = await selectActiveArtifactSourceManifestForProject(project.id);
 	if (!active?.sourceManifestJson) return c.json(ErrorResponseSchema.parse({ error: "No active source for project" }), 404);
@@ -28784,7 +28854,7 @@ const TRIGGER_KINDS = new Set([
 	"trigger-poll-group",
 	"cron-schedule"
 ]);
-const handler$50 = async (c) => {
+const handler$51 = async (c) => {
 	const project = c.get("project");
 	const user = c.get("user");
 	const artifactId = c.req.param("artifactId");
@@ -28848,7 +28918,7 @@ const handler$50 = async (c) => {
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/presign/POST.ts
 const SOURCE_BLOB_CONTENT_TYPE = "text/plain; charset=utf-8";
-const handler$49 = async (c) => {
+const handler$50 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -28876,7 +28946,7 @@ const handler$49 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/manifest/POST.ts
-const handler$48 = async (c) => {
+const handler$49 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -28908,7 +28978,7 @@ function extensionFromUpload(contentType, filename) {
 	if (fromName && /^[a-z0-9]+$/.test(fromName)) return fromName;
 	return chatAttachmentExtension(contentType) ?? "bin";
 }
-const handler$47 = async (c) => {
+const handler$48 = async (c) => {
 	const project = c.get("project");
 	const slug = c.req.param("slug");
 	if (!slug) return c.json(ErrorResponseSchema.parse({ error: "Agent slug is required" }), 400);
@@ -28933,7 +29003,7 @@ const handler$47 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/agents/[slug]/attachments/[...key]/GET.ts
-const handler$46 = async (c) => {
+const handler$47 = async (c) => {
 	const project = c.get("project");
 	const slug = c.req.param("slug");
 	const keyParam = c.req.param("key");
@@ -28979,7 +29049,7 @@ function resolveSourcePaths(rows, kindDir, filePaths) {
 		}] : [];
 	});
 }
-const handler$45 = async (c) => {
+const handler$46 = async (c) => {
 	const project = c.get("project");
 	const active = await selectActiveArtifactSourceManifestForProject(project.id);
 	if (!active || !active.sourceManifestJson) return c.json(ListProjectFilesResponseSchema.parse({
@@ -29024,7 +29094,7 @@ function ifNoneMatchMatches(ifNoneMatch, etag) {
 }
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/files/content/GET.ts
-const handler$44 = async (c) => {
+const handler$45 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -29070,7 +29140,7 @@ function createProjectReachabilityHandler(hosting) {
 }
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/GET.ts
-const handler$43 = async (c) => {
+const handler$44 = async (c) => {
 	const project = c.get("project");
 	const currentUserId = c.get("user").id;
 	const members = await selectProjectMembers(project.id);
@@ -29078,7 +29148,7 @@ const handler$43 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/POST.ts
-const handler$42 = async (c) => {
+const handler$43 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -29094,7 +29164,7 @@ const handler$42 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/[userId]/PATCH.ts
-const handler$41 = async (c) => {
+const handler$42 = async (c) => {
 	const project = c.get("project");
 	const userId = c.req.param("userId");
 	const body = await c.req.json().catch(() => null);
@@ -29111,7 +29181,7 @@ const handler$41 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/[userId]/DELETE.ts
-const handler$40 = async (c) => {
+const handler$41 = async (c) => {
 	const project = c.get("project");
 	const userId = c.req.param("userId");
 	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
@@ -29125,7 +29195,7 @@ const handler$40 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/me/DELETE.ts
-const handler$39 = async (c) => {
+const handler$40 = async (c) => {
 	const project = c.get("project");
 	const userId = c.get("user").id;
 	try {
@@ -29138,13 +29208,13 @@ const handler$39 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/settings/GET.ts
-const handler$38 = async (c) => {
+const handler$39 = async (c) => {
 	const project = c.get("project");
 	return c.json(ProjectSettingsResponseSchema.parse(mapProjectSettings(project)));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/settings/PATCH.ts
-const handler$37 = async (c) => {
+const handler$38 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -29269,7 +29339,7 @@ async function enrichCredentialInstances(rows, organizationId) {
 }
 //#endregion
 //#region src/routes/account/credentials/GET.ts
-const handler$36 = async (c) => {
+const handler$37 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const query = ListCredentialsPageQuerySchema.parse({
@@ -29298,7 +29368,7 @@ function withTargetScope$1(target, fn) {
 	if (target.projectScope) return runWithProjectScope(target.projectScope, fn);
 	return fn();
 }
-const handler$35 = async (c) => {
