@octonodes/cli 0.2.26 → 0.2.38

package/runtime/plugin-lifecycle.cjs

@@ -839,7 +839,7 @@ var require_constants = __commonJS({
   "packages/schema/dist/constants.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PLUGIN_PUBLISH_MAX_BYTES = exports2.PLUGIN_CONFIG_MAX_BYTES = exports2.PLUGIN_PUBLISH_AUDIENCE = exports2.PLUGIN_RELEASE_FILES = exports2.CAPABILITY_UNAVAILABLE_REASONS = exports2.CAPABILITY_MODES = exports2.PLATFORM_CAPABILITIES = exports2.SOURCE_CONTROL_REGION_KINDS = exports2.TASK_RELEASE_STATES = exports2.TASK_SPRINT_STATES = exports2.TASK_LINK_TYPES = exports2.TASK_VIEW_SORTS = exports2.TASK_VIEW_GROUPS = exports2.TASK_VIEW_LAYOUTS = exports2.TASK_FIELD_TYPES = exports2.WORK_ITEM_PRIORITIES = exports2.BUILTIN_WORK_ITEM_TYPES = exports2.WORK_ITEM_LEVELS = exports2.TASK_STATUS_CATEGORIES = exports2.TASK_SPACE_TEMPLATES = exports2.COLLABORATION_ACTIONS = exports2.AGENT_TOOL_RISKS = exports2.AGENT_ERROR_CODES = exports2.AGENT_RUN_STATUSES = exports2.WORKSPACE_ACTIONS = exports2.SETTINGS_SECTIONS = exports2.SETTINGS_API_VERSION = exports2.MARKETPLACE_SCOPES = exports2.PLUGIN_DEFINITION_FILENAMES = exports2.PLUGIN_MANIFEST_FILENAME = exports2.COMMUNITY_MEDIA_TYPES = exports2.COMMUNITY_MEDIA_BODY_BYTES = exports2.COMMUNITY_MEDIA_VIDEO_BYTES = exports2.COMMUNITY_MEDIA_IMAGE_BYTES = exports2.PROJECT_JOB_PROTOCOL = exports2.PLUGIN_DEFAULT_LICENSE = exports2.PLUGIN_SCHEMA_VERSION = void 0;
+    exports2.PLUGIN_PUBLISH_MAX_BYTES = exports2.PLUGIN_CONFIG_MAX_BYTES = exports2.PLUGIN_PUBLISH_AUDIENCE = exports2.PLUGIN_RELEASE_FILES = exports2.CAPABILITY_UNAVAILABLE_REASONS = exports2.CAPABILITY_MODES = exports2.PLATFORM_CAPABILITIES = exports2.SOURCE_CONTROL_REGION_KINDS = exports2.TASK_ATTACHMENT_MIME_TYPES = exports2.TASK_ATTACHMENT_INLINE_MIME_TYPES = exports2.TASK_ATTACHMENT_WORKSPACE_QUOTA_BYTES = exports2.TASK_ATTACHMENT_ITEM_LIMIT = exports2.TASK_ATTACHMENT_MAX_BYTES = exports2.TASK_FIELD_OPTION_LIMIT = exports2.TASK_FIELD_LIMIT = exports2.WORK_ITEM_TYPE_LIMIT = exports2.TASK_STATUS_LIMIT = exports2.WORK_ITEM_TREE_LIMIT = exports2.WORK_ITEM_BULK_LIMIT = exports2.TASK_RELEASE_STATES = exports2.TASK_SPRINT_STATES = exports2.TASK_LINK_TYPES = exports2.TASK_VIEW_SORTS = exports2.TASK_VIEW_GROUPS = exports2.TASK_VIEW_LAYOUTS = exports2.TASK_FIELD_TYPES = exports2.WORK_ITEM_PRIORITIES = exports2.BUILTIN_WORK_ITEM_TYPES = exports2.WORK_ITEM_LEVELS = exports2.TASK_STATUS_CATEGORIES = exports2.TASK_SPACE_TEMPLATES = exports2.COLLABORATION_ACTIONS = exports2.AGENT_TOOL_RISKS = exports2.AGENT_ERROR_CODES = exports2.AGENT_RUN_STATUSES = exports2.WORKSPACE_ACTIONS = exports2.SETTINGS_SECTIONS = exports2.SETTINGS_API_VERSION = exports2.MARKETPLACE_SCOPES = exports2.PLUGIN_DEFINITION_FILENAMES = exports2.PLUGIN_MANIFEST_FILENAME = exports2.COMMUNITY_MEDIA_TYPES = exports2.COMMUNITY_MEDIA_BODY_BYTES = exports2.COMMUNITY_MEDIA_VIDEO_BYTES = exports2.COMMUNITY_MEDIA_IMAGE_BYTES = exports2.PROJECT_JOB_PROTOCOL = exports2.PLUGIN_DEFAULT_LICENSE = exports2.PLUGIN_SCHEMA_VERSION = void 0;
     exports2.PLUGIN_SCHEMA_VERSION = "1";
     exports2.PLUGIN_DEFAULT_LICENSE = "MIT";
     exports2.PROJECT_JOB_PROTOCOL = "octonode.project-job.v1";
@@ -906,7 +906,22 @@ var require_constants = __commonJS({
       "content:read",
       "content:write",
       "content:publish",
-      "content:moderate"
+      "content:moderate",
+      "apps:read",
+      "apps:use",
+      "apps:manage",
+      "tokens:create",
+      "tokens:use",
+      "tokens:delegate",
+      "tokens:manage",
+      "policy:read",
+      "policy:manage",
+      "usage:read",
+      "usage:manage",
+      "remote:enroll",
+      "remote:connect",
+      "remote:execute",
+      "remote:manage"
     ];
     exports2.AGENT_RUN_STATUSES = [
       "queued",
@@ -929,6 +944,7 @@ var require_constants = __commonJS({
       "tool_failed",
       "step_limit",
       "token_limit",
+      "usage_limit",
       "permission_denied",
       "approval_denied",
       "conflict",
@@ -987,6 +1003,36 @@ var require_constants = __commonJS({
     exports2.TASK_LINK_TYPES = ["blocks", "duplicates", "relates"];
     exports2.TASK_SPRINT_STATES = ["future", "active", "completed"];
     exports2.TASK_RELEASE_STATES = ["unreleased", "released", "archived"];
+    exports2.WORK_ITEM_BULK_LIMIT = 100;
+    exports2.WORK_ITEM_TREE_LIMIT = 1e3;
+    exports2.TASK_STATUS_LIMIT = 20;
+    exports2.WORK_ITEM_TYPE_LIMIT = 50;
+    exports2.TASK_FIELD_LIMIT = 50;
+    exports2.TASK_FIELD_OPTION_LIMIT = 100;
+    exports2.TASK_ATTACHMENT_MAX_BYTES = 50 * 1024 * 1024;
+    exports2.TASK_ATTACHMENT_ITEM_LIMIT = 50;
+    exports2.TASK_ATTACHMENT_WORKSPACE_QUOTA_BYTES = 5 * 1024 * 1024 * 1024;
+    exports2.TASK_ATTACHMENT_INLINE_MIME_TYPES = [
+      "image/png",
+      "image/jpeg",
+      "image/gif",
+      "image/webp",
+      "image/avif",
+      "video/mp4",
+      "video/webm",
+      "application/pdf"
+    ];
+    exports2.TASK_ATTACHMENT_MIME_TYPES = [
+      ...exports2.TASK_ATTACHMENT_INLINE_MIME_TYPES,
+      "text/plain",
+      "text/markdown",
+      "text/csv",
+      "application/json",
+      "application/zip",
+      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+      "application/vnd.openxmlformats-officedocument.presentationml.presentation"
+    ];
     exports2.SOURCE_CONTROL_REGION_KINDS = [
       "if",
       "switch",
@@ -2593,12 +2639,13 @@ var require_data = __commonJS({
         return zod_1.z.null();
       if (schema.type === "array") {
         const prefix = (schema.prefixItems ?? []).map(nested);
-        let validator2 = zod_1.z.array(nested(schema.items ?? {}));
+        const rest = schema.items === false ? zod_1.z.never() : nested(schema.items ?? {});
+        let validator2 = zod_1.z.array(zod_1.z.unknown());
         if (typeof schema.minItems === "number")
           validator2 = validator2.min(schema.minItems);
         if (typeof schema.maxItems === "number")
           validator2 = validator2.max(schema.maxItems);
-        return validator2.refine((value) => value.every((item, index) => !prefix[index] || prefix[index].safeParse(item).success));
+        return validator2.refine((value) => value.every((item, index) => (prefix[index] ?? rest).safeParse(item).success));
       }
       if (schema.type !== "object")
         return zod_1.z.unknown();
@@ -2649,13 +2696,237 @@ var require_layout2 = __commonJS({
   }
 });
 
+// packages/schema/dist/attachments/constants.js
+var require_constants2 = __commonJS({
+  "packages/schema/dist/attachments/constants.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ATTACHMENT_ERRORS = exports2.ATTACHMENT_MIME_TYPES = exports2.ATTACHMENT_STATES = exports2.ATTACHMENT_LIMITS = void 0;
+    exports2.ATTACHMENT_LIMITS = {
+      workspaceFiles: 1e5,
+      dailyReservations: 1e3,
+      scanAttempts: 8,
+      scanMs: 12e4,
+      recoveryMs: 3e5,
+      cleanupMs: 864e5,
+      imageBytes: 10 * 1024 * 1024,
+      fileBytes: 25 * 1024 * 1024,
+      messageBytes: 50 * 1024 * 1024,
+      messageFiles: 10,
+      workspaceBytes: 1024 * 1024 * 1024,
+      userUploads: 4,
+      draftMs: 60 * 60 * 1e3,
+      uploadMs: 5 * 60 * 1e3,
+      processingBytes: 16 * 1024 * 1024,
+      mediaBytes: 4 * 1024 * 1024,
+      modelFiles: 10,
+      modelImages: 10,
+      modelPdfPages: 20,
+      modelTextBytes: 64 * 1024,
+      modelFileTextBytes: 32 * 1024,
+      metadataBytes: 16 * 1024,
+      textBytes: 128 * 1024,
+      pdfPages: 100,
+      imagePixels: 4e7
+    };
+    exports2.ATTACHMENT_STATES = [
+      "reserved",
+      "uploading",
+      "scanning",
+      "ready",
+      "attached",
+      "rejected",
+      "expired",
+      "deleted"
+    ];
+    exports2.ATTACHMENT_MIME_TYPES = [
+      "image/jpeg",
+      "image/png",
+      "image/webp",
+      "image/gif",
+      "application/pdf",
+      "text/plain",
+      "text/markdown",
+      "text/csv",
+      "application/json",
+      "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+    ];
+    exports2.ATTACHMENT_ERRORS = [
+      "unsupported_type",
+      "too_large",
+      "quota_exceeded",
+      "upload_expired",
+      "scan_unavailable",
+      "unsafe_file",
+      "invalid_file",
+      "processing_failed",
+      "model_incompatible"
+    ];
+  }
+});
+
+// packages/schema/dist/attachments/models.js
+var require_models = __commonJS({
+  "packages/schema/dist/attachments/models.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.attachmentModelCapabilities = attachmentModelCapabilities;
+    function attachmentModelCapabilities(model) {
+      const images = model.provider === "anthropic" && /^(sonnet|opus|haiku|claude-(?:3|haiku-4|sonnet-4|opus-4))/.test(model.model) || model.provider === "openai" && /^gpt-(?:4o|4\.1|5(?:\.\d+)?)(?:-|$)/.test(model.model) || model.provider === "google" && /^gemini-(?:2\.5|3)(?:-|\.)/.test(model.model);
+      return { images, pdf: images, text: true };
+    }
+  }
+});
+
+// packages/schema/dist/attachments/index.js
+var require_attachments = __commonJS({
+  "packages/schema/dist/attachments/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.attachmentPolicySchema = exports2.attachmentModelMessagesSchema = exports2.attachmentModelBlockSchema = exports2.attachmentPdfPreviewSchema = exports2.attachmentProcessingSchema = exports2.attachmentPageSchema = exports2.attachmentStoredSchema = exports2.attachmentDerivativeSchema = exports2.attachmentManifestSchema = exports2.attachmentSummarySchema = exports2.attachmentUploadSchema = exports2.attachmentIdListSchema = exports2.attachmentMimeSchema = exports2.attachmentDomainSchema = void 0;
+    var zod_1 = require("zod");
+    var constants_js_1 = require_constants2();
+    __exportStar(require_constants2(), exports2);
+    __exportStar(require_models(), exports2);
+    exports2.attachmentDomainSchema = zod_1.z.enum(["chat", "assistant", "support"]);
+    exports2.attachmentMimeSchema = zod_1.z.enum(constants_js_1.ATTACHMENT_MIME_TYPES);
+    exports2.attachmentIdListSchema = zod_1.z.array(zod_1.z.string().uuid()).max(constants_js_1.ATTACHMENT_LIMITS.messageFiles).refine((ids) => new Set(ids).size === ids.length, "Attachment IDs must be unique");
+    exports2.attachmentUploadSchema = zod_1.z.object({
+      name: zod_1.z.string().trim().min(1).max(240).refine((name) => !Array.from(name).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127 || char === "/" || char === "\\"), "Invalid filename"),
+      mime: exports2.attachmentMimeSchema,
+      size: zod_1.z.number().int().positive().max(constants_js_1.ATTACHMENT_LIMITS.fileBytes)
+    }).strict().refine(({ name }) => !/\.(?:html?|svg|exe|dll|bat|cmd|scr|com|msi|zip|rar|7z|xlsm|docm|pptm)$/i.test(name), "Unsupported filename extension").refine(({ mime, size }) => !mime.startsWith("image/") || size <= constants_js_1.ATTACHMENT_LIMITS.imageBytes, "Image exceeds size limit");
+    exports2.attachmentSummarySchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      conversationId: zod_1.z.string().uuid(),
+      domain: exports2.attachmentDomainSchema,
+      name: zod_1.z.string().min(1).max(240),
+      mime: exports2.attachmentMimeSchema,
+      size: zod_1.z.number().int().nonnegative(),
+      state: zod_1.z.enum(constants_js_1.ATTACHMENT_STATES),
+      version: zod_1.z.number().int().positive(),
+      createdAt: zod_1.z.number().int().nonnegative(),
+      expiresAt: zod_1.z.number().int().nonnegative(),
+      errorCode: zod_1.z.enum(constants_js_1.ATTACHMENT_ERRORS).nullable(),
+      width: zod_1.z.number().int().positive().nullable(),
+      height: zod_1.z.number().int().positive().nullable(),
+      pages: zod_1.z.number().int().positive().nullable(),
+      previews: zod_1.z.array(zod_1.z.enum(["thumbnail", "image", "text", "pdf"])),
+      messageId: zod_1.z.string().uuid().nullable()
+    }).strict();
+    exports2.attachmentManifestSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      name: zod_1.z.string().max(240),
+      mime: exports2.attachmentMimeSchema,
+      size: zod_1.z.number().int().positive().max(constants_js_1.ATTACHMENT_LIMITS.fileBytes),
+      sha256: zod_1.z.string().regex(/^[a-f0-9]{64}$/),
+      pages: zod_1.z.array(zod_1.z.number().int().positive()).max(constants_js_1.ATTACHMENT_LIMITS.pdfPages).optional()
+    }).strict();
+    exports2.attachmentDerivativeSchema = zod_1.z.object({
+      kind: zod_1.z.enum(["thumbnail", "image", "text", "pdf"]),
+      key: zod_1.z.string().min(1).max(1024),
+      sha256: zod_1.z.string().regex(/^[a-f0-9]{64}$/),
+      size: zod_1.z.number().int().nonnegative().max(constants_js_1.ATTACHMENT_LIMITS.fileBytes),
+      mime: zod_1.z.string().max(128)
+    }).strict();
+    exports2.attachmentStoredSchema = zod_1.z.object({
+      summary: exports2.attachmentSummarySchema,
+      uploaderId: zod_1.z.string().min(1).max(128),
+      attemptId: zod_1.z.string().uuid().nullable(),
+      objectKey: zod_1.z.string().max(1024).nullable(),
+      sha256: zod_1.z.string().regex(/^[a-f0-9]{64}$/).nullable(),
+      derivatives: zod_1.z.array(exports2.attachmentDerivativeSchema).max(4)
+    }).strict();
+    exports2.attachmentPageSchema = zod_1.z.object({
+      items: zod_1.z.array(exports2.attachmentSummarySchema),
+      nextCursor: zod_1.z.string().nullable()
+    });
+    exports2.attachmentProcessingSchema = zod_1.z.object({
+      mime: exports2.attachmentMimeSchema,
+      sha256: zod_1.z.string().regex(/^[a-f0-9]{64}$/),
+      width: zod_1.z.number().int().positive().max(4e4).nullable(),
+      height: zod_1.z.number().int().positive().max(4e4).nullable(),
+      pages: zod_1.z.number().int().positive().max(constants_js_1.ATTACHMENT_LIMITS.pdfPages).nullable(),
+      scannerVersion: zod_1.z.string().min(1).max(128),
+      derivatives: zod_1.z.array(zod_1.z.object({
+        kind: zod_1.z.enum(["thumbnail", "image", "text", "pdf"]),
+        mime: zod_1.z.string().max(128),
+        data: zod_1.z.string().max(24 * 1024 * 1024)
+      }).strict()).max(4)
+    }).strict();
+    exports2.attachmentPdfPreviewSchema = zod_1.z.object({
+      totalPages: zod_1.z.number().int().positive().max(1e4),
+      pages: zod_1.z.array(zod_1.z.object({
+        page: zod_1.z.number().int().positive(),
+        data: zod_1.z.string().regex(/^[A-Za-z0-9+/]*={0,2}$/).max(2 * 1024 * 1024)
+      }).strict()).min(1).max(100)
+    }).strict();
+    exports2.attachmentModelBlockSchema = zod_1.z.discriminatedUnion("type", [
+      zod_1.z.object({ type: zod_1.z.literal("text"), text: zod_1.z.string().max(constants_js_1.ATTACHMENT_LIMITS.textBytes + 1024) }).strict(),
+      zod_1.z.object({
+        type: zod_1.z.literal("image"),
+        mime: zod_1.z.enum(["image/jpeg", "image/png", "image/webp"]),
+        data: zod_1.z.string().max(24 * 1024 * 1024)
+      }).strict(),
+      zod_1.z.object({
+        type: zod_1.z.literal("document"),
+        mime: zod_1.z.literal("application/pdf"),
+        data: zod_1.z.string().max(24 * 1024 * 1024),
+        name: zod_1.z.string().max(240),
+        textBytes: zod_1.z.number().int().nonnegative().max(constants_js_1.ATTACHMENT_LIMITS.modelFileTextBytes).optional()
+      }).strict()
+    ]);
+    exports2.attachmentModelMessagesSchema = zod_1.z.array(zod_1.z.object({
+      messageId: zod_1.z.string().uuid(),
+      blocks: zod_1.z.array(exports2.attachmentModelBlockSchema).max(constants_js_1.ATTACHMENT_LIMITS.messageFiles * (constants_js_1.ATTACHMENT_LIMITS.pdfPages * 2 + 2))
+    }).strict()).max(100);
+    exports2.attachmentPolicySchema = zod_1.z.object({
+      uploadsEnabled: zod_1.z.boolean(),
+      modelInputEnabled: zod_1.z.boolean(),
+      types: zod_1.z.array(exports2.attachmentMimeSchema),
+      limits: zod_1.z.object({
+        imageBytes: zod_1.z.number().int().positive(),
+        fileBytes: zod_1.z.number().int().positive(),
+        messageBytes: zod_1.z.number().int().positive(),
+        messageFiles: zod_1.z.number().int().positive(),
+        pdfPages: zod_1.z.number().int().positive(),
+        modelFiles: zod_1.z.number().int().positive(),
+        modelImages: zod_1.z.number().int().positive(),
+        modelPdfPages: zod_1.z.number().int().positive(),
+        modelEncodedBytes: zod_1.z.number().int().positive(),
+        modelTextBytes: zod_1.z.number().int().positive(),
+        modelFileTextBytes: zod_1.z.number().int().positive()
+      }).strict()
+    }).strict();
+  }
+});
+
 // packages/schema/dist/collaboration.js
 var require_collaboration = __commonJS({
   "packages/schema/dist/collaboration.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.collaborationErrorSchema = exports2.realtimeInvalidationSchema = exports2.githubPublicationStateSchema = exports2.notificationSchema = exports2.reviewSuggestionSchema = exports2.suggestionCreateSchema = exports2.reviewCommentSchema = exports2.reviewThreadCreateSchema = exports2.reviewThreadSchema = exports2.reviewAnchorSchema = exports2.reviewFragmentSchema = exports2.reviewContextSchema = exports2.pullRequestStateSchema = exports2.messageUpdateSchema = exports2.messageCreateSchema = exports2.messageSchema = exports2.assistantSessionListQuerySchema = exports2.assistantSessionOrderSchema = exports2.assistantSessionSortSchema = exports2.assistantSessionCreateSchema = exports2.conversationCreateSchema = exports2.conversationSchema = exports2.conversationKindSchema = exports2.workspaceAgentCreateSchema = exports2.workspaceAgentSchema = exports2.profileUpdateSchema = exports2.profileSchema = exports2.pageSchema = exports2.revisionSchema = exports2.sha256Schema = exports2.gitShaSchema = exports2.entityIdSchema = exports2.idempotencyKeySchema = exports2.opaqueCursorSchema = exports2.principalSchema = exports2.agentScopeSchema = exports2.collaborationActionSchema = exports2.workspaceRefSchema = exports2.workspaceKindSchema = void 0;
+    exports2.collaborationErrorSchema = exports2.realtimeInvalidationSchema = exports2.githubPublicationStateSchema = exports2.notificationSchema = exports2.reviewSuggestionSchema = exports2.suggestionCreateSchema = exports2.reviewCommentSchema = exports2.reviewThreadCreateSchema = exports2.reviewThreadSchema = exports2.reviewAnchorSchema = exports2.reviewFragmentSchema = exports2.reviewContextSchema = exports2.pullRequestStateSchema = exports2.messageUpdateSchema = exports2.messageCreateSchema = exports2.messageSchema = exports2.assistantSessionListQuerySchema = exports2.assistantSessionOrderSchema = exports2.assistantSessionSortSchema = exports2.assistantSessionCreateSchema = exports2.conversationCreateSchema = exports2.conversationSchema = exports2.conversationKindSchema = exports2.workspaceAgentListQuerySchema = exports2.workspaceAgentCreateSchema = exports2.workspaceAgentSchema = exports2.profileUpdateSchema = exports2.profileSchema = exports2.pageSchema = exports2.revisionSchema = exports2.sha256Schema = exports2.gitShaSchema = exports2.entityIdSchema = exports2.idempotencyKeySchema = exports2.opaqueCursorSchema = exports2.principalSchema = exports2.agentScopeSchema = exports2.collaborationActionSchema = exports2.workspaceRefSchema = exports2.workspaceKindSchema = void 0;
     var zod_1 = require("zod");
+    var index_js_1 = require_attachments();
     var constants_1 = require_constants();
     exports2.workspaceKindSchema = zod_1.z.enum(["user", "org", "team"]);
     exports2.workspaceRefSchema = zod_1.z.object({
@@ -2716,6 +2987,7 @@ var require_collaboration = __commonJS({
       projectId: zod_1.z.string().min(1).max(128).nullable().optional(),
       expiresAt: zod_1.z.number().int().positive().nullable().optional()
     }).strict();
+    exports2.workspaceAgentListQuerySchema = zod_1.z.object({ projectId: zod_1.z.string().min(1).max(128).optional() });
     exports2.conversationKindSchema = zod_1.z.enum(["workspace", "group", "direct", "assistant"]);
     exports2.conversationSchema = zod_1.z.object({
       id: exports2.entityIdSchema,
@@ -2770,6 +3042,7 @@ var require_collaboration = __commonJS({
       origin: zod_1.z.enum(["octonode", "slack"]),
       replyToId: exports2.entityIdSchema.nullable(),
       body: zod_1.z.string().max(16384),
+      attachments: zod_1.z.array(index_js_1.attachmentSummarySchema).max(10).optional(),
       version: exports2.revisionSchema,
       createdAt: zod_1.z.number().int().nonnegative(),
       editedAt: zod_1.z.number().int().positive().nullable(),
@@ -2778,12 +3051,14 @@ var require_collaboration = __commonJS({
       viewerReactions: zod_1.z.array(zod_1.z.string().max(32)).max(100)
     }).strict();
     exports2.messageCreateSchema = zod_1.z.object({
-      body: zod_1.z.string().min(1).max(16384),
+      body: zod_1.z.string().max(16384),
+      attachmentIds: index_js_1.attachmentIdListSchema.optional(),
       replyToId: exports2.entityIdSchema.nullable().optional(),
       clientMutationId: exports2.idempotencyKeySchema
-    }).strict();
+    }).strict().refine(({ body, attachmentIds }) => !!body.trim() || !!attachmentIds?.length, "Message requires text or attachments");
     exports2.messageUpdateSchema = zod_1.z.object({
-      body: zod_1.z.string().min(1).max(16384),
+      body: zod_1.z.string().max(16384),
+      attachmentIds: index_js_1.attachmentIdListSchema.optional(),
       expectedVersion: exports2.revisionSchema
     }).strict();
     exports2.pullRequestStateSchema = zod_1.z.enum(["open", "closed", "merged"]);
@@ -2942,6 +3217,378 @@ var require_collaboration = __commonJS({
   }
 });
 
