@keystrokehq/platform 0.1.2 → 0.1.4

package/dist/dist-B1hOOWjl.mjs

@@ -1,3044 +0,0 @@
-import Docker from "dockerode";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { spawnSync } from "node:child_process";
-import { tmpdir } from "node:os";
-import { z } from "zod";
-import { CreateBucketCommand, DeleteBucketCommand, DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutBucketAclCommand, PutBucketPolicyCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-//#region ../../packages/hosting/dist/index.mjs
-const PROJECT_SERVER_PORT = 3e3;
-const PROJECT_SERVER_ROOT = "/app";
-const PROJECT_SERVER_FRAMEWORK_NODE_MODULES = `/opt/keystroke/node_modules`;
-const PROJECT_SERVER_HEALTH = {
-	path: "/health",
-	port: PROJECT_SERVER_PORT
-};
-const RUNTIME_ENV_KEYS = [
-	"BETTER_AUTH_SECRET",
-	"PUBLIC_SERVER_URL",
-	"PUBLIC_WEB_URL",
-	"POSTGRES_SSL",
-	"KEYSTROKE_SCHEDULER_MODULE",
-	"UPSTASH_REDIS_URL",
-	"REDIS_URL",
-	"KEYSTROKE_QUEUE_PREFIX"
-];
-/** Provider and gateway env forwarded from the platform into project servers. */
-const PROVIDER_ENV_KEYS = [
-	"ANTHROPIC_API_KEY",
-	"OPENAI_API_KEY",
-	"AI_GATEWAY_API_KEY",
-	"AI_GATEWAY_BASE_URL"
-];
-/** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
-const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
-/** Per-project postgres env injected into every project server container/machine. */
-function projectDatabaseRuntimeEnv(database) {
-	return {
-		POSTGRES_HOST: rewriteLoopbackHost(database.host),
-		POSTGRES_PORT: String(database.port),
-		POSTGRES_DB: database.database,
-		POSTGRES_USER: database.user,
-		POSTGRES_PASSWORD: database.password,
-		DATABASE_SEARCH_PATH: database.searchPath
-	};
-}
-/**
-* Builds the launch spec for a single project server. `artifactStorageKey` is the
-* object key for that deploy's built `dist` tarball in the org bucket — there is
-* no base image, so it is required.
-*/
-function resolveRuntimeLaunch(options, artifactStorageKey, database, extraEnv) {
-	if (!artifactStorageKey) throw new Error("Cannot start a project server without an artifact storage key");
-	const env = options.env ?? process.env;
-	return {
-		image: resolveProjectServerImage(env, options.image),
-		env: buildRuntimeEnv(env, artifactStorageKey, database, extraEnv),
-		port: PROJECT_SERVER_PORT,
-		health: PROJECT_SERVER_HEALTH
-	};
-}
-/** Env vars passed into the project server container/machine. */
-function buildRuntimeEnv(source, artifactStorageKey, database, extraEnv) {
-	const entries = new Map([
-		["PORT", String(PROJECT_SERVER_PORT)],
-		["KEYSTROKE_ROOT", PROJECT_SERVER_ROOT],
-		["KEYSTROKE_RUNTIME_NODE_MODULES", PROJECT_SERVER_FRAMEWORK_NODE_MODULES],
-		["ARTIFACT_STORAGE_KEY", artifactStorageKey],
-		["PROJECT_ID", database.projectId],
-		["ORGANIZATION_ID", database.organizationId],
-		["TENANT_ID", database.organizationId]
-	]);
-	for (const key of RUNTIME_ENV_KEYS) {
-		const value = source[key]?.trim();
-		if (!value) {
-			if (key === "POSTGRES_SSL") throw new Error("POSTGRES_SSL is required");
-			continue;
-		}
-		entries.set(key, value);
-	}
-	if (!extraEnv) for (const key of PROVIDER_ENV_KEYS) {
-		const value = source[key]?.trim();
-		if (value) entries.set(key, value);
-	}
-	const worker = resolveWorkerRuntimeConfig(source);
-	entries.set("PLATFORM_URL", worker.platformUrl);
-	entries.set("WORKER_INTERNAL_TOKEN", worker.workerToken);
-	for (const [key, value] of Object.entries(projectDatabaseRuntimeEnv(database))) entries.set(key, value);
-	if (extraEnv) for (const [key, value] of Object.entries(extraEnv)) entries.set(key, value);
-	return Object.fromEntries(entries);
-}
-function resolvePlatformWorkerToken(source = process.env) {
-	const explicit = source.PLATFORM_WORKER_TOKEN?.trim() ?? source.WORKER_INTERNAL_TOKEN?.trim();
-	if (explicit) return explicit;
-	if (source.NODE_ENV === "production") return;
-	return DEV_PLATFORM_WORKER_TOKEN;
-}
-/** Platform API URL reachable from a project-server container. */
-const DEV_PLATFORM_URL = "http://localhost:3002";
-function resolveWorkerPlatformUrl(source = process.env) {
-	const raw = source.PLATFORM_URL?.trim() ?? source.PUBLIC_PLATFORM_URL?.trim() ?? (source.NODE_ENV === "production" ? void 0 : DEV_PLATFORM_URL);
-	if (!raw) return;
-	return rewriteLoopbackUrl(raw);
-}
-/** Rewrite loopback hosts so containers can reach Postgres and other host services. */
-function rewriteLoopbackHost(host) {
-	if (host === "localhost" || host === "127.0.0.1") return "host.docker.internal";
-	return host;
-}
-function rewriteLoopbackUrl(url) {
-	try {
-		const parsed = new URL(url);
-		parsed.hostname = rewriteLoopbackHost(parsed.hostname);
-		return parsed.toString().replace(/\/$/, "");
-	} catch {
-		return url;
-	}
-}
-/** dockerode expects `KEY=value` strings. */
-function formatDockerEnv(env) {
-	return Object.entries(env).map(([key, value]) => `${key}=${value}`);
-}
-function resolveProjectServerImage(env = process.env, override) {
-	return override ?? env.PROJECT_DOCKER_IMAGE ?? env.TENANT_DOCKER_IMAGE ?? "keystroke/project-server:local";
-}
-var WorkerRuntimeConfigError = class extends Error {
-	missing;
-	constructor(missing) {
-		super(`Worker runtime config incomplete (missing: ${missing.join(", ")}). In production set PLATFORM_WORKER_TOKEN and PUBLIC_PLATFORM_URL (or PLATFORM_URL).`);
-		this.name = "WorkerRuntimeConfigError";
-		this.missing = missing;
-	}
-};
-/** Fail fast when the platform cannot start worker-mode project servers. */
-function resolveWorkerRuntimeConfig(source = process.env) {
-	const platformUrl = resolveWorkerPlatformUrl(source);
-	const workerToken = resolvePlatformWorkerToken(source);
-	const missing = [];
-	if (!platformUrl) missing.push("PUBLIC_PLATFORM_URL or PLATFORM_URL");
-	if (!workerToken) missing.push("PLATFORM_WORKER_TOKEN");
-	if (missing.length > 0) throw new WorkerRuntimeConfigError(missing);
-	return {
-		platformUrl,
-		workerToken
-	};
-}
-const DEFAULT_TIMEOUT_MS = 12e4;
-const DEFAULT_INTERVAL_MS = 500;
-async function waitForHealth(baseUrl, options = {}) {
-	const fetchImpl = options.fetchImpl ?? fetch;
-	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-	const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
-	const deadline = Date.now() + timeoutMs;
-	const url = new URL(PROJECT_SERVER_HEALTH.path, baseUrl);
-	while (Date.now() < deadline) {
-		try {
-			if ((await fetchImpl(url, { signal: AbortSignal.timeout(2e3) })).ok) return;
-		} catch {}
-		await sleep(intervalMs);
-	}
-	throw new Error(`Project server health check timed out after ${timeoutMs}ms (${url})`);
-}
-function sleep(ms) {
-	return new Promise((resolve) => {
-		setTimeout(resolve, ms);
-	});
-}
-const MINIO_DOCKER_NETWORK = process.env.MINIO_DOCKER_NETWORK ?? "keystroke";
-function createDockerRuntime(options = {}) {
-	const docker = options.docker ?? new Docker();
-	return { async start(input) {
-		const launch = resolveRuntimeLaunch(options, input.artifactStorageKey, input.database, input.env);
-		await ensureImage(docker, launch.image);
-		await removeExistingContainer(docker, input.projectId);
-		const container = await docker.createContainer({
-			Image: launch.image,
-			name: containerName(input.projectId),
-			Labels: {
-				"keystroke.project.id": input.projectId,
-				"keystroke.project.name": input.name
-			},
-			ExposedPorts: { [`${launch.port}/tcp`]: {} },
-			HostConfig: {
-				ExtraHosts: ["host.docker.internal:host-gateway"],
-				PortBindings: { [`${launch.port}/tcp`]: [{ HostPort: "0" }] }
-			},
-			NetworkingConfig: { EndpointsConfig: { [MINIO_DOCKER_NETWORK]: {} } },
-			Env: formatDockerEnv(launch.env)
-		});
-		await container.start();
-		const inspect = await container.inspect();
-		const binding = inspect.NetworkSettings.Ports?.[`${launch.port}/tcp`]?.[0];
-		if (!binding?.HostPort) throw new Error("Failed to resolve project container host port");
-		const baseUrl = `http://127.0.0.1:${binding.HostPort}`;
-		await waitForHealth(baseUrl, {
-			fetchImpl: options.fetchImpl,
-			timeoutMs: options.healthTimeoutMs
-		});
-		return {
-			runtimeId: inspect.Id,
-			baseUrl
-		};
-	} };
-}
-function containerName(projectId) {
-	return `keystroke-project-${projectId}`;
-}
-async function removeExistingContainer(docker, projectId) {
-	try {
-		const existing = docker.getContainer(containerName(projectId));
-		await existing.stop({ t: 5 }).catch(() => void 0);
-		await existing.remove({ force: true });
-	} catch {}
-}
-async function ensureImage(docker, image) {
-	try {
-		await docker.getImage(image).inspect();
-		return;
-	} catch {}
-	await new Promise((resolvePromise, reject) => {
-		docker.pull(image, (error, stream) => {
-			if (error) {
-				reject(error);
-				return;
-			}
-			if (!stream) {
-				reject(/* @__PURE__ */ new Error(`Failed to pull image ${image}`));
-				return;
-			}
-			docker.modem.followProgress(stream, (progressError) => {
-				if (progressError) {
-					reject(progressError);
-					return;
-				}
-				resolvePromise();
-			});
-		});
-	});
-}
-function dockerPlugin(options = {}) {
-	const env = options.env ?? process.env;
-	return {
-		name: "docker",
-		workerRuntime: resolveWorkerRuntimeConfig(env),
-		createRuntime: () => createDockerRuntime({
-			...options,
-			env
-		})
-	};
-}
-/** Local Docker hosting — default for platform and dev. */
-function defaultHostingPlugin(options = {}) {
-	return dockerPlugin(options);
-}
-async function pingProject(baseUrl, options = {}) {
-	const timeoutMs = options.timeoutMs ?? 15e3;
-	const headers = options.plugin?.pingRequestHeaders?.(options.runtimeId ?? null) ?? {};
-	try {
-		return (await (options.fetchImpl ?? fetch)(new URL(PROJECT_SERVER_HEALTH.path, baseUrl), {
-			signal: AbortSignal.timeout(timeoutMs),
-			headers
-		})).ok;
-	} catch {
-		return false;
-	}
-}
-function canPingProjectTarget(target, plugin) {
-	if (plugin?.canPingTarget) return plugin.canPingTarget(target);
-	return !!target.baseUrl;
-}
-async function pingProjectTarget(target, options = {}) {
-	if (!canPingProjectTarget(target, options.plugin)) return false;
-	return pingProject(target.baseUrl, {
-		...options,
-		runtimeId: target.runtimeId
-	});
-}
-//#endregion
-//#region ../../packages/shared/dist/index.mjs
-const ACTIVE_ORG_HEADER = "x-keystroke-org-id";
-/** Auth, session, and account-entry URL segments. */
-const AUTH_ACCOUNT_SLUGS = [
-	"2fa",
-	"accept-invite",
-	"auth",
-	"authorize",
-	"callback",
-	"callbacks",
-	"confirm-email",
-	"confirmation",
-	"connect",
-	"device",
-	"email-verification",
-	"forgot-password",
-	"invite",
-	"invites",
-	"login",
-	"logout",
-	"magic-link",
-	"mfa",
-	"oauth",
-	"onboarding",
-	"password",
-	"recovery",
-	"register",
-	"reset-password",
-	"saml",
-	"session",
-	"sessions",
-	"sign-in",
-	"sign-up",
-	"signin",
-	"signout",
-	"signup",
-	"sso",
-	"token",
-	"tokens",
-	"unlink",
-	"verify",
-	"verify-email"
-];
-/** Org, workspace, billing, and account-management URL segments. */
-const ORG_ACCOUNT_SLUGS = [
-	"account",
-	"accounts",
-	"billing",
-	"console",
-	"invoice",
-	"invoices",
-	"member",
-	"members",
-	"me",
-	"org",
-	"organization",
-	"organizations",
-	"orgs",
-	"payment",
-	"payments",
-	"plan",
-	"plans",
-	"portal",
-	"preferences",
-	"profile",
-	"settings",
-	"subscription",
-	"subscriptions",
-	"team",
-	"teams",
-	"upgrade",
-	"usage",
-	"user",
-	"users",
-	"workspace",
-	"workspaces"
-];
-/** Product surfaces, resource types, and in-app navigation segments. */
-const PRODUCT_SLUGS = [
-	"action",
-	"actions",
-	"activity",
-	"agent",
-	"agents",
-	"analytics",
-	"app",
-	"apps",
-	"artifact",
-	"artifacts",
-	"assistant",
-	"assistants",
-	"audit",
-	"audit-log",
-	"automation",
-	"automations",
-	"branch",
-	"branches",
-	"canvas",
-	"chat",
-	"chats",
-	"connection",
-	"connections",
-	"create",
-	"credential",
-	"credentials",
-	"dashboard",
-	"deployment",
-	"deployments",
-	"examples",
-	"execute",
-	"execution",
-	"executions",
-	"explore",
-	"get-started",
-	"history",
-	"inbox",
-	"inspector",
-	"integration",
-	"integrations",
-	"library",
-	"logs",
-	"marketplace",
-	"mcp",
-	"mcps",
-	"new",
-	"notifications",
-	"observe",
-	"plugin",
-	"plugins",
-	"primitive",
