@knpkv/control-center 0.1.0

package/dist/server/assets/controlCenterApi-tZPvRPRH.js

@@ -0,0 +1,1430 @@
+import { An as ReadinessVerdict, Br as RelationshipRepairProposalId, Cr as EntityId, Ct as ReleaseServiceName, D as DeliveryEntityStatusGroup, Dr as EvidenceId, E as DeliveryEntityService, Fr as PersonId, Gr as ShareId, Hr as ReleaseId, Ir as PluginConnectionId, Kr as WorkspaceId, Lr as ProviderAccountId, Lt as Actor, M as EvidenceItem, Nt as ReleaseRelayProjection, O as DeliveryNode, Or as FollowedResourceId, Pr as JobId, R as LedgerRevision, S as RelationshipRepairReviewDecision, St as ReleaseLifecycle, T as DeliveryEntityProjection, Tr as EventCursor, Vr as RelationshipRepairReviewId, Wr as SessionId, Wt as Role, _ as RelationshipRepairDisposition, _t as PluginConfigurationFieldV1, b as RelationshipRepairRationale, bt as SemanticVersion, cr as hasMaximumPluginJsonBytes, d as TimelineEventDetail, dr as PluginHealth, g as RelationshipRepairApplication, gr as SourceRevision, i as PortfolioInvalidatedEventV1, j as EvidenceClaim, k as DeliveryRelationship, kn as ReadinessStages, l as TimelineCursor, lr as Freshness, mr as ProviderId, p as TimelinePage, pt as NegotiatedPluginCapabilityV1, s as TimelineActorKind, u as TimelineEvent, ur as PluginFailureClass, v as RelationshipRepairProposal, w as DeliveryEntityKind, wr as EnvironmentId, wt as ReleaseVersion, yn as ReadinessFinding, yr as UtcTimestamp, yt as PluginId, zr as RelationshipId } from "./domainEvent-x7yeq-gU.js";
+import { MAXIMUM_AGENT_OUTPUT_TEXT_LENGTH } from "@knpkv/ai-runtime";
+import * as Schema from "effect/Schema";
+import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity } from "effect/unstable/httpapi";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import * as SchemaGetter from "effect/SchemaGetter";
+import * as Context from "effect/Context";
+//#region src/api/errors.ts
+var SafeApiMessage = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500));
+/** Correlation identifier shared by one HTTP response header and its typed error body. */
+var CorrelationId = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(128), Schema.isPattern(/^[A-Za-z0-9._:-]+$/u, { expected: "an HTTP-safe correlation identifier" })).pipe(Schema.brand("CorrelationId"));
+var commonErrorFields = {
+	correlationId: CorrelationId,
+	message: SafeApiMessage
+};
+/** A request failed schema, authority, origin, or CSRF-shape validation. */
+var InvalidRequestApiError = class extends Schema.TaggedErrorClass()("InvalidRequestApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("invalid-request")
+}, { httpApiStatus: 400 }) {};
+/** The browser did not present a valid active session. */
+var UnauthorizedApiError = class extends Schema.TaggedErrorClass()("UnauthorizedApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("unauthorized")
+}, { httpApiStatus: 401 }) {};
+/** The active session cannot perform the requested capability. */
+var ForbiddenApiError = class extends Schema.TaggedErrorClass()("ForbiddenApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("forbidden")
+}, { httpApiStatus: 403 }) {};
+/** An authenticated lookup did not resolve to a visible resource. */
+var NotFoundApiError = class extends Schema.TaggedErrorClass()("NotFoundApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("not-found")
+}, { httpApiStatus: 404 }) {};
+/** Current durable state conflicts with the requested transition. */
+var ConflictApiError = class extends Schema.TaggedErrorClass()("ConflictApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("conflict")
+}, { httpApiStatus: 409 }) {};
+/** A bounded request exceeded the public API size limit. */
+var PayloadTooLargeApiError = class extends Schema.TaggedErrorClass()("PayloadTooLargeApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("payload-too-large")
+}, { httpApiStatus: 413 }) {};
+/** The request did not complete within its bounded server deadline. */
+var RequestTimedOutApiError = class extends Schema.TaggedErrorClass()("RequestTimedOutApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("request-timed-out")
+}, { httpApiStatus: 408 }) {};
+/** The caller must wait until the optional safe retry instant. */
+var RateLimitedApiError = class extends Schema.TaggedErrorClass()("RateLimitedApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("rate-limited"),
+	retryAt: Schema.NullOr(UtcTimestamp)
+}, { httpApiStatus: 429 }) {};
+/** A required local or provider service is temporarily unavailable. */
+var ServiceUnavailableApiError = class extends Schema.TaggedErrorClass()("ServiceUnavailableApiError", {
+	...commonErrorFields,
+	code: Schema.Literal("service-unavailable"),
+	retryAt: Schema.NullOr(UtcTimestamp)
+}, { httpApiStatus: 503 }) {};
+/** Required response header attached to every successful and failed API response. */
+var CorrelationResponseHeaders = Schema.Struct({ "x-correlation-id": CorrelationId }).annotate({ identifier: "CorrelationResponseHeaders" });
+//#endregion
+//#region src/api/session.ts
+var LOWERCASE_SECRET_PATTERN = /^[0-9a-f]{64}$/u;
+/** Single-use pairing credential accepted only by the public pairing endpoint. */
+var PairingCode = Schema.String.check(Schema.isPattern(LOWERCASE_SECRET_PATTERN, { expected: "a lowercase 256-bit pairing credential" })).pipe(Schema.brand("PairingCode"));
+/** Mutation proof issued separately from the opaque session cookie. */
+var CsrfToken = Schema.String.check(Schema.isPattern(LOWERCASE_SECRET_PATTERN, { expected: "a lowercase 256-bit CSRF credential" })).pipe(Schema.brand("CsrfToken"));
+/** Secret-free metadata describing an authenticated browser session. */
+var SessionSummary = Schema.Struct({
+	sessionId: SessionId,
+	workspaceId: WorkspaceId,
+	actor: Actor,
+	permission: Role,
+	createdAt: UtcTimestamp,
+	lastSeenAt: UtcTimestamp,
+	idleExpiresAt: UtcTimestamp,
+	absoluteExpiresAt: UtcTimestamp,
+	revokedAt: Schema.NullOr(UtcTimestamp)
+}).annotate({ identifier: "ApiSessionSummary" });
+/** Pairing request whose credential is never represented in a URL. */
+var PairSessionRequest = Schema.Struct({ pairingCode: PairingCode });
+/** Pairing result; the opaque session token is delivered only through the response cookie. */
+var PairSessionResponse = Schema.Struct({
+	csrfToken: CsrfToken,
+	session: SessionSummary
+});
+/** Authenticated session metadata with a recoverable, session-bound mutation proof. */
+var CurrentSessionResponse = Schema.Struct({
+	csrfToken: CsrfToken,
+	session: SessionSummary
+});
+/** Bounded session-administration response. */
+var SessionListResponse = Schema.Array(SessionSummary).check(Schema.makeFilter((sessions) => sessions.length <= 100, { expected: "at most 100 sessions" }));
+/** Authenticated session attached to endpoint handlers by cookie middleware. */
+var CurrentSession = class extends Context.Service()("@knpkv/control-center/api/CurrentSession") {};
+/** Public middleware identity for the opaque `cc_session` cookie. */
+var SessionCookieAuth = class extends HttpApiMiddleware.Service()("@knpkv/control-center/api/SessionCookieAuth", {
+	error: [
+		UnauthorizedApiError,
+		ForbiddenApiError,
+		ServiceUnavailableApiError
+	],
+	security: { sessionCookie: HttpApiSecurity.apiKey({
+		in: "cookie",
+		key: "cc_session"
+	}) }
+}) {};
+/** Public middleware identity for the separate mutation CSRF header. */
+var SessionMutationAuth = class extends HttpApiMiddleware.Service()("@knpkv/control-center/api/SessionMutationAuth", {
+	error: [
+		InvalidRequestApiError,
+		ForbiddenApiError,
+		ServiceUnavailableApiError
+	],
+	security: { csrfToken: HttpApiSecurity.apiKey({
+		in: "header",
+		key: "x-csrf-token"
+	}) }
+}) {};
+/** Compatibility name emphasizing the CSRF mechanism used by mutation authorization. */
+var MutationCsrf = SessionMutationAuth;
+var authenticatedErrors$1 = [
+	UnauthorizedApiError,
+	ForbiddenApiError,
+	RequestTimedOutApiError,
+	ServiceUnavailableApiError
+];
+var pair = HttpApiEndpoint.post("pair", "/pair", {
+	payload: PairSessionRequest,
+	success: PairSessionResponse,
+	error: [
+		InvalidRequestApiError,
+		UnauthorizedApiError,
+		ConflictApiError,
+		RequestTimedOutApiError,
+		ServiceUnavailableApiError
+	]
+});
+var current = HttpApiEndpoint.get("current", "/current", {
+	success: CurrentSessionResponse,
+	error: authenticatedErrors$1
+}).middleware(SessionCookieAuth);
+var list$1 = HttpApiEndpoint.get("list", "/", {
+	success: SessionListResponse,
+	error: authenticatedErrors$1
+}).middleware(SessionCookieAuth);
+var revoke$1 = HttpApiEndpoint.delete("revoke", "/:sessionId", {
+	params: Schema.Struct({ sessionId: SessionId }),
+	success: HttpApiSchema.NoContent,
+	error: authenticatedErrors$1
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var logout = HttpApiEndpoint.post("logout", "/logout", {
+	success: HttpApiSchema.NoContent,
+	error: authenticatedErrors$1
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+/** Session pairing, inspection, administration, and logout contract. */
+var SessionApiGroup = class extends HttpApiGroup.make("session").add(pair, current, list$1, revoke$1, logout).prefix("/api/v1/session") {};
+//#endregion
+//#region src/api/plugins.ts
+var MAXIMUM_PLUGIN_CONNECTIONS = 100;
+var MAXIMUM_PROVIDER_ACCOUNTS = 100;
+var MAXIMUM_FOLLOWED_RESOURCES = 100;
+var MAXIMUM_DISCOVERED_AWS_PROFILES = 100;
+var MAXIMUM_DISCOVERED_AWS_RESOURCES = 20;
+var MAXIMUM_DISCOVERED_ATLASSIAN_PROFILES = 100;
+var MAXIMUM_ATLASSIAN_OAUTH_SITES = 100;
+var MAXIMUM_CONFIGURATION_VALUES = 100;
+var MAXIMUM_SECRET_VALUE_LENGTH = 16384;
+var isProviderHttpUrl = Schema.makeFilter((value) => {
+	const decoded = Schema.decodeUnknownResult(Schema.URLFromString)(value);
+	if (Result.isFailure(decoded)) return false;
+	const url = decoded.success;
+	return (url.protocol === "https:" || url.protocol === "http:") && url.hostname.length > 0 && url.username.length === 0 && url.password.length === 0 && url.hash.length === 0;
+}, { expected: "an HTTP(S) provider URL without credentials or a fragment" });