+// packages/schema/dist/support/constants.js
+var require_constants3 = __commonJS({
+  "packages/schema/dist/support/constants.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.SUPPORT_LIMITS = exports2.SUPPORT_QUEUES = exports2.SUPPORT_STATUSES = exports2.SUPPORT_ISSUE_TYPES = exports2.PLATFORM_SCOPES = void 0;
+    exports2.PLATFORM_SCOPES = ["app-support"];
+    exports2.SUPPORT_ISSUE_TYPES = [
+      "app_not_working",
+      "bug_report",
+      "payment_issue",
+      "account_access",
+      "how_to",
+      "other"
+    ];
+    exports2.SUPPORT_STATUSES = ["queued", "open", "waiting_customer", "waiting_internal", "closed"];
+    exports2.SUPPORT_QUEUES = [
+      "active",
+      "unassigned",
+      "mine",
+      "needs_response",
+      "overdue",
+      "waiting",
+      "closed",
+      "all"
+    ];
+    exports2.SUPPORT_LIMITS = {
+      page: 50,
+      maxPage: 100,
+      dailyRequests: 20,
+      activeRequests: 10,
+      realtimeTtlMs: 3e4,
+      sessionMs: 3e5,
+      socketLimit: 200,
+      uploadBytes: 1e7
+    };
+  }
+});
+
+// packages/schema/dist/support/schema.js
+var require_schema2 = __commonJS({
+  "packages/schema/dist/support/schema.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.supportUserProfileSchema = exports2.supportLabelsInputSchema = exports2.supportLabelsSchema = exports2.supportUnreadSchema = exports2.supportNotificationPageSchema = exports2.supportNotificationSchema = exports2.supportSettingsInputSchema = exports2.supportSettingsSchema = exports2.supportTemplateInputSchema = exports2.supportTemplateSchema = exports2.supportReportSchema = exports2.supportReadSchema = exports2.supportRealtimeTicketSchema = exports2.supportRealtimeRequestSchema = exports2.supportAccessSchema = exports2.supportGrantSchema = exports2.supportAgentSchema = exports2.supportNoteViewSchema = exports2.supportActivitySchema = exports2.supportMessagePageSchema = exports2.supportTicketPageSchema = exports2.supportTicketSchema = exports2.supportListQuerySchema = exports2.supportNoteSchema = exports2.supportTakeSchema = exports2.supportStateSchema = exports2.supportCloseSchema = exports2.supportTransferSchema = exports2.supportReplySchema = exports2.supportCreateSchema = exports2.supportMutationSchema = exports2.supportStatusSchema = exports2.supportIssueTypeSchema = exports2.platformScopeSchema = void 0;
+    var zod_1 = require("zod");
+    var index_js_1 = require_attachments();
+    var collaboration_js_1 = require_collaboration();
+    var constants_js_1 = require_constants3();
+    exports2.platformScopeSchema = zod_1.z.enum(constants_js_1.PLATFORM_SCOPES);
+    exports2.supportIssueTypeSchema = zod_1.z.enum(constants_js_1.SUPPORT_ISSUE_TYPES);
+    exports2.supportStatusSchema = zod_1.z.enum(constants_js_1.SUPPORT_STATUSES);
+    exports2.supportMutationSchema = zod_1.z.object({ clientMutationId: zod_1.z.string().uuid(), expectedVersion: zod_1.z.number().int().positive() }).strict();
+    exports2.supportCreateSchema = zod_1.z.object({
+      clientMutationId: zod_1.z.string().uuid(),
+      issueType: exports2.supportIssueTypeSchema,
+      subject: zod_1.z.string().trim().min(1).max(200),
+      description: zod_1.z.string().trim().min(1).max(16384),
+      intakeId: zod_1.z.string().uuid().optional(),
+      attachmentIds: index_js_1.attachmentIdListSchema.optional(),
+      source: zod_1.z.enum(["studio", "landing"]).default("studio"),
+      followUpOfTicketId: zod_1.z.string().uuid().optional()
+    }).strict();
+    exports2.supportReplySchema = exports2.supportMutationSchema.extend({
+      body: zod_1.z.string().trim().max(16384),
+      attachmentIds: index_js_1.attachmentIdListSchema.optional()
+    });
+    exports2.supportTransferSchema = exports2.supportMutationSchema.extend({
+      assigneeId: zod_1.z.string().uuid(),
+      reason: zod_1.z.string().trim().min(1).max(2e3)
+    });
+    exports2.supportCloseSchema = exports2.supportMutationSchema.extend({ summary: zod_1.z.string().trim().min(1).max(4e3) });
+    exports2.supportStateSchema = exports2.supportMutationSchema.extend({
+      status: zod_1.z.enum(["open", "waiting_customer", "waiting_internal"])
+    });
+    exports2.supportTakeSchema = exports2.supportMutationSchema.extend({
+      reason: zod_1.z.string().trim().min(1).max(2e3).optional()
+    });
+    exports2.supportNoteSchema = exports2.supportMutationSchema.extend({ body: zod_1.z.string().trim().min(1).max(16384) });
+    exports2.supportListQuerySchema = zod_1.z.object({
+      view: zod_1.z.enum(constants_js_1.SUPPORT_QUEUES).default("active"),
+      cursor: zod_1.z.string().max(2048).optional(),
+      issueType: exports2.supportIssueTypeSchema.optional(),
+      assigneeId: zod_1.z.string().uuid().optional(),
+      priority: zod_1.z.enum(["low", "normal", "high", "urgent"]).optional(),
+      tag: zod_1.z.string().trim().min(1).max(40).optional(),
+      sort: zod_1.z.enum(["recent", "oldest"]).optional(),
+      limit: zod_1.z.coerce.number().int().min(1).max(100).default(50),
+      q: zod_1.z.string().trim().max(200).default("")
+    });
+    exports2.supportTicketSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      number: zod_1.z.number().int().positive(),
+      conversationId: zod_1.z.string().uuid(),
+      requesterId: zod_1.z.string().uuid(),
+      issueType: exports2.supportIssueTypeSchema,
+      subject: zod_1.z.string(),
+      status: exports2.supportStatusSchema,
+      source: zod_1.z.enum(["studio", "landing"]),
+      assigneeId: zod_1.z.string().uuid().nullable(),
+      acceptedBy: zod_1.z.string().uuid().nullable(),
+      acceptedAt: zod_1.z.number().nullable(),
+      closedBy: zod_1.z.string().uuid().nullable(),
+      closedAt: zod_1.z.number().nullable(),
+      closeSummary: zod_1.z.string().nullable(),
+      followUpOfTicketId: zod_1.z.string().uuid().nullable(),
+      version: zod_1.z.number().int().positive(),
+      createdAt: zod_1.z.number(),
+      updatedAt: zod_1.z.number(),
+      firstResponseAt: zod_1.z.number().nullable(),
+      lastMessageAt: zod_1.z.number(),
+      unread: zod_1.z.number().int().nonnegative()
+    });
+    exports2.supportTicketPageSchema = zod_1.z.object({
+      items: exports2.supportTicketSchema.array(),
+      nextCursor: zod_1.z.string().nullable()
+    });
+    exports2.supportMessagePageSchema = zod_1.z.object({ items: collaboration_js_1.messageSchema.array(), nextCursor: zod_1.z.string().nullable() });
+    exports2.supportActivitySchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      seq: zod_1.z.number(),
+      ticketId: zod_1.z.string().uuid(),
+      actorId: zod_1.z.string().uuid(),
+      kind: zod_1.z.string(),
+      previousAssigneeId: zod_1.z.string().uuid().nullable(),
+      assigneeId: zod_1.z.string().uuid().nullable(),
+      reason: zod_1.z.string().nullable(),
+      status: exports2.supportStatusSchema,
+      version: zod_1.z.number(),
+      createdAt: zod_1.z.number()
+    });
+    exports2.supportNoteViewSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      seq: zod_1.z.number(),
+      actorId: zod_1.z.string().uuid(),
+      body: zod_1.z.string(),
+      createdAt: zod_1.z.number()
+    });
+    exports2.supportAgentSchema = zod_1.z.object({
+      userId: zod_1.z.string().uuid(),
+      email: zod_1.z.string().nullable(),
+      version: zod_1.z.number(),
+      grantedAt: zod_1.z.number(),
+      grantedBy: zod_1.z.string().uuid()
+    });
+    exports2.supportGrantSchema = zod_1.z.object({
+      enabled: zod_1.z.boolean(),
+      expectedVersion: zod_1.z.number().int().nonnegative(),
+      reason: zod_1.z.string().trim().min(1).max(2e3),
+      clientMutationId: zod_1.z.string().uuid()
+    }).strict();
+    exports2.supportAccessSchema = zod_1.z.object({
+      uploads: zod_1.z.boolean(),
+      available: zod_1.z.boolean(),
+      staff: zod_1.z.boolean(),
+      canManageAgents: zod_1.z.boolean(),
+      userId: zod_1.z.string().uuid()
+    });
+    exports2.supportRealtimeRequestSchema = zod_1.z.object({ ticketId: zod_1.z.string().uuid().optional(), staff: zod_1.z.boolean().default(false) }).strict();
+    exports2.supportRealtimeTicketSchema = zod_1.z.object({ ticket: zod_1.z.string(), expiresAt: zod_1.z.number(), path: zod_1.z.string() });
+    exports2.supportReadSchema = zod_1.z.object({ sequence: zod_1.z.number().int().nonnegative() }).strict();
+    exports2.supportReportSchema = zod_1.z.object({
+      queued: zod_1.z.number(),
+      active: zod_1.z.number(),
+      closed: zod_1.z.number(),
+      overdue: zod_1.z.number(),
+      transfers: zod_1.z.number(),
+      meanAcceptanceMs: zod_1.z.number().nullable(),
+      meanResponseMs: zod_1.z.number().nullable(),
+      meanResolutionMs: zod_1.z.number().nullable()
+    });
+    exports2.supportTemplateSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      title: zod_1.z.string().trim().min(1).max(100),
+      body: zod_1.z.string().trim().min(1).max(16384),
+      version: zod_1.z.number().int().positive()
+    });
+    exports2.supportTemplateInputSchema = exports2.supportTemplateSchema.pick({ title: true, body: true }).extend({ expectedVersion: zod_1.z.number().int().nonnegative() }).strict();
+    exports2.supportSettingsSchema = zod_1.z.object({
+      version: zod_1.z.number().int().positive(),
+      responseTargetMinutes: zod_1.z.number().int().min(1).max(43200).nullable(),
+      retentionDays: zod_1.z.number().int().min(1).max(3650).nullable()
+    });
+    exports2.supportSettingsInputSchema = exports2.supportSettingsSchema.omit({ version: true }).extend({ expectedVersion: zod_1.z.number().int().positive() }).strict();
+    exports2.supportNotificationSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      seq: zod_1.z.number(),
+      ticketId: zod_1.z.string().uuid(),
+      kind: zod_1.z.string(),
+      createdAt: zod_1.z.number(),
+      readAt: zod_1.z.number().nullable()
+    });
+    exports2.supportNotificationPageSchema = zod_1.z.object({
+      items: exports2.supportNotificationSchema.array(),
+      nextCursor: zod_1.z.string().nullable()
+    });
+    exports2.supportUnreadSchema = zod_1.z.object({
+      unread: zod_1.z.number().int().nonnegative(),
+      liveTickets: zod_1.z.number().int().nonnegative()
+    });
+    exports2.supportLabelsSchema = zod_1.z.object({
+      priority: zod_1.z.enum(["low", "normal", "high", "urgent"]),
+      tags: zod_1.z.array(zod_1.z.string().trim().min(1).max(40)).max(10).refine((tags) => new Set(tags).size === tags.length, "Tags must be unique")
+    }).strict();
+    exports2.supportLabelsInputSchema = exports2.supportLabelsSchema.extend({
+      clientMutationId: zod_1.z.string().uuid(),
+      expectedVersion: zod_1.z.number().int().positive()
+    });
+    exports2.supportUserProfileSchema = zod_1.z.object({
+      userId: zod_1.z.string().uuid(),
+      email: zod_1.z.string().nullable(),
+      displayName: zod_1.z.string().nullable(),
+      createdAt: zod_1.z.number()
+    });
+  }
+});
+
+// packages/schema/dist/support/types.js
+var require_types = __commonJS({
+  "packages/schema/dist/support/types.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+  }
+});
+
+// packages/schema/dist/support/recovery/constants.js
+var require_constants4 = __commonJS({
+  "packages/schema/dist/support/recovery/constants.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.SUPPORT_ARCHIVE_MAX_BYTES = exports2.SUPPORT_ARCHIVE_PAGE_SIZE = exports2.SUPPORT_ARCHIVE_TABLES = exports2.SUPPORT_ARCHIVE_VERSION = void 0;
+    exports2.SUPPORT_ARCHIVE_VERSION = 1;
+    exports2.SUPPORT_ARCHIVE_TABLES = [
+      "conversations",
+      "conversation_members",
+      "messages",
+      "message_reactions",
+      "attachments",
+      "message_attachments",
+      "support_tickets",
+      "support_intakes",
+      "support_activity",
+      "support_labels",
+      "support_notes",
+      "support_reads",
+      "support_replays",
+      "support_templates",
+      "support_notifications",
+      "support_settings",
+      "support_admin_events",
+      "support_deadline_alerts",
+      "support_erased_users",
+      "support_erased_tickets"
+    ];
+    exports2.SUPPORT_ARCHIVE_PAGE_SIZE = 25;
+    exports2.SUPPORT_ARCHIVE_MAX_BYTES = 1048576;
+  }
+});
+
+// packages/schema/dist/support/recovery/schema.js
+var require_schema3 = __commonJS({
+  "packages/schema/dist/support/recovery/schema.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.supportMaintenanceViewSchema = exports2.supportArchiveManifestSchema = exports2.supportArchivePageSchema = exports2.supportMaintenanceInputSchema = void 0;
+    var zod_1 = require("zod");
+    var constants_js_1 = require_constants4();
+    exports2.supportMaintenanceInputSchema = zod_1.z.object({
+      clientMutationId: zod_1.z.string().uuid(),
+      expectedEpoch: zod_1.z.number().int().positive(),
+      kind: zod_1.z.enum(["backup", "restore", "erase"]),
+      backupId: zod_1.z.string().uuid().optional(),
+      userId: zod_1.z.string().uuid().optional(),
+      ticketId: zod_1.z.string().uuid().optional(),
+      reason: zod_1.z.string().trim().min(1).max(2e3)
+    }).strict().superRefine((input, ctx) => {
+      if (input.kind === "restore" && !input.backupId)
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: "backupId required" });
+      if (input.kind === "erase" && Number(!!input.userId) + Number(!!input.ticketId) !== 1)
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: "exactly one erasure target required" });
+      if (input.kind !== "erase" && (input.userId || input.ticketId) || input.kind !== "restore" && input.backupId)
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: "unexpected target" });
+    });
+    exports2.supportArchivePageSchema = zod_1.z.object({
+      table: zod_1.z.enum(constants_js_1.SUPPORT_ARCHIVE_TABLES),
+      rows: zod_1.z.record(zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.null()])).array().max(constants_js_1.SUPPORT_ARCHIVE_PAGE_SIZE)
+    }).strict();
+    exports2.supportArchiveManifestSchema = zod_1.z.object({
+      version: zod_1.z.literal(constants_js_1.SUPPORT_ARCHIVE_VERSION),
+      desk: zod_1.z.literal("octonode"),
+      id: zod_1.z.string().uuid(),
+      generation: zod_1.z.number().int().positive(),
+      pages: zod_1.z.number().int().nonnegative(),
+      chain: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+      counts: zod_1.z.record(zod_1.z.number().int().nonnegative()),
+      createdAt: zod_1.z.number().int()
+    }).strict();
+    exports2.supportMaintenanceViewSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      kind: zod_1.z.enum(["backup", "restore", "erase"]),
+      status: zod_1.z.enum(["running", "failed", "complete", "cancelled"]),
+      phase: zod_1.z.string(),
+      createdAt: zod_1.z.number(),
+      updatedAt: zod_1.z.number(),
+      error: zod_1.z.string().nullable()
+    });
+  }
+});
+
+// packages/schema/dist/support/recovery/types.js
+var require_types2 = __commonJS({
+  "packages/schema/dist/support/recovery/types.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+  }
+});
+
+// packages/schema/dist/support/recovery/index.js
+var require_recovery = __commonJS({
+  "packages/schema/dist/support/recovery/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    __exportStar(require_constants4(), exports2);
+    __exportStar(require_schema3(), exports2);
+    __exportStar(require_types2(), exports2);
+  }
+});
+
+// packages/schema/dist/support/index.js
+var require_support = __commonJS({
+  "packages/schema/dist/support/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    __exportStar(require_constants3(), exports2);
+    __exportStar(require_schema2(), exports2);
+    __exportStar(require_types(), exports2);
+    __exportStar(require_recovery(), exports2);
+  }
+});
+
 // packages/schema/dist/task-management/common.js
 var require_common = __commonJS({
   "packages/schema/dist/task-management/common.js"(exports2) {
@@ -2971,6 +3618,10 @@ var require_common = __commonJS({
       name: exports2.taskNameSchema,
       description: exports2.taskDescriptionSchema,
       sprintsEnabled: zod_1.z.boolean(),
+      /** Finishing an item needs every open child finished first. */
+      blockDoneWithOpenChildren: zod_1.z.boolean(),
+      /** Finishing the last open child finishes its parent. */
+      autoCloseParent: zod_1.z.boolean(),
       version: collaboration_1.revisionSchema,
       createdAt: exports2.taskTimestampSchema,
       updatedAt: exports2.taskTimestampSchema,
@@ -2987,6 +3638,8 @@ var require_common = __commonJS({
       name: exports2.taskNameSchema.optional(),
       description: exports2.taskDescriptionSchema.optional(),
       sprintsEnabled: zod_1.z.boolean().optional(),
+      blockDoneWithOpenChildren: zod_1.z.boolean().optional(),
+      autoCloseParent: zod_1.z.boolean().optional(),
       expectedVersion: collaboration_1.revisionSchema
     }).strict().refine((changes) => Object.keys(changes).length > 1, "at least one task space change is required");
     exports2.taskStatusSchema = zod_1.z.object({
@@ -3264,7 +3917,7 @@ var require_items = __commonJS({
   "packages/schema/dist/task-management/work/items.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.workItemLinkMutationSchema = exports2.workItemMoveSchema = exports2.workItemUpdateSchema = exports2.workItemCreateSchema = exports2.workItemSchema = exports2.workItemPullRequestLinkSchema = exports2.workItemWorkflowLinkSchema = exports2.workItemLinkSchema = exports2.taskLinkTypeSchema = void 0;
+    exports2.workItemMineQuerySchema = exports2.workItemLinkMutationSchema = exports2.workItemMoveSchema = exports2.workItemBulkSchema = exports2.workItemUpdateSchema = exports2.workItemCreateSchema = exports2.workItemSchema = exports2.workItemDesignDocLinkSchema = exports2.workItemPullRequestLinkSchema = exports2.workItemWorkflowLinkSchema = exports2.workItemLinkSchema = exports2.taskLinkTypeSchema = void 0;
     var zod_1 = require("zod");
     var constants_1 = require_constants();
     var collaboration_1 = require_collaboration();
@@ -3292,6 +3945,12 @@ var require_items = __commonJS({
       createdBy: common_1.taskUserIdSchema,
       createdAt: common_1.taskTimestampSchema
     }).strict();
+    exports2.workItemDesignDocLinkSchema = zod_1.z.object({
+      itemId: collaboration_1.entityIdSchema,
+      documentId: collaboration_1.entityIdSchema,
+      createdBy: common_1.taskUserIdSchema,
+      createdAt: common_1.taskTimestampSchema
+    }).strict();
     exports2.workItemSchema = zod_1.z.object({
       id: collaboration_1.entityIdSchema,
       key: common_1.workItemKeySchema,
@@ -3315,7 +3974,8 @@ var require_items = __commonJS({
       links: zod_1.z.object({
         items: zod_1.z.array(exports2.workItemLinkSchema).max(100),
         workflows: zod_1.z.array(exports2.workItemWorkflowLinkSchema).max(100),
-        pullRequests: zod_1.z.array(exports2.workItemPullRequestLinkSchema).max(100)
+        pullRequests: zod_1.z.array(exports2.workItemPullRequestLinkSchema).max(100),
+        designDocs: zod_1.z.array(exports2.workItemDesignDocLinkSchema).max(100)
       }).strict(),
       version: collaboration_1.revisionSchema,
       createdAt: common_1.taskTimestampSchema,
@@ -3355,7 +4015,7 @@ var require_items = __commonJS({
       releaseIds: workItemMutationShape.releaseIds.optional(),
       clientMutationId: collaboration_1.idempotencyKeySchema
     }).strict();
-    exports2.workItemUpdateSchema = zod_1.z.object({
+    var workItemChangesShape = {
       typeId: workItemMutationShape.typeId.optional(),
       title: workItemMutationShape.title.optional(),
       description: workItemMutationShape.description.optional(),
@@ -3369,9 +4029,29 @@ var require_items = __commonJS({
       dueAt: workItemMutationShape.dueAt.optional(),
       fieldValues: workItemMutationShape.fieldValues.optional(),
       tagIds: workItemMutationShape.tagIds.optional(),
-      releaseIds: workItemMutationShape.releaseIds.optional(),
-      expectedVersion: collaboration_1.revisionSchema
-    }).strict().refine((changes) => Object.keys(changes).length > 1, "at least one work item change is required");
+      releaseIds: workItemMutationShape.releaseIds.optional()
+    };
+    exports2.workItemUpdateSchema = zod_1.z.object({ ...workItemChangesShape, expectedVersion: collaboration_1.revisionSchema }).strict().refine((changes) => Object.keys(changes).length > 1, "at least one work item change is required");
+    var workItemVersionedRefSchema = zod_1.z.object({ itemId: collaboration_1.entityIdSchema, expectedVersion: collaboration_1.revisionSchema }).strict();
+    exports2.workItemBulkSchema = zod_1.z.object({
+      create: zod_1.z.array(exports2.workItemCreateSchema.omit({ clientMutationId: true })).max(constants_1.WORK_ITEM_BULK_LIMIT).default([]),
+      update: zod_1.z.array(workItemVersionedRefSchema.extend({
+        changes: zod_1.z.object(workItemChangesShape).strict().refine((changes) => Object.keys(changes).length > 0, "at least one work item change is required")
+      }).strict()).max(constants_1.WORK_ITEM_BULK_LIMIT).default([]),
+      archive: zod_1.z.array(workItemVersionedRefSchema).max(constants_1.WORK_ITEM_BULK_LIMIT).default([]),
+      restore: zod_1.z.array(workItemVersionedRefSchema).max(constants_1.WORK_ITEM_BULK_LIMIT).default([]),
+      clientMutationId: collaboration_1.idempotencyKeySchema
+    }).strict().superRefine((bulk, context) => {
+      const total = bulk.create.length + bulk.update.length + bulk.archive.length + bulk.restore.length;
+      if (total === 0 || total > constants_1.WORK_ITEM_BULK_LIMIT)
+        context.addIssue({
+          code: zod_1.z.ZodIssueCode.custom,
+          message: `a bulk request needs 1-${constants_1.WORK_ITEM_BULK_LIMIT} operations`
+        });
+      const ids = [...bulk.update, ...bulk.archive, ...bulk.restore].map(({ itemId }) => itemId);
+      if (new Set(ids).size !== ids.length)
+        context.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: "each work item may appear once per bulk request" });
+    });
     exports2.workItemMoveSchema = zod_1.z.object({
       statusId: collaboration_1.entityIdSchema,
       beforeItemId: collaboration_1.entityIdSchema.nullable().optional(),
@@ -3390,8 +4070,17 @@ var require_items = __commonJS({
         kind: zod_1.z.literal("pull_request"),
         repositoryId: zod_1.z.number().int().positive(),
         pullNumber: zod_1.z.number().int().positive()
+      }).strict(),
+      zod_1.z.object({
+        kind: zod_1.z.literal("design_doc"),
+        documentId: collaboration_1.entityIdSchema
       }).strict()
     ]);
+    exports2.workItemMineQuerySchema = zod_1.z.object({
+      role: zod_1.z.enum(["assigned", "reported"]).default("assigned"),
+      includeDone: zod_1.z.boolean().default(false),
+      limit: zod_1.z.number().int().min(1).max(100).default(50)
+    }).strict();
   }
 });
 