-	"primitives",
-	"project",
-	"projects",
-	"recents",
-	"registry",
-	"reports",
-	"run",
-	"runs",
-	"runtime",
-	"runtimes",
-	"sandbox",
-	"sandboxes",
-	"search",
-	"skill",
-	"skills",
-	"templates",
-	"thread",
-	"threads",
-	"trigger",
-	"triggers",
-	"version",
-	"versions",
-	"workflow",
-	"workflows"
-];
-/** Marketing, docs, company, and go-to-market URL segments. */
-const MARKETING_SITE_SLUGS = [
-	"about",
-	"affiliates",
-	"ai",
-	"announcements",
-	"anthropic",
-	"blog",
-	"book-demo",
-	"brand",
-	"campaigns",
-	"career",
-	"careers",
-	"case-studies",
-	"casestudies",
-	"changelog",
-	"chatgpt",
-	"chrome-extension",
-	"claude",
-	"codex",
-	"community",
-	"company",
-	"compare",
-	"contact",
-	"contribute",
-	"creators",
-	"customers",
-	"demo",
-	"demos",
-	"discord",
-	"docs",
-	"documentation",
-	"download",
-	"downloads",
-	"dust",
-	"emerging-talent",
-	"engineering-blog",
-	"enterprise",
-	"events",
-	"experts",
-	"extension",
-	"faq",
-	"faqs",
-	"features",
-	"forum",
-	"glean",
-	"grok",
-	"guide",
-	"guides",
-	"gumloop",
-	"handbook",
-	"help",
-	"help-center",
-	"home",
-	"how-it-works",
-	"howitworks",
-	"inspo",
-	"intern",
-	"investors",
-	"jobs",
-	"legal",
-	"lindy",
-	"llm",
-	"llms",
-	"love",
-	"make",
-	"manifesto",
-	"media",
-	"merch",
-	"mission",
-	"mobile",
-	"models",
-	"n8n",
-	"news",
-	"newsroom",
-	"open",
-	"open-claw",
-	"open-source",
-	"openai",
-	"our-story",
-	"overview",
-	"partners",
-	"pi",
-	"pipedream",
-	"platform",
-	"press",
-	"press-kit",
-	"pricing",
-	"privacy",
-	"product",
-	"products",
-	"provider",
-	"providers",
-	"quick-start",
-	"quickstart",
-	"refer",
-	"relay",
-	"relay-app",
-	"reporting",
-	"request-demo",
-	"resources",
-	"roadmap",
-	"schedule-demo",
-	"security",
-	"solutions",
-	"stack-ai",
-	"stackai",
-	"startup",
-	"startups",
-	"status",
-	"stories",
-	"story",
-	"students",
-	"support",
-	"swag",
-	"switch",
-	"talent",
-	"terms",
-	"testimonials",
-	"thesis",
-	"tines",
-	"trust",
-	"tutorials",
-	"university",
-	"use-case",
-	"use-cases",
-	"usecases",
-	"versus",
-	"vellum",
-	"vs",
-	"webinars",
-	"workato",
-	"xai",
-	"yc",
-	"zapier"
-];
-/** Integrations, competitors, and partner brand slugs (marketing / integration pages). */
-const INTEGRATION_BRAND_SLUGS = [
-	"airtable",
-	"asana",
-	"aws",
-	"azure",
-	"bun",
-	"confluence",
-	"copilot",
-	"cursor",
-	"databricks",
-	"figma",
-	"firebase",
-	"fly",
-	"gcp",
-	"gemini",
-	"github",
-	"gitlab",
-	"gmail",
-	"heroku",
-	"hubspot",
-	"huggingface",
-	"jira",
-	"linear",
-	"mailchimp",
-	"meta",
-	"mistral",
-	"mixmax",
-	"monday",
-	"netlify",
-	"neon",
-	"notion",
-	"npm",
-	"outlook",
-	"outreach",
-	"perplexity",
-	"planetscale",
-	"pnpm",
-	"postmark",
-	"ramp",
-	"railway",
-	"render",
-	"resend",
-	"salesforce",
-	"segment",
-	"sendgrid",
-	"shopify",
-	"slack",
-	"snowflake",
-	"stripe",
-	"supabase",
-	"terraform",
-	"trello",
-	"turso",
-	"twilio",
-	"typeform",
-	"vercel",
-	"vscode",
-	"windsurf",
-	"yarn"
-];
-/** Company, team, and department landing-page segments. */
-const COMPANY_TEAM_SLUGS = [
-	"engineers",
-	"engineering",
-	"executives",
-	"hc",
-	"intern",
-	"it",
-	"leadership",
-	"marketing",
-	"ops",
-	"revops",
-	"sales",
-	"services",
-	"tech"
-];
-/** Legal, trust, compliance, and policy URL segments. */
-const LEGAL_TRUST_SLUGS = [
-	"accessibility",
-	"agreement",
-	"a11y",
-	"bug-bounty",
-	"compliance",
-	"cookie-policy",
-	"cookies",
-	"disclose",
-	"dpa",
-	"eula",
-	"gdpr",
-	"hipaa",
-	"iso",
-	"msa",
-	"pci",
-	"responsible-disclosure",
-	"sla",
-	"soc2",
-	"tos",
-	"trust-center",
-	"trustcenter",
-	"vulnerability"
-];
-/** Developer, API, CLI, and technical URL segments. */
-const DEVELOPER_TECH_SLUGS = [
-	"api",
-	"api-docs",
-	"cli",
-	"code",
-	"config",
-	"developer",
-	"developer-tools",
-	"developers",
-	"dev-tools",
-	"devtools",
-	"dev",
-	"dev-states",
-	"graphql",
-	"graphql-playground",
-	"mcp-server",
-	"mcp-servers",
-	"openapi",
-	"sdk",
-	"swagger"
-];
-/** Infra, ops, static assets, and system URL segments. */
-const INFRA_SYSTEM_SLUGS = [
-	"acme-challenge",
-	"admin",
-	"apple-app-site-association",
-	"assets",
-	"batch",
-	"cache",
-	"cdn",
-	"cron",
-	"debug",
-	"error",
-	"errors",
-	"favicon",
-	"feed",
-	"files",
-	"health",
-	"healthcheck",
-	"healthz",
-	"hooks",
-	"internal",
-	"item",
-	"manifest",
-	"metrics",
-	"null",
-	"ping",
-	"prod",
-	"public",
-	"redirect",
-	"robots",
-	"rpc",
-	"rss",
-	"sharer",
-	"sitemap",
-	"staging",
-	"static",
-	"storage",
-	"test",
-	"undefined",
-	"universal",
-	"webhooks",
-	"well-known",
-	"www"
-];
-/** Reserved slugs that are valid org names in theory but blocked for routing safety. */
-const ROUTING_SAFETY_SLUGS = [
-	"alpha",
-	"anonymous",
-	"archive",
-	"archived",
-	"beta",
-	"clone",
-	"copy",
-	"default",
-	"deleted",
-	"demo-org",
-	"draft",
-	"drafts",
-	"duplicate",
-	"early-access",
-	"embed",
-	"embedded",
-	"export",
-	"fork",
-	"free",
-	"guest",
-	"import",
-	"index",
-	"list",
-	"manage",
-	"moderator",
-	"newsletter",
-	"owner",
-	"preview",
-	"previews",
-	"private",
-	"pro",
-	"public-api",
-	"publish",
-	"published",
-	"queue",
-	"remove",
-	"root",
-	"sample",
-	"samples",
-	"selection",
-	"share",
-	"shared",
-	"sponsor",
-	"sponsors",
-	"sponsorship",
-	"subscribe",
-	"super",
-	"superuser",
-	"system",
-	"sys",
-	"test-org",
-	"trash",
-	"unpublish",
-	"unsubscribe",
-	"upload",
-	"uploads",
-	"waitlist",
-	"widget",
-	"widgets",
-	"worker",
-	"workers"
-];
-/**
-* URL segments reserved for global (non-org) routes — cannot be used as an org slug.
-* Prefer adding new entries to the category arrays above; the Set is the enforcement surface.
-*/
-const RESERVED_ORGANIZATION_SLUGS = new Set([
-	...AUTH_ACCOUNT_SLUGS,
-	...ORG_ACCOUNT_SLUGS,
-	...PRODUCT_SLUGS,
-	...MARKETING_SITE_SLUGS,
-	...INTEGRATION_BRAND_SLUGS,
-	...COMPANY_TEAM_SLUGS,
-	...LEGAL_TRUST_SLUGS,
-	...DEVELOPER_TECH_SLUGS,
-	...INFRA_SYSTEM_SLUGS,
-	...ROUTING_SAFETY_SLUGS
-]);
-/**
-* Base slug format: lowercase, 2-64 chars, alphanumeric + dashes.
-*
-* IMPORTANT: this is the schema for *reading* slugs (persisted rows, API
-* responses). It intentionally does NOT enforce the reserved-name list — an org
-* created before a name became reserved must still parse on read. Use
-* `ClaimableOrganizationSlugSchema` to validate slugs a user is trying to claim.
-*/
-const OrganizationSlugSchema = z.string().trim().toLowerCase().min(2, "Slug must be at least 2 characters").max(64, "Slug must be at most 64 characters").regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Use lowercase letters, numbers, and dashes only");
-/**
-* Slug validation for *claiming* a slug (organization create/rename). Adds the
-* reserved-name check on top of the base format. Never use this to parse
-* existing org data, or pre-existing orgs whose slug later became reserved would
-* fail to load.
-*/
-const ClaimableOrganizationSlugSchema = OrganizationSlugSchema.refine((slug) => !RESERVED_ORGANIZATION_SLUGS.has(slug), "This slug is reserved");
-/** Same format as organization slugs — org-scoped, no global reserved list. */
-const ProjectSlugSchema = OrganizationSlugSchema;
-/** TCP port to bind for a local server, derived from a public URL. */
-function listenPortFromUrl(url, fallback) {
-	const parsed = new URL(url);
-	if (parsed.port) {
-		const port = Number(parsed.port);
-		if (Number.isFinite(port) && port > 0) return port;
-	}
-	if (parsed.protocol === "https:") return 443;
-	if (parsed.protocol === "http:") return 80;
-	return fallback;
-}
-/** Shorthand: listen port from `PUBLIC_*_URL` or fallback. */
-function listenPortFromPublicUrl(value, fallback) {
-	const trimmed = value?.trim();
-	if (!trimmed) return fallback;
-	try {
-		return listenPortFromUrl(trimmed, fallback);
-	} catch {
-		return fallback;
-	}
-}
-/** On-disk path under the project root (packed in deploy artifacts when present). */
-const ROUTE_MANIFEST_REL_PATH = "dist/.keystroke/route-manifest.json";
-const StoredRouteManifestSkillSchema = z.object({
-	slug: z.string(),
-	name: z.string().optional(),
-	description: z.string().optional(),
-	moduleFile: z.string()
-});
-const serializedRouteManifestEntrySchema = z.discriminatedUnion("kind", [
-	z.object({
-		kind: z.literal("health"),
-		method: z.literal("GET"),
-		path: z.literal("/health")
-	}),
-	z.object({
-		kind: z.literal("agent"),
-		method: z.literal("POST"),
-		path: z.string(),
-		agentSlug: z.string(),
-		moduleFile: z.string(),
-		name: z.string().optional(),
-		description: z.string().optional(),
-		model: z.string(),
-		systemPrompt: z.string(),
-		toolCount: z.number().int().nonnegative(),
-		credentialCount: z.number().int().nonnegative(),
-		requestSchema: z.record(z.string(), z.unknown()),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("agent-sessions-list"),
-		method: z.literal("GET"),
-		path: z.string(),
-		agentSlug: z.string(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("agent-session-detail"),
-		method: z.literal("GET"),
-		path: z.string(),
-		agentSlug: z.string(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("workflow"),
-		method: z.literal("POST"),
-		path: z.string(),
-		workflowSlug: z.string(),
-		workflowName: z.string().optional(),
-		description: z.string().optional(),
-		subscribable: z.boolean(),
-		moduleFile: z.string(),
-		requestSchema: z.record(z.string(), z.unknown()),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("workflow-runs-list"),
-		method: z.literal("GET"),
-		path: z.string(),
-		workflowSlug: z.string(),
-		workflowName: z.string().optional(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("workflow-run-detail"),
-		method: z.literal("GET"),
-		path: z.string(),
-		workflowSlug: z.string(),
-		workflowName: z.string().optional(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("trigger-webhook"),
-		method: z.literal("POST"),
-		path: z.string(),
-		attachmentIds: z.array(z.string()),
-		moduleFile: z.string(),
-		requestSchema: z.record(z.string(), z.unknown()),
-		attachmentSchemas: z.record(z.string(), z.object({
-			requestSchema: z.record(z.string(), z.unknown()),
-			filterSchema: z.record(z.string(), z.unknown()).optional()
-		})),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("trigger-poll"),
-		method: z.literal("POST"),
-		path: z.string(),
-		attachmentId: z.string(),
-		moduleFile: z.string(),
-		schedule: z.string(),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("trigger-poll-group"),
-		method: z.literal("POST"),
-		path: z.string(),
-		pollId: z.string(),
-		attachmentIds: z.array(z.string()),
-		moduleFile: z.string(),
-		schedule: z.string(),
-		responseSchema: z.record(z.string(), z.unknown())
-	}),
-	z.object({
-		kind: z.literal("trigger-runs-list"),
-		method: z.literal("GET"),
-		path: z.string(),
-		attachmentId: z.string(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("trigger-run-detail"),
-		method: z.literal("GET"),
-		path: z.string(),
-		attachmentId: z.string(),
-		moduleFile: z.string()
-	}),
-	z.object({
-		kind: z.literal("cron-schedule"),
-		attachmentId: z.string(),
-		moduleFile: z.string(),
-		schedule: z.string()
-	}),
-	z.object({
-		kind: z.literal("plugin"),
-		method: z.enum([
-			"GET",
-			"POST",
-			"PUT",
-			"PATCH",
-			"DELETE"
-		]),
-		path: z.string(),
-		plugin: z.string()
-	})
-]);
-const StoredRouteManifestSchema = z.object({
-	version: z.literal(1),
-	entries: z.array(serializedRouteManifestEntrySchema),
-	skills: z.array(StoredRouteManifestSkillSchema).default([]),
-	integrations: z.array(z.string()).optional()
-});
-function parseStoredRouteManifest(value) {
-	return StoredRouteManifestSchema.parse(value);
-}
-/** Messaging platforms that support agent gateway bindings. */
-const ChannelPlatformKeySchema = z.enum(["slack"]);
-const ChannelReactionSupportSchema = z.enum([
-	"full",
-	"read-only",
-	"none"
-]);
-const ChannelCardSupportSchema = z.enum([
-	"full",
-	"partial",
-	"none"
-]);
-const ChannelStreamingSupportSchema = z.enum([
-	"native",
-	"post-edit",
-	"buffered",
-	"drafts",
-	"none"
-]);
-const ChannelCapabilitiesSchema = z.object({
-	mentions: z.boolean(),