+const handler$36 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const parsed = CreateCredentialsRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -29414,7 +29484,7 @@ async function canAccessCredentialRow(c, row) {
 }
 //#endregion
 //#region src/routes/account/credentials/[credentialId]/GET.ts
-const handler$34 = async (c) => {
+const handler$35 = async (c) => {
 	const organization = c.get("organization");
 	const credentialId = c.req.param("credentialId") ?? "";
 	const row = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
@@ -29475,7 +29545,7 @@ function sharedConnectionIdFor(row, scopeType, scopeId) {
 	if (!row.connectionId) return row.sharedConnectionId;
 	return mcpEntityId(scopeType, scopeId);
 }
-const handler$33 = async (c) => {
+const handler$34 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const credentialId = c.req.param("credentialId") ?? "";
@@ -29576,7 +29646,7 @@ function withTargetScope(target, fn) {
 	if (target.projectScope) return runWithProjectScope(target.projectScope, fn);
 	return fn();
 }
-const handler$32 = async (c) => {
+const handler$33 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const credentialId = c.req.param("credentialId") ?? "";
@@ -29611,6 +29681,7 @@ const handler$32 = async (c) => {
 		}] : []
 	];
 	let apiKeyValue;
+	let keystrokeSecretValue;
 	if (source.authKind === "api_key") {
 		const raw = await readCredentialInstanceSecret(source.id);
 		if (!raw) return c.json({ error: "Credential secret not found" }, 400);
@@ -29619,6 +29690,13 @@ const handler$32 = async (c) => {
 		} catch {
 			return c.json({ error: "Credential secret is invalid" }, 400);
 		}
+	} else if (source.authKind === "keystroke") {
+		const raw = await readCredentialInstanceSecret(source.id);
+		if (raw) try {
+			keystrokeSecretValue = JSON.parse(raw);
+		} catch {
+			return c.json({ error: "Credential secret is invalid" }, 400);
+		}
 	}
 	const sourceLabel = source.label ?? source.name ?? source.appSlug;
 	const baseLabel = input.label?.trim() || `${sourceLabel} (copy)`;
@@ -29668,6 +29746,7 @@ const handler$32 = async (c) => {
 				createdAt: now,
 				updatedAt: now
 			});
+			if (source.authKind === "keystroke" && keystrokeSecretValue !== void 0) await setCredentialInstanceSecretValue(id, keystrokeSecretValue);
 		});
 		createdIds.push(id);
 	}
@@ -29699,6 +29778,7 @@ function createDeleteCredentialHandler(options = {}) {
 					await options.mcp.revokeConnection(resolveMcpEntityId(existing), existing.connectionId);
 				}
 			}
+			await deleteCredentialInstanceSecret(existing.id);
 		} else await deleteCredentialInstanceSecret(existing.id);
 		await deleteCredentialInstanceById(credentialId);
 		return c.body(null, 204);
@@ -29706,7 +29786,7 @@ function createDeleteCredentialHandler(options = {}) {
 }
 //#endregion
 //#region src/routes/account/members/GET.ts
-const handler$31 = async (c) => {
+const handler$32 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const query = ListOrganizationMembersPageQuerySchema.parse({
 		limit: c.req.query("limit") || void 0,
@@ -29764,7 +29844,7 @@ async function sendOrganizationInviteEmail(payload, resend) {
 }
 //#endregion
 //#region src/routes/account/members/invitations/POST.ts
-const handler$30 = async (c) => {
+const handler$31 = async (c) => {
 	const user = c.get("user");
 	const organization = c.get("organization");
 	const body = await c.req.json().catch(() => null);
@@ -29790,7 +29870,7 @@ const handler$30 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/members/[userId]/PATCH.ts
-const handler$29 = async (c) => {
+const handler$30 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const userId = c.req.param("userId");
 	const body = await c.req.json().catch(() => null);
@@ -29807,7 +29887,7 @@ const handler$29 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/members/[userId]/DELETE.ts
-const handler$28 = async (c) => {
+const handler$29 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const userId = c.req.param("userId");
 	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
@@ -29821,13 +29901,13 @@ const handler$28 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/invitations/GET.ts
-const handler$27 = async (c) => {
+const handler$28 = async (c) => {
 	const invitations = await selectPendingInvitationsForUser(c.get("user").id);
 	return c.json(ListOrganizationInvitationsResponseSchema.parse(invitations.map(mapOrganizationInvitation)));
 };
 //#endregion
 //#region src/routes/account/invitations/[invitationId]/accept/POST.ts
-const handler$26 = async (c) => {
+const handler$27 = async (c) => {
 	const user = c.get("user");
 	const invitationId = c.req.param("invitationId");
 	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
@@ -29848,7 +29928,7 @@ const handler$26 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/invitations/[invitationId]/decline/POST.ts
-const handler$25 = async (c) => {