@@ -3415,11 +4104,15 @@ var require_views = __commonJS({
     }).strict();
     exports2.taskViewFilterSchema = zod_1.z.object({
       query: zod_1.z.string().trim().max(200).optional(),
+      focus: zod_1.z.enum(["all", "open", "unassigned", "overdue"]).optional(),
+      layout: zod_1.z.enum(["board", "list", "calendar", "timeline", "backlog", "sprint", "releases"]).optional(),
+      sort: exports2.taskViewSortSchema.optional(),
       typeIds: zod_1.z.array(collaboration_1.entityIdSchema).max(50).optional(),
       statusIds: zod_1.z.array(collaboration_1.entityIdSchema).max(20).optional(),
       priorities: zod_1.z.array(common_1.workItemPrioritySchema).max(constants_1.WORK_ITEM_PRIORITIES.length).optional(),
       assigneeIds: zod_1.z.array(common_1.taskUserIdSchema).max(100).optional(),
       tagIds: zod_1.z.array(collaboration_1.entityIdSchema).max(500).optional(),
+      archived: zod_1.z.boolean().optional(),
       sprintIds: zod_1.z.array(collaboration_1.entityIdSchema).max(100).optional(),
       releaseIds: zod_1.z.array(collaboration_1.entityIdSchema).max(100).optional(),
       parentId: collaboration_1.entityIdSchema.optional(),
@@ -3513,7 +4206,7 @@ var require_activity = __commonJS({
   "packages/schema/dist/task-management/activity.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.workItemActivityPageSchema = exports2.workItemCommentPageSchema = exports2.taskReleasePageSchema = exports2.taskSprintPageSchema = exports2.workItemPageSchema = exports2.taskSpacePageSchema = exports2.taskErrorSchema = exports2.workItemActivitySchema = exports2.workItemCommentCreateSchema = exports2.workItemCommentSchema = void 0;
+    exports2.workItemActivityPageSchema = exports2.workItemCommentPageSchema = exports2.taskReleasePageSchema = exports2.taskSprintPageSchema = exports2.workItemPageSchema = exports2.taskItemSummarySchema = exports2.taskItemTotalsSchema = exports2.taskSpacePageSchema = exports2.taskErrorSchema = exports2.workItemActivitySchema = exports2.workItemCommentCreateSchema = exports2.workItemCommentSchema = void 0;
     var zod_1 = require("zod");
     var collaboration_1 = require_collaboration();
     var common_1 = require_common();
@@ -3546,10 +4239,14 @@ var require_activity = __commonJS({
         "created",
         "updated",
         "moved",
+        "auto_closed",
+        "reopened",
         "archived",
         "commented",
         "linked",
         "unlinked",
+        "attached",
+        "detached",
         "sprint_planned",
         "sprint_started",
         "sprint_completed",
@@ -3574,7 +4271,19 @@ var require_activity = __commonJS({
       currentVersion: collaboration_1.revisionSchema.optional()
     }).strict();
     exports2.taskSpacePageSchema = (0, collaboration_1.pageSchema)(common_1.taskSpaceSchema);
-    exports2.workItemPageSchema = (0, collaboration_1.pageSchema)(items_1.workItemSchema);
+    exports2.taskItemTotalsSchema = zod_1.z.object({
+      total: zod_1.z.number().int().nonnegative(),
+      done: zod_1.z.number().int().nonnegative(),
+      storyPoints: zod_1.z.number().nonnegative()
+    });
+    exports2.taskItemSummarySchema = exports2.taskItemTotalsSchema.extend({
+      startAt: common_1.nullableTaskTimestampSchema,
+      endAt: common_1.nullableTaskTimestampSchema,
+      statuses: zod_1.z.record(exports2.taskItemTotalsSchema),
+      sprints: zod_1.z.record(exports2.taskItemTotalsSchema),
+      releases: zod_1.z.record(exports2.taskItemTotalsSchema)
+    });
+    exports2.workItemPageSchema = (0, collaboration_1.pageSchema)(items_1.workItemSchema).extend({ summary: exports2.taskItemSummarySchema });
     exports2.taskSprintPageSchema = (0, collaboration_1.pageSchema)(planning_1.taskSprintSchema);
     exports2.taskReleasePageSchema = (0, collaboration_1.pageSchema)(planning_1.taskReleaseSchema);
     exports2.workItemCommentPageSchema = (0, collaboration_1.pageSchema)(exports2.workItemCommentSchema);
@@ -3582,6 +4291,123 @@ var require_activity = __commonJS({
   }
 });
 
+// packages/schema/dist/task-management/attachments.js
+var require_attachments2 = __commonJS({
+  "packages/schema/dist/task-management/attachments.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.taskAttachmentRecordSchema = exports2.taskAttachmentUploadQuerySchema = exports2.taskAttachmentListSchema = exports2.taskAttachmentSchema = exports2.taskAttachmentNameSchema = exports2.isInlineTaskAttachment = exports2.taskAttachmentMimeSchema = void 0;
+    exports2.taskAttachmentKind = taskAttachmentKind;
+    exports2.attachmentSignatureMatches = attachmentSignatureMatches;
+    var zod_1 = require("zod");
+    var constants_1 = require_constants();
+    var collaboration_1 = require_collaboration();
+    var common_1 = require_common();
+    exports2.taskAttachmentMimeSchema = zod_1.z.enum(constants_1.TASK_ATTACHMENT_MIME_TYPES);
+    function taskAttachmentKind(mime) {
+      if (mime.startsWith("image/"))
+        return "image";
+      if (mime.startsWith("video/"))
+        return "video";
+      return "document";
+    }
+    var isInlineTaskAttachment = (mime) => constants_1.TASK_ATTACHMENT_INLINE_MIME_TYPES.includes(mime);
+    exports2.isInlineTaskAttachment = isInlineTaskAttachment;
+    exports2.taskAttachmentNameSchema = zod_1.z.string().trim().min(1).max(200).regex(/^[^/\\\p{Cc}]+$/u);
+    exports2.taskAttachmentSchema = zod_1.z.object({
+      id: collaboration_1.entityIdSchema,
+      itemId: collaboration_1.entityIdSchema,
+      name: exports2.taskAttachmentNameSchema,
+      mime: exports2.taskAttachmentMimeSchema,
+      size: zod_1.z.number().int().positive().max(constants_1.TASK_ATTACHMENT_MAX_BYTES),
+      checksum: zod_1.z.string().max(128),
+      createdBy: common_1.taskUserIdSchema,
+      createdAt: common_1.taskTimestampSchema
+    }).strict();
+    exports2.taskAttachmentListSchema = zod_1.z.object({ items: zod_1.z.array(exports2.taskAttachmentSchema).max(100) }).strict();
+    exports2.taskAttachmentUploadQuerySchema = zod_1.z.object({ name: exports2.taskAttachmentNameSchema }).strict();
+    exports2.taskAttachmentRecordSchema = zod_1.z.object({
+      id: collaboration_1.entityIdSchema,
+      name: exports2.taskAttachmentNameSchema,
+      mime: exports2.taskAttachmentMimeSchema,
+      size: zod_1.z.number().int().positive().max(constants_1.TASK_ATTACHMENT_MAX_BYTES),
+      checksum: zod_1.z.string().max(128),
+      objectKey: zod_1.z.string().min(1).max(512),
+      clientMutationId: collaboration_1.idempotencyKeySchema
+    }).strict();
+    var startsWith = (head, bytes, offset = 0) => bytes.every((byte, index) => head[offset + index] === byte);
+    var ascii = (text) => [...text].map((char) => char.charCodeAt(0));
+    function attachmentSignatureMatches(mime, head) {
+      switch (mime) {
+        case "image/png":
+          return startsWith(head, [137, ...ascii("PNG"), 13, 10, 26, 10]);
+        case "image/jpeg":
+          return startsWith(head, [255, 216, 255]);
+        case "image/gif":
+          return startsWith(head, ascii("GIF8"));
+        case "image/webp":
+          return startsWith(head, ascii("RIFF")) && startsWith(head, ascii("WEBP"), 8);
+        case "image/avif":
+        case "video/mp4":
+          return startsWith(head, ascii("ftyp"), 4);
+        case "video/webm":
+          return startsWith(head, [26, 69, 223, 163]);
+        case "application/pdf":
+          return startsWith(head, ascii("%PDF"));
+        case "application/zip":
+          return startsWith(head, [80, 75, 3, 4]);
+        default:
+          return mime.startsWith("application/vnd.openxmlformats-officedocument.") ? startsWith(head, [80, 75, 3, 4]) : !head.includes(0);
+      }
+    }
+  }
+});
+
+// packages/schema/dist/task-management/hierarchy.js
+var require_hierarchy = __commonJS({
+  "packages/schema/dist/task-management/hierarchy.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.workItemSummaryListSchema = exports2.workItemSummarySchema = exports2.taskSpaceTreeSchema = exports2.workItemTreeSchema = exports2.workItemTreeNodeSchema = void 0;
+    var zod_1 = require("zod");
+    var constants_1 = require_constants();
+    var collaboration_1 = require_collaboration();
+    var common_1 = require_common();
+    exports2.workItemTreeNodeSchema = zod_1.z.object({
+      id: collaboration_1.entityIdSchema,
+      key: common_1.workItemKeySchema,
+      spaceId: collaboration_1.entityIdSchema,
+      parentId: collaboration_1.entityIdSchema.nullable(),
+      depth: zod_1.z.number().int().nonnegative(),
+      title: zod_1.z.string(),
+      level: common_1.workItemLevelSchema,
+      typeName: zod_1.z.string(),
+      typeColor: common_1.taskColorSchema,
+      statusName: zod_1.z.string(),
+      statusColor: common_1.taskColorSchema,
+      statusCategory: common_1.taskStatusCategorySchema,
+      assigneeId: common_1.taskUserIdSchema.nullable(),
+      storyPoints: zod_1.z.number().nullable(),
+      startAt: common_1.nullableTaskTimestampSchema,
+      dueAt: common_1.nullableTaskTimestampSchema
+    }).strict();
+    exports2.workItemTreeSchema = zod_1.z.object({
+      nodes: zod_1.z.array(exports2.workItemTreeNodeSchema).max(constants_1.WORK_ITEM_TREE_LIMIT),
+      truncated: zod_1.z.boolean()
+    }).strict();
+    exports2.taskSpaceTreeSchema = exports2.workItemTreeSchema.omit({ truncated: true }).extend({
+      nextCursor: zod_1.z.string().nullable()
+    });
+    exports2.workItemSummarySchema = exports2.workItemTreeNodeSchema.omit({
+      parentId: true,
+      depth: true,
+      level: true,
+      typeName: true
+    });
+    exports2.workItemSummaryListSchema = zod_1.z.object({ items: zod_1.z.array(exports2.workItemSummarySchema).max(100) }).strict();
+  }
+});
+
 // packages/schema/dist/task-management/index.js
 var require_task_management = __commonJS({
   "packages/schema/dist/task-management/index.js"(exports2) {
@@ -3608,6 +4434,8 @@ var require_task_management = __commonJS({
     __exportStar(require_items(), exports2);
     __exportStar(require_views(), exports2);
     __exportStar(require_activity(), exports2);
+    __exportStar(require_attachments2(), exports2);
+    __exportStar(require_hierarchy(), exports2);
   }
 });
 