-	reactions: ChannelReactionSupportSchema,
-	cards: ChannelCardSupportSchema,
-	modals: z.boolean(),
-	streaming: ChannelStreamingSupportSchema,
-	dms: z.boolean()
-});
-const ChannelListenModeSchema = z.enum([
-	"mention",
-	"all",
-	"dm"
-]);
-const ChannelBindingKindSchema = z.enum([
-	"public",
-	"private",
-	"dm",
-	"group",
-	"space"
-]);
-const AppGatewaySchema = z.object({
-	capabilities: ChannelCapabilitiesSchema,
-	supportedModes: z.array(ChannelListenModeSchema).min(1),
-	resourceNoun: z.object({
-		singular: z.string().min(1),
-		plural: z.string().min(1)
-	}),
-	supportsChannelDirectory: z.boolean(),
-	webhookPathHint: z.string().min(1),
-	docsUrl: z.string().url().optional(),
-	tagline: z.string().min(1).optional()
-});
-z.object({
-	key: ChannelPlatformKeySchema,
-	name: z.string().min(1),
-	appLogoId: z.string().min(1),
-	fallbackDomain: z.string().min(1),
-	description: z.string().min(1),
-	tagline: z.string().min(1),
-	authKind: z.enum(["oauth", "api_key"]),
-	credentialFields: z.array(z.object({
-		key: z.string().min(1),
-		label: z.string().min(1),
-		placeholder: z.string().optional(),
-		helpText: z.string().optional(),
-		type: z.enum([
-			"text",
-			"password",
-			"textarea"
-		]),
-		required: z.boolean(),
-		prefix: z.string().optional()
-	})),
-	capabilities: ChannelCapabilitiesSchema,
-	supportedModes: z.array(ChannelListenModeSchema).min(1),
-	resourceNoun: z.object({
-		singular: z.string().min(1),
-		plural: z.string().min(1)
-	}),
-	webhookPathHint: z.string().min(1),
-	supportsChannelDirectory: z.boolean(),
-	docsUrl: z.string().url().optional()
-});
-const ChannelBindingSchema = z.object({
-	id: z.string().min(1),
-	channelId: z.string().min(1),
-	channelName: z.string().min(1),
-	channelKind: ChannelBindingKindSchema,
-	mode: ChannelListenModeSchema,
-	subscribeOnMention: z.boolean(),
-	createdAt: z.string(),
-	updatedAt: z.string()
-});
-const ChannelConnectionSchema = z.object({
-	id: z.string().min(1),
-	platform: ChannelPlatformKeySchema,
-	agentId: z.string().min(1),
-	accountLabel: z.string().min(1),
-	accountId: z.string().min(1),
-	connectedAt: z.string(),
-	bindings: z.array(ChannelBindingSchema)
-});
-const ChannelDirectoryEntrySchema = z.object({
-	id: z.string().min(1),
-	name: z.string().min(1),
-	kind: ChannelBindingKindSchema,
-	memberCount: z.number().int().nonnegative().optional(),
-	isArchived: z.boolean().optional()
-});
-z.object({ connections: z.array(ChannelConnectionSchema) });
-z.object({ channels: z.array(ChannelDirectoryEntrySchema) });
-z.object({ teamName: z.string().min(1).optional() });
-/** OAuth workspace available for channel bindings (e.g. Slack team). */
-const ChannelAccountSchema = z.object({
-	id: z.string().min(1),
-	platform: ChannelPlatformKeySchema,
-	label: z.string().min(1),
-	connectedAt: z.string()
-});
-z.object({ accounts: z.array(ChannelAccountSchema) });
-const NewChannelBindingInputSchema = z.object({
-	channelId: z.string().min(1),
-	channelName: z.string().min(1),
-	channelKind: ChannelBindingKindSchema.optional(),
-	mode: ChannelListenModeSchema.optional(),
-	subscribeOnMention: z.boolean().optional()
-});
-z.object({
-	platform: ChannelPlatformKeySchema,
-	accountId: z.string().min(1),
-	binding: NewChannelBindingInputSchema
-});
-z.object({ patch: z.object({
-	mode: ChannelListenModeSchema.optional(),
-	subscribeOnMention: z.boolean().optional()
-}) });
-/** A single OAuth scope an app can request, with human copy for connect UI. */
-const OAuthScopeOptionSchema = z.object({
-	name: z.string().min(1),
-	description: z.string().min(1),
-	defaultSelected: z.boolean().optional(),
-	required: z.boolean().optional()
-});
-/** How an app authenticates when connecting credentials. */
-const AppAuthKindSchema = z.enum([
-	"oauth",
-	"api_key",
-	"keystroke"
-]);
-/**
-* Where app metadata and execution are sourced (e.g. native, composio, pipedream, custom).
-* Opaque string — cloud/hosted entrypoints choose values; keystroke stays provider-agnostic.
-*/
-const AppSourceSchema = z.string().trim().min(1);
-z.object({
-	slug: z.string().trim().min(1),
-	name: z.string().min(1),
-	description: z.string().min(1),
-	category: z.string().min(1),
-	logo: z.string().url().optional(),
-	authKind: AppAuthKindSchema,
-	oauthScopes: z.array(OAuthScopeOptionSchema)
-}).extend({ source: AppSourceSchema });
-z.object({
-	id: z.string().min(1),
-	organizationId: z.string().min(1).nullable(),
-	slug: z.string().min(1),
-	name: z.string().min(1),
-	description: z.string().min(1),
-	category: z.string().min(1),
-	logo: z.string().url().nullable(),
-	authKind: AppAuthKindSchema,
-	oauthScopes: z.array(OAuthScopeOptionSchema),
-	source: AppSourceSchema,
-	createdAt: z.string().min(1),
-	updatedAt: z.string().min(1)
-});
-/**
-* A connectable integration shown in the "Connect an app" picker. An "app" is
-* an integration / credential set — connected state is whether a credential exists.
-*/
-const AppCatalogEntrySchema = z.object({
-	id: z.string().min(1),
-	name: z.string().min(1),
-	description: z.string().min(1),
-	category: z.string().min(1),
-	integrationDescription: z.string().min(1),
-	logo: z.string().url().nullable().optional(),
-	authKind: AppAuthKindSchema,
-	oauthScopes: z.array(OAuthScopeOptionSchema),
-	/** When present, the app supports agent gateway bindings (external channels). */
-	gateway: AppGatewaySchema.optional()
-});
-const ListAppsResponseSchema = z.object({ apps: z.array(AppCatalogEntrySchema) });
-/** How a credential instance is stored (`credential_instances.auth_kind`). */
-const CredentialAuthKindSchema = z.enum([
-	"api_key",
-	"oauth_managed",
-	"keystroke"
-]);
-/**
-* Where a credential instance is stored (`credential_instances.scope_type`), and the only thing an
-* action/tool can pin via `.scope(...)`. There is no resolution chain: when no scope is pinned, the
-* resolver tries the project default, then the org default, then throws.
-*/
-const CredentialScopeTypeSchema = z.enum([
-	"organization",
-	"project",
-	"user"
-]);
-CredentialAuthKindSchema.options;
-CredentialScopeTypeSchema.options;
-/** Human-readable app name from a credential slug (e.g. `google-drive` → `Google Drive`). */
-function displayCredentialAppName(appId) {
-	return appId.split(/[-_]+/).filter(Boolean).map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
-}
-function buildCredentialInstanceLabel(options) {
-	const appName = options.appName.trim();
-	switch (options.scopeType) {
-		case "organization": return `Organization ${appName}`;
-		case "user": return `Personal ${appName}`;
-		case "project": return `${appName} (${options.projectName?.trim() || "Project"})`;
-		default: return options.scopeType;
-	}
-}
-/** Pick a label that is unused within a credential scope, suffixing when needed. */
-function resolveUniqueCredentialInstanceLabel(options) {
-	const taken = new Set([...options.takenLabels].map((label) => label ?? null));
-	if (!taken.has(options.baseLabel)) return options.baseLabel;
-	const disambiguator = options.disambiguator?.trim();
-	if (disambiguator) {
-		const withDisambiguator = `${options.baseLabel} (${disambiguator})`;
-		if (!taken.has(withDisambiguator)) return withDisambiguator;
-	}
-	let suffix = 2;
-	while (taken.has(`${options.baseLabel} (${suffix})`)) suffix += 1;
-	return `${options.baseLabel} (${suffix})`;
-}
-/** Scope of a platform app credential (maps to `credential_instances.scope_type`). */
-const AppCredentialScopeSchema = z.enum([
-	"user",
-	"project",
-	"organization"
-]);
-/** How the credential was connected (OAuth vs manual api-key entry). */
-const AppCredentialConnectionKindSchema = z.enum(["oauth", "manual"]);
-/** Connect-dialog permission preset for OAuth scope selection. */
-const OAuthPermissionModeSchema = z.enum(["default", "restricted"]);
-const optionalTimestamp$1 = z.string().optional();
-const nullableOptionalTimestamp = z.string().nullable().optional();
-/**
-* Summary row for the apps/credentials table and credential detail page.
-* Plaintext secrets are never returned — only masked `keyPreviews`.
-*/
-const AppCredentialSummarySchema = z.object({
-	id: z.string().min(1),
-	appId: z.string().min(1),
-	label: z.string().min(1),
-	scope: AppCredentialScopeSchema,
-	lastRefreshedAt: z.string().nullable(),
-	appName: z.string().min(1).optional(),
-	projectId: z.string().min(1).optional(),
-	projectName: z.string().min(1).optional(),
-	status: z.string().optional(),
-	createdAt: optionalTimestamp$1,
-	lastUsedAt: nullableOptionalTimestamp,
-	isDefault: z.boolean().optional(),
-	connectionKind: AppCredentialConnectionKindSchema.optional(),
-	ownerUserId: z.string().min(1).optional(),
-	ownerName: z.string().min(1).optional(),
-	ownerAvatarUrl: z.string().url().optional(),
-	grantedScopes: z.array(z.string().min(1)).optional(),
-	credentialKeys: z.array(z.string().min(1)).optional(),
-	keyPreviews: z.record(z.string(), z.string()).optional(),
-	expiresAt: optionalTimestamp$1
-});
-const credentialSecretValueSchema = z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" });
-function hasCredentialTarget(input) {
-	return input.projects.length > 0 || input.createOrganizationCredential || input.createUserProvidedCredential;
-}
-function addMissingCredentialTargetIssue(ctx, path = ["projects"]) {
-	ctx.addIssue({
-		code: "custom",
-		message: "At least one credential target is required",
-		path
-	});
-}
-/** Target fields shared by create and OAuth start flows. */
-const CredentialTargetsFieldsSchema = z.object({
-	projects: z.array(z.string().min(1)).default([]),
-	createOrganizationCredential: z.boolean().default(false),
-	createUserProvidedCredential: z.boolean().default(false)
-});
-CredentialTargetsFieldsSchema.extend({
-	appId: z.string().min(1),
-	scopes: z.array(z.string().min(1)),
-	permissionMode: OAuthPermissionModeSchema
-});
-z.object({
-	status: z.enum(["connected", "redirecting"]),
-	authorizeUrl: z.string().url().nullable()
-});
-/** Request body for `POST /api/credentials` (manual api-key fan-out). */
-const CreateCredentialsRequestSchema = CredentialTargetsFieldsSchema.extend({
-	appId: z.string().min(1),
-	connectionKind: AppCredentialConnectionKindSchema,
-	value: credentialSecretValueSchema.optional(),
-	scopes: z.array(z.string().min(1)).optional()
-}).superRefine((input, ctx) => {
-	if (!hasCredentialTarget(input)) addMissingCredentialTargetIssue(ctx);
-	if (input.connectionKind === "manual" && !input.value) ctx.addIssue({
-		code: "custom",
-		message: "value is required for manual connections",
-		path: ["value"]
-	});
-	if (input.connectionKind === "oauth") ctx.addIssue({
-		code: "custom",
-		message: "OAuth credentials are created via the OAuth callback",
-		path: ["connectionKind"]
-	});
-});
-/** Request body for `PATCH /api/credentials/:id`. */
-const UpdateCredentialRequestSchema = z.object({
-	label: z.string().trim().min(1).optional(),
-	isDefault: z.boolean().optional(),
-	value: credentialSecretValueSchema.optional()
-}).refine((input) => input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0, { message: "At least one field is required" });
-const ListCredentialsResponseSchema = z.object({ credentials: z.array(AppCredentialSummarySchema) });
-const GetCredentialResponseSchema = z.object({ credential: AppCredentialSummarySchema });
-const CreateCredentialsResponseSchema = z.object({ credentials: z.array(AppCredentialSummarySchema) });
-const McpConnectionStatusSchema = z.enum([
-	"INITIATED",
-	"ACTIVE",
-	"EXPIRED",
-	"FAILED",
-	"INACTIVE",
-	"REVOKED"
-]);
-const McpAppSchema = z.object({
-	slug: z.string(),
-	name: z.string(),
-	connected: z.boolean(),
-	connectionId: z.string().optional(),
-	status: McpConnectionStatusSchema.optional()
-});
-z.object({ apps: z.array(McpAppSchema) });
-z.object({
-	connectionId: z.string(),
-	entityId: z.string(),
-	instanceId: z.string()
-});
-z.object({
-	app: z.string().trim().min(1),
-	tool: z.string().trim().min(1),
-	arguments: z.record(z.string(), z.unknown()).default({}),
-	/**
-	* Resolved credential instance to execute against. When set, the platform executes that exact
-	* connection (scoped to the caller's org); when omitted it resolves the app's instance by scope.