+const handler$26 = async (c) => {
 	const user = c.get("user");
 	const invitationId = c.req.param("invitationId");
 	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
@@ -29936,13 +30016,13 @@ function appRowToCustomAppDetail(row) {
 }
 //#endregion
 //#region src/routes/account/apps/GET.ts
-const handler$24 = async (c) => {
+const handler$25 = async (c) => {
 	const apps = (await listAppsForOrganization(c.get("organization").organizationId)).map(appRowToCatalogSummary);
 	return c.json(ListAppsResponseSchema.parse(apps));
 };
 //#endregion
 //#region src/routes/account/apps/POST.ts
-const handler$23 = async (c) => {
+const handler$24 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const parsed = CreateCustomAppRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -29987,7 +30067,7 @@ const handler$23 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/logo/POST.ts
-const handler$22 = async (c) => {
+const handler$23 = async (c) => {
 	const parsed = FinalizeCustomAppLogoRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid logo finalize request" }), 400);
 	const { organizationId } = c.get("organization");
@@ -30002,7 +30082,7 @@ const handler$22 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/logo/presign/POST.ts
-const handler$21 = async (c) => {
+const handler$22 = async (c) => {
 	const parsed = PresignCustomAppLogoRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid logo upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -30020,7 +30100,7 @@ const handler$21 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/discover/POST.ts
-const handler$20 = async (c) => {
+const handler$21 = async (c) => {
 	const parsed = McpDiscoverRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json({ error: "Invalid request body" }, 400);
 	try {
@@ -30034,7 +30114,7 @@ const handler$20 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/discover-openapi/POST.ts
-const handler$19 = async (c) => {
+const handler$20 = async (c) => {
 	const parsed = OpenApiDiscoverRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json({ error: "Invalid request body" }, 400);
 	try {
@@ -30051,7 +30131,7 @@ const handler$19 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/discover-graphql/POST.ts
-const handler$18 = async (c) => {
+const handler$19 = async (c) => {
 	const parsed = GraphqlDiscoverRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json({ error: "Invalid request body" }, 400);
 	try {
@@ -30083,7 +30163,7 @@ function sanitizedUrl(value) {
 }
 //#endregion
 //#region src/routes/account/apps/[slug]/mcp/oauth/connections/POST.ts
-const handler$17 = async (c) => {
+const handler$18 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const appSlug = c.req.param("slug")?.trim();
@@ -30177,7 +30257,7 @@ function buildOAuthWebLandingUrl(webOrigin, params) {
 function normalizedOAuthError(value) {
 	return /^[a-z0-9_]+$/i.test(value) ? value : "authorization_failed";
 }
-const handler$16 = async (c) => {
+const handler$17 = async (c) => {
 	const code = c.req.query("code")?.trim();
 	const state = c.req.query("state")?.trim();
 	const oauthError = c.req.query("error")?.trim();
@@ -30310,7 +30390,7 @@ const handler$16 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/slug-available/GET.ts
-const handler$15 = async (c) => {
+const handler$16 = async (c) => {
 	const organization = c.get("organization");
 	const parsed = AppSlugAvailabilityQuerySchema.safeParse({ slug: c.req.query("slug") });
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
@@ -30321,7 +30401,7 @@ const handler$15 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/[slug]/GET.ts
-const handler$14 = async (c) => {
+const handler$15 = async (c) => {
 	const organization = c.get("organization");
 	const slug = c.req.param("slug") ?? "";
 	if (!slug) return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
@@ -30336,7 +30416,7 @@ const handler$14 = async (c) => {
 //#endregion
 //#region src/routes/account/apps/[slug]/catalog/GET.ts
 /** Full catalog entry (scopes + credential template) for connect UI. */
-const handler$13 = async (c) => {
+const handler$14 = async (c) => {
 	const organization = c.get("organization");
 	const slug = c.req.param("slug") ?? "";
 	if (!slug) return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
@@ -30369,14 +30449,14 @@ function projectChannelPlatform(row) {
 	});
 }
 /** Gateway platforms only — avoids downloading the full apps catalog. */
-const handler$12 = async (c) => {
+const handler$13 = async (c) => {
 	const organization = c.get("organization");
 	const platforms = (await Promise.all(Object.keys(GATEWAY_BY_APP_SLUG).map((slug) => selectAppForOrganization(organization.organizationId, slug)))).flatMap((row) => row ? [projectChannelPlatform(row)] : []);
 	return c.json(ListChannelPlatformsResponseSchema.parse(platforms));