@@ -3945,8 +4773,196 @@ var require_capabilities = __commonJS({
   }
 });
 
+// packages/schema/dist/remote/constants.js
+var require_constants5 = __commonJS({
+  "packages/schema/dist/remote/constants.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.REMOTE_RESPONSE_HEADERS = exports2.REMOTE_REQUEST_HEADERS = exports2.REMOTE_FILE_CHUNK_BYTES = exports2.REMOTE_FILE_BYTES = exports2.REMOTE_RECOVERY_KEY = exports2.REMOTE_MAX_HOSTS = exports2.REMOTE_PAIRING_MS = exports2.REMOTE_RESPONSE_BYTES = exports2.REMOTE_MAX_STREAMS = exports2.REMOTE_FRAME_BYTES = exports2.REMOTE_BODY_BYTES = exports2.REMOTE_CHUNK_BYTES = exports2.REMOTE_LEASE_MS = exports2.REMOTE_PROTOCOL = void 0;
+    exports2.REMOTE_PROTOCOL = "octonode.remote.v1";
+    exports2.REMOTE_LEASE_MS = 3e4;
+    exports2.REMOTE_CHUNK_BYTES = 48 * 1024;
+    exports2.REMOTE_BODY_BYTES = 4 * 1024 * 1024;
+    exports2.REMOTE_FRAME_BYTES = 128 * 1024;
+    exports2.REMOTE_MAX_STREAMS = 32;
+    exports2.REMOTE_RESPONSE_BYTES = 50 * 1024 * 1024;
+    exports2.REMOTE_PAIRING_MS = 10 * 6e4;
+    exports2.REMOTE_MAX_HOSTS = 10;
+    exports2.REMOTE_RECOVERY_KEY = "remote-credentials/v1/recovery";
+    exports2.REMOTE_FILE_BYTES = 128 * 1024 * 1024;
+    exports2.REMOTE_FILE_CHUNK_BYTES = 512 * 1024;
+    exports2.REMOTE_REQUEST_HEADERS = [
+      "content-type",
+      "accept",
+      "if-match",
+      "if-none-match",
+      "idempotency-key",
+      "x-octonode-worktree",
+      "x-octonode-autocommit"
+    ];
+    exports2.REMOTE_RESPONSE_HEADERS = ["content-type", "etag", "retry-after", "x-octonode-git-commit"];
+  }
+});
+
+// packages/schema/dist/remote/schema.js
+var require_schema4 = __commonJS({
+  "packages/schema/dist/remote/schema.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.remoteFrameSchema = exports2.remoteGrantSchema = exports2.remoteGrantInputSchema = exports2.remoteCommandSchema = exports2.remoteCommandInputSchema = exports2.remoteTerminalQuerySchema = exports2.remoteTerminalSchema = exports2.remoteConnectionSchema = exports2.remoteDeviceSchema = exports2.remoteHostEnrollmentSchema = exports2.remoteHostSchema = exports2.remoteCredentialFenceSchema = exports2.remoteRecoveryCommandSchema = exports2.remoteRecoverySchema = exports2.remotePairSchema = exports2.remoteFileTransferSchema = exports2.remoteFileTransferInputSchema = exports2.remoteFileDownloadSchema = exports2.remoteFileChunkSchema = exports2.remoteFileMetadataSchema = exports2.remoteFileRevisionSchema = exports2.remotePreviewSchema = exports2.remotePreviewInputSchema = exports2.remotePreviewPortsSchema = exports2.remoteHostCreateSchema = exports2.remoteTargetSchema = exports2.remoteHostIdSchema = void 0;
+    var zod_1 = require("zod");
+    var constants_js_1 = require_constants5();
+    exports2.remoteHostIdSchema = zod_1.z.string().uuid();
+    exports2.remoteTargetSchema = zod_1.z.object({ computerId: exports2.remoteHostIdSchema, checkoutId: zod_1.z.string().uuid() }).strict();
+    exports2.remoteHostCreateSchema = zod_1.z.object({ name: zod_1.z.string().trim().min(1).max(80) }).strict();
+    exports2.remotePreviewPortsSchema = zod_1.z.array(zod_1.z.number().int().min(1024).max(65535)).max(8);
+    exports2.remotePreviewInputSchema = zod_1.z.object({
+      checkoutId: zod_1.z.string().uuid(),
+      projectId: zod_1.z.string().min(1).max(128).regex(/^[a-zA-Z0-9._-]+$/),
+      port: zod_1.z.number().int().min(1024).max(65535),
+      worktree: zod_1.z.string().uuid().optional()
+    }).strict();
+    exports2.remotePreviewSchema = zod_1.z.object({ url: zod_1.z.string().url(), expiresAt: zod_1.z.number() });
+    exports2.remoteFileRevisionSchema = zod_1.z.string().regex(/^[a-f0-9]{64}$/);
+    exports2.remoteFileMetadataSchema = zod_1.z.object({
+      path: zod_1.z.string(),
+      size: zod_1.z.number(),
+      revision: exports2.remoteFileRevisionSchema,
+      maxBytes: zod_1.z.number(),
+      chunkBytes: zod_1.z.number()
+    });
+    exports2.remoteFileChunkSchema = zod_1.z.object({ offset: zod_1.z.number().int().nonnegative(), data: zod_1.z.string().max(4 * Math.ceil(constants_js_1.REMOTE_FILE_CHUNK_BYTES / 3)) }).strict();
+    exports2.remoteFileDownloadSchema = exports2.remoteFileChunkSchema.extend({
+      revision: exports2.remoteFileRevisionSchema,
+      size: zod_1.z.number(),
+      nextOffset: zod_1.z.number()
+    });
+    exports2.remoteFileTransferInputSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      path: zod_1.z.string().min(1).max(2048),
+      size: zod_1.z.number().int().min(0).max(constants_js_1.REMOTE_FILE_BYTES),
+      revision: exports2.remoteFileRevisionSchema.nullable(),
+      sha256: exports2.remoteFileRevisionSchema
+    }).strict();
+    exports2.remoteFileTransferSchema = exports2.remoteFileTransferInputSchema.extend({
+      nextOffset: zod_1.z.number(),
+      state: zod_1.z.enum(["uploading", "committing", "completed", "expired"]),
+      createdAt: zod_1.z.number(),
+      project: zod_1.z.string(),
+      worktree: zod_1.z.string().nullable()
+    });
+    exports2.remotePairSchema = zod_1.z.object({ checkoutId: zod_1.z.string().uuid(), isolation: zod_1.z.enum(["native", "container"]).default("native") }).strict();
+    exports2.remoteRecoverySchema = zod_1.z.object({ epoch: zod_1.z.string().uuid(), state: zod_1.z.enum(["paused", "ready"]), cursor: zod_1.z.string().uuid().optional() }).strict();
+    exports2.remoteRecoveryCommandSchema = zod_1.z.discriminatedUnion("action", [
+      zod_1.z.object({ action: zod_1.z.literal("begin"), epoch: zod_1.z.string().uuid(), previousEpoch: zod_1.z.string().uuid().nullable() }).strict(),
+      zod_1.z.object({ action: zod_1.z.literal("finish"), epoch: zod_1.z.string().uuid() }).strict()
+    ]);
+    exports2.remoteCredentialFenceSchema = zod_1.z.object({ ownerHash: zod_1.z.string().regex(/^[a-f0-9]{64}$/), epoch: zod_1.z.string().uuid() }).strict();
+    exports2.remoteHostSchema = zod_1.z.object({
+      id: exports2.remoteHostIdSchema,
+      name: zod_1.z.string(),
+      workspace: zod_1.z.string(),
+      createdAt: zod_1.z.number(),
+      connectedAt: zod_1.z.number().nullable(),
+      checkoutId: zod_1.z.string().uuid().nullable(),
+      online: zod_1.z.boolean(),
+      isolation: zod_1.z.enum(["native", "container"]).default("native"),
+      canManage: zod_1.z.boolean().default(false)
+    });
+    exports2.remoteHostEnrollmentSchema = zod_1.z.object({
+      host: exports2.remoteHostSchema,
+      token: zod_1.z.string(),
+      expiresAt: zod_1.z.number()
+    });
+    exports2.remoteDeviceSchema = zod_1.z.object({
+      id: exports2.remoteHostIdSchema,
+      workspace: zod_1.z.string(),
+      ownerId: zod_1.z.string(),
+      checkoutId: zod_1.z.string().uuid().nullable(),
+      executionPolicy: zod_1.z.string().regex(/^[a-f0-9]{64}$/).optional()
+    });
+    exports2.remoteConnectionSchema = zod_1.z.object({
+      id: exports2.remoteHostIdSchema,
+      gateway: zod_1.z.string().url(),
+      token: zod_1.z.string().regex(/^octo_host_[a-f0-9]{64}$/),
+      paired: zod_1.z.boolean().default(false),
+      checkoutId: zod_1.z.string().uuid().optional(),
+      rootIdentity: zod_1.z.string().regex(/^[a-f0-9]{64}$/).optional(),
+      containerImage: zod_1.z.string().regex(/^(?:sha256:[a-f0-9]{64}|[a-zA-Z0-9./:_-]+@sha256:[a-f0-9]{64})$/).optional(),
+      previewPorts: exports2.remotePreviewPortsSchema.default([])
+    }).strict();
+    exports2.remoteTerminalSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      project: zod_1.z.string(),
+      worktree: zod_1.z.string().nullable(),
+      createdAt: zod_1.z.number()
+    });
+    exports2.remoteTerminalQuerySchema = zod_1.z.object({
+      project: zod_1.z.string().min(1).max(240),
+      worktree: zod_1.z.string().uuid().optional()
+    });
+    exports2.remoteCommandInputSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      command: zod_1.z.string().min(1).max(8192),
+      timeoutMs: zod_1.z.number().int().min(100).max(3e5).default(6e4)
+    }).strict();
+    exports2.remoteCommandSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      project: zod_1.z.string(),
+      worktree: zod_1.z.string().nullable(),
+      state: zod_1.z.enum(["running", "completed", "cancelled", "interrupted", "failed"]),
+      output: zod_1.z.string(),
+      truncated: zod_1.z.boolean(),
+      exitCode: zod_1.z.number().int().nullable(),
+      createdAt: zod_1.z.number(),
+      finishedAt: zod_1.z.number().nullable()
+    });
+    exports2.remoteGrantInputSchema = zod_1.z.object({
+      checkoutId: zod_1.z.string().uuid(),
+      read: zod_1.z.boolean(),
+      write: zod_1.z.boolean(),
+      execute: zod_1.z.boolean(),
+      terminal: zod_1.z.boolean(),
+      revision: zod_1.z.number().int().positive().nullable()
+    }).strict();
+    exports2.remoteGrantSchema = exports2.remoteGrantInputSchema.extend({
+      userId: zod_1.z.string(),
+      id: zod_1.z.string().uuid(),
+      revision: zod_1.z.number().int().positive()
+    });
+    exports2.remoteFrameSchema = zod_1.z.discriminatedUnion("type", [
+      zod_1.z.object({ type: zod_1.z.literal("policy"), value: zod_1.z.string().regex(/^[a-f0-9]{64}$/) }).strict(),
+      zod_1.z.object({ type: zod_1.z.literal("dial"), ticket: zod_1.z.string().uuid() }).strict(),
+      zod_1.z.object({ type: zod_1.z.literal("ping") }).strict(),
+      zod_1.z.object({ type: zod_1.z.literal("pong") }).strict(),
+      zod_1.z.object({
+        type: zod_1.z.literal("request"),
+        method: zod_1.z.string().max(10),
+        path: zod_1.z.string().max(4096),
+        headers: zod_1.z.record(zod_1.z.string().max(8192)),
+        websocket: zod_1.z.boolean()
+      }).strict(),
+      zod_1.z.object({
+        type: zod_1.z.literal("response"),
+        status: zod_1.z.number().int().min(100).max(599),
+        headers: zod_1.z.record(zod_1.z.string().max(8192))
+      }).strict(),
+      zod_1.z.object({
+        type: zod_1.z.literal("data"),
+        data: zod_1.z.string().max(constants_js_1.REMOTE_FRAME_BYTES),
+        binary: zod_1.z.boolean().optional(),
+        final: zod_1.z.boolean().optional()
+      }).strict(),
+      zod_1.z.object({ type: zod_1.z.literal("end") }).strict(),
+      zod_1.z.object({ type: zod_1.z.literal("ack") }).strict(),
+      zod_1.z.object({ type: zod_1.z.literal("cancel") }).strict(),
+      zod_1.z.object({ type: zod_1.z.literal("error"), message: zod_1.z.string().max(200) }).strict()
+    ]);
+  }
+});
+
 // packages/schema/dist/assistant/models.js
-var require_models = __commonJS({
+var require_models2 = __commonJS({
   "packages/schema/dist/assistant/models.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -4070,7 +5086,9 @@ var require_chat = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.canTransitionAgentRun = exports2.claudeSandboxRequestSchema = exports2.agentServiceRunRequestSchema = exports2.agentToolAuditSchema = exports2.agentStreamEventSchema = exports2.agentRunSchema = exports2.agentUsageSchema = exports2.assistantConversationUpdateSchema = exports2.assistantConversationConfigSchema = exports2.assistantSettingsSchema = exports2.agentToolRiskSchema = exports2.agentErrorCodeSchema = exports2.agentRunStatusSchema = void 0;
     var zod_1 = require("zod");
-    var models_js_1 = require_models();
+    var schema_js_1 = require_schema4();
+    var index_js_1 = require_attachments();
+    var models_js_1 = require_models2();
     var artifacts_js_1 = require_artifacts();
     var constants_1 = require_constants();
     var collaboration_1 = require_collaboration();
@@ -4105,6 +5123,7 @@ var require_chat = __commonJS({
       }).strict()).max(16).refine((skills) => new Set(skills.map(({ name }) => name)).size === skills.length && skills.reduce((size, skill) => size + new TextEncoder().encode(skill.instructions).length, 0) <= 128e3, "Skills exceed the session limit or repeat names")
     }).strict();
     exports2.assistantConversationConfigSchema = zod_1.z.object({
+      remoteTarget: schema_js_1.remoteTargetSchema.nullable().optional(),
       conversationId: collaboration_1.entityIdSchema,
       projectId: projectIdSchema,
       projectIds: projectIdsSchema,
@@ -4135,6 +5154,7 @@ var require_chat = __commonJS({
       modelCalls: zod_1.z.number().int().positive().max(100)
     }).strict().refine(({ inputTokens, outputTokens, totalTokens }) => inputTokens + outputTokens === totalTokens, "totalTokens must equal inputTokens plus outputTokens");
     var agentRunBaseSchema = zod_1.z.object({
+      remoteTarget: schema_js_1.remoteTargetSchema.nullable().optional(),
       id: collaboration_1.entityIdSchema,
       conversationId: collaboration_1.entityIdSchema,
       userMessageId: collaboration_1.entityIdSchema,
@@ -4267,6 +5287,7 @@ var require_chat = __commonJS({
       }
     });
     exports2.agentServiceRunRequestSchema = zod_1.z.object({
+      remoteTarget: schema_js_1.remoteTargetSchema.nullable().optional(),
       projectInstructions: zod_1.z.string().max(17e3).optional(),
       version: zod_1.z.literal(1),
       requestId: collaboration_1.entityIdSchema,
@@ -4284,8 +5305,9 @@ var require_chat = __commonJS({
       messages: zod_1.z.array(zod_1.z.object({
         id: collaboration_1.entityIdSchema,
         role: zod_1.z.enum(["user", "assistant"]),
-        content: zod_1.z.string().min(1).max(16384)
-      }).strict()).min(1).max(100),
+        content: zod_1.z.string().max(16384),
+        attachments: zod_1.z.array(index_js_1.attachmentManifestSchema).max(10).optional()
+      }).strict().refine(({ content, attachments }) => !!content.trim() || !!attachments?.length, "Message requires text or attachments")).min(1).max(100),
       limits: zod_1.z.object({
         maxOutputTokens: zod_1.z.number().int().min(1).max(32768),
         maxToolSteps: zod_1.z.number().int().min(1).max(32),
@@ -4318,6 +5340,22 @@ var require_chat = __commonJS({
   }
 });
 
+// packages/schema/dist/agent/constants.js
+var require_constants6 = __commonJS({
+  "packages/schema/dist/agent/constants.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ASSISTANT_MODEL_LIMITS = exports2.ASSISTANT_WORKERS_AI_MODEL = void 0;
+    exports2.ASSISTANT_WORKERS_AI_MODEL = "@cf/google/gemma-4-26b-a4b-it";
+    exports2.ASSISTANT_MODEL_LIMITS = {
+      inputTextBytes: 64 * 1024,
+      inputTokens: 128e3,
+      modelCalls: 8,
+      claudeBudgetUsd: 1
+    };
+  }
+});
+
 // packages/schema/dist/knowledge.js
 var require_knowledge = __commonJS({
   "packages/schema/dist/knowledge.js"(exports2) {
@@ -4364,10 +5402,11 @@ var require_architecture = __commonJS({
   "packages/schema/dist/architecture.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ArchitectureProjection = exports2.ArchitectureSeed = exports2.ArchitectureEdge = exports2.ArchitectureNode = exports2.ArchitectureScope = exports2.ArchitectureEntityKind = exports2.ArchitectureMode = void 0;
+    exports2.ArchitectureProjection = exports2.ArchitectureSeed = exports2.ArchitectureEdge = exports2.ArchitectureNode = exports2.ArchitectureScope = exports2.ArchitectureEntityKind = exports2.ArchitectureLevel = exports2.ArchitectureMode = void 0;
     var zod_1 = require("zod");
     var architectureId = zod_1.z.string().min(1).max(1024);
     exports2.ArchitectureMode = zod_1.z.enum(["inclusive", "exclusive"]);
+    exports2.ArchitectureLevel = zod_1.z.enum(["system", "components", "overview", "implementation"]);
     exports2.ArchitectureEntityKind = zod_1.z.enum([
       "repository",
       "package",
@@ -4394,7 +5433,8 @@ var require_architecture = __commonJS({
       status: zod_1.z.enum(["available", "unavailable", "reference", "boundary"]),
       scope: exports2.ArchitectureScope,
       ownerIds: zod_1.z.array(architectureId).max(100),
-      boundaryOf: architectureId.optional()
+      boundaryOf: architectureId.optional(),
+      source: zod_1.z.object({ projectId: architectureId, path: zod_1.z.string().min(1).max(1024) }).strict().optional()
     }).strict();
     exports2.ArchitectureEdge = zod_1.z.object({
       id: architectureId,
@@ -4427,6 +5467,15 @@ var require_architecture = __commonJS({
       architectureId,
       name: zod_1.z.string().min(1).max(240),
       truncated: zod_1.z.boolean(),
+      summary: zod_1.z.object({
+        nodeCount: zod_1.z.number().int().nonnegative(),
+        edgeCount: zod_1.z.number().int().nonnegative(),
+        omittedNodes: zod_1.z.number().int().nonnegative(),
+        omittedEdges: zod_1.z.number().int().nonnegative(),
+        hiddenByView: zod_1.z.number().int().nonnegative(),
+        matchedNodes: zod_1.z.number().int().nonnegative().optional()
+      }).strict().optional(),
+      matches: zod_1.z.array(architectureId).max(5e3).optional(),
       diagnostics: zod_1.z.array(zod_1.z.object({
         code: zod_1.z.string().min(1).max(120),
         message: zod_1.z.string().min(1).max(512)
@@ -4435,6 +5484,101 @@ var require_architecture = __commonJS({
   }
 });
 