-	*/
-	instanceId: z.string().trim().min(1).optional(),
-	/** Pinned provider toolkit version, sourced from the app definition; forwarded to the provider. */
-	version: z.string().trim().min(1)
-});
-const TeamRequestTypeSchema = z.enum([
-	"org-deletion",
-	"contact",
-	"enterprise-upgrade"
-]);
-const SubmitTeamRequestRequestSchema = z.object({
-	type: TeamRequestTypeSchema,
-	message: z.string().trim().max(5e3).optional()
-});
-const SubmitTeamRequestResponseSchema = z.object({ ok: z.literal(true) });
-function isCredentialInput(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const candidate = value;
-	return typeof candidate.key === "string" && CredentialAuthKindSchema.safeParse(candidate.kind).success && candidate.schema instanceof z.ZodType;
-}
-const credentialInputSchema = z.custom((value) => isCredentialInput(value), "must be a credential requirement");
-const PROJECT_SLUG_TAKEN_MESSAGE = "That slug is already taken.";
-const OrganizationSlugErrorCodeSchema = z.enum([
-	"slug_taken",
-	"slug_reserved",
-	"slug_invalid"
-]);
-const SlugAvailabilityReasonSchema = z.enum([
-	"taken",
-	"reserved",
-	"invalid"
-]);
-const SlugAvailabilityResponseSchema = z.object({
-	slug: z.string(),
-	available: z.boolean(),
-	reason: SlugAvailabilityReasonSchema.optional(),
-	suggestion: OrganizationSlugSchema.optional()
-});
-const SlugAvailabilityQuerySchema = z.object({
-	slug: z.string().trim().min(1),
-	excludeOrganizationId: z.string().min(1).optional()
-});
-const ProjectSlugAvailabilityReasonSchema = z.enum(["taken", "invalid"]);
-const ProjectSlugAvailabilityResponseSchema = z.object({
-	slug: z.string(),
-	available: z.boolean(),
-	reason: ProjectSlugAvailabilityReasonSchema.optional(),
-	suggestion: ProjectSlugSchema.optional()
-});
-const ProjectSlugAvailabilityQuerySchema = z.object({
-	slug: z.string().trim().min(1),
-	excludeProjectId: z.string().min(1).optional()
-});
-function organizationSlugErrorCodeFromMessage(message) {
-	if (message === "That slug is already taken." || /already taken/i.test(message)) return "slug_taken";
-	if (/reserved/i.test(message)) return "slug_reserved";
-	return "slug_invalid";
-}
-const ProjectStatusSchema = z.enum([
-	"inactive",
-	"starting",
-	"active",
-	"failed"
-]);
-const OrganizationUserRoleSchema = z.enum([
-	"owner",
-	"admin",
-	"builder"
-]);
-const isoDateTime$5 = z.string().datetime();
-const OrganizationSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	slug: OrganizationSlugSchema,
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
-});
-const ProjectSchema = z.object({
-	id: z.string(),
-	organizationId: z.string(),
-	name: z.string(),
-	slug: ProjectSlugSchema,
-	description: z.string().nullable(),
-	status: ProjectStatusSchema,
-	baseUrl: z.string().nullable(),
-	runtimeId: z.string().nullable(),
-	lastError: z.string().nullable(),
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
-});
-const UserOrganizationSchema = z.object({
-	organization: OrganizationSchema,
-	role: OrganizationUserRoleSchema
-});
-const ActiveOrganizationResponseSchema = z.object({ organization: UserOrganizationSchema.nullable() });
-const ListOrganizationsResponseSchema = z.object({ organizations: z.array(UserOrganizationSchema) });
-const CreateOrganizationRequestSchema = z.object({
-	name: z.string().trim().min(1),
-	/** Format-only at the wire boundary; reserved-name checks run in platform-database. */
-	slug: OrganizationSlugSchema.optional()
-});
-const UpdateOrganizationRequestSchema = z.object({
-	name: z.string().trim().min(1).optional(),
-	slug: ClaimableOrganizationSlugSchema.optional()
-}).refine((data) => data.name !== void 0 || data.slug !== void 0, { message: "At least one field is required" });
-const CreateOrganizationResponseSchema = z.object({ organization: UserOrganizationSchema });
-const ListProjectsResponseSchema = z.object({ projects: z.array(ProjectSchema) });
-const ProjectListMetricsSchema = z.object({
-	agentCount: z.number(),
-	workflowCount: z.number(),
-	skillCount: z.number(),
-	credentialCount: z.number(),
-	lastDeploymentAt: isoDateTime$5.nullable()
-});
-const ListProjectMetricsResponseSchema = z.object({ metrics: z.record(z.string(), ProjectListMetricsSchema) });
-const CreateProjectRequestSchema = z.object({
-	name: z.string().trim().min(1),
-	description: z.string().trim().min(1).optional()
-});
-const UpdateProjectRequestSchema = z.object({
-	name: z.string().trim().min(1).optional(),
-	description: z.string().trim().optional(),
-	slug: ProjectSlugSchema.optional()
-}).refine((data) => data.name !== void 0 || data.description !== void 0 || data.slug !== void 0, { message: "At least one field is required" });
-const CreateProjectResponseSchema = z.object({ project: ProjectSchema });
-const ProjectResponseSchema = z.object({ project: ProjectSchema });
-const ProjectReachabilityResponseSchema = z.object({ reachable: z.boolean() });
-const ValidationErrorDetailSchema = z.object({
-	path: z.string(),
-	message: z.string()
-});
-/** Machine-readable codes returned in standard API error bodies. */
-const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(z.enum(["needs_org_selection"]));
-/** Standard JSON error body returned by the HTTP API. */
-const ErrorResponseSchema = z.object({
-	error: z.string(),
-	code: ErrorResponseCodeSchema.optional(),
-	message: z.string().optional(),
-	details: z.array(ValidationErrorDetailSchema).optional()
-});
-/** Build the JSON body for HTTP 400 validation failures. */
-function validationErrorResponse(error, summary) {
-	return {
-		error: summary,
-		details: error.issues.map((issue) => ({
-			path: issue.path.join("."),
-			message: issue.message
-		}))
-	};
-}
-z.object({ message: z.string() });
-const CredentialRunContextSchema = z.object({
-	orgId: z.string().min(1).optional(),
-	projectId: z.string().min(1).optional(),
-	userId: z.string().min(1).optional(),
-	userIds: z.record(z.string(), z.string()).optional(),
-	selection: z.record(z.string(), z.string()).optional()
-});
-const ThinkingLevelSchema = z.enum([
-	"off",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh"
-]);
-z.object({
-	message: z.string().min(1),
-	sessionId: z.string().min(1).optional(),
-	subscriptionId: z.string().min(1).optional(),
-	context: CredentialRunContextSchema.optional(),
-	thinkingLevel: ThinkingLevelSchema.optional()
-});
-z.object({
-	sessionId: z.string(),
-	messages: z.array(z.record(z.string(), z.unknown())),
-	error: z.string().nullable()
-});
-const SkipResponseSchema = z.object({
-	ok: z.literal(true),
-	skipped: z.literal(true)
-});
-z.object({ ok: z.literal(true) });
-z.object({ service: z.string() });
-const ConnectProviderSchema = z.object({
-	key: z.string(),
-	mode: z.enum(["authorize-url", "browser-redirect"]),
-	path: z.string(),
-	requiresAuth: z.boolean()
-});
-z.object({ providers: z.array(ConnectProviderSchema) });
-z.object({ url: z.string() });
-z.object({ runId: z.string() });
-z.object({ sessionId: z.string() });
-z.object({
-	workflows: z.array(z.string().min(1)).optional(),
-	attachments: z.array(z.string().min(1)).optional()
-});
-const PollAttachmentResultSchema = z.object({
-	attachmentKey: z.string(),
-	workflowKey: z.string(),
-	runId: z.string().optional(),
-	body: z.unknown().optional(),
-	queued: z.boolean(),
-	skipped: z.boolean().optional()
-});
-const PollRunMultiResponseSchema = z.object({ results: z.array(PollAttachmentResultSchema) });
-z.union([
-	z.record(z.string(), z.unknown()),
-	PollRunMultiResponseSchema,
-	SkipResponseSchema,
-	z.object({ runId: z.string() })
-]);
-const RunSourceKindSchema = z.enum([
-	"api",
-	"trigger",
-	"gateway",
-	"workflow",
-	"agent"
-]);
-z.object({
-	kind: RunSourceKindSchema,
-	id: z.string().nullable()
-});
-const WorkflowRunStatusSchema = z.enum([
-	"pending",
-	"running",
-	"sleeping",
-	"waiting_hook",
-	"completed",
-	"failed",
-	"canceled"
-]);
-const WorkflowRunTriggerSchema = z.enum([
-	"api",
-	"cron",
-	"webhook",
-	"poll",
-	"retry"
-]);
-z.enum([
-	"run_started",
-	"step_completed",
-	"step_failed",
-	"step_retrying",
-	"sleep_scheduled",
-	"sleep_completed",
-	"hook_created",
-	"hook_resumed",
-	"run_completed",
-	"run_failed",
-	"run_canceled"
-]);
-const WorkflowRunSummarySchema = z.object({
-	id: z.string(),
-	status: WorkflowRunStatusSchema,
-	trigger: WorkflowRunTriggerSchema,
-	triggeredAt: z.string(),
-	startedAt: z.string().nullable(),
-	finishedAt: z.string().nullable(),
-	sourceKind: RunSourceKindSchema,
-	sourceId: z.string().nullable(),
-	triggerRunId: z.string().nullable(),
-	attachmentId: z.string().nullable()
-});
-const WorkflowRunRecordSchema = z.object({
-	id: z.string(),
-	workflowSlug: z.string(),
-	status: WorkflowRunStatusSchema,
-	trigger: WorkflowRunTriggerSchema,
-	triggeredAt: z.string(),
-	startedAt: z.string().nullable(),
-	finishedAt: z.string().nullable(),
-	sourceKind: RunSourceKindSchema,
-	sourceId: z.string().nullable(),
-	triggerRunId: z.string().nullable(),
-	attachmentId: z.string().nullable(),
-	parentWorkflowRunId: z.string().nullable(),
-	parentSpanId: z.string().nullable(),
-	input: z.unknown().nullable(),
-	output: z.unknown().nullable(),
-	error: z.unknown().nullable()
-});
-z.object({
-	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
-	cursor: z.string().min(1).optional(),
-	status: WorkflowRunStatusSchema.optional(),
-	trigger: WorkflowRunTriggerSchema.optional()
-});
-z.object({
-	items: z.array(WorkflowRunSummarySchema),
-	nextCursor: z.string().nullable()
-});
-z.enum([
-	"trigger",
-	"steps",
-	"trace"
-]);
-z.object({ include: z.string().optional() });
-const TriggerRunDetailSchema = z.object({
-	id: z.string(),
-	attachmentId: z.string(),
-	attachmentSlug: z.string().nullable(),
-	triggerType: z.enum([
-		"cron",
-		"webhook",
-		"poll"
-	]),
-	sourcePath: z.string().nullable(),
-	payload: z.unknown().nullable(),
-	triggeredAt: z.string()
-});
-const WorkflowStepRunSchema = z.object({
-	id: z.string(),
-	actionKey: z.string(),
-	output: z.unknown(),
-	completedAt: z.string()
-});
-const TraceTriggerSummarySchema = z.object({
-	triggerType: z.string(),
-	triggerRunId: z.string(),
-	workflowSlug: z.string().optional(),
-	agentSlug: z.string().optional(),
-	attachmentId: z.string().nullable().optional(),
-	attachmentSlug: z.string().nullable().optional(),
-	route: z.string().optional(),
-	sourcePath: z.string().nullable().optional()
-}).nullable();
-const TraceGatewaySummarySchema = z.object({
-	gatewayAttachmentId: z.string(),
-	gatewayAttachmentKey: z.string(),
-	threadId: z.string().optional(),
-	channelId: z.string().optional(),
-	mode: z.string().optional()
-}).nullable();
-const TraceSpanSchema = z.object({
-	id: z.string(),
-	traceId: z.string(),
-	parentSpanId: z.string().nullable(),
-	kind: z.string(),
-	refId: z.string(),
-	name: z.string(),
-	status: z.string(),
-	startedAt: z.string(),
-	finishedAt: z.string().nullable(),
-	metadata: z.unknown().nullable(),
-	error: z.unknown().nullable()
-});
-const TraceLogSchema = z.object({
-	id: z.string(),
-	traceId: z.string(),
-	spanId: z.string(),
-	seq: z.number(),
-	level: z.string(),
-	message: z.string(),
-	data: z.unknown().nullable(),
-	source: z.string(),
-	createdAt: z.string()
-});
-const TraceResponseSchema = z.object({
-	traceId: z.string(),
-	trigger: TraceTriggerSummarySchema,
-	gateway: TraceGatewaySummarySchema,
-	spans: z.array(TraceSpanSchema),
-	logs: z.array(TraceLogSchema)
-});
-z.object({
-	run: WorkflowRunRecordSchema,
-	trigger: TriggerRunDetailSchema.nullable(),
-	steps: z.array(WorkflowStepRunSchema),
-	trace: TraceResponseSchema.nullable()
-});
-const AgentSessionStatusSchema = z.enum([
-	"running",
-	"completed",
-	"failed",
-	"canceled"
-]);
-const AgentSessionSummarySchema = z.object({
-	id: z.string(),
-	status: AgentSessionStatusSchema,
-	source: RunSourceKindSchema,
-	sourceId: z.string().nullable(),
-	createdAt: z.string(),
-	updatedAt: z.string(),
-	messageCount: z.number()
-});
-const AgentSessionRecordSchema = z.object({
-	id: z.string(),
-	agentSlug: z.string(),
-	status: AgentSessionStatusSchema,
-	source: RunSourceKindSchema,
-	sourceId: z.string().nullable(),
-	createdAt: z.string(),
-	updatedAt: z.string(),
-	parentSpanId: z.string().nullable(),
-	messageCount: z.number(),
-	error: z.unknown().nullable()
-});
-z.object({
-	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
-	cursor: z.string().min(1).optional(),
-	status: AgentSessionStatusSchema.optional(),
-	source: RunSourceKindSchema.optional()
-});
-z.object({
-	items: z.array(AgentSessionSummarySchema),
-	nextCursor: z.string().nullable()
-});
-z.enum([
-	"gateway",
-	"messages",
-	"events",
-	"trace"
-]);
-z.object({ include: z.string().optional() });
-const GatewaySessionDetailSchema = z.object({
-	threadId: z.string(),
-	attachmentId: z.string(),
-	attachmentSlug: z.string().nullable()
-});
-const AgentEventSchema = z.object({
-	id: z.string(),
-	sessionId: z.string(),
-	seq: z.number(),
-	eventType: z.string(),
-	payload: z.unknown(),
-	createdAt: z.string()
-});
-z.object({
-	session: AgentSessionRecordSchema,
-	gateway: GatewaySessionDetailSchema.nullable(),
-	messages: z.array(z.record(z.string(), z.unknown())),
-	events: z.array(AgentEventSchema),
-	trace: TraceResponseSchema.nullable()
-});
-const SlackGatewayModeSchema = z.enum([