 };
 //#endregion
 //#region src/routes/account/api-keys/GET.ts
-const handler$11 = async (c) => {
+const handler$12 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const records = apiKeyListScope(accessContext(c)).kind === "all" ? await listOrgPlatformApiKeysForOrganization(organizationId) : await listOrgPlatformApiKeysForUser(organizationId, user.id);
@@ -30393,7 +30473,7 @@ const handler$11 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/api-keys/POST.ts
-const handler$10 = async (c) => {
+const handler$11 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const body = CreateApiKeyRequestSchema.parse(await c.req.json());
@@ -30416,7 +30496,7 @@ const handler$10 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/api-keys/[apiKeyId]/DELETE.ts
-const handler$9 = async (c) => {
+const handler$10 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const apiKeyId = c.req.param("apiKeyId");
@@ -30441,7 +30521,7 @@ const handler$9 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/managed-service-credentials/GET.ts
-const handler$8 = async (c) => {
+const handler$9 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const kindParam = c.req.query("kind");
@@ -30467,7 +30547,7 @@ const handler$8 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/managed-service-credentials/POST.ts
-const handler$7 = async (c) => {
+const handler$8 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	let raw;
@@ -30504,7 +30584,7 @@ const handler$7 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/managed-service-credentials/[id]/PATCH.ts
-const handler$6 = async (c) => {
+const handler$7 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const credentialId = c.req.param("id");
@@ -30543,7 +30623,7 @@ const handler$6 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/managed-service-credentials/[id]/DELETE.ts
-const handler$5 = async (c) => {
+const handler$6 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const credentialId = c.req.param("id");
 	if (!credentialId) return c.json(ErrorResponseSchema.parse({ error: "Credential id is required" }), 400);
@@ -30589,6 +30669,7 @@ function teamRequestHeading(type) {
 		case "contact": return "Contact request";
 		case "enterprise-upgrade": return "Enterprise upgrade requested";
 		case "verification": return "Organization access requested";
+		case "connector-access": return "Connector sandbox access requested";
 		default: return type;
 	}
 }
@@ -30610,7 +30691,8 @@ function buildTeamRequestSlackPayload(input) {
 		case "org-deletion":
 		case "contact":
 		case "enterprise-upgrade":
-		case "verification": break;
+		case "verification":
+		case "connector-access": break;
 		default: return input.type;
 	}
 	const timestamp = input.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -30634,6 +30716,10 @@ function buildTeamRequestSlackPayload(input) {
 			text: `*Organization:*\n${input.org.name}\n\`${input.org.slug}\`\n\`${input.org.id}\``
 		}
 	];
+	if (input.type === "connector-access" && input.appSlug) fields.push({
+		type: "mrkdwn",
+		text: `*Connector:*\n\`${escapeSlackText(input.appSlug)}\``
+	});
 	const blocks = [{
 		type: "header",
 		text: {
@@ -30645,7 +30731,7 @@ function buildTeamRequestSlackPayload(input) {
 		type: "section",
 		fields
 	}];
-	if ((input.type === "contact" || input.type === "verification") && input.message?.trim()) blocks.push({
+	if ((input.type === "contact" || input.type === "verification" || input.type === "connector-access") && input.message?.trim()) blocks.push({
 		type: "section",
 		text: {
 			type: "mrkdwn",
@@ -30662,7 +30748,7 @@ async function postTeamRequestToSlack(input) {
 }
 //#endregion
 //#region src/routes/account/team-requests/POST.ts
-const handler$4 = async (c) => {
+const handler$5 = async (c) => {
 	const user = c.get("user");
 	const organizationContext = c.get("organization");
 	const parsed = SubmitTeamRequestRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -30676,6 +30762,7 @@ const handler$4 = async (c) => {
 		await postTeamRequestToSlack({
 			type: parsed.data.type,
 			message: parsed.data.message,
+			appSlug: parsed.data.appSlug,
 			user: {
 				id: user.id,
 				name: user.name,
@@ -30695,11 +30782,94 @@ const handler$4 = async (c) => {
 		name: "support:requested",
 		actorId: user.id,
 		organizationId: organization.id,
-		properties: { request_type: parsed.data.type }
+		properties: {
+			request_type: parsed.data.type,
+			...parsed.data.appSlug ? { app_slug: parsed.data.appSlug } : {}
+		}
 	}).catch(() => {});
 	return c.json(SubmitTeamRequestResponseSchema.parse({ ok: true }), 200);
 };
 //#endregion
+//#region src/lib/agent-feedback-slack.ts
+/** Slack section mrkdwn text limit. */
+const SLACK_SECTION_TEXT_LIMIT = 3e3;
+function chunkSlackText(text, size) {
+	if (text.length <= size) return [text];
+	const chunks = [];