+/** Stable field key shared by descriptor metadata and configuration values. */
+var PluginConfigurationKey = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(100)).pipe(Schema.brand("PluginConfigurationKey"));
+/** Opaque reference created through the separate secret-management boundary. */
+var OpaqueSecretReference = Schema.String.check(Schema.isPattern(/^secret_[0-9a-f]{64}$/u, { expected: "an opaque secret reference" })).pipe(Schema.brand("OpaqueSecretReference"));
+var configurationValueFields = { key: PluginConfigurationKey };
+var BoundedConfigurationText = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(4096));
+var BoundedConfigurationUrl = BoundedConfigurationText.check(isProviderHttpUrl);
+var AtlassianCloudSiteUrl = BoundedConfigurationUrl.check(Schema.makeFilter((value) => {
+	const decoded = Schema.decodeUnknownResult(Schema.URLFromString)(value);
+	if (Result.isFailure(decoded)) return false;
+	const url = decoded.success;
+	return url.protocol === "https:" && url.port.length === 0 && url.hostname.endsWith(".atlassian.net") && url.hostname.length > 14 && (url.pathname === "" || url.pathname === "/") && url.search.length === 0;
+}, { expected: "an HTTPS Atlassian Cloud site root" }));
+/** Explicit replacement semantics for a redacted secret in a full configuration update. */
+var SecretReferencePatchOperation = Schema.Union([
+	Schema.TaggedStruct("keep", {}),
+	Schema.TaggedStruct("clear", {}),
+	Schema.TaggedStruct("replace", { reference: OpaqueSecretReference })
+]).pipe(Schema.toTaggedUnion("_tag"));
+/** Secret-safe current value; secret fields reveal only whether a reference is configured. */
+var RedactedPluginConfigurationValue = Schema.Union([
+	Schema.TaggedStruct("text", {
+		...configurationValueFields,
+		value: BoundedConfigurationText
+	}),
+	Schema.TaggedStruct("url", {
+		...configurationValueFields,
+		value: BoundedConfigurationUrl
+	}),
+	Schema.TaggedStruct("boolean", {
+		...configurationValueFields,
+		value: Schema.Boolean
+	}),
+	Schema.TaggedStruct("integer", {
+		...configurationValueFields,
+		value: Schema.Int
+	}),
+	Schema.TaggedStruct("select", {
+		...configurationValueFields,
+		value: BoundedConfigurationText
+	}),
+	Schema.TaggedStruct("secret-reference", {
+		...configurationValueFields,
+		state: Schema.Literals(["configured", "missing"])
+	})
+]).pipe(Schema.toTaggedUnion("_tag"));
+/** Typed configuration update; secret bytes remain outside this endpoint. */
+var PluginConfigurationPatchValue = Schema.Union([
+	Schema.TaggedStruct("text", {
+		...configurationValueFields,
+		value: BoundedConfigurationText
+	}),
+	Schema.TaggedStruct("url", {
+		...configurationValueFields,
+		value: BoundedConfigurationUrl
+	}),
+	Schema.TaggedStruct("boolean", {
+		...configurationValueFields,
+		value: Schema.Boolean
+	}),
+	Schema.TaggedStruct("integer", {
+		...configurationValueFields,
+		value: Schema.Int
+	}),
+	Schema.TaggedStruct("select", {
+		...configurationValueFields,
+		value: BoundedConfigurationText
+	}),
+	Schema.TaggedStruct("secret-reference", {
+		...configurationValueFields,
+		operation: SecretReferencePatchOperation
+	})
+]).pipe(Schema.toTaggedUnion("_tag"));
+var boundedConfigurationValues = (value) => Schema.Array(value).check(Schema.makeFilter((values) => values.length <= MAXIMUM_CONFIGURATION_VALUES, { expected: `at most ${MAXIMUM_CONFIGURATION_VALUES} plugin configuration values` }), Schema.makeFilter((values) => new Set(values.map(({ key }) => key)).size === values.length, { expected: "unique plugin configuration keys" }));
+/** Redacted current configuration with its compare-and-swap revision. */
+var PluginConfiguration = Schema.Struct({
+	pluginConnectionId: PluginConnectionId,
+	revision: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	values: boundedConfigurationValues(RedactedPluginConfigurationValue),
+	updatedAt: Schema.NullOr(UtcTimestamp)
+}).annotate({ identifier: "PluginConfiguration" });
+/** Bounded compare-and-swap update request for one plugin connection. */
+var PatchPluginConfigurationRequest = Schema.Struct({
+	expectedRevision: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	values: boundedConfigurationValues(PluginConfigurationPatchValue)
+}).annotate({ identifier: "PatchPluginConfigurationRequest" });
+/** Secret-free plugin connection row used by navigation and portfolio views. */
+var NullableProviderAccountId = Schema.NullOr(ProviderAccountId);
+var NullableFollowedResourceId = Schema.NullOr(FollowedResourceId);
+var PluginConnectionSummary = Schema.Struct({
+	pluginConnectionId: PluginConnectionId,
+	providerAccountId: Schema.optional(NullableProviderAccountId).pipe(Schema.decodeTo(Schema.toType(NullableProviderAccountId), {
+		decode: SchemaGetter.withDefault(Effect.succeed(null)),
+		encode: SchemaGetter.required()
+	})),
+	followedResourceId: Schema.optional(NullableFollowedResourceId).pipe(Schema.decodeTo(Schema.toType(NullableFollowedResourceId), {
+		decode: SchemaGetter.withDefault(Effect.succeed(null)),
+		encode: SchemaGetter.required()
+	})),
+	providerId: ProviderId,
+	displayName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	isEnabled: Schema.Boolean,
+	supportsSynchronization: Schema.optional(Schema.Boolean).pipe(Schema.decodeTo(Schema.Boolean, {
+		decode: SchemaGetter.withDefault(Effect.succeed(false)),
+		encode: SchemaGetter.required()
+	})),
+	health: Schema.NullOr(PluginHealth),
+	updatedAt: UtcTimestamp
+}).annotate({ identifier: "PluginConnectionSummary" });
+/** Secret-free provider resource shown inside its owning account. */
+var FollowedResourceSummary = Schema.Struct({
+	followedResourceId: FollowedResourceId,
+	providerId: ProviderId,
+	displayName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	providerImmutableId: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(512)),
+	isEnabled: Schema.Boolean
+}).annotate({ identifier: "FollowedResourceSummary" });
+/** One provider account and the resources this workspace follows within it. */
+var ProviderAccountSummary = Schema.Struct({
+	providerAccountId: ProviderAccountId,
+	providerFamily: Schema.Literals([
+		"aws",
+		"atlassian",
+		"clockify"
+	]),
+	displayName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	providerImmutableId: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(512)),
+	resources: Schema.Array(FollowedResourceSummary).check(Schema.makeFilter((resources) => resources.length <= MAXIMUM_FOLLOWED_RESOURCES, { expected: `at most ${MAXIMUM_FOLLOWED_RESOURCES} followed resources per provider account` }))
+}).annotate({ identifier: "ProviderAccountSummary" });
+var CatalogFieldText = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500));
+/** Secret-free setup field shown before a first-party provider has runtime state. */
+var PluginServiceCatalogField = Schema.Struct({
+	key: PluginConfigurationKey,
+	label: CatalogFieldText,
+	description: CatalogFieldText,
+	kind: Schema.Literals([
+		"text",
+		"url",
+		"integer",
+		"secret"
+	]),
+	scope: Schema.Literals(["adapter", "credential"]),
+	required: Schema.Boolean,
+	defaultValue: Schema.NullOr(Schema.String.check(Schema.isMaxLength(4096))),
+	isReadOnly: Schema.Boolean,
+	minimum: Schema.NullOr(Schema.Int),
+	maximum: Schema.NullOr(Schema.Int)
+}).annotate({ identifier: "PluginServiceCatalogField" });
+/** One fixed first-party service available whether or not it is configured. */
+var PluginServiceCatalogEntry = Schema.Struct({
+	providerId: ProviderId,
+	displayName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	description: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)),
+	configurationFields: Schema.Array(PluginServiceCatalogField).check(Schema.isNonEmpty(), Schema.makeFilter((fields) => fields.length <= MAXIMUM_CONFIGURATION_VALUES, { expected: `at most ${MAXIMUM_CONFIGURATION_VALUES} catalog configuration fields` }))
+}).annotate({ identifier: "PluginServiceCatalogEntry" });
+/** One local AWS CLI profile available to first-party AWS adapters. */
+var DiscoveredAwsProfile = Schema.Struct({
+	profile: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	region: Schema.NullOr(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(100)))
+}).annotate({ identifier: "DiscoveredAwsProfile" });
+/** Bounded local AWS profile discovery response. */
+var AwsProfileDiscoveryResponse = Schema.Array(DiscoveredAwsProfile).check(Schema.makeFilter((profiles) => profiles.length <= MAXIMUM_DISCOVERED_AWS_PROFILES, { expected: `at most ${MAXIMUM_DISCOVERED_AWS_PROFILES} discovered AWS profiles` }));
+/** Validated local AWS credential selector for one explicit discovery request. */
+var AwsResourceDiscoveryRequest = Schema.Struct({
+	profile: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200), Schema.isPattern(/^[A-Za-z0-9_+=,.@ -]+$/u, { expected: "a valid AWS profile name" })),
+	region: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(100), Schema.isPattern(/^[a-z]{2}(?:-[a-z0-9]+)+-[0-9]+$/u, { expected: "a valid AWS region" }))
+}).annotate({ identifier: "AwsResourceDiscoveryRequest" });
+var AwsResourceName = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(100));
+var AwsResourceNames = Schema.Array(AwsResourceName).check(Schema.makeFilter((names) => names.length <= MAXIMUM_DISCOVERED_AWS_RESOURCES, { expected: `at most ${MAXIMUM_DISCOVERED_AWS_RESOURCES} discovered AWS resources` }), Schema.makeFilter((names) => new Set(names).size === names.length, { expected: "unique AWS resource names" }));
+/** Safe per-service AWS resource discovery result. */
+var AwsServiceResourceDiscovery = Schema.Union([Schema.TaggedStruct("available", {
+	names: AwsResourceNames,
+	truncated: Schema.Boolean
+}), Schema.TaggedStruct("failed", { failureClass: Schema.Literals([
+	"authorization",
+	"malformed-response",
+	"rate-limit",
+	"timeout",
+	"unavailable"
+]) })]).pipe(Schema.toTaggedUnion("_tag"), Schema.annotate({ identifier: "AwsServiceResourceDiscovery" }));
+/** Identity-verified, secret-free AWS resource discovery response. */