-	"mention",
-	"channel",
-	"dm"
-]);
-const GatewayAttachmentSourceSchema = z.object({
-	kind: z.literal("slack"),
-	mode: SlackGatewayModeSchema,
-	credentialKey: z.string(),
-	channelIds: z.array(z.string()).optional(),
-	subscribeOnMention: z.boolean()
-});
-const GatewayAttachmentRecordSchema = z.object({
-	id: z.string(),
-	key: z.string(),
-	agentKey: z.string(),
-	channelId: z.string(),
-	teamId: z.string().nullable().optional(),
-	platform: z.string(),
-	source: GatewayAttachmentSourceSchema,
-	registeredAt: z.string(),
-	updatedAt: z.string()
-});
-z.object({ attachments: z.array(GatewayAttachmentRecordSchema) });
-z.object({
-	agentKey: z.string().min(1),
-	teamId: z.string().min(1).optional(),
-	mode: SlackGatewayModeSchema.optional(),
-	subscribeOnMention: z.boolean().optional()
-});
-const AgentListItemSchema = z.object({
-	key: z.string(),
-	name: z.string().optional(),
-	route: z.string()
-});
-z.object({ agents: z.array(AgentListItemSchema) });
-const HistoryRunKindSchema = z.enum(["workflow", "agent"]);
-const HistoryRunStatusSchema = z.enum([
-	"pending",
-	"running",
-	"sleeping",
-	"waiting_hook",
-	"completed",
-	"failed",
-	"canceled"
-]);
-const HistoryRunActorSchema = z.object({
-	userId: z.string(),
-	name: z.string(),
-	avatarUrl: z.string().nullable().optional()
-});
-const HistoryRunUsageLineItemSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	amountUsd: z.number()
-});
-const HistoryRunUsageSchema = z.object({
-	runDurationMs: z.number().nullable(),
-	lineItems: z.array(HistoryRunUsageLineItemSchema),
-	totalExcludingDurationUsd: z.number().nullable()
-});
-const HistoryRunSchema = z.object({
-	id: z.string(),
-	kind: HistoryRunKindSchema,
-	traceId: z.string().nullable(),
-	projectId: z.string(),
-	projectName: z.string(),
-	resourceKey: z.string(),
-	resourceId: z.string(),
-	resourceName: z.string(),
-	status: HistoryRunStatusSchema,
-	triggeredAt: z.string(),
-	timeInQueueMs: z.number().nullable(),
-	startedAt: z.string(),
-	finishedAt: z.string().nullable(),
-	durationMs: z.number().nullable(),
-	triggerLabel: z.string(),
-	triggerRaw: z.string(),
-	ranAs: HistoryRunActorSchema.nullable(),
-	modelsUsed: z.array(z.string()),
-	otherServicesUsed: z.array(z.string()),
-	totalCostUsd: z.number().nullable(),
-	messageCount: z.number().optional(),
-	stepCount: z.number().optional()
-});
-const HistoryTraceSpanSchema = z.object({
-	id: z.string(),
-	traceId: z.string(),
-	parentSpanId: z.string().nullable(),
-	kind: z.string(),
-	refId: z.string(),
-	name: z.string(),
-	status: z.string(),
-	startedAt: z.string(),
-	finishedAt: z.string().nullable(),
-	metadata: z.unknown().nullable(),
-	error: z.unknown().nullable()
-});
-const HistoryTraceLogSchema = z.object({
-	id: z.string(),
-	traceId: z.string(),
-	spanId: z.string(),
-	seq: z.number(),
-	level: z.string(),
-	message: z.string(),
-	data: z.unknown().nullable(),
-	source: z.string(),
-	createdAt: z.string()
-});
-const HistoryTraceTriggerSchema = z.object({
-	triggerType: z.string(),
-	triggerRunId: z.string(),
-	workflowKey: z.string().optional(),
-	agentKey: z.string().optional(),
-	attachmentId: z.string().nullable().optional(),
-	attachmentKey: z.string().nullable().optional(),
-	route: z.string().optional(),
-	sourcePath: z.string().nullable().optional()
-}).nullable();
-const HistoryTraceGatewaySchema = z.object({
-	gatewayAttachmentId: z.string(),
-	gatewayAttachmentKey: z.string(),
-	threadId: z.string().optional(),
-	channelId: z.string().optional(),
-	mode: z.string().optional()
-}).nullable();
-const HistoryTraceSchema = z.object({
-	traceId: z.string(),
-	trigger: HistoryTraceTriggerSchema,
-	gateway: HistoryTraceGatewaySchema,
-	spans: z.array(HistoryTraceSpanSchema),
-	logs: z.array(HistoryTraceLogSchema)
-});
-const HistoryWorkflowStepSchema = z.object({
-	id: z.string(),
-	actionKey: z.string(),
-	output: z.unknown(),
-	completedAt: z.string()
-});
-const HistoryWorkflowRunDetailSchema = z.object({
-	kind: z.literal("workflow"),
-	run: z.object({
-		id: z.string(),
-		workflowKey: z.string(),
-		status: HistoryRunStatusSchema,
-		trigger: z.string(),
-		triggeredAt: z.string(),
-		startedAt: z.string().nullable(),
-		finishedAt: z.string().nullable(),
-		input: z.unknown().nullable(),
-		output: z.unknown().nullable(),
-		error: z.unknown().nullable()
-	}),
-	trigger: z.object({
-		id: z.string(),
-		attachmentKey: z.string().nullable(),
-		triggerType: z.string(),
-		sourcePath: z.string().nullable(),
-		payload: z.unknown().nullable(),
-		triggeredAt: z.string()
-	}).nullable(),
-	steps: z.array(HistoryWorkflowStepSchema),
-	trace: HistoryTraceSchema.nullable(),
-	ranAs: HistoryRunActorSchema.nullable().optional(),
-	usage: HistoryRunUsageSchema.nullable().optional()
-});
-const HistoryAgentSessionDetailSchema = z.object({
-	kind: z.literal("agent"),
-	runId: z.string(),
-	session: z.object({
-		id: z.string(),
-		agentKey: z.string(),
-		status: HistoryRunStatusSchema,
-		source: z.enum([
-			"api",
-			"gateway",
-			"trigger",
-			"workflow",
-			"agent"
-		]),
-		sourceId: z.string().nullable(),
-		createdAt: z.string(),
-		updatedAt: z.string(),
-		messageCount: z.number(),
-		error: z.unknown().nullable()
-	}),
-	gateway: z.object({
-		threadId: z.string(),
-		attachmentKey: z.string().nullable()
-	}).nullable(),
-	messages: z.array(z.record(z.string(), z.unknown())),
-	trace: HistoryTraceSchema.nullable(),
-	ranAs: HistoryRunActorSchema.nullable().optional(),
-	usage: HistoryRunUsageSchema.nullable().optional()
-});
-const HistoryRunDetailSchema = z.discriminatedUnion("kind", [HistoryWorkflowRunDetailSchema, HistoryAgentSessionDetailSchema]);
-const HistoryRunListQuerySchema = z.object({
-	project: z.string().min(1).optional(),
-	status: HistoryRunStatusSchema.optional(),
-	kind: HistoryRunKindSchema.optional()
-});
-const HistoryRunListResponseSchema = z.array(HistoryRunSchema);
-const HistoryRunDetailResponseSchema = HistoryRunDetailSchema.nullable();
-const HistoryRunCancelResponseSchema = HistoryRunSchema.nullable();
-const WorkflowSubscriptionRecordSchema = z.object({
-	id: z.string(),
-	workflowKey: z.string(),
-	userId: z.string(),
-	enabled: z.boolean(),
-	createdAt: z.string(),
-	updatedAt: z.string()
-});
-z.object({ subscriptions: z.array(WorkflowSubscriptionRecordSchema) });
-z.object({
-	userId: z.string().min(1).optional(),
-	enabled: z.boolean().optional()
-});
-const CredentialInstanceRecordSchema = z.object({
-	id: z.string(),
-	key: z.string(),
-	scopeType: CredentialScopeTypeSchema,
-	scopeId: z.string().nullable(),
-	label: z.string().nullable(),
-	isDefault: z.boolean(),
-	authKind: CredentialAuthKindSchema
-});
-z.object({ instances: z.array(CredentialInstanceRecordSchema) });
-z.object({
-	key: z.string().min(1),
-	scopeType: CredentialScopeTypeSchema,
-	scopeId: z.string().nullable().optional(),
-	label: z.string().nullable().optional(),
-	isDefault: z.boolean().optional(),
-	value: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" })
-});
-z.object({
-	label: z.string().nullable().optional(),
-	isDefault: z.boolean().optional(),
-	value: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { message: "value must be a non-empty object" }).optional()
-});
-const TriggerRunTypeSchema = z.enum([
-	"cron",
-	"webhook",
-	"poll"
-]);
-const TriggerRunWorkflowSummarySchema = z.object({
-	id: z.string(),
-	status: WorkflowRunStatusSchema,
-	workflowSlug: z.string()
-});
-const TriggerRunAgentSessionSummarySchema = z.object({
-	id: z.string(),
-	agentSlug: z.string()
-});
-const TriggerRunSummarySchema = z.object({
-	id: z.string(),
-	triggerType: TriggerRunTypeSchema,
-	triggeredAt: z.string(),
-	sourcePath: z.string().nullable(),
-	workflowRun: TriggerRunWorkflowSummarySchema.nullable(),
-	agentSession: TriggerRunAgentSessionSummarySchema.nullable()
-});
-const TriggerRunRecordSchema = z.object({
-	id: z.string(),
-	attachmentId: z.string(),
-	attachmentSlug: z.string(),
-	triggerType: TriggerRunTypeSchema,
-	sourcePath: z.string().nullable(),
-	payload: z.unknown().nullable(),
-	triggeredAt: z.string()
-});
-z.object({
-	limit: z.coerce.number().int().min(1).max(100).optional().default(20),
-	cursor: z.string().min(1).optional(),
-	triggerType: TriggerRunTypeSchema.optional()
-});
-z.object({
-	items: z.array(TriggerRunSummarySchema),
-	nextCursor: z.string().nullable()
-});
-z.enum([
-	"workflows",
-	"agents",
-	"trace"
-]);
-z.object({ include: z.string().optional() });
-const TriggerRunAgentSessionDetailSchema = z.object({
-	id: z.string(),
-	agentSlug: z.string()
-});
-z.object({
-	run: TriggerRunRecordSchema,
-	workflowRuns: z.array(WorkflowRunSummarySchema),
-	agentSessions: z.array(TriggerRunAgentSessionDetailSchema),
-	trace: TraceResponseSchema.nullable()
-});
-const TriggerTypeSchema = z.enum([
-	"webhook",
-	"poll",
-	"cron"
-]);
-const TriggerTargetKindSchema = z.enum(["workflow", "agent"]);
-const TriggerListItemSchema = z.object({
-	key: z.string(),
-	type: TriggerTypeSchema,
-	route: z.string().optional(),
-	webhookUrl: z.string().url().optional(),
-	targetKind: TriggerTargetKindSchema,
-	workflowKey: z.string().optional(),
-	agentKey: z.string().optional()
-});
-z.object({ triggers: z.array(TriggerListItemSchema) });
-z.object({ endpoint: z.string().min(1).optional() });
-const OrganizationMemberRoleSchema = z.enum([
-	"owner",
-	"admin",
-	"builder"
-]);
-const OrganizationMemberStatusSchema = z.enum([
-	"invited",
-	"active",
-	"rejected",
-	"suspended"
-]);
-const InvitableOrganizationMemberRoleSchema = z.enum(["admin", "builder"]);
-const isoDateTime$4 = z.string().datetime();
-const OrganizationMemberSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	email: z.string().email(),
-	role: OrganizationMemberRoleSchema,
-	status: OrganizationMemberStatusSchema,
-	avatarUrl: z.string().optional(),
-	joinedAt: isoDateTime$4.optional(),
-	lastActiveAt: isoDateTime$4.nullable().optional()
-});
-const ListOrganizationMembersResponseSchema = z.object({ members: z.array(OrganizationMemberSchema) });
-const InviteOrganizationMembersRequestSchema = z.object({
-	emails: z.array(z.string().trim().email()).min(1),
-	role: InvitableOrganizationMemberRoleSchema
-});
-const InviteOrganizationMemberResultStatusSchema = z.enum([
-	"sent",
-	"already_member",
-	"pending",
-	"invalid"
-]);
-const InviteOrganizationMemberResultSchema = z.object({
-	email: z.string(),
-	status: InviteOrganizationMemberResultStatusSchema,
-	invitationId: z.string().optional()
-});
-const InviteOrganizationMembersResponseSchema = z.object({ results: z.array(InviteOrganizationMemberResultSchema) });
-const UpdateOrganizationMemberRequestSchema = z.object({ role: InvitableOrganizationMemberRoleSchema });
-const UpdateOrganizationMemberResponseSchema = z.object({ member: OrganizationMemberSchema });
-const OrganizationInvitationSchema = z.object({
-	id: z.string(),
-	organizationName: z.string(),
-	organizationSlug: OrganizationSlugSchema,
-	invitedByName: z.string().optional(),
-	invitedByEmail: z.string().email().optional(),
-	role: OrganizationMemberRoleSchema
-});
-const ListOrganizationInvitationsResponseSchema = z.object({ invitations: z.array(OrganizationInvitationSchema) });
-const AcceptOrganizationInvitationResponseSchema = z.object({ organization: UserOrganizationSchema });
-const DeclineOrganizationInvitationResponseSchema = z.object({ success: z.literal(true) });
-/** Web path to auto-accept an invitation after sign-in (used in invite emails). */
-function organizationInvitationAcceptPath(invitationId) {
-	return `/organization/invitations?${new URLSearchParams({ accept: invitationId }).toString()}`;
-}
-const isoDateTime$3 = z.string().datetime();
-const ApiKeyCreatorSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	email: z.string().email().optional(),
-	avatarUrl: z.string().optional(),
-	/** True when the creator user row no longer exists. */
-	deleted: z.boolean().optional()
-});
-const ApiKeySummarySchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	keyPreview: z.string(),
-	createdAt: isoDateTime$3,
-	createdBy: ApiKeyCreatorSchema,
-	isCreatedByCurrentUser: z.boolean()
-});
-const ListApiKeysResponseSchema = z.object({ apiKeys: z.array(ApiKeySummarySchema) });
-const CreateApiKeyRequestSchema = z.object({ name: z.string().trim().min(1).max(128) });
-const CreateApiKeyResponseSchema = ApiKeySummarySchema.extend({ secret: z.string() });
-const ProjectUserRoleSchema = z.enum(["admin", "builder"]);
-const ProjectInvitePermissionSchema = z.enum(["admin", "all"]);
-const ProjectMemberStatusSchema = z.enum(["active", "invited"]);
-const isoDateTime$2 = z.string().datetime();
-const ProjectMemberSchema = z.object({
-	id: z.string(),
-	projectId: z.string(),
-	name: z.string(),
-	email: z.string().email(),
-	role: ProjectUserRoleSchema,
-	status: ProjectMemberStatusSchema,
-	image: z.string().nullable(),
-	createdAt: isoDateTime$2,
-	isCurrentUser: z.boolean().optional()
-});
-const ListProjectMembersResponseSchema = z.object({ members: z.array(ProjectMemberSchema) });
-const InviteProjectMembersRequestSchema = z.object({
-	emails: z.array(z.string().trim().email()).min(1),
-	role: ProjectUserRoleSchema
-});
-const InviteProjectMemberResultStatusSchema = z.enum([
-	"added",
-	"already_member",