+// packages/schema/dist/architecture/draft.js
+var require_draft = __commonJS({
+  "packages/schema/dist/architecture/draft.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ApplyArchitectureDraft = exports2.ArchitectureDraftReview = exports2.SaveArchitectureDraft = exports2.ArchitectureDraftResult = exports2.ArchitectureDraft = exports2.ArchitectureDraftItem = void 0;
+    var zod_1 = require("zod");
+    var architecture_js_1 = require_architecture();
+    var draftId = zod_1.z.string().regex(/^draft:[a-zA-Z0-9_-]+$/).max(100);
+    var revision = zod_1.z.string().regex(/^[a-f0-9]{64}$/);
+    exports2.ArchitectureDraftItem = zod_1.z.object({
+      id: draftId,
+      type: zod_1.z.enum(["component", "group", "note"]),
+      kind: architecture_js_1.ArchitectureEntityKind.exclude(["repository", "boundary"]),
+      label: zod_1.z.string().trim().min(1).max(120),
+      description: zod_1.z.string().max(2e3),
+      groupId: draftId.optional(),
+      creation: zod_1.z.object({
+        template: zod_1.z.enum(["project", "package", "workflow", "data-table"]),
+        path: zod_1.z.string().min(1).max(512).regex(/^(?:[a-zA-Z0-9_-]+\/)*[a-zA-Z0-9_-]+$/).optional(),
+        projectId: zod_1.z.string().min(1).max(512).optional(),
+        packageName: zod_1.z.string().regex(/^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/).max(214).optional()
+      }).strict().optional(),
+      implementation: zod_1.z.string().max(512).optional(),
+      position: zod_1.z.object({ x: zod_1.z.number().finite().min(-1e5).max(1e5), y: zod_1.z.number().finite().min(-1e5).max(1e5) }).strict().optional()
+    }).strict();
+    exports2.ArchitectureDraft = zod_1.z.object({
+      version: zod_1.z.literal(1),
+      name: zod_1.z.string().trim().min(1).max(120),
+      baseRevision: revision,
+      items: zod_1.z.array(exports2.ArchitectureDraftItem).max(200),
+      connections: zod_1.z.array(architecture_js_1.ArchitectureEdge.pick({ from: true, to: true, relation: true }).extend({ id: draftId }).strict()).max(500)
+    }).strict();
+    exports2.ArchitectureDraftResult = zod_1.z.object({ draft: exports2.ArchitectureDraft.nullable(), revision: revision.nullable(), pendingToken: revision.optional() }).strict();
+    exports2.SaveArchitectureDraft = zod_1.z.object({ draft: exports2.ArchitectureDraft, revision: revision.nullable() }).strict();
+    exports2.ArchitectureDraftReview = zod_1.z.object({
+      token: revision,
+      currentRevision: revision,
+      baseChanged: zod_1.z.boolean(),
+      applicableConnections: zod_1.z.array(zod_1.z.string()),
+      plannedItems: zod_1.z.number().int().nonnegative(),
+      plannedConnections: zod_1.z.number().int().nonnegative(),
+      issues: zod_1.z.array(zod_1.z.object({
+        code: zod_1.z.enum([
+          "duplicate_id",
+          "missing_endpoint",
+          "invalid_group",
+          "self_dependency",
+          "cycle",
+          "partial_projection",
+          "unavailable_project",
+          "invalid_creation",
+          "creation_conflict"
+        ]),
+        entityId: zod_1.z.string().optional()
+      }).strict()),
+      changes: zod_1.z.array(zod_1.z.object({ projectId: zod_1.z.string(), path: zod_1.z.string(), before: zod_1.z.string(), after: zod_1.z.string() }).strict()),
+      resources: zod_1.z.array(zod_1.z.object({
+        itemId: draftId,
+        template: zod_1.z.enum(["workflow", "data-table"]),
+        projectId: zod_1.z.string(),
+        id: zod_1.z.string(),
+        name: zod_1.z.string(),
+        description: zod_1.z.string()
+      }).strict()).default([])
+    }).strict();
+    exports2.ApplyArchitectureDraft = zod_1.z.object({ token: revision, cancel: zod_1.z.boolean().optional() }).strict();
+  }
+});
+
+// packages/schema/dist/architecture/index.js
+var require_architecture2 = __commonJS({
+  "packages/schema/dist/architecture/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    __exportStar(require_draft(), exports2);
+  }
+});
+
 // packages/schema/dist/repository/registry.js
 var require_registry = __commonJS({
   "packages/schema/dist/repository/registry.js"(exports2) {
@@ -5312,7 +6456,7 @@ var require_definitions = __commonJS({
 });
 
 // packages/schema/dist/json/schema.js
-var require_schema2 = __commonJS({
+var require_schema5 = __commonJS({
   "packages/schema/dist/json/schema.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -11997,52 +13141,792 @@ var require_settings = __commonJS({
             });
           }
         }
-        view.canvas?.collapseLayers?.forEach((layerId, index) => {
-          if (!Object.hasOwn(settings.layers ?? {}, layerId))
-            ctx.addIssue({
-              code: "custom",
-              path: ["views", viewId, "canvas", "collapseLayers", index],
-              message: `unknown layer "${layerId}"`
-            });
-        });
+        view.canvas?.collapseLayers?.forEach((layerId, index) => {
+          if (!Object.hasOwn(settings.layers ?? {}, layerId))
+            ctx.addIssue({
+              code: "custom",
+              path: ["views", viewId, "canvas", "collapseLayers", index],
+              message: `unknown layer "${layerId}"`
+            });
+        });
+      }
+    });
+  }
+});
+
+// packages/schema/dist/access/tokens.js
+var require_tokens = __commonJS({
+  "packages/schema/dist/access/tokens.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.accessTokenUpdateSchema = exports2.accessTokenCreateSchema = exports2.accessTokenOriginSchema = exports2.accessTokenListQuerySchema = void 0;
+    var zod_1 = require("zod");
+    var constants_1 = require_constants();
+    exports2.accessTokenListQuerySchema = zod_1.z.object({
+      type: zod_1.z.enum(["personal", "service", "public"]).optional(),
+      search: zod_1.z.string().trim().max(200).default(""),
+      sort: zod_1.z.enum(["name", "createdAt", "lastUsedAt"]).default("createdAt"),
+      order: zod_1.z.enum(["asc", "desc"]).default("desc"),
+      limit: zod_1.z.coerce.number().int().min(1).max(100).default(25),
+      offset: zod_1.z.coerce.number().int().min(0).max(1e6).default(0)
+    });
+    exports2.accessTokenOriginSchema = zod_1.z.string().max(2048).refine((value) => {
+      try {
+        const url = new URL(value);
+        return url.protocol === "https:" && url.origin === value && !url.hostname.includes("*");
+      } catch {
+        return false;
+      }
+    }, "Expected an exact HTTPS origin");
+    exports2.accessTokenCreateSchema = zod_1.z.object({
+      name: zod_1.z.string().trim().min(1).max(128),
+      type: zod_1.z.enum(["personal", "service", "public"]).default("personal"),
+      workspaceId: zod_1.z.string().regex(/^(user|org|team):[^:]+$/).max(256).optional(),
+      scopes: zod_1.z.array(zod_1.z.enum(["*", ...constants_1.WORKSPACE_ACTIONS])).min(1).max(constants_1.WORKSPACE_ACTIONS.length).optional(),
+      allowedOrigins: zod_1.z.array(exports2.accessTokenOriginSchema).max(32).optional(),
+      expiresAt: zod_1.z.string().datetime().optional()
+    }).strict();
+    exports2.accessTokenUpdateSchema = exports2.accessTokenCreateSchema.pick({ name: true, scopes: true, allowedOrigins: true }).partial().strict();
+  }
+});
+
+// packages/schema/dist/access/constants.js
+var require_constants7 = __commonJS({
+  "packages/schema/dist/access/constants.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ACCESS_INSPECTION_RESOURCES = exports2.ACCESS_RUN_ACTIONS = exports2.ACCESS_RUN_FEATURES = exports2.OWNER_RECOVERY_ACTIONS = exports2.ACTION_FEATURE = exports2.ACCESS_FEATURE_METERS = exports2.ACCESS_METER_UNITS = exports2.ACCESS_PROFILE_TEMPLATES = exports2.ACCESS_ENFORCED_METERS = exports2.LEGACY_WILDCARD_ACTIONS = exports2.NON_DELEGABLE_ACTIONS = exports2.MAX_CREDENTIAL_LIFETIME_SECONDS = exports2.ACCESS_CAPACITY_METERS = exports2.ACCESS_TOKEN_TYPES = exports2.ACCESS_METERS = exports2.ACCESS_FEATURES = exports2.ACCESS_TIERS = void 0;
+    exports2.ACCESS_TIERS = ["free", "pro", "max", "legacy"];
+    exports2.ACCESS_FEATURES = [
+      "projects",
+      "workflows",
+      "otto",
+      "apps",
+      "tasks",
+      "data",
+      "api_tokens",
+      "remote",
+      "members",
+      "teams",
+      "plugins",
+      "social",
+      "reviews",
+      "github",
+      "agents",
+      "billing",
+      "integrations",
+      "design",
+      "previews",
+      "terminal",
+      "content",
+      "administration"
+    ];
+    exports2.ACCESS_METERS = [
+      "executions",
+      "ai_credits",
+      "apps",
+      "api_tokens",
+      "tasks",
+      "data_rows",
+      "storage_bytes",
+      "remote_hosts",
+      "concurrent_runs"
+    ];
+    exports2.ACCESS_TOKEN_TYPES = ["personal", "service", "public", "agent", "assistant"];
+    exports2.ACCESS_CAPACITY_METERS = ["tasks", "data_rows", "storage_bytes", "concurrent_runs"];
+    exports2.MAX_CREDENTIAL_LIFETIME_SECONDS = 31536e4;
+    exports2.NON_DELEGABLE_ACTIONS = [
+      "tokens:create",
+      "tokens:delegate",
+      "tokens:manage",
+      "agents:manage",
+      "policy:read",
+      "policy:manage",
+      "usage:manage",
+      "org:settings",
+      "members:invite",
+      "members:manage",
+      "teams:manage",
+      "billing:read",
+      "billing:manage",
+      "workspace:delete"
+    ];
+    exports2.LEGACY_WILDCARD_ACTIONS = [
+      "projects:read",
+      "projects:write",
+      "workflows:run",
+      "data:read",
+      "data:write",
+      "tables:manage",
+      "members:invite",
+      "members:manage",
+      "teams:manage",
+      "plugins:publish",
+      "plugins:install",
+      "org:settings",
+      "social:read",
+      "social:write",
+      "social:moderate",
+      "tasks:read",
+      "tasks:write",
+      "tasks:manage",
+      "reviews:write",
+      "github:connect",
+      "github:publish",
+      "agents:manage",
+      "billing:read",
+      "billing:manage",
+      "integrations:read",
+      "integrations:manage",
+      "design:read",
+      "design:review",
+      "previews:read",
+      "previews:manage",
+      "terminal:use",
+      "workflow-agents:run",
+      "workflow-agents:manage",
+      "agent-operations:read",
+      "agent-operations:manage",
+      "data:export",
+      "data:restore",
+      "workspace:delete",
+      "content:read",
+      "content:write",
+      "content:publish",
+      "content:moderate",
+      "apps:read",
+      "apps:use"
+    ];
+    exports2.ACCESS_ENFORCED_METERS = [
+      "executions",
+      "ai_credits",
+      "apps",
+      "api_tokens",
+      "remote_hosts",
+      "tasks",
+      "data_rows",
+      "storage_bytes",
+      "concurrent_runs"
+    ];
+    exports2.ACCESS_PROFILE_TEMPLATES = [
+      {
+        version: 1,
+        tier: "free",
+        policy: {
+          deniedFeatures: ["remote"],
+          deniedActions: [],
+          limits: { apps: 1, api_tokens: 2, remote_hosts: 0 },
+          credentials: { deniedTypes: ["service", "public"], deniedScopes: [], maxLifetimeSeconds: 2592e3 }
+        }
+      },
+      {
+        version: 1,
+        tier: "pro",
+        policy: {
+          deniedFeatures: ["remote"],
+          deniedActions: [],
+          limits: { apps: 10, api_tokens: 20, remote_hosts: 0 },
+          credentials: { deniedTypes: ["public"], deniedScopes: [], maxLifetimeSeconds: 7776e3 }
+        }
+      },
+      {
+        version: 1,
+        tier: "max",
+        policy: {
+          deniedFeatures: [],
+          deniedActions: [],
+          limits: { apps: 50, api_tokens: 100, remote_hosts: 3 },
+          credentials: { deniedTypes: ["public"], deniedScopes: [], maxLifetimeSeconds: 7776e3 }
+        }
+      }
+    ];
+    exports2.ACCESS_METER_UNITS = {
+      executions: "per_month",
+      ai_credits: "per_month",
+      apps: "resident",
+      api_tokens: "resident",
+      tasks: "resident",
+      data_rows: "resident",
+      storage_bytes: "bytes",
+      remote_hosts: "resident",
+      concurrent_runs: "concurrent"
+    };
+    exports2.ACCESS_FEATURE_METERS = {
+      projects: [],
+      workflows: ["executions", "concurrent_runs"],
+      otto: ["ai_credits", "concurrent_runs"],
+      apps: ["apps"],
+      tasks: ["tasks"],
+      data: ["data_rows", "storage_bytes"],
+      api_tokens: ["api_tokens"],
+      remote: ["remote_hosts", "concurrent_runs"],
+      members: [],
+      teams: [],
+      plugins: [],
+      social: ["storage_bytes"],
+      reviews: [],
+      github: [],
+      agents: ["api_tokens"],
+      billing: [],
+      integrations: [],
+      design: [],
+      previews: [],
+      terminal: ["concurrent_runs"],
+      content: [],
+      administration: []
+    };
+    exports2.ACTION_FEATURE = {
+      "projects:read": "projects",
+      "projects:write": "projects",
+      "workflows:run": "workflows",
+      "data:read": "data",
+      "data:write": "data",
+      "tables:manage": "data",
+      "members:invite": "members",
+      "members:manage": "members",
+      "teams:manage": "teams",
+      "plugins:publish": "plugins",
+      "plugins:install": "plugins",
+      "org:settings": "administration",
+      "social:read": "social",
+      "social:write": "social",
+      "social:moderate": "social",
+      "tasks:read": "tasks",
+      "tasks:write": "tasks",
+      "tasks:manage": "tasks",
+      "reviews:write": "reviews",
+      "github:connect": "github",
+      "github:publish": "github",
+      "agents:manage": "agents",
+      "billing:read": "billing",
+      "billing:manage": "billing",
+      "integrations:read": "integrations",
+      "integrations:manage": "integrations",
+      "design:read": "design",
+      "design:review": "design",
+      "previews:read": "previews",
+      "previews:manage": "previews",
+      "terminal:use": "terminal",
+      "workflow-agents:run": "otto",
+      "workflow-agents:manage": "otto",
+      "agent-operations:read": "otto",
+      "agent-operations:manage": "otto",
+      "data:export": "data",
+      "data:restore": "data",
+      "workspace:delete": null,
+      "content:read": "content",
+      "content:write": "content",
+      "content:publish": "content",
+      "content:moderate": "content",
+      "apps:read": "apps",
+      "apps:use": "apps",
+      "apps:manage": "apps",
+      "tokens:create": "api_tokens",
+      "tokens:use": "api_tokens",
+      "tokens:delegate": "api_tokens",
+      "tokens:manage": null,
+      "policy:read": "administration",
+      "policy:manage": "administration",
+      "usage:read": "administration",
+      "usage:manage": "administration",
+      "remote:enroll": "remote",
+      "remote:connect": "remote",
+      "remote:execute": "remote",
+      "remote:manage": null
+    };
+    exports2.OWNER_RECOVERY_ACTIONS = [
+      "policy:read",
+      "policy:manage",
+      "usage:read",
+      "usage:manage",
+      "tokens:manage",
+      "agents:manage",
+      "members:manage",
+      "billing:read",
+      "billing:manage",
+      "org:settings",
+      "workspace:delete",
+      "remote:manage"
+    ];
+    exports2.ACCESS_RUN_FEATURES = ["workflows", "otto", "remote", "terminal"];
+    exports2.ACCESS_RUN_ACTIONS = {
+      workflows: "workflows:run",
+      otto: "workflow-agents:run",
+      remote: "remote:execute",
+      terminal: "terminal:use"
+    };
+    exports2.ACCESS_INSPECTION_RESOURCES = ["project", "table", "app", "task", "remote_host"];
+  }
+});
+
+// packages/schema/dist/access/policy.js
+var require_policy = __commonJS({
+  "packages/schema/dist/access/policy.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.accessCredentialRevokeSchema = exports2.accessCredentialsSchema = exports2.accessCredentialSchema = exports2.accessCredentialsQuerySchema = exports2.accessUsageSchema = exports2.accessScopesSchema = exports2.accessScopesQuerySchema = exports2.accessCatalogSchema = exports2.accessPolicyHistorySchema = exports2.accessImpactResultSchema = exports2.accessImpactSchema = exports2.accessInspectionResultSchema = exports2.accessInspectionSchema = exports2.accessCredentialRefSchema = exports2.accessEffectiveQuerySchema = exports2.accessPolicyQuerySchema = exports2.effectiveAccessSchema = exports2.accessDecisionSchema = exports2.accessReasonSchema = exports2.accessPolicyHeadSchema = exports2.accessPolicyRecordSchema = exports2.accessPolicyWriteSchema = exports2.accessPolicyTargetSchema = exports2.accessProfileSchema = exports2.accessPolicySchema = exports2.credentialPolicySchema = exports2.accessLimitsSchema = exports2.accessLimitSchema = exports2.accessMeterSchema = exports2.accessFeatureSchema = void 0;
+    var constants_js_1 = require_constants7();
+    var zod_1 = require("zod");
+    var constants_js_2 = require_constants();
+    var constants_js_3 = require_constants7();
+    exports2.accessFeatureSchema = zod_1.z.enum(constants_js_3.ACCESS_FEATURES);
+    exports2.accessMeterSchema = zod_1.z.enum(constants_js_3.ACCESS_METERS);
+    exports2.accessLimitSchema = zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).nullable();
+    exports2.accessLimitsSchema = zod_1.z.object({
+      executions: exports2.accessLimitSchema.optional(),
+      ai_credits: exports2.accessLimitSchema.optional(),
+      apps: exports2.accessLimitSchema.optional(),
+      api_tokens: exports2.accessLimitSchema.optional(),
+      tasks: exports2.accessLimitSchema.optional(),
+      data_rows: exports2.accessLimitSchema.optional(),
+      storage_bytes: exports2.accessLimitSchema.optional(),
+      remote_hosts: exports2.accessLimitSchema.optional(),
+      concurrent_runs: exports2.accessLimitSchema.optional()
+    }).strict().superRefine((limits, ctx) => {
+      for (const meter of constants_js_3.ACCESS_METERS)
+        if (typeof limits[meter] === "number" && !constants_js_3.ACCESS_ENFORCED_METERS.includes(meter))
+          ctx.addIssue({ code: "custom", path: [meter], message: "This meter is not available for hard limits yet" });
+    });
+    exports2.credentialPolicySchema = zod_1.z.object({
+      deniedTypes: zod_1.z.array(zod_1.z.enum(constants_js_3.ACCESS_TOKEN_TYPES)).max(constants_js_3.ACCESS_TOKEN_TYPES.length).default([]),
+      deniedScopes: zod_1.z.array(zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS)).max(constants_js_2.WORKSPACE_ACTIONS.length).default([]),
+      maxLifetimeSeconds: zod_1.z.number().int().positive().max(constants_js_3.MAX_CREDENTIAL_LIFETIME_SECONDS).nullable().default(null)
+    }).strict();
+    exports2.accessPolicySchema = zod_1.z.object({
+      deniedFeatures: zod_1.z.array(exports2.accessFeatureSchema).max(constants_js_3.ACCESS_FEATURES.length).default([]),
+      deniedActions: zod_1.z.array(zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS)).max(constants_js_2.WORKSPACE_ACTIONS.length).default([]),
+      limits: exports2.accessLimitsSchema.default({}),
+      credentials: exports2.credentialPolicySchema.default({})
+    }).strict();
+    exports2.accessProfileSchema = zod_1.z.object({
+      version: zod_1.z.literal(1),
+      tier: zod_1.z.enum(constants_js_3.ACCESS_TIERS),
+      policy: exports2.accessPolicySchema
+    }).strict();
+    exports2.accessPolicyTargetSchema = zod_1.z.object({
+      kind: zod_1.z.enum(["platform", "tier", "user", "org", "team"]),
+      id: zod_1.z.string().min(1).max(128),
+      memberId: zod_1.z.string().min(1).max(128).nullable().default(null)
+    }).strict().superRefine((target, ctx) => {
+      if (target.kind === "platform" && (target.id !== "platform" || target.memberId))
+        ctx.addIssue({ code: "custom", message: "Platform policies have a single platform target" });
+      if (target.kind === "tier" && (!constants_js_3.ACCESS_TIERS.some((tier) => tier === target.id) || target.memberId))
+        ctx.addIssue({ code: "custom", message: "Tier policies require a known tier and no member" });
+      if (target.kind === "user" && target.memberId)
+        ctx.addIssue({ code: "custom", message: "Personal policies cannot target another member" });
+    });
+    exports2.accessPolicyWriteSchema = zod_1.z.object({
+      target: exports2.accessPolicyTargetSchema,
+      revision: zod_1.z.number().int().nonnegative(),
+      policy: exports2.accessPolicySchema,
+      reason: zod_1.z.string().trim().min(3).max(1e3)
+    }).strict();
+    exports2.accessPolicyRecordSchema = exports2.accessPolicyWriteSchema.extend({
+      updatedBy: zod_1.z.string(),
+      updatedAt: zod_1.z.number().int().nonnegative()
+    });
+    var accessPolicyHeadBaseSchema = exports2.accessPolicyRecordSchema.extend({
+      canManage: zod_1.z.boolean(),
+      canManageCredentials: zod_1.z.boolean(),
+      canReadUsage: zod_1.z.boolean(),
+      canManageUsage: zod_1.z.boolean()
+    });
+    exports2.accessPolicyHeadSchema = zod_1.z.union([
+      accessPolicyHeadBaseSchema.extend({ revision: zod_1.z.number().int().positive() }),
+      accessPolicyHeadBaseSchema.extend({
+        revision: zod_1.z.literal(0),
+        reason: zod_1.z.literal(""),
+        updatedBy: zod_1.z.literal(""),
+        updatedAt: zod_1.z.literal(0)
+      })
+    ]);
+    exports2.accessReasonSchema = zod_1.z.enum([
+      "allowed",
+      "role_denied",
+      "plan_denied",
+      "policy_denied",
+      "credential_denied",
+      "resource_denied",
+      "not_released"
+    ]);
+    exports2.accessDecisionSchema = zod_1.z.object({
+      action: zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS),
+      allowed: zod_1.z.boolean(),
+      reason: exports2.accessReasonSchema,
+      source: zod_1.z.string().nullable()
+    });
+    exports2.effectiveAccessSchema = zod_1.z.object({
+      workspace: zod_1.z.object({ kind: zod_1.z.enum(["user", "org", "team"]), id: zod_1.z.string() }),
+      tier: zod_1.z.enum(constants_js_3.ACCESS_TIERS),
+      fundingWorkspace: zod_1.z.object({ kind: zod_1.z.enum(["user", "org", "team"]), id: zod_1.z.string() }),
+      decisions: zod_1.z.array(exports2.accessDecisionSchema),
+      deniedFeatures: zod_1.z.array(exports2.accessFeatureSchema).default([]),
+      limits: exports2.accessLimitsSchema,
+      credentials: exports2.credentialPolicySchema,
+      revisions: zod_1.z.array(zod_1.z.object({ source: zod_1.z.string(), revision: zod_1.z.number().int().nonnegative() }))
+    });
+    exports2.accessPolicyQuerySchema = zod_1.z.object({
+      kind: zod_1.z.enum(["platform", "tier", "user", "org", "team"]),
+      id: zod_1.z.string().min(1).max(128),
+      memberId: zod_1.z.string().min(1).max(128).optional(),
+      before: zod_1.z.coerce.number().int().positive().default(Number.MAX_SAFE_INTEGER),
+      limit: zod_1.z.coerce.number().int().min(1).max(100).default(25)
+    });
+    exports2.accessEffectiveQuerySchema = zod_1.z.object({
+      workspace: zod_1.z.string().regex(/^(user|org|team):[^:]+$/).max(256)
+    });
+    exports2.accessCredentialRefSchema = zod_1.z.object({ store: zod_1.z.enum(["api", "agent"]), id: zod_1.z.string().min(1).max(128) }).strict();
+    exports2.accessInspectionSchema = zod_1.z.object({
+      workspace: zod_1.z.object({ kind: zod_1.z.enum(["user", "org", "team"]), id: zod_1.z.string().min(1).max(128) }),
+      userId: zod_1.z.string().min(1).max(128),
+      draft: exports2.accessPolicyWriteSchema.optional(),
+      credential: exports2.accessCredentialRefSchema.optional(),
+      projectId: zod_1.z.string().min(1).max(128).optional(),
+      resource: zod_1.z.object({ kind: zod_1.z.enum(constants_js_1.ACCESS_INSPECTION_RESOURCES), id: zod_1.z.string().min(1).max(128) }).strict().optional()
+    }).strict();
+    exports2.accessInspectionResultSchema = zod_1.z.object({
+      current: exports2.effectiveAccessSchema,
+      proposed: exports2.effectiveAccessSchema,
+      changedActions: zod_1.z.array(zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS)),
+      changedFeatures: zod_1.z.array(exports2.accessFeatureSchema).default([]),
+      changedLimits: zod_1.z.array(exports2.accessMeterSchema).default([]),
+      credentialsChanged: zod_1.z.boolean().default(false),
+      resource: zod_1.z.object({
+        kind: zod_1.z.enum(constants_js_1.ACCESS_INSPECTION_RESOURCES),
+        id: zod_1.z.string(),
+        projectId: zod_1.z.string().nullable(),
+        deniedActions: zod_1.z.array(zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS)).default([])
+      }).nullable().default(null)
+    });
+    exports2.accessImpactSchema = exports2.accessInspectionSchema.omit({ userId: true, credential: true }).extend({
+      draft: exports2.accessPolicyWriteSchema,
+      cursor: zod_1.z.string().max(500).optional(),
+      limit: zod_1.z.number().int().min(1).max(25).default(10)
+    });
+    exports2.accessImpactResultSchema = zod_1.z.object({
+      items: zod_1.z.array(zod_1.z.object({
+        workspace: exports2.accessInspectionSchema.shape.workspace,
+        userId: zod_1.z.string(),
+        changedActions: zod_1.z.array(zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS)),
+        changedFeatures: zod_1.z.array(exports2.accessFeatureSchema),
+        changedLimits: zod_1.z.array(exports2.accessMeterSchema),
+        credentialsChanged: zod_1.z.boolean()
+      })),
+      scanned: zod_1.z.number().int().nonnegative(),
+      nextCursor: zod_1.z.string().nullable()
+    });
+    exports2.accessPolicyHistorySchema = zod_1.z.object({
+      items: zod_1.z.array(exports2.accessPolicyRecordSchema),
+      nextCursor: zod_1.z.number().nullable()
+    });
+    exports2.accessCatalogSchema = zod_1.z.object({
+      features: zod_1.z.array(exports2.accessFeatureSchema),
+      actions: zod_1.z.array(zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS)),
+      meters: zod_1.z.array(zod_1.z.object({
+        key: exports2.accessMeterSchema,
+        unit: zod_1.z.enum(["per_month", "resident", "bytes", "concurrent"]),
+        enforced: zod_1.z.boolean()
+      })),
+      tokenTypes: zod_1.z.array(zod_1.z.enum(constants_js_3.ACCESS_TOKEN_TYPES)),
+      templates: zod_1.z.array(exports2.accessProfileSchema)
+    });
+    exports2.accessScopesQuerySchema = zod_1.z.object({
+      kind: zod_1.z.enum(["platform", "user", "org", "team"]),
+      id: zod_1.z.string().min(1).max(128),
+      search: zod_1.z.string().max(100).default(""),
+      cursor: zod_1.z.string().max(400).optional(),
+      limit: zod_1.z.coerce.number().int().min(1).max(100).default(25)
+    });
+    exports2.accessScopesSchema = zod_1.z.object({
+      items: zod_1.z.array(zod_1.z.object({ target: exports2.accessPolicyTargetSchema, name: zod_1.z.string(), role: zod_1.z.string().nullable() })),
+      nextCursor: zod_1.z.string().nullable()
+    });
+    exports2.accessUsageSchema = zod_1.z.object({
+      target: exports2.accessPolicyTargetSchema,
+      periodStart: zod_1.z.number(),
+      periodEnd: zod_1.z.number(),
+      meters: zod_1.z.array(zod_1.z.object({
+        key: exports2.accessMeterSchema,
+        used: zod_1.z.number().nonnegative().nullable(),
+        limit: exports2.accessLimitSchema,
+        source: zod_1.z.string(),
+        unit: zod_1.z.enum(["per_month", "resident", "bytes", "concurrent"])
+      }))
+    });
+    exports2.accessCredentialsQuerySchema = exports2.accessScopesQuerySchema.extend({
+      memberId: zod_1.z.string().min(1).max(128).optional(),
+      type: zod_1.z.enum(constants_js_3.ACCESS_TOKEN_TYPES).optional(),
+      status: zod_1.z.enum(["active", "expired", "revoked", "all"]).default("active")
+    });
+    exports2.accessCredentialSchema = exports2.accessCredentialRefSchema.extend({
+      ownerId: zod_1.z.string(),
+      name: zod_1.z.string(),
+      type: zod_1.z.enum(constants_js_3.ACCESS_TOKEN_TYPES),
+      prefix: zod_1.z.string(),
+      workspace: zod_1.z.string(),
+      projectId: zod_1.z.string().nullable(),
+      scopes: zod_1.z.array(zod_1.z.string()),
+      createdAt: zod_1.z.number(),
+      expiresAt: zod_1.z.number().nullable(),
+      lastUsedAt: zod_1.z.number().nullable(),
+      revokedAt: zod_1.z.number().nullable()
+    });
+    exports2.accessCredentialsSchema = zod_1.z.object({
+      items: zod_1.z.array(exports2.accessCredentialSchema),
+      nextCursor: zod_1.z.string().nullable()
+    });
+    exports2.accessCredentialRevokeSchema = exports2.accessCredentialRefSchema.extend({ reason: zod_1.z.string().trim().min(3).max(1e3) }).strict();
+  }
+});
+
+// packages/schema/dist/access/types.js
+var require_types3 = __commonJS({
+  "packages/schema/dist/access/types.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+  }
+});
+
+// packages/schema/dist/access/resolve.js
+var require_resolve = __commonJS({
+  "packages/schema/dist/access/resolve.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.resolveAccess = resolveAccess;
+    var constants_js_1 = require_constants();
+    var constants_js_2 = require_constants7();
+    function resolveAccess(input) {
+      const limits = {};
+      let credentials = { deniedTypes: [], deniedScopes: [], maxLifetimeSeconds: null };
+      for (const source of input.sources) {
+        for (const meter of constants_js_2.ACCESS_METERS) {
+          const next2 = source.policy.limits[meter];
+          if (next2 === void 0)
+            continue;
+          const previous = limits[meter];
+          limits[meter] = next2 === null ? previous ?? null : previous == null ? next2 : Math.min(previous, next2);
+        }
+        const next = source.policy.credentials;
+        credentials = {
+          deniedTypes: [.../* @__PURE__ */ new Set([...credentials.deniedTypes, ...next.deniedTypes])],
+          deniedScopes: [.../* @__PURE__ */ new Set([...credentials.deniedScopes, ...next.deniedScopes])],
+          maxLifetimeSeconds: next.maxLifetimeSeconds === null ? credentials.maxLifetimeSeconds : credentials.maxLifetimeSeconds === null ? next.maxLifetimeSeconds : Math.min(credentials.maxLifetimeSeconds, next.maxLifetimeSeconds)
+        };
       }
-    });
+      const decisions = constants_js_1.WORKSPACE_ACTIONS.map((action) => {
+        if (!input.permissions[action])
+          return { action, allowed: false, reason: "role_denied", source: "role" };
+        const feature = constants_js_2.ACTION_FEATURE[action];
+        if (feature === "remote" && !input.remoteReady)
+          return { action, allowed: false, reason: "not_released", source: "deployment" };
+        for (const source of input.sources) {
+          if (input.owner && source.source !== "platform" && constants_js_2.OWNER_RECOVERY_ACTIONS.includes(action))
+            continue;
+          if (source.policy.deniedActions.includes(action) || feature && source.policy.deniedFeatures.includes(feature))
+            return {
+              action,
+              allowed: false,
+              reason: source.source === "plan" ? "plan_denied" : "policy_denied",
+              source: source.source
+            };
+        }
+        return { action, allowed: true, reason: "allowed", source: null };
+      });
+      return {
+        decisions,
+        limits,
+        credentials,
+        deniedFeatures: [...new Set(input.sources.flatMap((source) => source.policy.deniedFeatures))]
+      };
+    }
   }
 });
 