+var AwsResourceDiscoveryResponse = Schema.Struct({
+	accountId: Schema.String.check(Schema.isPattern(/^[0-9]{12}$/u, { expected: "a 12-digit AWS account id" })),
+	codeCommit: AwsServiceResourceDiscovery,
+	codePipeline: AwsServiceResourceDiscovery
+}).annotate({ identifier: "AwsResourceDiscoveryResponse" });
+/** One local OAuth profile available to first-party Atlassian adapters. */
+var DiscoveredAtlassianProfile = Schema.Struct({
+	profileId: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)),
+	name: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)),
+	siteUrl: BoundedConfigurationUrl,
+	cloudId: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)),
+	accountName: Schema.NullOr(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500))),
+	accountEmail: Schema.NullOr(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500))),
+	status: Schema.Literals(["valid", "expired"]),
+	providers: Schema.Array(Schema.Literals(["jira", "confluence"])).check(Schema.isNonEmpty())
+}).annotate({ identifier: "DiscoveredAtlassianProfile" });
+/** Bounded local Atlassian OAuth profile discovery response. */
+var AtlassianProfileDiscoveryResponse = Schema.Array(DiscoveredAtlassianProfile).check(Schema.makeFilter((profiles) => profiles.length <= MAXIMUM_DISCOVERED_ATLASSIAN_PROFILES, { expected: `at most ${MAXIMUM_DISCOVERED_ATLASSIAN_PROFILES} discovered Atlassian profiles` }));
+/** Single-use browser OAuth grant identifier; it is also the provider state parameter. */
+var AtlassianOAuthGrantId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/u, { expected: "a base64url-encoded 256-bit OAuth state" })).pipe(Schema.brand("AtlassianOAuthGrantId"));
+/** Atlassian product requested by one browser OAuth grant. */
+var AtlassianOAuthProvider = Schema.Literals(["jira", "confluence"]);
+/** One or both distinct Atlassian products requested by an OAuth grant. */
+var AtlassianOAuthProviderIntent = Schema.Array(AtlassianOAuthProvider).check(Schema.isNonEmpty(), Schema.makeFilter((providers) => providers.length <= 2, { expected: "at most two Atlassian OAuth providers" }), Schema.makeFilter((providers) => new Set(providers).size === providers.length, { expected: "distinct Atlassian OAuth providers" }));
+/** OAuth app credentials entered once in Control Center and retained only by its server. */
+var AtlassianOAuthClientConfiguration = Schema.Struct({
+	clientId: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)),
+	clientSecret: Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(MAXIMUM_SECRET_VALUE_LENGTH))
+}).annotate({ identifier: "AtlassianOAuthClientConfiguration" });
+/** Owner request to start OAuth for the products currently being configured. */
+var CreateAtlassianOAuthGrantRequest = Schema.Struct({
+	providers: AtlassianOAuthProviderIntent,
+	configuration: Schema.optional(AtlassianOAuthClientConfiguration)
+}).annotate({ identifier: "CreateAtlassianOAuthGrantRequest" });
+/** Safe result of preparing the browser authorization redirect. */
+var AtlassianOAuthGrantStartResponse = Schema.Union([Schema.TaggedStruct("ready", {
+	authorizationUrl: Schema.String.check(isProviderHttpUrl),
+	callbackUrl: BoundedConfigurationUrl
+}), Schema.TaggedStruct("configuration-required", { callbackUrl: BoundedConfigurationUrl })]).pipe(Schema.toTaggedUnion("_tag"), Schema.annotate({ identifier: "AtlassianOAuthGrantStartResponse" }));
+/** Authorization code returned by Atlassian to the same authenticated browser. */
+var ExchangeAtlassianOAuthGrantRequest = Schema.Struct({ code: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(4096)) }).annotate({ identifier: "ExchangeAtlassianOAuthGrantRequest" });
+/** One accessible Atlassian site awaiting explicit selection. */
+var AtlassianOAuthSite = Schema.Struct({
+	cloudId: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)),
+	name: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)),
+	siteUrl: AtlassianCloudSiteUrl
+}).annotate({ identifier: "AtlassianOAuthSite" });
+/** Secret-free account and site choices returned after code exchange. */
+var AtlassianOAuthGrantExchangeResponse = Schema.Struct({
+	grantId: AtlassianOAuthGrantId,
+	accountName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)),
+	accountEmail: Schema.NullOr(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500))),
+	sites: Schema.Array(AtlassianOAuthSite).check(Schema.isNonEmpty(), Schema.makeFilter((sites) => sites.length <= MAXIMUM_ATLASSIAN_OAUTH_SITES, { expected: `at most ${MAXIMUM_ATLASSIAN_OAUTH_SITES} accessible Atlassian sites` }))
+}).annotate({ identifier: "AtlassianOAuthGrantExchangeResponse" });
+/** Explicit site choice that completes a pending browser OAuth grant. */
+var CompleteAtlassianOAuthGrantRequest = Schema.Struct({ cloudId: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500)) }).annotate({ identifier: "CompleteAtlassianOAuthGrantRequest" });
+/** Bounded plugin-navigation and portfolio response retained for v1 clients. */
+var PluginListResponse = Schema.Array(PluginConnectionSummary).check(Schema.makeFilter((plugins) => plugins.length <= MAXIMUM_PLUGIN_CONNECTIONS, { expected: `at most ${MAXIMUM_PLUGIN_CONNECTIONS} plugin connections` }));
+var ProviderAccountSummaries = Schema.Array(ProviderAccountSummary).check(Schema.makeFilter((accounts) => accounts.length <= MAXIMUM_PROVIDER_ACCOUNTS, { expected: `at most ${MAXIMUM_PROVIDER_ACCOUNTS} provider accounts` }));
+/** Bounded Services overview with the fixed catalog and durable connections. */
+var PluginOverviewResponse = Schema.Struct({
+	catalog: Schema.Array(PluginServiceCatalogEntry).check(Schema.makeFilter((entries) => entries.length === 5, { expected: "the five first-party services" })),
+	connections: Schema.Array(PluginConnectionSummary).check(Schema.makeFilter((plugins) => plugins.length <= MAXIMUM_PLUGIN_CONNECTIONS, { expected: `at most ${MAXIMUM_PLUGIN_CONNECTIONS} plugin connections` })),
+	accounts: Schema.optional(ProviderAccountSummaries).pipe(Schema.decodeTo(Schema.toType(ProviderAccountSummaries), {
+		decode: SchemaGetter.withDefault(Effect.succeed([])),
+		encode: SchemaGetter.required()
+	}))
+}).annotate({ identifier: "PluginOverviewResponse" });
+var createValueFields = { key: PluginConfigurationKey };
+/** Typed setup input; only the secret variant carries transport-only secret text. */
+var CreatePluginConnectionValue = Schema.Union([
+	Schema.TaggedStruct("text", {
+		...createValueFields,
+		value: BoundedConfigurationText
+	}),
+	Schema.TaggedStruct("url", {
+		...createValueFields,
+		value: BoundedConfigurationUrl
+	}),
+	Schema.TaggedStruct("integer", {
+		...createValueFields,
+		value: Schema.Int
+	}),
+	Schema.TaggedStruct("secret", {
+		...createValueFields,
+		value: Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(MAXIMUM_SECRET_VALUE_LENGTH))
+	})
+]).pipe(Schema.toTaggedUnion("_tag"));
+/** Bounded owner request to create, configure, enable, and immediately test a connection. */
+var CreatePluginConnectionRequest = Schema.Struct({
+	pluginConnectionId: PluginConnectionId,
+	providerId: ProviderId,
+	displayName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	values: boundedConfigurationValues(CreatePluginConnectionValue)
+}).annotate({ identifier: "CreatePluginConnectionRequest" });
+/** Current health for one authenticated plugin connection lookup. */
+var PluginHealthResponse = Schema.Struct({
+	pluginConnectionId: PluginConnectionId,
+	health: PluginHealth
+}).annotate({ identifier: "PluginHealthResponse" });
+var ConnectionIdentityText = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(512));
+/** Secret-free provider identity proven by a live connection test. */
+var PluginConnectionIdentity = Schema.Struct({
+	kind: Schema.Literals([
+		"user",
+		"account",
+		"workspace"
+	]),
+	label: ConnectionIdentityText,
+	displayName: ConnectionIdentityText,
+	providerImmutableId: ConnectionIdentityText
+}).annotate({ identifier: "PluginConnectionIdentity" });
+var connectionTestTiming = {
+	pluginConnectionId: PluginConnectionId,
+	providerId: ProviderId,
+	checkedAt: UtcTimestamp,
+	latencyMilliseconds: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+};
+/** Normalized result of live health and identity discovery against one connection. */
+var PluginConnectionTestResult = Schema.Union([Schema.TaggedStruct("healthy", {
+	...connectionTestTiming,
+	identity: PluginConnectionIdentity
+}), Schema.TaggedStruct("failed", {
+	...connectionTestTiming,
+	failureClass: PluginFailureClass,
+	retryAt: Schema.NullOr(UtcTimestamp),
+	safeMessage: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200))
+})]).pipe(Schema.toTaggedUnion("_tag"), Schema.annotate({ identifier: "PluginConnectionTestResult" }));
+/** Durable result of the most recent bounded synchronization invocation. */
+var PluginSynchronizationResult = Schema.Literals([
+	"never",
+	"running",
+	"synchronized",
+	"source-unavailable",
+	"interrupted"
+]);
+/** Secret-free durable synchronization state for one negotiated connection stream. */
+var PluginSynchronizationState = Schema.Struct({
+	pluginConnectionId: PluginConnectionId,
+	providerId: ProviderId,
+	streamKey: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(100)),
+	lastAttemptAt: Schema.NullOr(UtcTimestamp),
+	lastSuccessAt: Schema.NullOr(UtcTimestamp),
+	result: PluginSynchronizationResult,
+	pagesCommitted: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+}).annotate({ identifier: "PluginSynchronizationState" });
+/** Redacted result of durable setup and its immediate live identity check. */
+var CreatePluginConnectionResponse = Schema.Struct({
+	connection: PluginConnectionSummary,
+	configuration: PluginConfiguration,
+	test: PluginConnectionTestResult
+}).annotate({ identifier: "CreatePluginConnectionResponse" });
+var MAXIMUM_BATCH_PLUGIN_CONNECTIONS = 40;
+/** Bounded setup batch owned by one authenticated workspace. */