-	"not_org_member",
-	"invalid"
-]);
-const InviteProjectMemberResultSchema = z.object({
-	email: z.string(),
-	status: InviteProjectMemberResultStatusSchema
-});
-const InviteProjectMembersResponseSchema = z.object({ results: z.array(InviteProjectMemberResultSchema) });
-const UpdateProjectMemberRequestSchema = z.object({ role: ProjectUserRoleSchema });
-const UpdateProjectMemberResponseSchema = z.object({ member: ProjectMemberSchema });
-const ProjectSettingsSchema = z.object({
-	description: z.string(),
-	defaultRole: ProjectUserRoleSchema,
-	invitePermission: ProjectInvitePermissionSchema
-});
-const UpdateProjectSettingsRequestSchema = z.object({
-	description: z.string().optional(),
-	defaultRole: ProjectUserRoleSchema.optional(),
-	invitePermission: ProjectInvitePermissionSchema.optional()
-}).refine((data) => data.description !== void 0 || data.defaultRole !== void 0 || data.invitePermission !== void 0, { message: "At least one field is required" });
-const ProjectSettingsResponseSchema = z.object({ settings: ProjectSettingsSchema });
-/** Custom avatar override; null means fall back to OAuth `users.image`. */
-const UserAvatarSchema = z.object({ url: z.url().nullable() });
-const UserAvatarPatchSchema = z.object({ 
-/** Storage key returned from presign; null removes the custom override. */
-storageKey: z.string().min(1).nullable() });
-const PresignUserAvatarRequestSchema = z.object({ contentType: z.string().trim().min(1) });
-const PresignUserAvatarResponseSchema = z.object({
-	uploadUrl: z.url(),
-	storageKey: z.string().min(1)
-});
-const UserInterfaceThemeSchema = z.enum([
-	"system",
-	"light",
-	"dark"
-]);
-const UserSurfaceContrastSchema = z.enum(["off", "on"]);
-const UserWorkspaceLayoutModeSchema = z.enum(["default", "linear"]);
-const UserWorkspaceFontSizeSchema = z.enum(["default", "large"]);
-const UserSidebarNavIconVisibilitySchema = z.enum(["hidden", "visible"]);
-const UserSidebarFooterChatRowVisibilitySchema = z.enum(["hidden", "visible"]);
-const UserWorkspaceFavoriteKindSchema = z.enum([
-	"agent",
-	"workflow",
-	"skill",
-	"run"
-]);
-const UserWorkspaceFavoriteSchema = z.object({
-	kind: UserWorkspaceFavoriteKindSchema,
-	resourceId: z.string().min(1)
-});
-const UserSidebarPreferencesSchema = z.object({
-	navIconVisibility: UserSidebarNavIconVisibilitySchema,
-	footerChatRowVisibility: UserSidebarFooterChatRowVisibilitySchema,
-	hiddenNavItemIds: z.array(z.string()),
-	topNavItemOrderIds: z.array(z.string()),
-	workspaceNavItemOrderIds: z.array(z.string())
-});
-const UserPreferencesSchema = z.object({
-	interfaceTheme: UserInterfaceThemeSchema,
-	surfaceContrast: UserSurfaceContrastSchema,
-	layoutMode: UserWorkspaceLayoutModeSchema,
-	fontSize: UserWorkspaceFontSizeSchema,
-	sidebar: UserSidebarPreferencesSchema,
-	favorites: z.array(UserWorkspaceFavoriteSchema),
-	projectOrderIds: z.array(z.string()),
-	projectDotColors: z.record(z.string(), z.string()),
-	onboardingTabVisible: z.boolean()
-});
-const UserSidebarPreferencesPatchSchema = z.object({
-	navIconVisibility: UserSidebarNavIconVisibilitySchema.optional(),
-	footerChatRowVisibility: UserSidebarFooterChatRowVisibilitySchema.optional(),
-	hiddenNavItemIds: z.array(z.string()).optional(),
-	topNavItemOrderIds: z.array(z.string()).optional(),
-	workspaceNavItemOrderIds: z.array(z.string()).optional()
-});
-const UserPreferencesPatchSchema = z.object({
-	interfaceTheme: UserInterfaceThemeSchema.optional(),
-	surfaceContrast: UserSurfaceContrastSchema.optional(),
-	layoutMode: UserWorkspaceLayoutModeSchema.optional(),
-	fontSize: UserWorkspaceFontSizeSchema.optional(),
-	sidebar: UserSidebarPreferencesPatchSchema.optional(),
-	favorites: z.array(UserWorkspaceFavoriteSchema).optional(),
-	projectOrderIds: z.array(z.string()).optional(),
-	projectDotColors: z.record(z.string(), z.string()).optional(),
-	onboardingTabVisible: z.boolean().optional()
-}).refine((value) => value.interfaceTheme !== void 0 || value.surfaceContrast !== void 0 || value.layoutMode !== void 0 || value.fontSize !== void 0 || value.sidebar !== void 0 || value.favorites !== void 0 || value.projectOrderIds !== void 0 || value.projectDotColors !== void 0 || value.onboardingTabVisible !== void 0, { message: "At least one preference field is required" });
-const DEFAULT_USER_SIDEBAR_PREFERENCES = {
-	navIconVisibility: "visible",
-	footerChatRowVisibility: "visible",
-	hiddenNavItemIds: ["registry"],
-	topNavItemOrderIds: [],
-	workspaceNavItemOrderIds: []
-};
-const DEFAULT_USER_PREFERENCES = {
-	interfaceTheme: "system",
-	surfaceContrast: "on",
-	layoutMode: "linear",
-	fontSize: "default",
-	sidebar: DEFAULT_USER_SIDEBAR_PREFERENCES,
-	favorites: [],
-	projectOrderIds: [],
-	projectDotColors: {},
-	onboardingTabVisible: true
-};
-function normalizeInterfaceTheme(value) {
-	if (value === "light" || value === "dark") return value;
-	return "system";
-}
-function normalizeSurfaceContrast(value) {
-	return value === "off" ? "off" : "on";
-}
-function normalizeLayoutMode(value) {
-	return value === "default" ? "default" : "linear";
-}
-function normalizeFontSize(value) {
-	return value === "large" ? "large" : "default";
-}
-function normalizeStringList(value) {
-	if (!Array.isArray(value)) return [];
-	return Array.from(new Set(value.filter((item) => typeof item === "string")));
-}
-function normalizeHiddenNavItemIds(value) {
-	if (!Array.isArray(value)) return DEFAULT_USER_SIDEBAR_PREFERENCES.hiddenNavItemIds;
-	return normalizeStringList(value);
-}
-function normalizeSidebarPreferences(value) {
-	if (!value || typeof value !== "object") return DEFAULT_USER_SIDEBAR_PREFERENCES;
-	const sidebar = value;
-	return {
-		navIconVisibility: sidebar.navIconVisibility === "visible" ? "visible" : "hidden",
-		footerChatRowVisibility: sidebar.footerChatRowVisibility === "hidden" ? "hidden" : "visible",
-		hiddenNavItemIds: normalizeHiddenNavItemIds(sidebar.hiddenNavItemIds),
-		topNavItemOrderIds: normalizeStringList(sidebar.topNavItemOrderIds),
-		workspaceNavItemOrderIds: normalizeStringList(sidebar.workspaceNavItemOrderIds)
-	};
-}
-function isWorkspaceFavoriteKind(value) {
-	return value === "agent" || value === "workflow" || value === "skill" || value === "run";
-}
-function normalizeFavorites(value) {
-	if (!Array.isArray(value)) return [];
-	const seenKeys = /* @__PURE__ */ new Set();
-	const favorites = [];
-	for (const item of value) {
-		if (!item || typeof item !== "object") continue;
-		const favorite = item;
-		if (typeof favorite.kind !== "string" || !isWorkspaceFavoriteKind(favorite.kind) || typeof favorite.resourceId !== "string" || favorite.resourceId.length === 0) continue;
-		const key = `${favorite.kind}:${favorite.resourceId}`;
-		if (seenKeys.has(key)) continue;
-		seenKeys.add(key);
-		favorites.push({
-			kind: favorite.kind,
-			resourceId: favorite.resourceId
-		});
-	}
-	return favorites;
-}
-function normalizeProjectDotColors(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[0] === "string" && typeof entry[1] === "string"));
-}
-function normalizeOnboardingTabVisible(value) {
-	return typeof value === "boolean" ? value : DEFAULT_USER_PREFERENCES.onboardingTabVisible;
-}
-function normalizeUserPreferences(value) {
-	if (!value || typeof value !== "object") return DEFAULT_USER_PREFERENCES;
-	const preferences = value;
-	return UserPreferencesSchema.parse({
-		interfaceTheme: normalizeInterfaceTheme(preferences.interfaceTheme),
-		surfaceContrast: normalizeSurfaceContrast(preferences.surfaceContrast),
-		layoutMode: normalizeLayoutMode(preferences.layoutMode),
-		fontSize: normalizeFontSize(preferences.fontSize),
-		sidebar: normalizeSidebarPreferences(preferences.sidebar),
-		favorites: normalizeFavorites(preferences.favorites),
-		projectOrderIds: normalizeStringList(preferences.projectOrderIds),
-		projectDotColors: normalizeProjectDotColors(preferences.projectDotColors),
-		onboardingTabVisible: normalizeOnboardingTabVisible(preferences.onboardingTabVisible)
-	});
-}
-function mergeUserPreferences(current, patch) {
-	return normalizeUserPreferences({
-		...current,
-		...patch,
-		sidebar: patch.sidebar ? {
-			...current.sidebar,
-			...patch.sidebar
-		} : current.sidebar
-	});
-}
-const OrganizationLogoVariantSchema = z.enum(["light", "dark"]);
-const OrganizationSidebarBrandingSchema = z.object({
-	customLogoEnabled: z.boolean(),
-	customLogoExplicitlyDisabled: z.boolean(),
-	logoLightUrl: z.url().nullable(),
-	logoDarkUrl: z.url().nullable(),
-	logoHeightPx: z.number().int().min(14).max(32)
-});
-const OrganizationSidebarBrandingPatchSchema = z.object({
-	customLogoEnabled: z.boolean().optional(),
-	customLogoExplicitlyDisabled: z.boolean().optional(),
-	logoLightStorageKey: z.string().min(1).nullable().optional(),
-	logoDarkStorageKey: z.string().min(1).nullable().optional(),
-	logoHeightPx: z.number().int().min(14).max(32).optional()
-}).refine((value) => value.customLogoEnabled !== void 0 || value.customLogoExplicitlyDisabled !== void 0 || value.logoLightStorageKey !== void 0 || value.logoDarkStorageKey !== void 0 || value.logoHeightPx !== void 0, { message: "At least one branding field is required" });
-const PresignOrgLogoRequestSchema = z.object({
-	variant: OrganizationLogoVariantSchema,
-	contentType: z.string().trim().min(1)
-});
-const PresignOrgLogoResponseSchema = z.object({
-	uploadUrl: z.url(),
-	storageKey: z.string().min(1)
-});
-const ProjectArtifactStatusSchema = z.enum(["pending", "ready"]);
-const isoDateTime$1 = z.string().datetime();
-const ProjectArtifactSchema = z.object({
-	id: z.string(),
-	projectId: z.string(),
-	storageKey: z.string(),
-	status: ProjectArtifactStatusSchema,
-	createdAt: isoDateTime$1,
-	updatedAt: isoDateTime$1
-});
-const CreateProjectArtifactResponseSchema = z.object({
-	artifact: ProjectArtifactSchema,
-	uploadUrl: z.string().url(),
-	expiresInSeconds: z.number().int().positive()
-});
-const CompleteProjectArtifactResponseSchema = z.object({
-	artifact: ProjectArtifactSchema,
-	project: ProjectSchema
-});
-const DownloadActiveProjectArtifactResponseSchema = z.object({
-	artifactId: z.string(),
-	downloadUrl: z.string().url(),
-	expiresInSeconds: z.number().int().positive()
-});
-const ProjectDeploymentSchema = z.object({
-	id: z.string(),
-	projectId: z.string(),
-	version: z.number().int().positive(),
-	deployedBy: z.string().nullable(),
-	deployedByEmail: z.string().optional(),
-	deployedByAvatarUrl: z.string().optional(),
-	createdAt: isoDateTime$1,
-	active: z.boolean()
-});
-const ListProjectDeploymentsResponseSchema = z.object({ deployments: z.array(ProjectDeploymentSchema) });
-const PLATFORM_RESOURCE_UNSUPPORTED_TEXT = "Not Supported";
-const optionalCount = z.number().int().nonnegative().nullable().optional();
-const optionalTimestamp = z.string().nullable().optional();
-const AgentSummarySchema = z.object({
-	id: z.string().min(1),
-	slug: z.string().min(1),
-	name: z.string().min(1),
-	projectId: z.string().min(1),
-	updatedAt: z.string().min(1),
-	description: z.string().optional(),
-	sourcePath: z.string().min(1).optional(),
-	model: z.string().optional(),
-	toolCount: optionalCount,
-	credentialCount: optionalCount,
-	lastRunAt: optionalTimestamp
-});
-const WorkflowSummarySchema = z.object({
-	id: z.string().min(1),
-	slug: z.string().min(1),
-	name: z.string().min(1),
-	projectId: z.string().min(1),
-	updatedAt: z.string().min(1),
-	description: z.string().optional(),
-	sourcePath: z.string().min(1).optional(),
-	lastRunAt: optionalTimestamp
-});
-const SkillSummarySchema = z.object({
-	id: z.string().min(1),
-	slug: z.string().min(1),
-	name: z.string().min(1),
-	projectId: z.string().min(1),
-	updatedAt: z.string().min(1),
-	description: z.string().optional(),
-	sourcePath: z.string().min(1).optional()
-});
-const AgentSummaryListResponseSchema = z.array(AgentSummarySchema);
-const AgentSummaryDetailResponseSchema = AgentSummarySchema.nullable();
-const WorkflowSummaryListResponseSchema = z.array(WorkflowSummarySchema);
-const WorkflowSummaryDetailResponseSchema = WorkflowSummarySchema.nullable();
-const SkillSummaryListResponseSchema = z.array(SkillSummarySchema);
-const SkillSummaryDetailResponseSchema = SkillSummarySchema.nullable();
-const RecentResourceKindSchema = z.enum([
-	"agent",
-	"workflow",
-	"skill"
-]);
-const RecentResourceSourceSchema = z.enum(["owned", "shared"]);
-const RecentResourceSchema = z.object({
-	id: z.string().min(1),
-	resourceKind: RecentResourceKindSchema,
-	resourceId: z.string().min(1),
-	name: z.string().min(1),
-	description: z.string().optional(),
-	projectId: z.string().min(1),
-	projectName: z.string().min(1),
-	sourcePath: z.string().min(1).optional(),
-	source: RecentResourceSourceSchema,
-	lastOpenedAt: z.string().min(1),
-	lastModifiedAt: z.string().min(1)
-});
-const RecentResourceListResponseSchema = z.array(RecentResourceSchema);
-const isoDateTime = z.string().datetime();
-const sha256Hex = z.string().regex(/^[a-f0-9]{64}$/, "Expected a lowercase hex sha256 digest");
-/**
-* A single entry in a deploy's file tree, as served to the dashboard. Carries
-* no contents: `id` is a stable, path-derived handle used for selection and
-* `?file=` deep links; `hash` is the content address used to fetch the bytes
-* lazily and to cache them immutably in the browser.