-// packages/schema/dist/access/tokens.js
-var require_tokens = __commonJS({
-  "packages/schema/dist/access/tokens.js"(exports2) {
+// packages/schema/dist/access/capacity.js
+var require_capacity = __commonJS({
+  "packages/schema/dist/access/capacity.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.accessTokenUpdateSchema = exports2.accessTokenCreateSchema = exports2.accessTokenOriginSchema = exports2.accessTokenListQuerySchema = void 0;
+    exports2.accessRunReservationSchema = exports2.capacityResponseSchema = exports2.capacityRequestSchema = exports2.capacityPrincipalSchema = exports2.capacityClaimSchema = exports2.capacityOwnerSchema = exports2.capacityUsageSchema = exports2.capacityQuantitiesSchema = void 0;
+    var constants_js_1 = require_constants7();
     var zod_1 = require("zod");
-    var constants_1 = require_constants();
-    exports2.accessTokenListQuerySchema = zod_1.z.object({
-      type: zod_1.z.enum(["personal", "service", "public"]).optional(),
-      search: zod_1.z.string().trim().max(200).default(""),
-      sort: zod_1.z.enum(["name", "createdAt", "lastUsedAt"]).default("createdAt"),
-      order: zod_1.z.enum(["asc", "desc"]).default("desc"),
-      limit: zod_1.z.coerce.number().int().min(1).max(100).default(25),
-      offset: zod_1.z.coerce.number().int().min(0).max(1e6).default(0)
+    var collaboration_js_1 = require_collaboration();
+    var constants_js_2 = require_constants();
+    exports2.capacityQuantitiesSchema = zod_1.z.object({
+      tasks: zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).default(0),
+      data_rows: zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).default(0),
+      storage_bytes: zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).default(0),
+      concurrent_runs: zod_1.z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).default(0)
+    }).strict();
+    exports2.capacityUsageSchema = zod_1.z.record(zod_1.z.string().max(128), exports2.capacityQuantitiesSchema);
+    exports2.capacityOwnerSchema = zod_1.z.object({
+      id: zod_1.z.string().min(1).max(256),
+      workspace: zod_1.z.object({ kind: zod_1.z.enum(["user", "org", "team"]), id: zod_1.z.string().min(1).max(128) }),
+      category: zod_1.z.enum(["tasks", "tables", "attachments", "runs"]),
+      revision: zod_1.z.number().int().nonnegative(),
+      usage: exports2.capacityUsageSchema
+    }).strict();
+    exports2.capacityClaimSchema = zod_1.z.object({
+      owner: exports2.capacityOwnerSchema,
+      projectId: zod_1.z.string().min(1).max(128).optional(),
+      operationId: zod_1.z.string().uuid(),
+      proposed: exports2.capacityUsageSchema
+    }).strict();
+    exports2.capacityPrincipalSchema = zod_1.z.discriminatedUnion("kind", [
+      zod_1.z.object({ kind: zod_1.z.literal("user"), userId: zod_1.z.string().min(1).max(128), apiTokenId: zod_1.z.string().max(128).optional() }),
+      zod_1.z.object({
+        kind: zod_1.z.literal("agent"),
+        agentId: zod_1.z.string().min(1).max(128),
+        apiTokenOwnerId: zod_1.z.string().max(128).optional(),
+        workspace: collaboration_js_1.workspaceRefSchema,
+        projectId: zod_1.z.string().max(128).nullable(),
+        scopes: zod_1.z.array(collaboration_js_1.agentScopeSchema).max(constants_js_2.WORKSPACE_ACTIONS.length)
+      })
+    ]);
+    exports2.capacityRequestSchema = zod_1.z.discriminatedUnion("operation", [
+      zod_1.z.object({ operation: zod_1.z.literal("recover"), owner: exports2.capacityOwnerSchema }).strict(),
+      zod_1.z.object({
+        operation: zod_1.z.literal("replace"),
+        operationId: zod_1.z.string().uuid(),
+        owners: zod_1.z.array(exports2.capacityOwnerSchema).min(1).max(4),
+        principal: exports2.capacityPrincipalSchema.optional(),
+        projectId: zod_1.z.string().max(128).optional()
+      }).strict(),
+      zod_1.z.object({ operation: zod_1.z.literal("register"), owner: exports2.capacityOwnerSchema }).strict(),
+      zod_1.z.object({
+        operation: zod_1.z.literal("reserve"),
+        principal: exports2.capacityPrincipalSchema,
+        action: zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS),
+        claim: exports2.capacityClaimSchema
+      }).strict(),
+      zod_1.z.object({ operation: zod_1.z.literal("reduce"), claim: exports2.capacityClaimSchema }).strict(),
+      zod_1.z.object({
+        operation: zod_1.z.literal("settle"),
+        owner: exports2.capacityOwnerSchema,
+        operationId: zod_1.z.string().uuid(),
+        committed: zod_1.z.boolean()
+      }).strict(),
+      zod_1.z.object({
+        operation: zod_1.z.literal("check"),
+        principal: exports2.capacityPrincipalSchema,
+        workspace: collaboration_js_1.workspaceRefSchema,
+        projectId: zod_1.z.string().min(1).max(128).optional(),
+        action: zod_1.z.enum(constants_js_2.WORKSPACE_ACTIONS),
+        epoch: zod_1.z.number().int().nonnegative()
+      }).strict()
+    ]);
+    exports2.capacityResponseSchema = zod_1.z.object({
+      owner: exports2.capacityOwnerSchema.optional(),
+      epoch: zod_1.z.number().int().nonnegative().optional(),
+      status: zod_1.z.enum(["reserved", "settled"]).optional(),
+      revisions: zod_1.z.record(zod_1.z.string(), zod_1.z.number().int().nonnegative()).optional()
     });
-    exports2.accessTokenOriginSchema = zod_1.z.string().max(2048).refine((value) => {
-      try {
-        const url = new URL(value);
-        return url.protocol === "https:" && url.origin === value && !url.hostname.includes("*");
-      } catch {
-        return false;
-      }
-    }, "Expected an exact HTTPS origin");
-    exports2.accessTokenCreateSchema = zod_1.z.object({
-      name: zod_1.z.string().trim().min(1).max(128),
-      type: zod_1.z.enum(["personal", "service", "public"]).default("personal"),
-      workspaceId: zod_1.z.string().regex(/^(user|org|team):[^:]+$/).max(256).optional(),
-      scopes: zod_1.z.array(zod_1.z.enum(["*", ...constants_1.WORKSPACE_ACTIONS])).min(1).max(constants_1.WORKSPACE_ACTIONS.length).optional(),
-      allowedOrigins: zod_1.z.array(exports2.accessTokenOriginSchema).max(32).optional(),
-      expiresAt: zod_1.z.string().datetime().optional()
+    exports2.accessRunReservationSchema = zod_1.z.object({
+      workspace: collaboration_js_1.workspaceRefSchema,
+      feature: zod_1.z.enum(constants_js_1.ACCESS_RUN_FEATURES),
+      id: zod_1.z.string().min(1).max(100).regex(/^[a-zA-Z0-9_-]+$/),
+      projectId: zod_1.z.string().min(1).max(128).optional()
     }).strict();
-    exports2.accessTokenUpdateSchema = exports2.accessTokenCreateSchema.pick({ name: true, scopes: true, allowedOrigins: true }).partial().strict();
+  }
+});
+
+// packages/schema/dist/access/routes/constants.js
+var require_constants8 = __commonJS({
+  "packages/schema/dist/access/routes/constants.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ACCESS_ROUTE_FEATURES = void 0;
+    exports2.ACCESS_ROUTE_FEATURES = {
+      access: null,
+      auth: null,
+      billing: null,
+      capabilities: null,
+      config: "projects",
+      desktop: "remote",
+      health: null,
+      identity: null,
+      organizations: null,
+      profile: null,
+      profiles: null,
+      registry: "plugins",
+      "super-admin": null,
+      "workspace-admin": null,
+      workspaces: null,
+      ai: "otto",
+      assistant: "otto",
+      apps: "apps",
+      architectures: "reviews",
+      community: "content",
+      customization: "projects",
+      "design-documents": "design",
+      executions: "workflows",
+      folders: "projects",
+      git: "projects",
+      github: "github",
+      gitlab: "integrations",
+      knowledge: "otto",
+      marketplace: "plugins",
+      "native-nodes": "plugins",
+      nodes: "plugins",
+      parser: "projects",
+      plugins: "plugins",
+      "project-jobs": "projects",
+      projects: "projects",
+      "remote-hosts": "remote",
+      "review-comments": "reviews",
+      "review-suggestions": "reviews",
+      "review-threads": "reviews",
+      runs: "workflows",
+      search: "projects",
+      slack: "integrations",
+      support: null,
+      social: "social",
+      "source-repositories": "projects",
+      store: "projects",
+      "task-spaces": "tasks",
+      templates: "workflows",
+      terminal: "terminal",
+      tokens: null,
+      variables: "data",
+      webhooks: "workflows",
+      wf: "workflows",
+      "work-items": "tasks",
+      workflows: "workflows",
+      "workspace-agents": "agents"
+    };
+  }
+});
+
+// packages/schema/dist/access/routes/resolve.js
+var require_resolve2 = __commonJS({
+  "packages/schema/dist/access/routes/resolve.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.routeAccessFeatures = routeAccessFeatures;
+    var constants_js_1 = require_constants8();
+    function routeAccessFeatures(path) {
+      if (path === "/wf/exec")
+        return ["workflows"];
+      const [, api, root] = path.split("/");
+      if (api !== "api" || !Object.hasOwn(constants_js_1.ACCESS_ROUTE_FEATURES, root))
+        return null;
+      if (root === "search")
+        return ["projects", "workflows", "plugins", "data"];
+      if (/\/(?:data-tables|data-table-schema|sql|variables)(?:\/|$)/.test(path))
+        return ["data"];
+      if (root === "marketplace" && /\/apps(?:\/|$)|\/app-development(?:\/|$)|\/app-tunnels(?:\/|$)/.test(path))
+        return ["apps"];
+      if (/\/nodes\/[^/]+\/invoke$/.test(path))
+        return ["workflows"];
+      if (root === "projects" && /\/(?:claude|assistant)(?:\/|$)/.test(path))
+        return ["otto"];
+      if (root === "projects" && path.endsWith("/persist"))
+        return ["terminal"];
+      if (root === "projects" && /\/(?:workflows|test-workflows|runs|executions)(?:\/|$)/.test(path))
+        return ["workflows"];
+      const feature = constants_js_1.ACCESS_ROUTE_FEATURES[root];
+      return feature ? [feature] : [];
+    }
   }
 });
 