+var CreatePluginConnectionsRequest = Schema.Struct({ connections: Schema.Array(CreatePluginConnectionRequest).check(Schema.makeFilter((connections) => connections.length >= 1 && connections.length <= MAXIMUM_BATCH_PLUGIN_CONNECTIONS, { expected: `between 1 and ${MAXIMUM_BATCH_PLUGIN_CONNECTIONS} plugin connections` }), Schema.makeFilter((connections) => new Set(connections.map(({ pluginConnectionId }) => pluginConnectionId)).size === connections.length, { expected: "unique plugin connection identifiers" })) }).annotate({ identifier: "CreatePluginConnectionsRequest" });
+var PluginConnectionSetupFailureClass = Schema.Literals([
+	"conflict",
+	"invalid-request",
+	"not-found",
+	"rate-limited",
+	"service-unavailable"
+]);
+/** One ordered result from a multi-connection setup request. */
+var CreatePluginConnectionBatchResult = Schema.Union([Schema.TaggedStruct("succeeded", { response: CreatePluginConnectionResponse }), Schema.TaggedStruct("failed", {
+	pluginConnectionId: PluginConnectionId,
+	failureClass: PluginConnectionSetupFailureClass
+})]).pipe(Schema.toTaggedUnion("_tag"));
+/** Ordered redacted results for a bounded setup batch. */
+var CreatePluginConnectionsResponse = Schema.Struct({ results: Schema.Array(CreatePluginConnectionBatchResult).check(Schema.makeFilter((results) => results.length >= 1 && results.length <= MAXIMUM_BATCH_PLUGIN_CONNECTIONS, { expected: `between 1 and ${MAXIMUM_BATCH_PLUGIN_CONNECTIONS} plugin connection results` })) }).annotate({ identifier: "CreatePluginConnectionsResponse" });
+/** Owner-only transition for independently enabling or disabling one connection. */
+var SetPluginConnectionEnabledRequest = Schema.Struct({ isEnabled: Schema.Boolean }).annotate({ identifier: "SetPluginConnectionEnabledRequest" });
+/** Secret-free configuration contract exposed to settings views. */
+var PluginConfigurationMetadata = Schema.Struct({
+	pluginConnectionId: PluginConnectionId,
+	pluginId: PluginId,
+	contractVersion: SemanticVersion,
+	adapterVersion: SemanticVersion,
+	configurationFields: Schema.Array(PluginConfigurationFieldV1).check(Schema.makeFilter((fields) => fields.length <= 100, { expected: "at most 100 configuration fields" })),
+	capabilities: Schema.Array(NegotiatedPluginCapabilityV1).check(Schema.makeFilter((capabilities) => capabilities.length <= 32, { expected: "at most 32 negotiated plugin capabilities" }))
+}).annotate({ identifier: "PluginConfigurationMetadata" });
+var pluginReadErrors = [
+	UnauthorizedApiError,
+	ForbiddenApiError,
+	RateLimitedApiError,
+	RequestTimedOutApiError,
+	ServiceUnavailableApiError
+];
+var list = HttpApiEndpoint.get("list", "/", {
+	success: PluginListResponse,
+	error: pluginReadErrors
+}).middleware(SessionCookieAuth);
+var overview = HttpApiEndpoint.get("overview", "/overview", {
+	success: PluginOverviewResponse,
+	error: pluginReadErrors
+}).middleware(SessionCookieAuth);
+var discoverAwsProfiles = HttpApiEndpoint.get("discoverAwsProfiles", "/discovery/aws-profiles", {
+	success: AwsProfileDiscoveryResponse,
+	error: pluginReadErrors
+}).middleware(SessionCookieAuth);
+var discoverAwsResources = HttpApiEndpoint.post("discoverAwsResources", "/discovery/aws-resources", {
+	payload: AwsResourceDiscoveryRequest,
+	success: AwsResourceDiscoveryResponse,
+	error: [...pluginReadErrors, InvalidRequestApiError]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var discoverAtlassianProfiles = HttpApiEndpoint.get("discoverAtlassianProfiles", "/discovery/atlassian-profiles", {
+	success: AtlassianProfileDiscoveryResponse,
+	error: pluginReadErrors
+}).middleware(SessionCookieAuth);
+var createAtlassianOAuthGrant = HttpApiEndpoint.post("createAtlassianOAuthGrant", "/oauth/atlassian/grants", {
+	payload: CreateAtlassianOAuthGrantRequest,
+	success: AtlassianOAuthGrantStartResponse,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		ConflictApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var exchangeAtlassianOAuthGrant = HttpApiEndpoint.post("exchangeAtlassianOAuthGrant", "/oauth/atlassian/grants/:grantId/exchange", {
+	params: Schema.Struct({ grantId: AtlassianOAuthGrantId }),
+	payload: ExchangeAtlassianOAuthGrantRequest,
+	success: AtlassianOAuthGrantExchangeResponse,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		NotFoundApiError,
+		ConflictApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var completeAtlassianOAuthGrant = HttpApiEndpoint.post("completeAtlassianOAuthGrant", "/oauth/atlassian/grants/:grantId/complete", {
+	params: Schema.Struct({ grantId: AtlassianOAuthGrantId }),
+	payload: CompleteAtlassianOAuthGrantRequest,
+	success: DiscoveredAtlassianProfile,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		NotFoundApiError,
+		ConflictApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var createConnection = HttpApiEndpoint.post("createConnection", "/connections", {
+	payload: CreatePluginConnectionRequest,
+	success: CreatePluginConnectionResponse,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		NotFoundApiError,
+		ConflictApiError,
+		PayloadTooLargeApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var createConnections = HttpApiEndpoint.post("createConnections", "/connections/batch", {
+	payload: CreatePluginConnectionsRequest,
+	success: CreatePluginConnectionsResponse,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		ConflictApiError,
+		PayloadTooLargeApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var setConnectionEnabled = HttpApiEndpoint.patch("setConnectionEnabled", "/connections/:pluginConnectionId", {
+	params: Schema.Struct({ pluginConnectionId: PluginConnectionId }),
+	payload: SetPluginConnectionEnabledRequest,
+	success: PluginConnectionSummary,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		NotFoundApiError,
+		ConflictApiError,
+		PayloadTooLargeApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var health = HttpApiEndpoint.get("health", "/:pluginConnectionId/health", {
+	params: Schema.Struct({ pluginConnectionId: PluginConnectionId }),
+	success: PluginHealthResponse,
+	error: [...pluginReadErrors, NotFoundApiError]
+}).middleware(SessionCookieAuth);
+var testConnection = HttpApiEndpoint.post("testConnection", "/:pluginConnectionId/test", {
+	params: Schema.Struct({ pluginConnectionId: PluginConnectionId }),
+	success: PluginConnectionTestResult,
+	error: [...pluginReadErrors, NotFoundApiError]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var synchronization = HttpApiEndpoint.get("synchronization", "/:pluginConnectionId/synchronization", {
+	params: Schema.Struct({ pluginConnectionId: PluginConnectionId }),
+	success: PluginSynchronizationState,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		NotFoundApiError
+	]
+}).middleware(SessionCookieAuth);
+var synchronizeConnection = HttpApiEndpoint.post("synchronizeConnection", "/:pluginConnectionId/sync", {
+	params: Schema.Struct({ pluginConnectionId: PluginConnectionId }),
+	success: PluginSynchronizationState,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		NotFoundApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var configurationMetadata = HttpApiEndpoint.get("configurationMetadata", "/:pluginConnectionId/configuration-metadata", {
+	params: Schema.Struct({ pluginConnectionId: PluginConnectionId }),
+	success: PluginConfigurationMetadata,
+	error: [...pluginReadErrors, NotFoundApiError]
+}).middleware(SessionCookieAuth);
+var configuration = HttpApiEndpoint.get("configuration", "/:pluginConnectionId/configuration", {
+	params: Schema.Struct({ pluginConnectionId: PluginConnectionId }),
+	success: PluginConfiguration,
+	error: [...pluginReadErrors, NotFoundApiError]
+}).middleware(SessionCookieAuth);
+var patchConfiguration = HttpApiEndpoint.patch("patchConfiguration", "/:pluginConnectionId/configuration", {
+	params: Schema.Struct({ pluginConnectionId: PluginConnectionId }),
+	payload: PatchPluginConfigurationRequest,
+	success: PluginConfiguration,
+	error: [
+		...pluginReadErrors,
+		InvalidRequestApiError,
+		NotFoundApiError,
+		ConflictApiError,
+		PayloadTooLargeApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+/** Authenticated plugin list, health, and secret-free configuration contract. */
+var PluginsApiGroup = class extends HttpApiGroup.make("plugins").add(list, overview, discoverAwsProfiles, discoverAwsResources, discoverAtlassianProfiles, createAtlassianOAuthGrant, exchangeAtlassianOAuthGrant, completeAtlassianOAuthGrant, createConnection, createConnections, setConnectionEnabled, health, testConnection, synchronization, synchronizeConnection, configurationMetadata, configuration, patchConfiguration).prefix("/api/v1/plugins") {};
+//#endregion
+//#region src/api/portfolio.ts
+var MAXIMUM_PORTFOLIO_RELEASES = 200;
+var MAXIMUM_TARGET_ENVIRONMENTS = 50;
+var MAXIMUM_SNAPSHOT_JSON_BYTES = 1024 * 1024;
+var MAXIMUM_COUNT = 1e6;
+var MAXIMUM_RELEASE_COLLABORATORS = 50;
+var BoundedCount = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0), Schema.isLessThanOrEqualTo(MAXIMUM_COUNT));
+/** Compact relationship totals for one release delivery graph. */
+var PortfolioRelationshipCounts = Schema.Struct({
+	issues: BoundedCount,
+	pullRequests: BoundedCount,
+	pipelineExecutions: BoundedCount,
+	truncated: Schema.Boolean
+}).annotate({ identifier: "PortfolioRelationshipCounts" });
+/** Current server-owned readiness facts required by the bird's-eye portfolio. */
+var PortfolioReadinessSummary = Schema.Struct({
+	authority: Schema.Literals(["authoritative", "pending"]),
+	verdict: ReadinessVerdict,
+	stages: ReadinessStages,
+	blockerCount: BoundedCount,
+	warningCount: BoundedCount,
+	gapCount: BoundedCount,
+	primaryFinding: Schema.NullOr(ReadinessFinding),
+	evaluatedAt: UtcTimestamp
+}).annotate({ identifier: "PortfolioReadinessSummary" });
+/** Release-scoped human responsibility shown in the compact portfolio. */
+var PortfolioReleaseRole = Schema.Literals(["release-owner", "release-approver"]);
+/** Named human collaborator resolved from durable workspace identity. */
+var PortfolioReleaseCollaborator = Schema.Struct({
+	personId: PersonId,