+	for (let i = 0; i < text.length; i += size) chunks.push(text.slice(i, i + size));
+	return chunks;
+}
+function buildAgentFeedbackSlackText(input) {
+	const lines = [
+		`*User:* ${escapeSlackText(input.user.name.trim())}`,
+		`*Email:* ${escapeSlackText(input.user.email.trim())}`,
+		`*Org:* ${escapeSlackText(input.org.name.trim())} (\`${escapeSlackText(input.org.slug.trim())}\`)`
+	];
+	if (input.cliVersion?.trim()) lines.push(`*CLI:* ${escapeSlackText(input.cliVersion.trim())}`);
+	if (input.projectSlug?.trim()) lines.push(`*Project:* \`${escapeSlackText(input.projectSlug.trim())}\``);
+	lines.push("", "-------------------------", "", escapeSlackText(input.message.trim()));
+	return lines.join("\n");
+}
+function buildAgentFeedbackSlackPayload(input) {
+	const body = buildAgentFeedbackSlackText(input);
+	return {
+		text: `Feedback Report from ${input.user.name} (${input.org.name})`,
+		blocks: chunkSlackText(body, SLACK_SECTION_TEXT_LIMIT).map((chunk) => ({
+			type: "section",
+			text: {
+				type: "mrkdwn",
+				text: chunk
+			}
+		}))
+	};
+}
+async function postAgentFeedbackToSlack(input) {
+	await postAgentFeedbackSlackWebhook(buildAgentFeedbackSlackPayload(input));
+}
+//#endregion
+//#region src/routes/account/agent-feedback/POST.ts
+const handler$4 = async (c) => {
+	const user = c.get("user");
+	const organizationContext = c.get("organization");
+	const parsed = SubmitAgentFeedbackRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) {
+		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
+		return c.json({ error: message }, 400);
+	}
+	const organization = await selectOrganizationById(organizationContext.organizationId);
+	if (!organization) return c.json({ error: "Organization not found" }, 404);
+	try {
+		await postAgentFeedbackToSlack({
+			message: parsed.data.message,
+			cliVersion: parsed.data.cliVersion,
+			projectSlug: parsed.data.projectSlug,
+			user: {
+				name: user.name,
+				email: user.email
+			},
+			org: {
+				name: organization.name,
+				slug: organization.slug
+			}
+		});
+	} catch (error) {
+		console.error("Failed to deliver agent feedback to Slack", error);
+		return c.json({ error: "Failed to deliver feedback" }, 502);
+	}
+	trackProductEvent({
+		name: "feedback:submitted",
+		actorId: user.id,
+		organizationId: organization.id,
+		properties: {
+			source: "cli-agent",
+			has_cli_version: Boolean(parsed.data.cliVersion),
+			has_project_slug: Boolean(parsed.data.projectSlug),
+			message_length: parsed.data.message.length
+		}
+	}).catch(() => {});
+	return c.json(SubmitAgentFeedbackResponseSchema.parse({ ok: true }), 200);
+};
+//#endregion
 //#region src/routes/account/templates/GET.ts
 function toIso(date) {
 	return date.toISOString();
@@ -30747,7 +30917,7 @@ function mountAccountRoutes(options) {
 	const projectScoped = new Hono();
 	const protect = requireSession(createDefaultAuthJwtVerifier());
 	const deleteCredential = createDeleteCredentialHandler({ mcp: options.mcp });
-	account.get("/mcp/oauth/callback", handler$16);
+	account.get("/mcp/oauth/callback", handler$17);
 	account.use("/*", protect);
 	orgScoped.use("/*", protect);
 	orgScoped.use("/*", requireOrganization());
@@ -30769,119 +30939,120 @@ function mountAccountRoutes(options) {
 	const requireProjectManageMembers = authorize(projectActions.manageMembers);
 	const requireInvitableProjectRole = authorizePayload(InviteProjectMembersRequestSchema, ({ c, ctx, body }) => canInviteToProject(ctx, { invitePermission: getProjectInvitePermission(c) }, body.role));
 	const requireOrgParam = requireOrganizationParam();
-	account.get("/organizations", handler$105);
-	account.get("/organizations/slug-available", handler$104);
+	account.get("/organizations", handler$106);
+	account.get("/organizations/slug-available", handler$105);
 	account.post("/organizations", createOrganizationHandler(options));
-	account.get("/organizations/:organizationId", requireOrgParam, handler$103);
-	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$102);
-	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$101);
-	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$100);
-	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$99);
-	account.get("/invitations", handler$27);
-	account.post("/invitations/:invitationId/accept", handler$26);
-	account.post("/invitations/:invitationId/decline", handler$25);
-	account.get("/users/me/avatar", handler$110);
-	account.post("/users/me/avatar/presign", handler$109);
-	account.patch("/users/me/avatar", handler$108);
-	account.get("/users/me/preferences", handler$107);
-	account.patch("/users/me/preferences", handler$106);
+	account.get("/organizations/:organizationId", requireOrgParam, handler$104);
+	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$103);
+	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$102);