@@ -12199,6 +14083,7 @@ var require_installation = __commonJS({
       grants: exports2.appGrantsSchema
     }).strict();
     exports2.appInstallationsQuerySchema = zod_1.z.object({
+      appId: zod_1.z.string().uuid().optional(),
       offset: zod_1.z.coerce.number().int().min(0).max(1e6).default(0),
       q: zod_1.z.string().max(200).optional(),
       sort: zod_1.z.enum(["name", "installed", "updated"]).default("installed"),
@@ -12459,7 +14344,7 @@ var require_publishing = __commonJS({
   "packages/schema/dist/plugin/publishing.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PluginCloudBuild = exports2.PluginPublisherBuildDetail = exports2.PluginPublisherBuilds = exports2.PluginPublisherBuildQuery = exports2.PluginPublisherListQuery = exports2.PluginPublisherApplied = exports2.PluginPublisherApply = exports2.PluginPublisherReview = exports2.PluginPublisherReviewItem = exports2.PluginPublisherOperation = exports2.PluginPublisherConnections = exports2.PluginPublisherConnection = exports2.PluginPublisherPreview = exports2.PluginPublisherConsent = exports2.PluginPublisherAutomatic = exports2.PluginPublisherRepository = exports2.PluginPublisherInput = exports2.pluginReleaseScope = exports2.PluginReleaseConfig = exports2.PluginConfigPath = void 0;
+    exports2.PluginCloudBuild = exports2.PluginPublisherBuildDetail = exports2.PluginPublisherBuilds = exports2.PluginPublisherBuildQuery = exports2.PluginPublisherListQuery = exports2.PluginPublisherApplied = exports2.PluginPublisherApply = exports2.PluginPublisherReview = exports2.PluginPublisherReviewItem = exports2.PluginPublisherOperation = exports2.PluginPublisherRepositoryPage = exports2.PluginPublisherRepositoryQuery = exports2.PluginPublisherConnections = exports2.PluginPublisherConnection = exports2.PluginPublisherPreview = exports2.PluginPublisherConsent = exports2.PluginPublisherAutomatic = exports2.PluginPublisherRepository = exports2.PluginPublisherInput = exports2.pluginReleaseScope = exports2.PluginReleaseConfig = exports2.PluginConfigPath = void 0;
     var zod_1 = require("zod");
     var icons_1 = require_icons();
     var version_1 = require_version();
@@ -12505,6 +14390,23 @@ var require_publishing = __commonJS({
       lastPublishedAt: zod_1.z.number().nullable()
     });
     exports2.PluginPublisherConnections = zod_1.z.object({ items: zod_1.z.array(exports2.PluginPublisherConnection) });
+    exports2.PluginPublisherRepositoryQuery = zod_1.z.object({
+      search: zod_1.z.string().trim().max(200).default(""),
+      scope: zod_1.z.enum(["all", "user", "team", "organization", "public"]).default("all"),
+      sort: zod_1.z.enum(["name", "-name"]).default("name"),
+      limit: zod_1.z.coerce.number().int().min(1).max(100).default(20),
+      offset: zod_1.z.coerce.number().int().min(0).max(1e6).default(0)
+    });
+    exports2.PluginPublisherRepositoryPage = zod_1.z.object({
+      items: zod_1.z.array(zod_1.z.object({
+        repositoryId: zod_1.z.number().int(),
+        repository: zod_1.z.string(),
+        branch: zod_1.z.string(),
+        plugins: zod_1.z.array(zod_1.z.string()),
+        scopes: zod_1.z.array(zod_1.z.enum(["user", "team", "organization", "public"]))
+      })),
+      total: zod_1.z.number().int().nonnegative()
+    });
     exports2.PluginPublisherOperation = zod_1.z.enum(["create", "update", "delete"]);
     exports2.PluginPublisherReviewItem = zod_1.z.object({
       configPath: exports2.PluginConfigPath,
@@ -12921,110 +14823,219 @@ var require_resources = __commonJS({
   }
 });
 
-// packages/schema/dist/remote/constants.js
-var require_constants2 = __commonJS({
-  "packages/schema/dist/remote/constants.js"(exports2) {
+// packages/schema/dist/billing/ai.js
+var require_ai = __commonJS({
+  "packages/schema/dist/billing/ai.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.REMOTE_RESPONSE_HEADERS = exports2.REMOTE_REQUEST_HEADERS = exports2.REMOTE_MAX_HOSTS = exports2.REMOTE_PAIRING_MS = exports2.REMOTE_RESPONSE_BYTES = exports2.REMOTE_MAX_STREAMS = exports2.REMOTE_FRAME_BYTES = exports2.REMOTE_BODY_BYTES = exports2.REMOTE_CHUNK_BYTES = exports2.REMOTE_LEASE_MS = exports2.REMOTE_PROTOCOL = void 0;
-    exports2.REMOTE_PROTOCOL = "octonode.remote.v1";
-    exports2.REMOTE_LEASE_MS = 3e4;
-    exports2.REMOTE_CHUNK_BYTES = 48 * 1024;
-    exports2.REMOTE_BODY_BYTES = 4 * 1024 * 1024;
-    exports2.REMOTE_FRAME_BYTES = 128 * 1024;
-    exports2.REMOTE_MAX_STREAMS = 32;
-    exports2.REMOTE_RESPONSE_BYTES = 50 * 1024 * 1024;
-    exports2.REMOTE_PAIRING_MS = 10 * 6e4;
-    exports2.REMOTE_MAX_HOSTS = 10;
-    exports2.REMOTE_REQUEST_HEADERS = [
-      "content-type",
-      "accept",
-      "if-match",
-      "if-none-match",
-      "idempotency-key",
-      "x-octonode-worktree",
-      "x-octonode-autocommit"
-    ];
-    exports2.REMOTE_RESPONSE_HEADERS = ["content-type", "etag", "retry-after", "x-octonode-git-commit"];
+    exports2.aiBillingPolicySchema = exports2.aiPricedModelSchema = exports2.aiPlanBudgetSchema = exports2.aiBudgetWindowSchema = void 0;
+    var zod_1 = require("zod");
+    var identifier = zod_1.z.string().regex(/^[a-z][a-z0-9_]{0,63}$/);
+    var usdMicros = zod_1.z.number().int().min(0).max(1e12);
+    exports2.aiBudgetWindowSchema = zod_1.z.object({
+      id: identifier,
+      durationSeconds: zod_1.z.number().int().min(60).max(31536e3),
+      budgetUsdMicros: usdMicros
+    }).strict();
+    exports2.aiPlanBudgetSchema = zod_1.z.object({
+      plan: identifier,
+      monthlyBudgetUsdMicros: usdMicros,
+      windows: zod_1.z.array(exports2.aiBudgetWindowSchema).max(12),
+      modelIds: zod_1.z.array(identifier).max(100)
+    }).strict().superRefine((plan, ctx) => {
+      if (new Set(plan.windows.map((window) => window.id)).size !== plan.windows.length)
+        ctx.addIssue({ code: "custom", path: ["windows"], message: "Window IDs must be unique within a plan" });
+      if (new Set(plan.modelIds).size !== plan.modelIds.length)
+        ctx.addIssue({ code: "custom", path: ["modelIds"], message: "Model IDs must be unique" });
+    });
+    exports2.aiPricedModelSchema = zod_1.z.object({
+      id: identifier,
+      name: zod_1.z.string().trim().min(1).max(80),
+      provider: zod_1.z.enum(["workers-ai", "anthropic", "openai", "google"]),
+      model: zod_1.z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9@][A-Za-z0-9._:/@-]*$/),
+      inputUsdMicrosPerMillion: usdMicros,
+      outputUsdMicrosPerMillion: usdMicros,
+      enabled: zod_1.z.boolean()
+    }).strict();
+    exports2.aiBillingPolicySchema = zod_1.z.object({
+      creditsPerUsd: zod_1.z.number().min(1e-6).max(1e6).multipleOf(1e-6),
+      models: zod_1.z.array(exports2.aiPricedModelSchema).max(100),
+      plans: zod_1.z.array(exports2.aiPlanBudgetSchema).max(100)
+    }).strict().superRefine((policy, ctx) => {
+      for (const field of ["models", "plans"]) {
+        const ids = policy[field].map((item) => "id" in item ? item.id : item.plan);
+        if (new Set(ids).size !== ids.length)
+          ctx.addIssue({ code: "custom", path: [field], message: `Duplicate ${field} identifier` });
+      }
+      const identities = policy.models.map((model) => `${model.provider}:${model.model}`);
+      if (new Set(identities).size !== identities.length)
+        ctx.addIssue({ code: "custom", path: ["models"], message: "Provider/model pairs must be unique" });
+      for (const [index, plan] of policy.plans.entries())
+        if (plan.modelIds.some((id) => !policy.models.some((model) => model.id === id)))
+          ctx.addIssue({ code: "custom", path: ["plans", index, "modelIds"], message: "Unknown model ID" });
+    });
   }
 });
 
-// packages/schema/dist/remote/schema.js
-var require_schema3 = __commonJS({
-  "packages/schema/dist/remote/schema.js"(exports2) {
+// packages/schema/dist/billing/usage.js
+var require_usage = __commonJS({
+  "packages/schema/dist/billing/usage.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.remoteFrameSchema = exports2.remoteTerminalQuerySchema = exports2.remoteTerminalSchema = exports2.remoteConnectionSchema = exports2.remoteDeviceSchema = exports2.remoteHostEnrollmentSchema = exports2.remoteHostSchema = exports2.remoteHostCreateSchema = exports2.remoteHostIdSchema = void 0;
+    exports2.billingAiUserUsageSchema = void 0;
     var zod_1 = require("zod");
-    var constants_js_1 = require_constants2();
-    exports2.remoteHostIdSchema = zod_1.z.string().uuid();
-    exports2.remoteHostCreateSchema = zod_1.z.object({ name: zod_1.z.string().trim().min(1).max(80) }).strict();
-    exports2.remoteHostSchema = zod_1.z.object({
-      id: exports2.remoteHostIdSchema,
-      name: zod_1.z.string(),
-      workspace: zod_1.z.string(),
-      createdAt: zod_1.z.number(),
-      connectedAt: zod_1.z.number().nullable(),
-      online: zod_1.z.boolean()
+    exports2.billingAiUserUsageSchema = zod_1.z.object({
+      periodStart: zod_1.z.number().int().nonnegative(),
+      periodEnd: zod_1.z.number().int().nonnegative(),
+      creditsPerUsd: zod_1.z.number().positive().nullable(),
+      totalCredits: zod_1.z.number(),
+      unattributedCredits: zod_1.z.number(),
+      users: zod_1.z.array(zod_1.z.object({
+        userId: zod_1.z.string(),
+        name: zod_1.z.string(),
+        credits: zod_1.z.number()
+      })).max(100),
+      truncated: zod_1.z.boolean()
     });
-    exports2.remoteHostEnrollmentSchema = zod_1.z.object({
-      host: exports2.remoteHostSchema,
-      token: zod_1.z.string(),
-      expiresAt: zod_1.z.number()
+  }
+});
+
+// packages/schema/dist/billing/index.js
+var require_billing = __commonJS({
+  "packages/schema/dist/billing/index.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.billingAiUserUsageSchema = exports2.aiPricedModelSchema = exports2.aiPlanBudgetSchema = exports2.aiBudgetWindowSchema = exports2.aiBillingPolicySchema = void 0;
+    var ai_js_1 = require_ai();
+    Object.defineProperty(exports2, "aiBillingPolicySchema", { enumerable: true, get: function() {
+      return ai_js_1.aiBillingPolicySchema;
+    } });
+    Object.defineProperty(exports2, "aiBudgetWindowSchema", { enumerable: true, get: function() {
+      return ai_js_1.aiBudgetWindowSchema;
+    } });
+    Object.defineProperty(exports2, "aiPlanBudgetSchema", { enumerable: true, get: function() {
+      return ai_js_1.aiPlanBudgetSchema;
+    } });
+    Object.defineProperty(exports2, "aiPricedModelSchema", { enumerable: true, get: function() {
+      return ai_js_1.aiPricedModelSchema;
+    } });
+    var usage_js_1 = require_usage();
+    Object.defineProperty(exports2, "billingAiUserUsageSchema", { enumerable: true, get: function() {
+      return usage_js_1.billingAiUserUsageSchema;
+    } });
+  }
+});
+
+// packages/schema/dist/billing.js
+var require_billing2 = __commonJS({
+  "packages/schema/dist/billing.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.billingHierarchySchema = exports2.billingHierarchyInputSchema = exports2.billingChangeSchema = exports2.billingSelectionSchema = exports2.billingCatalogSchema = exports2.billingCreditPackSchema = exports2.billingOfferSchema = void 0;
+    var zod_1 = require("zod");
+    var policy_js_1 = require_policy();
+    var index_js_1 = require_billing();
+    var capacityAddonSchema = zod_1.z.object({
+      addonId: zod_1.z.string().min(1).max(100),
+      units: zod_1.z.number().int().positive().max(1e8),
+      priceCents: zod_1.z.number().int().nonnegative().max(1e8)
+    }).strict();
+    exports2.billingOfferSchema = zod_1.z.object({
+      id: zod_1.z.string().regex(/^[a-z][a-z0-9_]{0,63}$/),
+      plan: zod_1.z.string().regex(/^[a-z][a-z0-9_]{0,63}$/),
+      name: zod_1.z.string().trim().min(1).max(80),
+      rank: zod_1.z.number().int().nonnegative().max(1e3),
+      workspaceKind: zod_1.z.enum(["user", "org", "team"]),
+      interval: zod_1.z.enum(["month", "year"]),
+      productId: zod_1.z.string().regex(/^pdt_[A-Za-z0-9_]+$/),
+      currency: zod_1.z.string().regex(/^[A-Z]{3}$/),
+      monthlyPriceCents: zod_1.z.number().int().positive().max(1e8),
+      basePriceCents: zod_1.z.number().int().nonnegative().max(1e8).optional(),
+      organizationId: zod_1.z.string().regex(/^[A-Za-z0-9_-]{1,128}$/).optional(),
+      hostingMode: zod_1.z.enum(["shared", "dedicated", "dedicated_customer_storage"]).optional(),
+      annualDiscountPercent: zod_1.z.number().min(0).max(99),
+      includedExecutions: zod_1.z.number().int().positive().max(1e8),
+      includedAiCredits: zod_1.z.number().int().positive().max(1e8),
+      access: policy_js_1.accessProfileSchema.optional(),
+      seatAddonId: zod_1.z.string().min(1).max(100).nullable(),
+      executionAddon: capacityAddonSchema.nullable(),
+      aiAddon: capacityAddonSchema.nullable(),
+      enabled: zod_1.z.boolean()
+    }).strict().superRefine((offer, ctx) => {
+      if (offer.workspaceKind !== "org" && (offer.organizationId || offer.basePriceCents || offer.hostingMode && offer.hostingMode !== "shared"))
+        ctx.addIssue({ code: "custom", message: "Enterprise agreements and hosting fees require an organization" });
+      if ((offer.basePriceCents || offer.hostingMode && offer.hostingMode !== "shared") && !offer.organizationId)
+        ctx.addIssue({ code: "custom", message: "Hosting agreements must be restricted to an organization" });
+      if (offer.workspaceKind === "user" !== (offer.seatAddonId === null))
+        ctx.addIssue({
+          code: "custom",
+          path: ["seatAddonId"],
+          message: "Organizations and teams require a seat add-on; personal plans cannot have seats"
+        });
+      const ids = [offer.seatAddonId, offer.executionAddon?.addonId, offer.aiAddon?.addonId].filter(Boolean);
+      if (new Set(ids).size !== ids.length)
+        ctx.addIssue({ code: "custom", message: "Add-on IDs must be distinct" });
     });
-    exports2.remoteDeviceSchema = zod_1.z.object({
-      id: exports2.remoteHostIdSchema,
-      workspace: zod_1.z.string(),
-      ownerId: zod_1.z.string()
+    exports2.billingCreditPackSchema = zod_1.z.object({
+      id: zod_1.z.string().regex(/^[a-z][a-z0-9_]{0,63}$/),
+      name: zod_1.z.string().trim().min(1).max(80),
+      productId: zod_1.z.string().regex(/^pdt_[A-Za-z0-9_]+$/),
+      meter: zod_1.z.enum(["executions", "ai_credits"]),
+      units: zod_1.z.number().int().positive().max(1e8),
+      priceCents: zod_1.z.number().int().positive().max(1e8),
+      currency: zod_1.z.string().regex(/^[A-Z]{3}$/),
+      enabled: zod_1.z.boolean()
+    }).strict();
+    exports2.billingCatalogSchema = zod_1.z.object({
+      revision: zod_1.z.number().int().nonnegative(),
+      freeExecutions: zod_1.z.number().int().positive().max(1e8),
+      freeAiCredits: zod_1.z.number().int().positive().max(1e8),
+      freeAccess: policy_js_1.accessProfileSchema.optional(),
+      aiPolicy: index_js_1.aiBillingPolicySchema.optional(),
+      offers: zod_1.z.array(exports2.billingOfferSchema).max(100),
+      creditPacks: zod_1.z.array(exports2.billingCreditPackSchema).max(100).default([])
+    }).strict().superRefine((catalog, ctx) => {
+      if (catalog.freeAccess && catalog.freeAccess.tier !== "free")
+        ctx.addIssue({
+          code: "custom",
+          path: ["freeAccess", "tier"],
+          message: "The Free profile must use the free tier"
+        });
+      const products = [...catalog.offers, ...catalog.creditPacks].map((item) => item.productId);
+      if (new Set(products).size !== products.length)
+        ctx.addIssue({ code: "custom", message: "Product IDs must be unique" });
+      if (new Set(catalog.creditPacks.map((pack) => pack.id)).size !== catalog.creditPacks.length)
+        ctx.addIssue({ code: "custom", message: "Duplicate pack ID" });
+      for (const field of ["id", "productId"])
+        if (new Set(catalog.offers.map((offer) => offer[field])).size !== catalog.offers.length)
+          ctx.addIssue({ code: "custom", path: ["offers"], message: `Duplicate ${field}` });
     });
-    exports2.remoteConnectionSchema = zod_1.z.object({
-      id: exports2.remoteHostIdSchema,
-      gateway: zod_1.z.string().url(),
-      token: zod_1.z.string().regex(/^octo_host_[a-f0-9]{64}$/),
-      paired: zod_1.z.boolean().default(false)
+    exports2.billingSelectionSchema = zod_1.z.object({
+      offerId: zod_1.z.string().min(1).max(64),
+      seats: zod_1.z.number().int().min(1).max(1e4).default(1),
+      executionPacks: zod_1.z.number().int().min(0).max(1e4).default(0),
+      aiPacks: zod_1.z.number().int().min(0).max(1e4).default(0),
+      discountCodes: zod_1.z.array(zod_1.z.string().trim().min(3).max(16)).max(20).optional()
     }).strict();
-    exports2.remoteTerminalSchema = zod_1.z.object({
-      id: zod_1.z.string().uuid(),
-      project: zod_1.z.string(),
-      worktree: zod_1.z.string().nullable(),
-      createdAt: zod_1.z.number()
+    exports2.billingChangeSchema = exports2.billingSelectionSchema.extend({
+      quoteId: zod_1.z.string().uuid()
     });
-    exports2.remoteTerminalQuerySchema = zod_1.z.object({
-      project: zod_1.z.string().min(1).max(240),
-      worktree: zod_1.z.string().uuid().optional()
+    exports2.billingHierarchyInputSchema = zod_1.z.object({
+      mode: zod_1.z.enum(["separate", "consolidated"]),
+      revision: zod_1.z.number().int().nonnegative()
+    }).strict();
+    exports2.billingHierarchySchema = zod_1.z.object({
+      mode: zod_1.z.enum(["separate", "consolidated"]),
+      revision: zod_1.z.number().int().nonnegative(),
+      organizationId: zod_1.z.string().nullable(),
+      inherited: zod_1.z.boolean(),
+      canManage: zod_1.z.boolean()
     });
-    exports2.remoteFrameSchema = zod_1.z.discriminatedUnion("type", [
-      zod_1.z.object({ type: zod_1.z.literal("dial"), ticket: zod_1.z.string().uuid() }).strict(),
-      zod_1.z.object({ type: zod_1.z.literal("ping") }).strict(),
-      zod_1.z.object({ type: zod_1.z.literal("pong") }).strict(),
-      zod_1.z.object({
-        type: zod_1.z.literal("request"),
-        method: zod_1.z.string().max(10),
-        path: zod_1.z.string().max(4096),
-        headers: zod_1.z.record(zod_1.z.string().max(8192)),
-        websocket: zod_1.z.boolean()
-      }).strict(),
-      zod_1.z.object({
-        type: zod_1.z.literal("response"),
-        status: zod_1.z.number().int().min(100).max(599),
-        headers: zod_1.z.record(zod_1.z.string().max(8192))
-      }).strict(),
-      zod_1.z.object({
-        type: zod_1.z.literal("data"),
-        data: zod_1.z.string().max(constants_js_1.REMOTE_FRAME_BYTES),
-        binary: zod_1.z.boolean().optional(),
-        final: zod_1.z.boolean().optional()
-      }).strict(),
-      zod_1.z.object({ type: zod_1.z.literal("end") }).strict(),
-      zod_1.z.object({ type: zod_1.z.literal("ack") }).strict(),
-      zod_1.z.object({ type: zod_1.z.literal("cancel") }).strict(),
-      zod_1.z.object({ type: zod_1.z.literal("error"), message: zod_1.z.string().max(200) }).strict()
-    ]);
   }
 });
 