+	displayName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	avatarFallback: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(4)),
+	role: PortfolioReleaseRole
+}).annotate({ identifier: "PortfolioReleaseCollaborator" });
+var BoundedReleaseCollaborators = Schema.Array(PortfolioReleaseCollaborator).check(Schema.makeFilter((collaborators) => collaborators.length <= MAXIMUM_RELEASE_COLLABORATORS, { expected: `at most ${MAXIMUM_RELEASE_COLLABORATORS} release collaborators` }), Schema.makeFilter((collaborators) => new Set(collaborators.map(({ personId, role }) => `${personId}\u0000${role}`)).size === collaborators.length, { expected: "unique person and release-role pairs" }));
+/** Compact release projection for the authenticated bird's-eye portfolio. */
+var PortfolioReleaseSummary = Schema.Struct({
+	releaseId: ReleaseId,
+	serviceName: ReleaseServiceName,
+	version: ReleaseVersion,
+	lifecycle: ReleaseLifecycle,
+	relay: ReleaseRelayProjection,
+	freshness: Freshness,
+	targetEnvironmentIds: Schema.Array(EnvironmentId).check(Schema.isUnique(), Schema.makeFilter((environments) => environments.length <= MAXIMUM_TARGET_ENVIRONMENTS, { expected: `at most ${MAXIMUM_TARGET_ENVIRONMENTS} target environments` })),
+	collaborators: BoundedReleaseCollaborators,
+	collaboratorCount: BoundedCount,
+	readiness: Schema.NullOr(PortfolioReadinessSummary),
+	relationships: PortfolioRelationshipCounts,
+	sourceRevisionCount: BoundedCount,
+	updatedAt: UtcTimestamp
+}).annotate({ identifier: "PortfolioReleaseSummary" });
+/** Bounded, point-in-time portfolio projection for one authenticated workspace. */
+var PortfolioSnapshot = Schema.Struct({
+	workspaceId: WorkspaceId,
+	eventCursor: EventCursor,
+	generatedAt: UtcTimestamp,
+	releases: Schema.Array(PortfolioReleaseSummary).check(Schema.makeFilter((releases) => releases.length <= MAXIMUM_PORTFOLIO_RELEASES, { expected: `at most ${MAXIMUM_PORTFOLIO_RELEASES} releases` }), Schema.makeFilter((releases) => new Set(releases.map(({ releaseId }) => releaseId)).size === releases.length, { expected: "unique release identifiers" })),
+	plugins: Schema.Array(PluginConnectionSummary).check(Schema.makeFilter((plugins) => plugins.length <= 100, { expected: "at most 100 plugin connections" }), Schema.makeFilter((plugins) => new Set(plugins.map(({ pluginConnectionId }) => pluginConnectionId)).size === plugins.length, { expected: "unique plugin connection identifiers" }))
+}).check(hasMaximumPluginJsonBytes(MAXIMUM_SNAPSHOT_JSON_BYTES)).annotate({ identifier: "PortfolioSnapshot" });
+var snapshot = HttpApiEndpoint.get("snapshot", "/snapshot", {
+	success: PortfolioSnapshot,
+	error: [
+		UnauthorizedApiError,
+		ForbiddenApiError,
+		RequestTimedOutApiError,
+		ServiceUnavailableApiError
+	]
+}).middleware(SessionCookieAuth);
+/** Authenticated point-in-time portfolio contract. */
+var PortfolioApiGroup = class extends HttpApiGroup.make("portfolio").add(snapshot).prefix("/api/v1/portfolio") {};
+//#endregion
+//#region src/api/wire.ts
+var CANONICAL_NONNEGATIVE_INTEGER_PATTERN = /^(?:0|[1-9][0-9]*)$/u;
+var MAXIMUM_SAFE_INTEGER_DIGITS = String(Number.MAX_SAFE_INTEGER).length;
+var NonNegativeSafeInteger = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/** Canonical unsigned-decimal HTTP representation of a nonnegative safe integer. */
+var CanonicalNonNegativeIntegerFromString = Schema.String.check(Schema.isMaxLength(MAXIMUM_SAFE_INTEGER_DIGITS), Schema.isPattern(CANONICAL_NONNEGATIVE_INTEGER_PATTERN, { expected: "a canonical unsigned-decimal integer" })).pipe(Schema.decodeTo(NonNegativeSafeInteger, {
+	decode: SchemaGetter.transform((value) => Number(value)),
+	encode: SchemaGetter.transform((value) => String(value))
+}));
+//#endregion
+//#region src/api/agent.ts
+var MAXIMUM_PROMPT_LENGTH = 8e3;
+var MAXIMUM_HISTORY_MESSAGES = 12;
+var MAXIMUM_HISTORY_MESSAGE_LENGTH = 12e3;
+var MAXIMUM_HISTORY_CONTENT_LENGTH = 64e3;
+var MAXIMUM_REPLY_LENGTH = 32e3;
+var MAXIMUM_DURABLE_PROMPT_LENGTH = 5e3;
+var MAXIMUM_THREAD_EVENT_PAGE_SIZE = 128;
+/** Bounded current instruction sent to the release-aware model. */
+var AgentPrompt = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(MAXIMUM_PROMPT_LENGTH));
+var BoundedHistoryContent = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(MAXIMUM_HISTORY_MESSAGE_LENGTH));
+/** Supported local command-line model providers. */
+var AgentProvider = Schema.Literals(["codex", "claude"]);
+/** Provider-neutral configured runtime identity accepted by durable jobs. */
+var DurableAgentProviderId = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)).pipe(Schema.brand("DurableAgentProviderId"));
+/** Prompt guaranteed to fit the durable user-message event envelope. */
+var DurableAgentPrompt = Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(MAXIMUM_DURABLE_PROMPT_LENGTH));
+/** Release-agent provider alias retained for discoverability beside the turn schemas. */
+var ReleaseAgentProvider = AgentProvider;
+/** One bounded prior turn supplied to preserve release-thread context. */
+var AgentHistoryMessage = Schema.Struct({
+	role: Schema.Literals(["user", "assistant"]),
+	content: BoundedHistoryContent
+}).annotate({ identifier: "ReleaseAgentHistoryMessage" });
+/** History-message alias retained for discoverability beside the turn schemas. */
+var ReleaseAgentHistoryMessage = AgentHistoryMessage;
+var ReleaseAgentHistory = Schema.Array(AgentHistoryMessage).check(Schema.makeFilter((history) => history.length <= MAXIMUM_HISTORY_MESSAGES, { expected: `at most ${MAXIMUM_HISTORY_MESSAGES} release-agent history messages` }), Schema.makeFilter((history) => history.reduce((length, message) => length + message.content.length, 0) <= MAXIMUM_HISTORY_CONTENT_LENGTH, { expected: `at most ${MAXIMUM_HISTORY_CONTENT_LENGTH} release-agent history characters` }));
+/** Bounded browser request for one release-aware model turn. */
+var ReleaseAgentTurnRequest = Schema.Struct({
+	provider: AgentProvider,
+	prompt: AgentPrompt,
+	history: ReleaseAgentHistory
+}).annotate({ identifier: "ReleaseAgentTurnRequest" });
+/** Model reply plus the authoritative release projection used for the turn. */
+var ReleaseAgentTurnResponse = Schema.Struct({
+	releaseId: ReleaseId,
+	provider: AgentProvider,
+	reply: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(MAXIMUM_REPLY_LENGTH)),
+	release: PortfolioReleaseSummary,
+	eventCursor: EventCursor
+}).check(Schema.makeFilter(({ release, releaseId }) => release.releaseId === releaseId, { expected: "release-agent response identity to match its release projection" })).annotate({ identifier: "ReleaseAgentTurnResponse" });
+/** Cursor of the last durable release-thread event observed by a client. */
+var ReleaseAgentThreadCursor = Schema.Int.check(Schema.isBetween({
+	minimum: 0,
+	maximum: Number.MAX_SAFE_INTEGER
+})).pipe(Schema.brand("ReleaseAgentThreadCursor"));
+/** Canonical query-string representation of a durable release-thread cursor. */
+var ReleaseAgentThreadCursorFromString = CanonicalNonNegativeIntegerFromString.pipe(Schema.decodeTo(ReleaseAgentThreadCursor));
+/** Bounded caller-selected page size for durable release-thread replay. */
+var ReleaseAgentThreadEventLimitFromString = CanonicalNonNegativeIntegerFromString.pipe(Schema.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(MAXIMUM_THREAD_EVENT_PAGE_SIZE)));
+var releaseAgentThreadEventFields = {
+	eventSequence: ReleaseAgentThreadCursor.check(Schema.isGreaterThan(0)),
+	jobId: JobId,
+	occurredAt: UtcTimestamp
+};
+var ReleaseAgentUserMessageEvent = Schema.TaggedStruct("user-message", {
+	...releaseAgentThreadEventFields,
+	prompt: DurableAgentPrompt
+});
+var ReleaseAgentJobQueuedEvent = Schema.TaggedStruct("job-queued", {
+	...releaseAgentThreadEventFields,
+	providerId: DurableAgentProviderId
+});
+var ReleaseAgentJobStartedEvent = Schema.TaggedStruct("job-started", releaseAgentThreadEventFields);
+var ReleaseAgentAssistantOutputEvent = Schema.TaggedStruct("assistant-output", {
+	...releaseAgentThreadEventFields,
+	text: Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(MAXIMUM_AGENT_OUTPUT_TEXT_LENGTH))
+});
+var ReleaseAgentProgressEvent = Schema.TaggedStruct("progress", {
+	...releaseAgentThreadEventFields,
+	text: Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(MAXIMUM_AGENT_OUTPUT_TEXT_LENGTH))
+});
+var ReleaseAgentUsageEvent = Schema.TaggedStruct("usage", {
+	...releaseAgentThreadEventFields,
+	inputTokens: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	outputTokens: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+});
+var ReleaseAgentJobCompletedEvent = Schema.TaggedStruct("job-completed", {
+	...releaseAgentThreadEventFields,
+	outcome: Schema.Literals([
+		"success",
+		"cancelled",
+		"max-steps"
+	])
+});
+var ReleaseAgentJobFailedEvent = Schema.TaggedStruct("job-failed", {
+	...releaseAgentThreadEventFields,
+	retryable: Schema.Boolean
+});
+var ReleaseAgentCancellationRequestedEvent = Schema.TaggedStruct("cancel-requested", {
+	...releaseAgentThreadEventFields,
+	requestedAt: UtcTimestamp
+});
+/** One browser-safe event from the durable release thread. */
+var ReleaseAgentThreadEvent = Schema.Union([
+	ReleaseAgentUserMessageEvent,
+	ReleaseAgentJobQueuedEvent,
+	ReleaseAgentJobStartedEvent,
+	ReleaseAgentAssistantOutputEvent,
+	ReleaseAgentProgressEvent,
+	ReleaseAgentUsageEvent,
+	ReleaseAgentJobCompletedEvent,
+	ReleaseAgentJobFailedEvent,
+	ReleaseAgentCancellationRequestedEvent
+]).pipe(Schema.toTaggedUnion("_tag"));
+/** Bounded request to enqueue one durable read-only release-agent job. */
+var EnqueueReleaseAgentJobRequest = Schema.Struct({
+	providerId: DurableAgentProviderId,
+	prompt: DurableAgentPrompt
+}).annotate({ identifier: "EnqueueReleaseAgentJobRequest" });
+/** Durable identity returned after the job and its initial events commit. */
+var EnqueueReleaseAgentJobResponse = Schema.Struct({
+	releaseId: ReleaseId,
+	jobId: JobId,
+	state: Schema.Literal("queued")
+}).annotate({ identifier: "EnqueueReleaseAgentJobResponse" });
+/** Ordered, bounded release-thread replay page. */