-*/
-const ProjectFileSummarySchema = z.object({
-	id: z.string(),
-	path: z.string().min(1),
-	hash: sha256Hex
-});
-/** Maps a runtime resource slug (agent/workflow/skill) to its source file path. */
-const ProjectSourceResourceRefSchema = z.object({
-	slug: z.string().min(1),
-	path: z.string().min(1)
-});
-const ProjectSourceResourcesSchema = z.object({
-	agents: z.array(ProjectSourceResourceRefSchema).default([]),
-	workflows: z.array(ProjectSourceResourceRefSchema).default([]),
-	skills: z.array(ProjectSourceResourceRefSchema).default([])
-});
-const emptyResources = () => ({
-	agents: [],
-	workflows: [],
-	skills: []
-});
-/** Response for the file-tree listing of a project's active deploy. */
-const ListProjectFilesResponseSchema = z.object({
-	artifactId: z.string().nullable(),
-	files: z.array(ProjectFileSummarySchema),
-	resources: ProjectSourceResourcesSchema.default(emptyResources())
-});
-z.object({
-	path: z.string().min(1),
-	contents: z.string(),
-	hash: sha256Hex
-});
-/** A blob the CLI may need to upload, keyed by content hash. */
-const SourceBlobRefSchema = z.object({
-	hash: sha256Hex,
-	size: z.number().int().nonnegative()
-});
-/** Request: ask the platform which blobs are missing and get presigned PUTs. */
-const PresignProjectSourceRequestSchema = z.object({ blobs: z.array(SourceBlobRefSchema) });
-const PresignedBlobUploadSchema = z.object({
-	hash: sha256Hex,
-	url: z.string().url()
-});
-/** Response: presigned PUTs for the subset of blobs not already stored. */
-const PresignProjectSourceResponseSchema = z.object({ uploads: z.array(PresignedBlobUploadSchema) });
-/** A file reference in a manifest upload: where the path's content lives. */
-const ManifestFileRefSchema = z.object({
-	path: z.string().min(1),
-	hash: sha256Hex
-});
-/** Request body the CLI sends to finalize a deploy's source manifest. */
-const UploadProjectSourceManifestRequestSchema = z.object({ files: z.array(ManifestFileRefSchema) });
-const UploadProjectSourceResponseSchema = z.object({
-	ok: z.literal(true),
-	fileCount: z.number().int().nonnegative()
-});
-/** A file entry as persisted in the stored manifest (path-derived id added). */
-const StoredManifestFileSchema = z.object({
-	id: z.string(),
-	path: z.string().min(1),
-	hash: sha256Hex
-});
-/** The immutable per-deploy manifest persisted to object storage. */
-const StoredProjectSourceManifestSchema = z.object({
-	files: z.array(StoredManifestFileSchema),
-	generatedAt: isoDateTime
-});
-/** Stable, path-derived file id (used by the web for selection + deep links). */
-function projectFileId(path) {
-	return `file-${path.trim().replace(/^\.?\/+/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase()}`;
-}
-function mapOrganization(row) {
-	return OrganizationSchema.parse({
-		id: row.id,
-		name: row.name,
-		slug: row.slug,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	});
-}
-function mapProject(row) {
-	return ProjectSchema.parse({
-		id: row.id,
-		organizationId: row.organizationId,
-		name: row.name,
-		slug: row.slug,
-		description: row.description,
-		status: row.status,
-		baseUrl: row.baseUrl,
-		runtimeId: row.runtimeId,
-		lastError: row.lastError,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	});
-}
-function mapUserOrganization(row) {
-	return UserOrganizationSchema.parse({
-		organization: mapOrganization(row.organization),
-		role: row.role
-	});
-}
-function mapOrganizationMember(row) {
-	return OrganizationMemberSchema.parse({
-		id: row.id,
-		name: row.name,
-		email: row.email,
-		role: row.role,
-		status: row.status,
-		...row.image ? { avatarUrl: row.image } : {},
-		joinedAt: row.createdAt.toISOString(),
-		lastActiveAt: null
-	});
-}
-function mapOrganizationInvitation(row) {
-	return OrganizationInvitationSchema.parse({
-		id: row.id,
-		organizationName: row.organizationName,
-		organizationSlug: row.organizationSlug,
-		role: row.role,
-		...row.invitedByName ? { invitedByName: row.invitedByName } : {},
-		...row.invitedByEmail ? { invitedByEmail: row.invitedByEmail } : {}
-	});
-}
-function mapProjectMember(row, options) {
-	return ProjectMemberSchema.parse({
-		id: row.id,
-		projectId: row.projectId,
-		name: row.name,
-		email: row.email,
-		role: row.role,
-		status: row.status,
-		image: row.image,
-		createdAt: row.createdAt.toISOString(),
-		isCurrentUser: options?.isCurrentUser
-	});
-}
-function mapProjectSettings(row) {
-	return {
-		description: row.description ?? "",
-		defaultRole: row.defaultMemberRole,
-		invitePermission: row.invitePermission
-	};
-}
-function mapProjectArtifact(row) {
-	return ProjectArtifactSchema.parse({
-		id: row.id,
-		projectId: row.projectId,
-		storageKey: row.storageKey,
-		status: row.status,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	});
-}
-function mapProjectDeployment(row) {
-	return ProjectDeploymentSchema.parse({
-		id: row.id,
-		projectId: row.projectId,
-		version: row.version,
-		deployedBy: row.deployedByName,
-		...row.deployedByEmail ? { deployedByEmail: row.deployedByEmail } : {},
-		...row.deployedByAvatarUrl ? { deployedByAvatarUrl: row.deployedByAvatarUrl } : {},
-		createdAt: row.createdAt.toISOString(),
-		active: row.active
-	});
-}
-//#endregion
-//#region ../../packages/storage/dist/index.mjs
-function readEnv$1(env, ...keys) {
-	for (const key of keys) {
-		const value = env[key]?.trim();
-		if (value) return value;
-	}
-}
-function requireEnv(env, keys) {
-	const candidates = Array.isArray(keys) ? keys : [keys];
-	const value = readEnv$1(env, ...candidates);
-	if (!value) throw new Error(`${candidates[0]} is required`);
-	return value;
-}
-/** Admin S3 credentials for storage plugins (bucket is per-org, not from env). */
-function storageAdminConfigFromEnv(env = process.env) {
-	const accessKeyId = requireEnv(env, ["STORAGE_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"]);
-	const secretAccessKey = requireEnv(env, ["STORAGE_SECRET_ACCESS_KEY", "AWS_SECRET_ACCESS_KEY"]);
-	const endpoint = requireEnv(env, [
-		"STORAGE_ENDPOINT",
-		"AWS_ENDPOINT_URL_S3",
-		"AWS_S3_ENDPOINT"
-	]);
-	return {
-		region: readEnv$1(env, "STORAGE_REGION", "AWS_REGION") ?? "us-east-1",
-		accessKeyId,
-		secretAccessKey,
-		endpoint,
-		forcePathStyle: env.STORAGE_FORCE_PATH_STYLE === void 0 ? true : env.STORAGE_FORCE_PATH_STYLE === "true"
-	};
-}
-const DEFAULT_PRESIGN_TTL_SECONDS = 900;
-function createStorage(config) {
-	const client = new S3Client(toClientConfig(config));
-	return {
-		async putObject(input) {
-			await client.send(new PutObjectCommand({
-				Bucket: config.bucket,
-				Key: input.key,
-				Body: input.body,
-				ContentType: input.contentType
-			}));
-		},
-		async getObject(key) {
-			const response = await client.send(new GetObjectCommand({
-				Bucket: config.bucket,
-				Key: key
-			}));
-			if (!response.Body) throw new Error(`Object body missing for key ${key}`);
-			return response.Body.transformToByteArray();
-		},
-		async headObject(key) {
-			try {
-				return { contentLength: (await client.send(new HeadObjectCommand({
-					Bucket: config.bucket,
-					Key: key
-				}))).ContentLength ?? 0 };
-			} catch (error) {
-				if (isNotFoundError(error)) return;
-				throw error;
-			}
-		},
-		async presignGet(input) {
-			return getSignedUrl(client, new GetObjectCommand({
-				Bucket: config.bucket,
-				Key: input.key
-			}), { expiresIn: input.expiresInSeconds ?? DEFAULT_PRESIGN_TTL_SECONDS });
-		},
-		async presignPut(input) {
-			return getSignedUrl(client, new PutObjectCommand({
-				Bucket: config.bucket,
-				Key: input.key,
-				ContentType: input.contentType ?? "application/gzip"
-			}), { expiresIn: input.expiresInSeconds ?? DEFAULT_PRESIGN_TTL_SECONDS });
-		},
-		async deleteObject(key) {
-			await client.send(new DeleteObjectCommand({
-				Bucket: config.bucket,
-				Key: key
-			}));
-		}
-	};
-}
-function toClientConfig(config) {
-	return {
-		region: config.region,
-		credentials: {
-			accessKeyId: config.accessKeyId,
-			secretAccessKey: config.secretAccessKey
-		},
-		endpoint: config.endpoint,
-		forcePathStyle: config.forcePathStyle
-	};
-}
-function isNotFoundError(error) {
-	if (!error || typeof error !== "object") return false;
-	const name = "name" in error ? String(error.name) : "";
-	const status = "$metadata" in error ? error.$metadata : void 0;
-	return name === "NotFound" || name === "NoSuchKey" || status?.httpStatusCode === 404;
-}
-var RouteManifestNotFoundError = class extends Error {
-	constructor(message = `Route manifest missing in artifact (${ROUTE_MANIFEST_REL_PATH})`) {
-		super(message);
-		this.name = "RouteManifestNotFoundError";
-	}
-};
-/** Read `.keystroke/route-manifest.json` from a packed project artifact tarball. */
-function extractRouteManifestFromArtifact(archive) {
-	const tempDir = mkdtempSync(join(tmpdir(), "keystroke-artifact-"));
-	const archivePath = join(tempDir, "artifact.tgz");
-	try {
-		writeFileSync(archivePath, archive);
-		if (spawnSync("tar", [
-			"-xzf",
-			archivePath,
-			"-C",
-			tempDir,
-			"dist/.keystroke/route-manifest.json"
-		], { encoding: "utf8" }).status !== 0) throw new RouteManifestNotFoundError();
-		const raw = readFileSync(join(tempDir, ROUTE_MANIFEST_REL_PATH), "utf8");
-		return JSON.parse(raw);
-	} catch (error) {
-		if (error instanceof RouteManifestNotFoundError) throw error;
-		throw new RouteManifestNotFoundError(error instanceof Error ? error.message : "Failed to extract route manifest");
-	} finally {
-		rmSync(tempDir, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-/** Object key for a built project artifact tarball. */
-function projectArtifactKey(projectId, version) {
-	return `projects/${projectId}/artifacts/${version}.tgz`;
-}
-const SHA256_HEX = /^[a-f0-9]{64}$/;
-/** True when `hash` is a lowercase hex sha256 digest (64 chars). */
-function isSourceBlobHash(hash) {
-	return SHA256_HEX.test(hash);
-}
-/**
-* Content-addressed key for a single source file's contents, deduped across all
-* of a project's deploys. `hash` is a lowercase hex sha256 of the file bytes.