+	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$101);
+	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$100);
+	account.get("/invitations", handler$28);
+	account.post("/invitations/:invitationId/accept", handler$27);
+	account.post("/invitations/:invitationId/decline", handler$26);
+	account.get("/users/me/avatar", handler$111);
+	account.post("/users/me/avatar/presign", handler$110);
+	account.patch("/users/me/avatar", handler$109);
+	account.get("/users/me/preferences", handler$108);
+	account.patch("/users/me/preferences", handler$107);
 	const withOrgDb = withOrganizationProjectDatabase();
-	orgScoped.get("/apps", handler$24);
+	orgScoped.get("/apps", handler$25);
 	orgScoped.get("/templates", listTemplatesHandler);
 	orgScoped.get("/templates/:slug", getTemplateHandler);
 	orgScoped.get("/templates/:slug/files", getTemplateFilesHandler);
-	orgScoped.get("/apps/slug-available", handler$15);
-	orgScoped.get("/channel-platforms", handler$12);
-	orgScoped.post("/apps/discover", requireOrgUpdate, handler$20);
-	orgScoped.post("/apps/discover-openapi", requireOrgUpdate, handler$19);
-	orgScoped.post("/apps/discover-graphql", requireOrgUpdate, handler$18);
-	orgScoped.post("/apps/logo/presign", requireOrgUpdate, handler$21);
-	orgScoped.post("/apps/logo", requireOrgUpdate, handler$22);
-	orgScoped.post("/apps", requireOrgUpdate, handler$23);
-	orgScoped.post("/apps/:slug/mcp/oauth/connections", requireOrgUpdate, withOrgDb, handler$17);
-	orgScoped.get("/apps/:slug/catalog", handler$13);
-	orgScoped.get("/apps/:slug", handler$14);
-	account.post("/team-requests", requireOrganization(), handler$4);
-	orgScoped.get("/members", handler$31);
-	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$30);
-	orgScoped.patch("/members/:userId", requireUserManage, handler$29);
-	orgScoped.delete("/members/:userId", requireUserManage, handler$28);
-	orgScoped.get("/api-keys", handler$11);
-	orgScoped.post("/api-keys", requireApiKeyCreate, handler$10);
-	orgScoped.delete("/api-keys/:apiKeyId", handler$9);
-	orgScoped.get("/managed-service-credentials", requireManagedServicesRead, handler$8);
-	orgScoped.post("/managed-service-credentials", requireManagedServicesManage, handler$7);
-	orgScoped.patch("/managed-service-credentials/:id", requireManagedServicesManage, handler$6);
-	orgScoped.delete("/managed-service-credentials/:id", requireManagedServicesManage, handler$5);
-	orgScoped.get("/agents", withOrgDb, handler$96);
-	orgScoped.get("/agents/:agentId", withOrgDb, handler$95);
-	orgScoped.get("/agents/:agentId/memory/files", withOrgDb, handler$94);
-	orgScoped.get("/agents/:agentId/memory/files/content", withOrgDb, handler$93);
-	orgScoped.get("/agents/:agentId/workspace/files", withOrgDb, handler$92);
-	orgScoped.get("/agents/:agentId/workspace/files/content", withOrgDb, handler$91);
-	orgScoped.get("/workflows", withOrgDb, handler$89);
-	orgScoped.get("/workflows/forms", handler$88);
-	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$87);
-	orgScoped.get("/workflows/:workflowId/canvas", withOrgDb, handler$86);
-	orgScoped.get("/workflows/:workflowId/canvas/credentials", withOrgDb, handler$85);
-	orgScoped.get("/workflows/:workflowId/canvas/runs/:runId", withOrgDb, handler$84);
-	orgScoped.get("/workflows/:workflowId/overview", withOrgDb, handler$83);
-	orgScoped.get("/workflows/:workflowId/runs", withOrgDb, handler$74);
-	orgScoped.get("/workflows/:workflowId/run-inputs", withOrgDb, handler$82);
-	orgScoped.put("/workflows/:workflowId/run-inputs", withOrgDb, handler$81);
-	orgScoped.post("/workflows/:workflowId/run", withOrgDb, handler$80);
-	orgScoped.get("/workflows/:workflowId/form", withOrgDb, handler$79);
-	orgScoped.put("/workflows/:workflowId/form", withOrgDb, handler$78);
-	orgScoped.delete("/workflows/:workflowId/form", withOrgDb, handler$77);
-	orgScoped.post("/workflows/:workflowId/form/rotate", withOrgDb, handler$76);
-	orgScoped.post("/workflows/:workflowId/attachments/presign", withOrgDb, handler$75);
-	orgScoped.get("/skills", withOrgDb, handler$72);
-	orgScoped.get("/skills/:skillId", withOrgDb, handler$71);
-	orgScoped.get("/triggers", withOrgDb, handler$70);
-	orgScoped.get("/triggers/:triggerId", withOrgDb, handler$69);
-	orgScoped.get("/triggers/:triggerId/runs", withOrgDb, handler$68);
-	orgScoped.get("/triggers/:triggerId/file", withOrgDb, handler$67);
-	orgScoped.get("/triggers/:triggerId/overview", withOrgDb, handler$66);
-	orgScoped.get("/triggers/:triggerId/invoke-inputs", withOrgDb, handler$63);
-	orgScoped.post("/triggers/:triggerId/invoke", withOrgDb, handler$64);
-	orgScoped.patch("/triggers/:triggerId/attachments/:attachmentId", withOrgDb, handler$65);
-	orgScoped.get("/recents", withOrgDb, handler$62);
-	orgScoped.get("/history", withOrgDb, handler$98);
-	orgScoped.get("/history/:runId", withOrgDb, handler$97);