+var ReleaseAgentThreadPage = Schema.Struct({
+	releaseId: ReleaseId,
+	events: Schema.Array(ReleaseAgentThreadEvent).check(Schema.makeFilter((events) => events.length <= MAXIMUM_THREAD_EVENT_PAGE_SIZE, { expected: `at most ${MAXIMUM_THREAD_EVENT_PAGE_SIZE} release-agent thread events` })),
+	nextCursor: ReleaseAgentThreadCursor
+}).annotate({ identifier: "ReleaseAgentThreadPage" });
+var turn = HttpApiEndpoint.post("turn", "/releases/:releaseId/turns", {
+	params: Schema.Struct({ releaseId: ReleaseId }),
+	payload: ReleaseAgentTurnRequest,
+	success: ReleaseAgentTurnResponse,
+	error: [
+		InvalidRequestApiError,
+		UnauthorizedApiError,
+		ForbiddenApiError,
+		NotFoundApiError,
+		RequestTimedOutApiError,
+		RateLimitedApiError,
+		PayloadTooLargeApiError,
+		ServiceUnavailableApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var enqueueJob = HttpApiEndpoint.post("enqueueJob", "/releases/:releaseId/jobs", {
+	params: Schema.Struct({ releaseId: ReleaseId }),
+	payload: EnqueueReleaseAgentJobRequest,
+	success: EnqueueReleaseAgentJobResponse.pipe(HttpApiSchema.status(202)),
+	error: [
+		InvalidRequestApiError,
+		UnauthorizedApiError,
+		ForbiddenApiError,
+		NotFoundApiError,
+		RequestTimedOutApiError,
+		PayloadTooLargeApiError,
+		RateLimitedApiError,
+		ServiceUnavailableApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var replayThread = HttpApiEndpoint.get("replayThread", "/releases/:releaseId/thread/events", {
+	params: Schema.Struct({ releaseId: ReleaseId }),
+	query: Schema.Struct({
+		after: Schema.optionalKey(ReleaseAgentThreadCursorFromString),
+		limit: Schema.optionalKey(ReleaseAgentThreadEventLimitFromString)
+	}),
+	success: ReleaseAgentThreadPage,
+	error: [
+		InvalidRequestApiError,
+		UnauthorizedApiError,
+		ForbiddenApiError,
+		NotFoundApiError,
+		RequestTimedOutApiError,
+		RateLimitedApiError,
+		ServiceUnavailableApiError
+	]
+}).middleware(SessionCookieAuth);
+/** Authenticated release-aware synchronous and durable agent contract. */
+var AgentApiGroup = class extends HttpApiGroup.make("agent").add(turn).add(enqueueJob).add(replayThread).prefix("/api/v1/agent") {};
+var MAXIMUM_RELATIONSHIP_HISTORY = 200;
+var MAXIMUM_EVIDENCE_CLAIMS = 200;
+var boundedArray = (schema, maximum) => Schema.Array(schema).check(Schema.isMaxLength(maximum));
+/** One persisted entity projection with its ledger observation time. */
+var InspectedEntityProjection = Schema.Struct({
+	projection: DeliveryEntityProjection,
+	recordedAt: UtcTimestamp
+}).annotate({ identifier: "InspectedEntityProjection" });
+/** Bounded deterministic graph prefix; `truncated` explicitly reports incomplete material. */
+var ReleaseDeliveryGraphInspection = Schema.Struct({
+	releaseId: ReleaseId,
+	environmentId: Schema.NullOr(EnvironmentId),
+	truncated: Schema.Boolean,
+	nodes: boundedArray(DeliveryNode, 500),
+	entityProjections: boundedArray(InspectedEntityProjection, 500),
+	relationships: boundedArray(DeliveryRelationship, 500),
+	evidenceClaims: boundedArray(EvidenceClaim, 500),
+	evidenceItems: boundedArray(EvidenceItem, 500)
+}).annotate({ identifier: "ReleaseDeliveryGraphInspection" });
+var WorkspaceEntityReleaseIds = Schema.Array(ReleaseId).check(Schema.isUnique(), Schema.isMaxLength(500), Schema.makeFilter((releaseIds) => releaseIds.every((releaseId, index) => {
+	const previous = releaseIds[index - 1];
+	return index === 0 || previous !== void 0 && previous < releaseId;
+}), { expected: "sorted workspace entity release identifiers" }));
+/** Compact canonical human identity assigned to one current workspace entity. */
+var WorkspaceEntityOwner = Schema.Struct({
+	avatarFallback: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(4)),
+	displayName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	personId: PersonId,
+	roles: boundedArray(Role, 16).check(Schema.isMinLength(1))
+}).annotate({ identifier: "WorkspaceEntityOwner" });
+var WorkspaceEntityOwners = boundedArray(WorkspaceEntityOwner, 20);
+var WorkspaceOwnerOptions = boundedArray(WorkspaceEntityOwner, 200);
+/** One current workspace entity projection and every bounded current release membership. */
+var WorkspaceEntityProjection = Schema.Struct({
+	canonicalReleaseId: Schema.NullOr(ReleaseId),
+	owners: WorkspaceEntityOwners,
+	ownersTruncated: Schema.Boolean,
+	releaseIds: WorkspaceEntityReleaseIds,
+	releaseMembershipsTruncated: Schema.Boolean,
+	projection: DeliveryEntityProjection,
+	recordedAt: UtcTimestamp
+}).check(Schema.makeFilter(({ canonicalReleaseId, releaseIds }) => canonicalReleaseId === (releaseIds[0] ?? null), { expected: "canonical release identifier to be the first current release membership" }), Schema.makeFilter(({ releaseIds, releaseMembershipsTruncated }) => !releaseMembershipsTruncated || releaseIds.length === 500, { expected: "truncated workspace release memberships to contain the complete bounded prefix" }), Schema.makeFilter(({ owners, ownersTruncated }) => !ownersTruncated || owners.length === 20, { expected: "truncated workspace owners to contain the complete bounded prefix" })).annotate({ identifier: "WorkspaceEntityProjection" });
+/** Bounded workspace-wide index of current present normalized entities. */
+var WorkspaceEntityProjectionIndex = Schema.Struct({
+	matchedCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	ownerOptions: WorkspaceOwnerOptions,
+	ownerOptionsTruncated: Schema.Boolean,
+	totalCount: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	truncated: Schema.Boolean,
+	items: boundedArray(WorkspaceEntityProjection, 500)
+}).check(Schema.makeFilter(({ ownerOptions, ownerOptionsTruncated }) => !ownerOptionsTruncated || ownerOptions.length === 200, { expected: "truncated workspace owner options to contain the complete bounded prefix" })).annotate({ identifier: "WorkspaceEntityProjectionIndex" });
+/** Complete bounded graph closure surrounding one exact normalized entity. */
+var WorkspaceEntityGraph = Schema.Struct({
+	truncated: Schema.Boolean,
+	nodes: boundedArray(DeliveryNode, 200),
+	relatedEntityProjections: boundedArray(InspectedEntityProjection, 100),
+	relationships: boundedArray(DeliveryRelationship, 100),
+	evidenceClaims: boundedArray(EvidenceClaim, 200),
+	evidenceItems: boundedArray(EvidenceItem, 200)
+}).annotate({ identifier: "WorkspaceEntityGraph" });
+/** Bounded attributable activity for one exact normalized entity. */
+var WorkspaceEntityActivity = Schema.Struct({
+	truncated: Schema.Boolean,
+	events: boundedArray(TimelineEvent, 20)
+}).annotate({ identifier: "WorkspaceEntityActivity" });
+/** Canonical provider-neutral full-page read model for one workspace entity. */
+var WorkspaceEntityInspection = Schema.Struct({
+	entity: WorkspaceEntityProjection,
+	source: SourceRevision,
+	isSourceCurrent: Schema.Boolean,
+	freshness: Schema.NullOr(Freshness),
+	graph: WorkspaceEntityGraph,
+	activity: WorkspaceEntityActivity
+}).annotate({ identifier: "WorkspaceEntityInspection" });
+/** Bounded immutable lifecycle history for one relationship, newest first. */
+var RelationshipHistoryInspection = Schema.Struct({
+	relationshipId: RelationshipId,
+	revisions: boundedArray(DeliveryRelationship, MAXIMUM_RELATIONSHIP_HISTORY)
+}).annotate({ identifier: "RelationshipHistoryInspection" });
+/** One immutable evidence item and every bounded claim attributed to it. */
+var EvidenceInspection = Schema.Struct({
+	evidence: EvidenceItem,
+	claims: boundedArray(EvidenceClaim, MAXIMUM_EVIDENCE_CLAIMS)
+}).annotate({ identifier: "EvidenceInspection" });
+/** Read-only repair suggestion derived from one current incomplete relationship. */
+var RelationshipRepairCandidate = Schema.Struct({
+	relationship: DeliveryRelationship,
+	suggestedDisposition: Schema.Literals([
+		"link",
+		"verify",
+		"reject"
+	]),
+	explanation: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(1e3)),
+	impact: Schema.Struct({
+		releaseId: ReleaseId,
+		environmentId: Schema.NullOr(EnvironmentId)
+	}),
+	requiredPermission: Schema.Literal("workspace-owner")
+}).annotate({ identifier: "RelationshipRepairCandidate" });
+/** Bounded candidate discovery result; discovery never mutates the relationship ledger. */
+var RelationshipRepairCandidates = Schema.Struct({
+	releaseId: ReleaseId,
+	environmentId: Schema.NullOr(EnvironmentId),
+	truncated: Schema.Boolean,
+	candidates: boundedArray(RelationshipRepairCandidate, 500)
+}).annotate({ identifier: "RelationshipRepairCandidates" });
+/** Non-mutating proposal input with the optimistic precondition required by a future apply step. */
+var RelationshipRepairProposalDraft = Schema.Struct({
+	candidate: RelationshipRepairCandidate,
+	precondition: Schema.Struct({
+		relationshipId: RelationshipId,
+		expectedRevision: LedgerRevision
+	}),
+	proposal: Schema.Struct({
+		disposition: Schema.Literals([
+			"link",
+			"verify",
+			"reject"
+		]),
+		rationale: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(1e3))
+	})
+}).annotate({ identifier: "RelationshipRepairProposalDraft" });
+/** Idempotent intent for creating a durable proposal from one exact repair candidate. */
+var CreateRelationshipRepairProposalRequest = Schema.Struct({
+	proposalId: RelationshipRepairProposal.fields.proposalId,
+	environmentId: RelationshipRepairProposal.fields.environmentId,
+	expectedRevision: RelationshipRepairProposal.fields.expectedRevision,
+	disposition: RelationshipRepairDisposition,
+	rationale: RelationshipRepairRationale
+}).annotate({ identifier: "CreateRelationshipRepairProposalRequest" });
+/** Bounded newest-first proposal page for one release/environment scope. */
+var RelationshipRepairProposalList = Schema.Struct({
+	releaseId: ReleaseId,
+	environmentId: Schema.NullOr(EnvironmentId),
+	status: Schema.NullOr(RelationshipRepairProposal.fields.status),
+	truncated: Schema.Boolean,
+	proposals: boundedArray(RelationshipRepairProposal, 128),
+	applications: boundedArray(RelationshipRepairApplication, 128)
+}).annotate({ identifier: "RelationshipRepairProposalList" });