-*/
-function projectSourceBlobKey(projectId, hash) {
-	if (!isSourceBlobHash(hash)) throw new Error("Invalid source blob hash");
-	return `projects/${projectId}/sources/blobs/${hash}`;
-}
-const AVATAR_EXTENSION = /^[a-z0-9]+$/;
-/** Object key for a user's custom profile avatar in the shared keystroke-users bucket. */
-function userAvatarStorageKey(userId, extension) {
-	const ext = extension.replace(/^\./, "").toLowerCase();
-	if (!AVATAR_EXTENSION.test(ext)) throw new Error("Invalid avatar extension");
-	return `avatars/${userId}/avatar.${ext}`;
-}
-/** True when `key` is the canonical avatar object for `userId`. */
-function isUserAvatarStorageKey(key, userId) {
-	const prefix = `avatars/${userId}/avatar.`;
-	if (!key.startsWith(prefix)) return false;
-	const ext = key.slice(prefix.length);
-	return AVATAR_EXTENSION.test(ext);
-}
-/** Object key for an org logo in the shared keystroke-assets bucket. */
-function orgLogoStorageKey(organizationId, variant, extension) {
-	const ext = extension.replace(/^\./, "").toLowerCase();
-	if (!AVATAR_EXTENSION.test(ext)) throw new Error("Invalid org logo extension");
-	return `org-logos/${organizationId}/logo-${variant}.${ext}`;
-}
-/** True when `key` is the canonical logo object for `organizationId` and `variant`. */
-function isOrgLogoStorageKey(key, organizationId, variant) {
-	const prefix = `org-logos/${organizationId}/logo-${variant}.`;
-	if (!key.startsWith(prefix)) return false;
-	const ext = key.slice(prefix.length);
-	return AVATAR_EXTENSION.test(ext);
-}
-function isBucketAlreadyExistsError(error) {
-	if (!error || typeof error !== "object") return false;
-	const name = "name" in error ? String(error.name) : "";
-	const code = "Code" in error ? String(error.Code) : "";
-	return name === "BucketAlreadyOwnedByYou" || code === "BucketAlreadyOwnedByYou" || name === "BucketAlreadyExists" || code === "BucketAlreadyExists";
-}
-/** Shared bucket for cross-org public assets (avatars, org sidebar logos). */
-const KEYSTROKE_ASSETS_BUCKET = "keystroke-assets";
-/** Env var for the browser-facing origin of public asset objects (no trailing slash). */
-const KEYSTROKE_ASSETS_PUBLIC_URL_BASE_ENV = "KEYSTROKE_ASSETS_PUBLIC_URL_BASE";
-const KEYSTROKE_ASSETS_AVATAR_PREFIX = "avatars/";
-const KEYSTROKE_ASSETS_ORG_LOGO_PREFIX = "org-logos/";
-function readEnv(env, key) {
-	return env[key]?.trim() || void 0;
-}
-/** Default path-style base when `KEYSTROKE_ASSETS_PUBLIC_URL_BASE` is unset (local MinIO). */
-function defaultKeystrokeAssetsPublicUrlBase(env = process.env) {
-	return `${storageAdminConfigFromEnv(env).endpoint.replace(/\/+$/, "")}/${KEYSTROKE_ASSETS_BUCKET}`;
-}
-/** Public URL prefix for asset objects — configured base or local path-style default. */
-function keystrokeAssetsPublicUrlBase(env = process.env) {
-	const configured = readEnv(env, KEYSTROKE_ASSETS_PUBLIC_URL_BASE_ENV);
-	if (configured) return configured.replace(/\/+$/, "");
-	return defaultKeystrokeAssetsPublicUrlBase(env);
-}
-function keystrokeAssetsPublicUrlPrefixes(env = process.env) {
-	const prefixes = [keystrokeAssetsPublicUrlBase(env)];
-	if (readEnv(env, "KEYSTROKE_ASSETS_PUBLIC_URL_BASE")) prefixes.push(defaultKeystrokeAssetsPublicUrlBase(env));
-	return [...new Set(prefixes)];
-}
-function createAssetsStorageClient(env = process.env) {
-	return createStorage({
-		...storageAdminConfigFromEnv(env),
-		bucket: KEYSTROKE_ASSETS_BUCKET
-	});
-}
-/** Stable public URL for an object in the keystroke-assets bucket. */
-function publicKeystrokeAssetsObjectUrl(key, env = process.env) {
-	return `${keystrokeAssetsPublicUrlBase(env)}/${key}`;
-}
-/** Extract the object key from a public keystroke-assets URL when it matches `requiredPrefix`. */
-function keystrokeAssetsKeyFromPublicUrl(url, requiredPrefix, env = process.env) {
-	for (const prefix of keystrokeAssetsPublicUrlPrefixes(env)) {
-		const normalizedPrefix = `${prefix.replace(/\/+$/, "")}/`;
-		if (!url.startsWith(normalizedPrefix)) continue;
-		const key = decodeURIComponent(url.slice(normalizedPrefix.length).split("?")[0] ?? "");
-		if (key.startsWith(requiredPrefix)) return key;
-	}
-	return null;
-}
-function isKeystrokeAssetsAvatarPublicUrl(url, env = process.env) {
-	return keystrokeAssetsKeyFromPublicUrl(url, KEYSTROKE_ASSETS_AVATAR_PREFIX, env) !== null;
-}
-function keystrokeAssetsAvatarKeyFromPublicUrl(url, env = process.env) {
-	return keystrokeAssetsKeyFromPublicUrl(url, KEYSTROKE_ASSETS_AVATAR_PREFIX, env);
-}
-function isKeystrokeAssetsOrgLogoPublicUrl(url, env = process.env) {
-	return keystrokeAssetsKeyFromPublicUrl(url, KEYSTROKE_ASSETS_ORG_LOGO_PREFIX, env) !== null;
-}
-function keystrokeAssetsOrgLogoKeyFromPublicUrl(url, env = process.env) {
-	return keystrokeAssetsKeyFromPublicUrl(url, KEYSTROKE_ASSETS_ORG_LOGO_PREFIX, env);
-}
-async function ensureKeystrokeAssetsBucket(env = process.env) {
-	const adminConfig = storageAdminConfigFromEnv(env);
-	const adminClient = new S3Client({
-		region: adminConfig.region,
-		credentials: {
-			accessKeyId: adminConfig.accessKeyId,
-			secretAccessKey: adminConfig.secretAccessKey
-		},
-		endpoint: adminConfig.endpoint,
-		forcePathStyle: adminConfig.forcePathStyle
-	});
-	await createAssetsBucketIfNeeded(adminClient, KEYSTROKE_ASSETS_BUCKET);
-	await applyPublicAssetsBucketAcl(adminClient, KEYSTROKE_ASSETS_BUCKET);
-	await applyPublicAssetsBucketPolicy(adminClient, KEYSTROKE_ASSETS_BUCKET);
-}
-async function createAssetsBucketIfNeeded(adminClient, bucket) {
-	try {
-		await adminClient.send(new CreateBucketCommand({
-			Bucket: bucket,
-			ACL: "public-read"
-		}));
-		return;
-	} catch (error) {
-		if (isBucketAlreadyExistsError(error)) return;
-	}
-	try {
-		await adminClient.send(new CreateBucketCommand({ Bucket: bucket }));
-	} catch (error) {
-		if (!isBucketAlreadyExistsError(error)) throw error;
-	}
-}
-async function applyPublicAssetsBucketAcl(adminClient, bucket) {
-	try {
-		await adminClient.send(new PutBucketAclCommand({
-			Bucket: bucket,
-			ACL: "public-read"
-		}));
-	} catch (error) {
-		if (!isUnsupportedStorageFeatureError(error)) console.warn("[storage] PutBucketAcl failed (continuing):", error);
-	}
-}
-async function applyPublicAssetsBucketPolicy(adminClient, bucket) {
-	try {
-		await adminClient.send(new PutBucketPolicyCommand({
-			Bucket: bucket,
-			Policy: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Effect: "Allow",
-					Principal: "*",
-					Action: ["s3:GetObject"],
-					Resource: [`arn:aws:s3:::${bucket}/${KEYSTROKE_ASSETS_AVATAR_PREFIX}*`, `arn:aws:s3:::${bucket}/${KEYSTROKE_ASSETS_ORG_LOGO_PREFIX}*`]
-				}]
-			})
-		}));
-	} catch (error) {
-		if (!isUnsupportedStorageFeatureError(error)) console.warn("[storage] PutBucketPolicy failed (continuing):", error);
-	}
-}
-function isUnsupportedStorageFeatureError(error) {
-	if (!error || typeof error !== "object") return false;
-	const name = "name" in error ? String(error.name) : "";
-	const code = "Code" in error ? String(error.Code) : "";
-	return name === "NotImplemented" || code === "NotImplemented" || code === "NotSupported";
-}
-const DEFAULT_BUCKET_NAME_PREFIX = "ks";
-function orgStorageBucketName(input, prefix = DEFAULT_BUCKET_NAME_PREFIX) {
-	return `${prefix.trim().replace(/-+$/g, "")}-${input.organizationId.toLowerCase()}`;
-}
-function minioStoragePlugin(options = {}) {
-	const adminConfig = storageAdminConfigFromEnv(options.env ?? process.env);
-	const adminClient = new S3Client({
-		region: adminConfig.region,
-		credentials: {
-			accessKeyId: adminConfig.accessKeyId,
-			secretAccessKey: adminConfig.secretAccessKey
-		},
-		endpoint: adminConfig.endpoint,
-		forcePathStyle: adminConfig.forcePathStyle
-	});
-	return {
-		async provisionOrganization(input) {
-			const bucket = orgStorageBucketName(input, options.bucketNamePrefix);
-			try {
-				await adminClient.send(new CreateBucketCommand({ Bucket: bucket }));
-			} catch (error) {
-				if (!isBucketAlreadyExistsError(error)) throw error;
-			}
-			return {
-				bucket,
-				endpoint: adminConfig.endpoint,
-				accessKeyId: adminConfig.accessKeyId,
-				secretAccessKey: adminConfig.secretAccessKey,
-				region: adminConfig.region,
-				forcePathStyle: adminConfig.forcePathStyle
-			};
-		},
-		async deprovisionOrganization(result) {
-			const client = new S3Client({
-				region: result.region ?? adminConfig.region,
-				credentials: {
-					accessKeyId: result.accessKeyId,
-					secretAccessKey: result.secretAccessKey
-				},
-				endpoint: result.endpoint,
-				forcePathStyle: result.forcePathStyle ?? true
-			});
-			if (((await client.send(new ListObjectsV2Command({
-				Bucket: result.bucket,
-				MaxKeys: 1
-			}))).KeyCount ?? 0) > 0) throw new Error(`Refusing to delete non-empty storage bucket ${result.bucket}`);
-			await client.send(new DeleteBucketCommand({ Bucket: result.bucket }));
-		}
-	};
-}
-//#endregion
-export { ListProjectMembersResponseSchema as $, mapProjectDeployment as $t, CreateProjectArtifactResponseSchema as A, UpdateOrganizationMemberResponseSchema as At, HistoryRunListResponseSchema as B, UserPreferencesPatchSchema as Bt, CompleteProjectArtifactResponseSchema as C, SlugAvailabilityQuerySchema as Ct, CreateCredentialsResponseSchema as D, SubmitTeamRequestResponseSchema as Dt, CreateCredentialsRequestSchema as E, SubmitTeamRequestRequestSchema as Et, ErrorResponseSchema as F, UpdateProjectSettingsRequestSchema as Ft, ListApiKeysResponseSchema as G, buildCredentialInstanceLabel as Gt, InviteOrganizationMembersResponseSchema as H, WorkflowSummaryDetailResponseSchema as Ht, GetCredentialResponseSchema as I, UploadProjectSourceManifestRequestSchema as It, ListOrganizationInvitationsResponseSchema as J, listenPortFromPublicUrl as Jt, ListAppsResponseSchema as K, credentialInputSchema as Kt, HistoryRunCancelResponseSchema as L, UploadProjectSourceResponseSchema as Lt, CreateProjectResponseSchema as M, UpdateProjectMemberRequestSchema as Mt, DeclineOrganizationInvitationResponseSchema as N, UpdateProjectMemberResponseSchema as Nt, CreateOrganizationRequestSchema as O, UpdateCredentialRequestSchema as Ot, DownloadActiveProjectArtifactResponseSchema as P, UpdateProjectRequestSchema as Pt, ListProjectFilesResponseSchema as Q, mapProjectArtifact as Qt, HistoryRunDetailResponseSchema as R, UserAvatarPatchSchema as Rt, AgentSummarySchema as S, SkillSummarySchema as St, CreateApiKeyResponseSchema as T, StoredProjectSourceManifestSchema as Tt, InviteProjectMembersRequestSchema as U, WorkflowSummaryListResponseSchema as Ut, InviteOrganizationMembersRequestSchema as V, UserPreferencesSchema as Vt, InviteProjectMembersResponseSchema as W, WorkflowSummarySchema as Wt, ListOrganizationsResponseSchema as X, mapOrganizationMember as Xt, ListOrganizationMembersResponseSchema as Y, mapOrganizationInvitation as Yt, ListProjectDeploymentsResponseSchema as Z, mapProject as Zt, ACTIVE_ORG_HEADER as _, ProjectSourceResourcesSchema as _t, isKeystrokeAssetsAvatarPublicUrl as a, organizationInvitationAcceptPath as an, PROJECT_SLUG_TAKEN_MESSAGE as at, AgentSummaryDetailResponseSchema as b, SkillSummaryDetailResponseSchema as bt, isUserAvatarStorageKey as c, projectFileId as cn, PresignProjectSourceRequestSchema as ct, minioStoragePlugin as d, defaultHostingPlugin as dn, PresignUserAvatarResponseSchema as dt, mapProjectMember as en, ListProjectMetricsResponseSchema as et, orgLogoStorageKey as f, pingProjectTarget as fn, ProjectReachabilityResponseSchema as ft, userAvatarStorageKey as g, ProjectSlugAvailabilityResponseSchema as gt, publicKeystrokeAssetsObjectUrl as h, ProjectSlugAvailabilityQuerySchema as ht, extractRouteManifestFromArtifact as i, normalizeUserPreferences as in, PLATFORM_RESOURCE_UNSUPPORTED_TEXT as it, CreateProjectRequestSchema as j, UpdateOrganizationRequestSchema as jt, CreateOrganizationResponseSchema as k, UpdateOrganizationMemberRequestSchema as kt, keystrokeAssetsAvatarKeyFromPublicUrl as l, resolveUniqueCredentialInstanceLabel as ln, PresignProjectSourceResponseSchema as lt, projectSourceBlobKey as m, ProjectSettingsResponseSchema as mt, createAssetsStorageClient as n, mapUserOrganization as nn, OrganizationSidebarBrandingPatchSchema as nt, isKeystrokeAssetsOrgLogoPublicUrl as o, organizationSlugErrorCodeFromMessage as on, PresignOrgLogoRequestSchema as ot, projectArtifactKey as p, ProjectResponseSchema as pt, ListCredentialsResponseSchema as q, displayCredentialAppName as qt, ensureKeystrokeAssetsBucket as r, mergeUserPreferences as rn, OrganizationSidebarBrandingSchema as rt, isOrgLogoStorageKey as s, parseStoredRouteManifest as sn, PresignOrgLogoResponseSchema as st, RouteManifestNotFoundError as t, mapProjectSettings as tn, ListProjectsResponseSchema as tt, keystrokeAssetsOrgLogoKeyFromPublicUrl as u, validationErrorResponse as un, PresignUserAvatarRequestSchema as ut, AcceptOrganizationInvitationResponseSchema as v, RecentResourceListResponseSchema as vt, CreateApiKeyRequestSchema as w, SlugAvailabilityResponseSchema as wt, AgentSummaryListResponseSchema as x, SkillSummaryListResponseSchema as xt, ActiveOrganizationResponseSchema as y, RecentResourceSchema as yt, HistoryRunListQuerySchema as z, UserAvatarSchema as zt };
-
-//# sourceMappingURL=dist-B1hOOWjl.mjs.map