-	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$73);
-	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$90);
-	orgScoped.get("/credentials", withOrgDb, handler$36);
-	orgScoped.post("/credentials", withOrgDb, handler$35);
-	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$34(c, next));
-	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$33);
-	orgScoped.post("/credentials/:credentialId/duplicate", withOrgDb, handler$32);
+	orgScoped.get("/apps/slug-available", handler$16);
+	orgScoped.get("/channel-platforms", handler$13);
+	orgScoped.post("/apps/discover", requireOrgUpdate, handler$21);
+	orgScoped.post("/apps/discover-openapi", requireOrgUpdate, handler$20);
+	orgScoped.post("/apps/discover-graphql", requireOrgUpdate, handler$19);
+	orgScoped.post("/apps/logo/presign", requireOrgUpdate, handler$22);
+	orgScoped.post("/apps/logo", requireOrgUpdate, handler$23);
+	orgScoped.post("/apps", requireOrgUpdate, handler$24);
+	orgScoped.post("/apps/:slug/mcp/oauth/connections", requireOrgUpdate, withOrgDb, handler$18);
+	orgScoped.get("/apps/:slug/catalog", handler$14);
+	orgScoped.get("/apps/:slug", handler$15);
+	account.post("/team-requests", requireOrganization(), handler$5);
+	account.post("/agent-feedback", requireOrganization(), handler$4);
+	orgScoped.get("/members", handler$32);
+	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$31);
+	orgScoped.patch("/members/:userId", requireUserManage, handler$30);
+	orgScoped.delete("/members/:userId", requireUserManage, handler$29);
+	orgScoped.get("/api-keys", handler$12);
+	orgScoped.post("/api-keys", requireApiKeyCreate, handler$11);
+	orgScoped.delete("/api-keys/:apiKeyId", handler$10);
+	orgScoped.get("/managed-service-credentials", requireManagedServicesRead, handler$9);
+	orgScoped.post("/managed-service-credentials", requireManagedServicesManage, handler$8);
+	orgScoped.patch("/managed-service-credentials/:id", requireManagedServicesManage, handler$7);
+	orgScoped.delete("/managed-service-credentials/:id", requireManagedServicesManage, handler$6);
+	orgScoped.get("/agents", withOrgDb, handler$97);
+	orgScoped.get("/agents/:agentId", withOrgDb, handler$96);
+	orgScoped.get("/agents/:agentId/memory/files", withOrgDb, handler$95);
+	orgScoped.get("/agents/:agentId/memory/files/content", withOrgDb, handler$94);
+	orgScoped.get("/agents/:agentId/workspace/files", withOrgDb, handler$93);
+	orgScoped.get("/agents/:agentId/workspace/files/content", withOrgDb, handler$92);
+	orgScoped.get("/workflows", withOrgDb, handler$90);
+	orgScoped.get("/workflows/forms", handler$89);
+	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$88);
+	orgScoped.get("/workflows/:workflowId/canvas", withOrgDb, handler$87);
+	orgScoped.get("/workflows/:workflowId/canvas/credentials", withOrgDb, handler$86);
+	orgScoped.get("/workflows/:workflowId/canvas/runs/:runId", withOrgDb, handler$85);
+	orgScoped.get("/workflows/:workflowId/overview", withOrgDb, handler$84);
+	orgScoped.get("/workflows/:workflowId/runs", withOrgDb, handler$75);
+	orgScoped.get("/workflows/:workflowId/run-inputs", withOrgDb, handler$83);
+	orgScoped.put("/workflows/:workflowId/run-inputs", withOrgDb, handler$82);
+	orgScoped.post("/workflows/:workflowId/run", withOrgDb, handler$81);
+	orgScoped.get("/workflows/:workflowId/form", withOrgDb, handler$80);
+	orgScoped.put("/workflows/:workflowId/form", withOrgDb, handler$79);
+	orgScoped.delete("/workflows/:workflowId/form", withOrgDb, handler$78);
+	orgScoped.post("/workflows/:workflowId/form/rotate", withOrgDb, handler$77);
+	orgScoped.post("/workflows/:workflowId/attachments/presign", withOrgDb, handler$76);
+	orgScoped.get("/skills", withOrgDb, handler$73);
+	orgScoped.get("/skills/:skillId", withOrgDb, handler$72);
+	orgScoped.get("/triggers", withOrgDb, handler$71);
+	orgScoped.get("/triggers/:triggerId", withOrgDb, handler$70);
+	orgScoped.get("/triggers/:triggerId/runs", withOrgDb, handler$69);
+	orgScoped.get("/triggers/:triggerId/file", withOrgDb, handler$68);
+	orgScoped.get("/triggers/:triggerId/overview", withOrgDb, handler$67);
+	orgScoped.get("/triggers/:triggerId/invoke-inputs", withOrgDb, handler$64);
+	orgScoped.post("/triggers/:triggerId/invoke", withOrgDb, handler$65);
+	orgScoped.patch("/triggers/:triggerId/attachments/:attachmentId", withOrgDb, handler$66);
+	orgScoped.get("/recents", withOrgDb, handler$63);
+	orgScoped.get("/history", withOrgDb, handler$99);
+	orgScoped.get("/history/:runId", withOrgDb, handler$98);
+	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$74);
+	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$91);
+	orgScoped.get("/credentials", withOrgDb, handler$37);
+	orgScoped.post("/credentials", withOrgDb, handler$36);
+	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$35(c, next));
+	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$34);