+/** Idempotent immutable review command for one pending proposal. */
+var ReviewRelationshipRepairProposalRequest = Schema.Struct({
+	reviewId: RelationshipRepairReviewId,
+	decision: RelationshipRepairReviewDecision,
+	rationale: RelationshipRepairRationale
+}).annotate({ identifier: "ReviewRelationshipRepairProposalRequest" });
+/** Applied proposal together with the immutable relationship revision it appended. */
+var ApplyRelationshipRepairProposalResponse = Schema.Struct({
+	application: RelationshipRepairApplication,
+	relationship: DeliveryRelationship
+}).annotate({ identifier: "ApplyRelationshipRepairProposalResponse" });
+var readErrors = [
+	UnauthorizedApiError,
+	ForbiddenApiError,
+	NotFoundApiError,
+	RequestTimedOutApiError,
+	ServiceUnavailableApiError
+];
+var releaseSlice = HttpApiEndpoint.get("releaseSlice", "/api/v1/relationships/releases/:releaseId", {
+	params: { releaseId: ReleaseId },
+	query: { environmentId: Schema.optionalKey(EnvironmentId) },
+	success: ReleaseDeliveryGraphInspection,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var workspaceEntityProjections = HttpApiEndpoint.get("workspaceEntityProjections", "/api/v1/items", {
+	query: {
+		q: Schema.optionalKey(Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200))),
+		owner: Schema.optionalKey(PersonId),
+		service: Schema.optionalKey(DeliveryEntityService),
+		status: Schema.optionalKey(DeliveryEntityStatusGroup),
+		type: Schema.optionalKey(DeliveryEntityKind)
+	},
+	success: WorkspaceEntityProjectionIndex,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var workspaceEntity = HttpApiEndpoint.get("workspaceEntity", "/api/v1/items/:entityId", {
+	params: { entityId: EntityId },
+	success: WorkspaceEntityInspection,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var relationship = HttpApiEndpoint.get("relationship", "/api/v1/relationships/:relationshipId", {
+	params: { relationshipId: RelationshipId },
+	query: { revision: Schema.optionalKey(CanonicalNonNegativeIntegerFromString.pipe(Schema.decodeTo(LedgerRevision))) },
+	success: DeliveryRelationship,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var repairCandidates = HttpApiEndpoint.get("repairCandidates", "/api/v1/relationships/releases/:releaseId/repair-candidates", {
+	params: { releaseId: ReleaseId },
+	query: { environmentId: Schema.optionalKey(EnvironmentId) },
+	success: RelationshipRepairCandidates,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var repairProposalDraft = HttpApiEndpoint.get("repairProposalDraft", "/api/v1/relationships/releases/:releaseId/repair-candidates/:relationshipId/proposal-draft", {
+	params: {
+		releaseId: ReleaseId,
+		relationshipId: RelationshipId
+	},
+	query: {
+		environmentId: Schema.optionalKey(EnvironmentId),
+		revision: CanonicalNonNegativeIntegerFromString.pipe(Schema.decodeTo(LedgerRevision))
+	},
+	success: RelationshipRepairProposalDraft,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var createRepairProposal = HttpApiEndpoint.post("createRepairProposal", "/api/v1/relationships/releases/:releaseId/repair-candidates/:relationshipId/proposals", {
+	params: {
+		releaseId: ReleaseId,
+		relationshipId: RelationshipId
+	},
+	payload: CreateRelationshipRepairProposalRequest,
+	success: RelationshipRepairProposal,
+	error: [
+		...readErrors,
+		InvalidRequestApiError,
+		ConflictApiError,
+		PayloadTooLargeApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var listRepairProposals = HttpApiEndpoint.get("listRepairProposals", "/api/v1/relationships/releases/:releaseId/repair-proposals", {
+	params: { releaseId: ReleaseId },
+	query: {
+		environmentId: Schema.optionalKey(EnvironmentId),
+		status: Schema.optionalKey(RelationshipRepairProposal.fields.status)
+	},
+	success: RelationshipRepairProposalList,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var getRepairProposal = HttpApiEndpoint.get("getRepairProposal", "/api/v1/relationships/repair-proposals/:proposalId", {
+	params: { proposalId: RelationshipRepairProposalId },
+	success: RelationshipRepairProposal,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var reviewRepairProposal = HttpApiEndpoint.post("reviewRepairProposal", "/api/v1/relationships/repair-proposals/:proposalId/reviews", {
+	params: { proposalId: RelationshipRepairProposalId },
+	payload: ReviewRelationshipRepairProposalRequest,
+	success: RelationshipRepairProposal,
+	error: [
+		...readErrors,
+		InvalidRequestApiError,
+		ConflictApiError,
+		PayloadTooLargeApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var applyRepairProposal = HttpApiEndpoint.post("applyRepairProposal", "/api/v1/relationships/repair-proposals/:proposalId/applications", {
+	params: { proposalId: RelationshipRepairProposalId },
+	success: ApplyRelationshipRepairProposalResponse,
+	error: [
+		...readErrors,
+		InvalidRequestApiError,
+		ConflictApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var relationshipHistory = HttpApiEndpoint.get("relationshipHistory", "/api/v1/relationships/:relationshipId/history", {
+	params: { relationshipId: RelationshipId },
+	success: RelationshipHistoryInspection,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+var evidence = HttpApiEndpoint.get("evidence", "/api/v1/evidence/:evidenceId", {
+	params: { evidenceId: EvidenceId },
+	success: EvidenceInspection,
+	error: readErrors
+}).middleware(SessionCookieAuth);
+/** Authenticated, workspace-safe delivery relationship and evidence inspection. */
+var DeliveryGraphApiGroup = class extends HttpApiGroup.make("deliveryGraph").add(workspaceEntityProjections, workspaceEntity, releaseSlice, repairCandidates, repairProposalDraft, createRepairProposal, listRepairProposals, getRepairProposal, reviewRepairProposal, applyRepairProposal, relationship, relationshipHistory, evidence) {};
+//#endregion
+//#region src/api/liveEvents.ts
+/** URL/header representation of a nonnegative workspace event cursor. */
+var EventCursorFromString = CanonicalNonNegativeIntegerFromString.pipe(Schema.decodeTo(EventCursor));
+/** Replay boundary telling a client to replace local state with an authoritative snapshot. */
+var StreamResetRequired = Schema.Struct({
+	reason: Schema.Literals([
+		"retention",
+		"cursor-ahead",
+		"gap",
+		"replay-budget"
+	]),
+	requestedCursor: EventCursor,
+	headCursor: EventCursor,
+	prunedThroughCursor: EventCursor
+}).annotate({ identifier: "StreamResetRequired" });
+/** Keepalive payload that reports the latest durable cursor without advancing EventSource state. */
+var StreamHeartbeat = Schema.Struct({
+	eventCursor: EventCursor,
+	sentAt: UtcTimestamp
+}).annotate({ identifier: "StreamHeartbeat" });
+/** Authoritative portfolio replacement emitted first and after replay reset. */
+var PortfolioSnapshotLiveEvent = Schema.Struct({
+	id: EventCursorFromString,
+	event: Schema.Literal("portfolio.snapshot"),
+	data: Schema.fromJsonString(PortfolioSnapshot)
+}).annotate({ identifier: "PortfolioSnapshotLiveEvent" });
+/** Durable notification that a browser should refresh its portfolio projection. */
+var PortfolioInvalidatedLiveEvent = Schema.Struct({
+	id: EventCursorFromString,
+	event: Schema.Literal("portfolio.invalidated"),
+	data: Schema.fromJsonString(PortfolioInvalidatedEventV1)
+}).annotate({ identifier: "PortfolioInvalidatedLiveEvent" });
+/** Replay-gap instruction; it deliberately has no SSE ID so it cannot advance resume state. */
+var StreamResetRequiredLiveEvent = Schema.Struct({
+	id: Schema.optionalKey(Schema.Undefined),
+	event: Schema.Literal("stream.reset-required"),
+	data: Schema.fromJsonString(StreamResetRequired)
+}).annotate({ identifier: "StreamResetRequiredLiveEvent" });
+/** Keepalive event; it deliberately has no SSE ID so it cannot advance resume state. */
+var StreamHeartbeatLiveEvent = Schema.Struct({
+	id: Schema.optionalKey(Schema.Undefined),
+	event: Schema.Literal("stream.heartbeat"),
+	data: Schema.fromJsonString(StreamHeartbeat)
+}).annotate({ identifier: "StreamHeartbeatLiveEvent" });
+/** Closed browser-safe union emitted by the authenticated live event stream. */
+var ControlCenterLiveEvent = Schema.Union([
+	PortfolioSnapshotLiveEvent,
+	PortfolioInvalidatedLiveEvent,
+	StreamResetRequiredLiveEvent,
+	StreamHeartbeatLiveEvent
+]).annotate({ identifier: "ControlCenterLiveEvent" });
+var stream = HttpApiEndpoint.get("stream", "/api/v1/events", {
+	query: { after: Schema.optionalKey(EventCursorFromString) },
+	headers: { "last-event-id": Schema.optionalKey(EventCursorFromString) },
+	success: HttpApiSchema.StreamSse({ events: ControlCenterLiveEvent }),
+	error: [
+		InvalidRequestApiError,
+		UnauthorizedApiError,
+		ForbiddenApiError,
+		RateLimitedApiError,
+		RequestTimedOutApiError,
+		ServiceUnavailableApiError
+	]
+}).middleware(SessionCookieAuth);
+/** Authenticated resumable stream of workspace-local Control Center events. */
+var LiveEventsApiGroup = class extends HttpApiGroup.make("liveEvents").add(stream) {};
+//#endregion
+//#region src/api/media.ts
+/** Workspace-scoped opaque media reference that reveals neither provider URLs nor local storage keys. */
+var OpaqueMediaId = Schema.String.check(Schema.isPattern(/^media_[0-9a-f]{64}$/u, { expected: "an opaque SHA-256 media identifier" })).pipe(Schema.brand("OpaqueMediaId"));
+/** Closed set of inert raster formats accepted at the authenticated media boundary. */
+var SafeMediaContentType = Schema.Literals([
+	"image/avif",
+	"image/jpeg",
+	"image/png",
+	"image/webp"
+]);
+/** Security and metadata headers required on authenticated opaque media responses. */
+var MediaResponseHeaders = Schema.Struct({
+	"x-correlation-id": CorrelationId,
+	"content-type": SafeMediaContentType,
+	"content-length": CanonicalNonNegativeIntegerFromString,
+	"cache-control": Schema.Literal("private, no-store"),
+	"x-content-type-options": Schema.Literal("nosniff")
+}).annotate({ identifier: "MediaResponseHeaders" });
+var read = HttpApiEndpoint.get("read", "/:mediaId", {
+	params: Schema.Struct({ mediaId: OpaqueMediaId }),