+	orgScoped.post("/credentials/:credentialId/duplicate", withOrgDb, handler$33);
 	orgScoped.delete("/credentials/:credentialId", withOrgDb, deleteCredential);
-	orgScoped.get("/projects", handler$61);
-	orgScoped.get("/projects/slug-available", handler$58);
-	orgScoped.get("/projects/metrics", withOrgDb, handler$60);
+	orgScoped.get("/projects", handler$62);
+	orgScoped.get("/projects/slug-available", handler$59);
+	orgScoped.get("/projects/metrics", withOrgDb, handler$61);
 	orgScoped.post("/projects", createCreateProjectHandler(options.projectQuotaGate));
-	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$57);
-	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$56);
-	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$55);
-	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$38);
-	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$37);
-	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$43);
-	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$42);
-	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$41);
-	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$40);
-	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$39);
+	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$58);
+	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$57);
+	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$56);
+	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$39);
+	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$38);
+	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$44);
+	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$43);
+	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$42);
+	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$41);
+	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$40);
 	projectScoped.get("/:projectId/reachability", requireProject(), requireProjectMember, createProjectReachabilityHandler(options.hosting));
-	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$45);
-	projectScoped.post("/:projectId/agents/:slug/attachments/presign", requireProject(), requireProjectMember, withOrgDb, handler$47);
-	projectScoped.get("/:projectId/agents/:slug/attachments/:key{.+}", requireProject(), requireProjectMember, withOrgDb, handler$46);
-	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$44);
-	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$54);
-	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$52);
-	projectScoped.get("/:projectId/artifacts/active/source", requireProject(), requireProjectMember, withOrgDb, handler$51);
-	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$53);
-	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$50);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$49);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$48);
+	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$46);
+	projectScoped.post("/:projectId/agents/:slug/attachments/presign", requireProject(), requireProjectMember, withOrgDb, handler$48);
+	projectScoped.get("/:projectId/agents/:slug/attachments/:key{.+}", requireProject(), requireProjectMember, withOrgDb, handler$47);
+	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$45);
+	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$55);
+	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$53);
+	projectScoped.get("/:projectId/artifacts/active/source", requireProject(), requireProjectMember, withOrgDb, handler$52);
+	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$54);
+	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$51);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$50);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$49);
 	orgScoped.route("/projects", projectScoped);
 	account.route("/", orgScoped);
 	return account;
@@ -31013,7 +31184,7 @@ async function runOrgDatabaseQuery(options, query) {
 function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, mcp) {
 	const internal = new Hono();
 	const protect = requireWorkerToken(workerToken);
-	const materialize = createCredentialMaterializeHandler(tokenRefresh);
+	const materialize = createCredentialMaterializeHandler(tokenRefresh, { resolveSandboxAccessToken: mcp ? (connectionId) => mcp.resolveSandboxAccessToken(connectionId) : void 0 });
 	internal.use("/orgs/:organizationId/db/*", async (c, next) => {
 		const verified = verifyOrgWorkerToken(workerToken, readWorkerTokenFromRequest(c));
 		if (!verified || verified.organizationId !== c.req.param("organizationId")) return c.json({
@@ -31563,4 +31734,4 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 //#endregion
 export { r1 as S, o as _, c as a, b$1 as b, a$1 as c, c$1 as d, r as f, e as g, u as h, n$1 as i, d$1 as l, b as m, n, p as o, r$1 as p, i as r, x as s, startPlatformServer as t, x$1 as u, r$3 as v, I1 as x, h as y };
 
-//# sourceMappingURL=start-C8A5Y1es.mjs.map
+//# sourceMappingURL=start-B3sE8bjc.mjs.map