+	success: HttpApiSchema.StreamUint8Array({ contentType: "application/octet-stream" }),
+	error: [
+		UnauthorizedApiError,
+		ForbiddenApiError,
+		NotFoundApiError,
+		RequestTimedOutApiError,
+		ServiceUnavailableApiError
+	]
+}).middleware(SessionCookieAuth);
+/** Authenticated, workspace-resolved opaque media contract. */
+var MediaApiGroup = class extends HttpApiGroup.make("media").add(read).prefix("/api/v1/media") {};
+//#endregion
+//#region src/api/shares.ts
+/** Owner-authored intent for one exact entity share grant. */
+var CreateAuthorizedShareRequest = Schema.Struct({
+	shareId: ShareId,
+	entityId: EntityId,
+	granteePersonId: PersonId,
+	expiresAt: UtcTimestamp
+});
+/** Secret-free grant metadata returned to authenticated callers. */
+var AuthorizedShareSummary = Schema.Struct({
+	shareId: ShareId,
+	entityId: EntityId,
+	granteePersonId: PersonId,
+	createdAt: UtcTimestamp,
+	expiresAt: UtcTimestamp,
+	revokedAt: Schema.NullOr(UtcTimestamp)
+}).annotate({ identifier: "AuthorizedShareSummary" });
+/** Exact current entity projection resolved without relationships or release context. */
+var AuthorizedShareResolution = Schema.Struct({
+	share: AuthorizedShareSummary,
+	item: InspectedEntityProjection
+}).annotate({ identifier: "AuthorizedShareResolution" });
+var authenticatedErrors = [
+	UnauthorizedApiError,
+	ForbiddenApiError,
+	RequestTimedOutApiError,
+	ServiceUnavailableApiError
+];
+var create = HttpApiEndpoint.post("create", "/", {
+	payload: CreateAuthorizedShareRequest,
+	success: AuthorizedShareSummary,
+	error: [
+		...authenticatedErrors,
+		InvalidRequestApiError,
+		NotFoundApiError,
+		ConflictApiError
+	]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+var resolve = HttpApiEndpoint.get("resolve", "/:workspaceId/:shareId", {
+	params: Schema.Struct({
+		workspaceId: WorkspaceId,
+		shareId: ShareId
+	}),
+	success: AuthorizedShareResolution,
+	error: [...authenticatedErrors, NotFoundApiError]
+}).middleware(SessionCookieAuth);
+var revoke = HttpApiEndpoint.delete("revoke", "/:workspaceId/:shareId", {
+	params: Schema.Struct({
+		workspaceId: WorkspaceId,
+		shareId: ShareId
+	}),
+	success: HttpApiSchema.NoContent,
+	error: [...authenticatedErrors, NotFoundApiError]
+}).middleware(SessionCookieAuth).middleware(SessionMutationAuth);
+/** Exact-scope authenticated entity-share contract. */
+var SharesApiGroup = class extends HttpApiGroup.make("shares").add(create, resolve, revoke).prefix("/api/v1/shares") {};
+//#endregion
+//#region src/api/timeline.ts
+var TimelinePageSizeFromString = CanonicalNonNegativeIntegerFromString.pipe(Schema.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(100)));
+/** Hard caller-selected event bound for one Timeline download. */
+var TimelineExportLimitFromString = CanonicalNonNegativeIntegerFromString.pipe(Schema.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(1e3)));
+/** Content types emitted by the bounded Timeline download endpoints. */
+var TimelineExportContentType = Schema.Literals(["application/json; charset=utf-8", "text/csv; charset=utf-8"]);
+/** Security, download, and truncation headers on a Timeline export response. */
+var TimelineExportResponseHeaders = Schema.Struct({
+	"cache-control": Schema.Literal("private, no-store"),
+	"content-disposition": Schema.Literals(["attachment; filename=\"timeline-export.csv\"", "attachment; filename=\"timeline-export.json\""]),
+	"content-type": TimelineExportContentType,
+	"x-content-type-options": Schema.Literal("nosniff"),
+	"x-timeline-export-count": CanonicalNonNegativeIntegerFromString,
+	"x-timeline-export-limit": TimelineExportLimitFromString,
+	"x-timeline-export-truncated": Schema.Literals(["false", "true"])
+}).annotate({ identifier: "TimelineExportResponseHeaders" });
+var exportQuery = {
+	actor: Schema.optionalKey(TimelineActorKind),
+	from: Schema.optionalKey(UtcTimestamp),
+	limit: TimelineExportLimitFromString,
+	to: Schema.optionalKey(UtcTimestamp)
+};
+var timelineErrors = [
+	InvalidRequestApiError,
+	UnauthorizedApiError,
+	ForbiddenApiError,
+	RequestTimedOutApiError,
+	ServiceUnavailableApiError
+];
+var page = HttpApiEndpoint.get("page", "/api/v1/timeline", {
+	query: {
+		actor: Schema.optionalKey(TimelineActorKind),
+		beforeEventKey: Schema.optionalKey(Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(1024))),
+		beforeOccurredAt: Schema.optionalKey(UtcTimestamp),
+		from: Schema.optionalKey(UtcTimestamp),
+		limit: Schema.optionalKey(TimelinePageSizeFromString),
+		to: Schema.optionalKey(UtcTimestamp)
+	},
+	success: TimelinePage,
+	error: timelineErrors
+}).middleware(SessionCookieAuth);
+var detail = HttpApiEndpoint.get("detail", "/api/v1/timeline/events/:eventKey", {
+	params: { eventKey: TimelineCursor.fields.eventKey },
+	success: TimelineEventDetail,
+	error: [
+		InvalidRequestApiError,
+		UnauthorizedApiError,
+		ForbiddenApiError,
+		NotFoundApiError,
+		RequestTimedOutApiError,
+		ServiceUnavailableApiError
+	]
+}).middleware(SessionCookieAuth);
+var exportCsv = HttpApiEndpoint.get("exportCsv", "/api/v1/timeline/export.csv", {
+	query: exportQuery,
+	success: HttpApiSchema.StreamUint8Array({ contentType: "text/csv; charset=utf-8" }),
+	error: timelineErrors
+}).middleware(SessionCookieAuth);
+var exportJson = HttpApiEndpoint.get("exportJson", "/api/v1/timeline/export.json", {
+	query: exportQuery,
+	success: HttpApiSchema.StreamUint8Array({ contentType: "application/json; charset=utf-8" }),
+	error: timelineErrors
+}).middleware(SessionCookieAuth);
+/** Authenticated, workspace-scoped durable activity Timeline. */
+var TimelineApiGroup = class extends HttpApiGroup.make("timeline").add(page).add(detail).add(exportCsv).add(exportJson) {};
+//#endregion
+//#region src/api/controlCenterApi.ts
+/** Browser-safe authenticated HTTP contract shared by the generated client and server implementation. */
+var ControlCenterApi = class extends HttpApi.make("ControlCenterApi").add(SessionApiGroup).add(SharesApiGroup).add(PluginsApiGroup).add(PortfolioApiGroup).add(DeliveryGraphApiGroup).add(MediaApiGroup).add(LiveEventsApiGroup).add(TimelineApiGroup).add(AgentApiGroup) {};
+//#endregion
+export { PortfolioReadinessSummary as $, PairSessionResponse as $t, RelationshipRepairProposalDraft as A, PluginConfiguration as At, DurableAgentProviderId as B, PluginOverviewResponse as Bt, CreateRelationshipRepairProposalRequest as C, CreatePluginConnectionsRequest as Ct, RelationshipHistoryInspection as D, ExchangeAtlassianOAuthGrantRequest as Dt, InspectedEntityProjection as E, DiscoveredAwsProfile as Et, AgentApiGroup as F, PluginConnectionSetupFailureClass as Ft, ReleaseAgentThreadCursor as G, PluginsApiGroup as Gt, EnqueueReleaseAgentJobResponse as H, PluginServiceCatalogField as Ht, AgentHistoryMessage as I, PluginConnectionSummary as It, ReleaseAgentThreadEventLimitFromString as J, CsrfToken as Jt, ReleaseAgentThreadCursorFromString as K, RedactedPluginConfigurationValue as Kt, AgentPrompt as L, PluginConnectionTestResult as Lt, WorkspaceEntityActivity as M, PluginConfigurationMetadata as Mt, WorkspaceEntityGraph as N, PluginConfigurationPatchValue as Nt, RelationshipRepairCandidate as O, OpaqueSecretReference as Ot, WorkspaceEntityInspection as P, PluginConnectionIdentity as Pt, PortfolioApiGroup as Q, PairSessionRequest as Qt, AgentProvider as R, PluginHealthResponse as Rt, StreamResetRequiredLiveEvent as S, CreatePluginConnectionValue as St, EvidenceInspection as T, DiscoveredAtlassianProfile as Tt, ReleaseAgentHistoryMessage as U, PluginSynchronizationResult as Ut, EnqueueReleaseAgentJobRequest as V, PluginServiceCatalogEntry as Vt, ReleaseAgentProvider as W, PluginSynchronizationState as Wt, ReleaseAgentTurnRequest as X, CurrentSessionResponse as Xt, ReleaseAgentThreadPage as Y, CurrentSession as Yt, ReleaseAgentTurnResponse as Z, MutationCsrf as Zt, PortfolioInvalidatedLiveEvent as _, CompleteAtlassianOAuthGrantRequest as _t, TimelineExportResponseHeaders as a, SessionSummary as an, AtlassianOAuthClientConfiguration as at, StreamHeartbeatLiveEvent as b, CreatePluginConnectionRequest as bt, CreateAuthorizedShareRequest as c, CorrelationResponseHeaders as cn, AtlassianOAuthGrantStartResponse as ct, MediaResponseHeaders as d, NotFoundApiError as dn, AtlassianOAuthSite as dt, PairingCode as en, PortfolioRelationshipCounts as et, OpaqueMediaId as f, PayloadTooLargeApiError as fn, AtlassianProfileDiscoveryResponse as ft, LiveEventsApiGroup as g, UnauthorizedApiError as gn, AwsServiceResourceDiscovery as gt, EventCursorFromString as h, ServiceUnavailableApiError as hn, AwsResourceDiscoveryResponse as ht, TimelineExportLimitFromString as i, SessionMutationAuth as in, PortfolioSnapshot as it, ReleaseDeliveryGraphInspection as j, PluginConfigurationKey as jt, RelationshipRepairCandidates as k, PatchPluginConfigurationRequest as kt, SharesApiGroup as l, ForbiddenApiError as ln, AtlassianOAuthProvider as lt, ControlCenterLiveEvent as m, RequestTimedOutApiError as mn, AwsResourceDiscoveryRequest as mt, TimelineApiGroup as n, SessionCookieAuth as nn, PortfolioReleaseRole as nt, AuthorizedShareResolution as o, ConflictApiError as on, AtlassianOAuthGrantExchangeResponse as ot, SafeMediaContentType as p, RateLimitedApiError as pn, AwsProfileDiscoveryResponse as pt, ReleaseAgentThreadEvent as q, SetPluginConnectionEnabledRequest as qt, TimelineExportContentType as r, SessionListResponse as rn, PortfolioReleaseSummary as rt, AuthorizedShareSummary as s, CorrelationId as sn, AtlassianOAuthGrantId as st, ControlCenterApi as t, SessionApiGroup as tn, PortfolioReleaseCollaborator as tt, MediaApiGroup as u, InvalidRequestApiError as un, AtlassianOAuthProviderIntent as ut, PortfolioSnapshotLiveEvent as v, CreateAtlassianOAuthGrantRequest as vt, DeliveryGraphApiGroup as w, CreatePluginConnectionsResponse as wt, StreamResetRequired as x, CreatePluginConnectionResponse as xt, StreamHeartbeat as y, CreatePluginConnectionBatchResult as yt, DurableAgentPrompt as z, PluginListResponse as zt };
+
+//# sourceMappingURL=controlCenterApi-tZPvRPRH.js.map