 // packages/schema/dist/remote/types.js
-var require_types = __commonJS({
+var require_types4 = __commonJS({
   "packages/schema/dist/remote/types.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -13032,7 +15043,7 @@ var require_types = __commonJS({
 });
 
 // packages/schema/dist/remote/policy.js
-var require_policy = __commonJS({
+var require_policy2 = __commonJS({
   "packages/schema/dist/remote/policy.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -13046,11 +15057,13 @@ var require_policy = __commonJS({
       const p = url.pathname;
       if (url.searchParams.get("global") === "true")
         return null;
+      if (/^\/api\/projects\/[a-zA-Z0-9._-]+\/preview\/\d{2,5}(?:\/|$)/.test(p))
+        return ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"].includes(method) ? "execute" : null;
       if (/\/(?:internal|desktop|claude|frontend|preview|github|gitlab|data-tables|data-table-schema|sql|analytics|triggers|webhooks)(?:\/|$)/.test(p))
         return null;
       if (!["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "QUERY"].includes(method))
         return null;
-      if (!/^\/api\/(?:projects|source-repositories|architectures|workflows|nodes|source|folders|git|config|parser|executions|runs|terminal|capabilities|health|plugins|variables|native|store|search|orchestration)(?:\/|$)/.test(p))
+      if (!/^\/api\/(?:projects|source-repositories|architectures|workflows|nodes|source|folders|git|config|parser|executions|runs|terminal|capabilities|health|plugins|variables|native|native-nodes|store|search|orchestration)(?:\/|$)/.test(p))
         return null;
       if ((p === "/api/source-repositories" || p === "/api/projects") && method !== "GET")
         return null;
@@ -13058,7 +15071,11 @@ var require_policy = __commonJS({
         return null;
       if (/\/(?:import|export|restore|purge|persist|sync)(?:\/|$)/.test(p))
         return null;
-      if (p === "/api/terminal" || /\/(?:run|run-all|invoke|executions|cancel|compile|runtime)(?:\/|$)/.test(p))
+      if (/^\/api\/projects\/[^/]+\/files\/transfers(?:\/|$)/.test(p))
+        return ["GET", "HEAD"].includes(method) ? "read" : "write";
+      if (/^\/api\/workflows\/[^/]+\/run$/.test(p))
+        return "execute";
+      if (p === "/api/terminal" || /\/(?:commands|run|run-all|invoke|executions|cancel|compile|runtime)(?:\/|$)/.test(p))
         return method === "GET" && p !== "/api/terminal" ? "read" : "execute";
       return ["GET", "HEAD", "QUERY"].includes(method) ? "read" : "write";
     }
@@ -13074,8 +15091,8 @@ var require_channel = __commonJS({
     exports2.remoteBytes = remoteBytes;
     exports2.remoteBody = remoteBody;
     exports2.remoteSocketMessage = remoteSocketMessage;
-    var constants_js_1 = require_constants2();
-    var schema_js_1 = require_schema3();
+    var constants_js_1 = require_constants5();
+    var schema_js_1 = require_schema4();
     var RemoteChannel = class {
       constructor(write) {
         this.queue = [];
@@ -13245,16 +15262,64 @@ var require_remote = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    __exportStar(require_constants2(), exports2);
-    __exportStar(require_schema3(), exports2);
-    __exportStar(require_types(), exports2);
-    __exportStar(require_policy(), exports2);
+    __exportStar(require_constants5(), exports2);
+    __exportStar(require_schema4(), exports2);
+    __exportStar(require_types4(), exports2);
+    __exportStar(require_policy2(), exports2);
     __exportStar(require_channel(), exports2);
   }
 });
 
+// packages/schema/dist/hosting.js
+var require_hosting = __commonJS({
+  "packages/schema/dist/hosting.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.archiveUploadResultSchema = exports2.archiveCaptureResultSchema = exports2.objectArchiveSchema = exports2.storageConnectionInputSchema = exports2.storageCredentialSchema = exports2.storageLocationSchema = void 0;
+    var zod_1 = require("zod");
+    exports2.storageLocationSchema = zod_1.z.object({
+      id: zod_1.z.string().uuid(),
+      generation: zod_1.z.number().int().positive(),
+      provider: zod_1.z.enum(["r2", "aws_s3", "s3_compatible"]),
+      endpoint: zod_1.z.string().url(),
+      region: zod_1.z.string().min(1).max(80),
+      bucket: zod_1.z.string().regex(/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/),
+      prefix: zod_1.z.string().regex(/^(?:[a-zA-Z0-9_-]+\/)+$/).max(400),
+      forcePathStyle: zod_1.z.boolean().default(false)
+    }).strict();
+    exports2.storageCredentialSchema = zod_1.z.object({
+      accessKeyId: zod_1.z.string().min(1).max(256),
+      secretAccessKey: zod_1.z.string().min(1).max(256),
+      sessionToken: zod_1.z.string().min(1).max(8192).optional(),
+      expiresAt: zod_1.z.number().int().positive().optional()
+    }).strict().refine((value) => !value.sessionToken || Boolean(value.expiresAt), "Session credentials require expiresAt");
+    exports2.storageConnectionInputSchema = zod_1.z.object({
+      location: exports2.storageLocationSchema,
+      credentials: exports2.storageCredentialSchema
+    }).strict();
+    exports2.objectArchiveSchema = zod_1.z.object({
+      format: zod_1.z.literal("octonode-squashfs-v1"),
+      id: zod_1.z.string().uuid(),
+      connectionId: zod_1.z.string().uuid(),
+      generation: zod_1.z.number().int().positive(),
+      workspace: zod_1.z.string().regex(/^(org|team):[A-Za-z0-9_-]+$/),
+      key: zod_1.z.string().min(1).max(1024),
+      dir: zod_1.z.string().startsWith("/workspace"),
+      bytes: zod_1.z.number().int().positive().max(64 * 1024 ** 3),
+      sha256: zod_1.z.string().regex(/^[a-f0-9]{64}$/),
+      createdAt: zod_1.z.number().int().positive(),
+      expiresAt: zod_1.z.number().int().positive()
+    }).strict();
+    exports2.archiveCaptureResultSchema = zod_1.z.object({
+      bytes: zod_1.z.number().int().positive().max(64 * 1024 ** 3),
+      sha256: zod_1.z.string().regex(/^[a-f0-9]{64}$/)
+    }).strict();
+    exports2.archiveUploadResultSchema = zod_1.z.object({ etag: zod_1.z.string().min(1).nullable() }).strict();
+  }
+});
+
 // packages/schema/dist/assistant/instructions/constants.js
-var require_constants3 = __commonJS({
+var require_constants9 = __commonJS({
   "packages/schema/dist/assistant/instructions/constants.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -13273,7 +15338,7 @@ var require_instructions = __commonJS({
     exports2.assistantProjectInstructionsSchema = void 0;
     exports2.isProjectInstructionPath = isProjectInstructionPath;
     var zod_1 = require("zod");
-    var constants_js_1 = require_constants3();
+    var constants_js_1 = require_constants9();
     exports2.assistantProjectInstructionsSchema = zod_1.z.object({
       files: zod_1.z.array(zod_1.z.object({
         path: zod_1.z.string().max(1024),
@@ -13340,7 +15405,7 @@ var require_dist = __commonJS({
       for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.ToolkitAction = exports2.schemaVersion = exports2.octonodeJsonSchema = exports2.testDataValidator = void 0;
+    exports2.billingHierarchySchema = exports2.billingHierarchyInputSchema = exports2.ToolkitAction = exports2.schemaVersion = exports2.octonodeJsonSchema = exports2.testDataValidator = void 0;
     __exportStar(require_envelope(), exports2);
     __exportStar(require_config(), exports2);
     __exportStar(require_entry(), exports2);
@@ -13355,21 +15420,25 @@ var require_dist = __commonJS({
     __exportStar(require_source(), exports2);
     __exportStar(require_graph(), exports2);
     __exportStar(require_collaboration(), exports2);
+    __exportStar(require_support(), exports2);
     __exportStar(require_task_management(), exports2);
     __exportStar(require_collaboration2(), exports2);
     __exportStar(require_documents(), exports2);
     __exportStar(require_dashboard(), exports2);
     __exportStar(require_capabilities(), exports2);
     __exportStar(require_chat(), exports2);
+    __exportStar(require_constants6(), exports2);
+    __exportStar(require_attachments(), exports2);
     __exportStar(require_knowledge(), exports2);
     __exportStar(require_architecture(), exports2);
+    __exportStar(require_architecture2(), exports2);
     __exportStar(require_registry(), exports2);
     __exportStar(require_publications(), exports2);
     __exportStar(require_media(), exports2);
     __exportStar(require_media_types(), exports2);
     __exportStar(require_templates(), exports2);
     __exportStar(require_constants(), exports2);
-    var schema_1 = require_schema2();
+    var schema_1 = require_schema5();
     Object.defineProperty(exports2, "octonodeJsonSchema", { enumerable: true, get: function() {
       return schema_1.octonodeJsonSchema;
     } });
@@ -13379,6 +15448,12 @@ var require_dist = __commonJS({
     __exportStar(require_icons(), exports2);
     __exportStar(require_settings(), exports2);
     __exportStar(require_tokens(), exports2);
+    __exportStar(require_constants7(), exports2);
+    __exportStar(require_policy(), exports2);
+    __exportStar(require_types3(), exports2);
+    __exportStar(require_resolve(), exports2);
+    __exportStar(require_capacity(), exports2);
+    __exportStar(require_resolve2(), exports2);
     __exportStar(require_plugin(), exports2);
     __exportStar(require_app(), exports2);
     __exportStar(require_contributions(), exports2);
@@ -13406,26 +15481,38 @@ var require_dist = __commonJS({
     __exportStar(require_table_constants(), exports2);
     __exportStar(require_resources(), exports2);
     __exportStar(require_artifacts(), exports2);
-    __exportStar(require_models(), exports2);
+    __exportStar(require_models2(), exports2);
+    __exportStar(require_billing2(), exports2);
+    __exportStar(require_billing(), exports2);
+    var billing_js_1 = require_billing2();
+    Object.defineProperty(exports2, "billingHierarchyInputSchema", { enumerable: true, get: function() {
+      return billing_js_1.billingHierarchyInputSchema;
+    } });
+    Object.defineProperty(exports2, "billingHierarchySchema", { enumerable: true, get: function() {
+      return billing_js_1.billingHierarchySchema;
+    } });
     __exportStar(require_remote(), exports2);
+    __exportStar(require_hosting(), exports2);
     __exportStar(require_instructions(), exports2);
-    __exportStar(require_constants3(), exports2);
+    __exportStar(require_constants9(), exports2);
     __exportStar(require_catalog(), exports2);
   }
 });
 
 // packages/plugin-runtime/dist/constants.js
-var require_constants4 = __commonJS({
+var require_constants10 = __commonJS({
   "packages/plugin-runtime/dist/constants.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.LANGUAGE = void 0;
+    exports2.NODE_BUILD_TARGET = exports2.NODE_ENGINE_RANGE = exports2.LANGUAGE = void 0;
     exports2.LANGUAGE = "typescript";
+    exports2.NODE_ENGINE_RANGE = "^20.19.0 || >=22.12.0";
+    exports2.NODE_BUILD_TARGET = "node20.19";
   }
 });
 
 // packages/plugin-runtime/dist/json/schema.js
-var require_schema4 = __commonJS({
+var require_schema6 = __commonJS({
   "packages/plugin-runtime/dist/json/schema.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -13473,8 +15560,19 @@ var require_schema4 = __commonJS({
             walk(schema.additionalProperties, value, `${path}.${key}`, errors);
         }
       }
-      if (Array.isArray(data) && isPlainObject(schema.items)) {
-        data.forEach((item, i) => walk(schema.items, item, `${path}[${i}]`, errors));
+      if (Array.isArray(data)) {
+        if (typeof schema.minItems === "number" && data.length < schema.minItems)
+          errors.push({ path, message: `expected at least ${schema.minItems} items` });
+        if (typeof schema.maxItems === "number" && data.length > schema.maxItems)
+          errors.push({ path, message: `expected at most ${schema.maxItems} items` });
+        const prefix = Array.isArray(schema.prefixItems) ? schema.prefixItems : [];
+        data.forEach((item, i) => {
+          const itemSchema = i < prefix.length ? prefix[i] : schema.items;
+          if (itemSchema === false)
+            errors.push({ path: `${path}[${i}]`, message: "unexpected item" });
+          else if (isPlainObject(itemSchema))
+            walk(itemSchema, item, `${path}[${i}]`, errors);
+        });
       }
     }
     function normalizeTypes(type) {
@@ -13533,8 +15631,8 @@ var require_runner = __commonJS({
     exports2.start = start;
     var node_console_1 = require("node:console");
     var schema_1 = require_dist();
-    var constants_js_1 = require_constants4();
-    var schema_js_1 = require_schema4();
+    var constants_js_1 = require_constants10();
+    var schema_js_1 = require_schema6();
     var NodeError = class extends Error {
       constructor(message, opts) {
         super(message);
@@ -13849,7 +15947,7 @@ var require_runner = __commonJS({
 });
 
 // packages/common/dist/constants.js
-var require_constants5 = __commonJS({
+var require_constants11 = __commonJS({
   "packages/common/dist/constants.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -14207,6 +16305,19 @@ var require_routing = __commonJS({
     exports2.controlPlanePath = controlPlanePath;
     exports2.workspaceRef = workspaceRef;
     function controlPlanePath(url, method = "GET") {
+      if (/^\/api\/access\/(?:effective|catalog|policy|history|inspect|impact|usage|scopes|credentials)(?:\/[^/]+)?$/.test(url.pathname))
+        return `${url.pathname.slice(4)}${url.search}`;
+      if (/^\/api\/support\/(?:access|realtime(?:-ticket)?|(?:staff\/)?tickets(?:\/[^/]+(?:\/(?:messages|read|take|transfer|close|state|notes|activity|labels))?)?|staff\/(?:agents|reports))$/.test(url.pathname) || /^\/api\/super-admin\/support\/agents(?:\/[^/]+)?$/.test(url.pathname))
+        return `${url.pathname.slice(4)}${url.search}`;
+      if (/^\/api\/support\/(?:intakes|files\/[^/]+(?:\/[^/]+(?:\/content)?)?)$/.test(url.pathname))
+        return `${url.pathname.slice(4)}${url.search}`;
+      if (/^\/api\/support\/(?:staff\/)?(?:unread|notifications(?:\/read)?|settings|templates(?:\/[^/]+)?)$/.test(url.pathname))
+        return `${url.pathname.slice(4)}${url.search}`;
+      if (/^\/api\/support\/staff\/maintenance(?:\/[^/]+(?:\/(?:step|cancel))?)?$/.test(url.pathname))
+        return `${url.pathname.slice(4)}${url.search}`;
+      const hosting = url.pathname.match(/^\/api\/organizations\/([^/]+)\/(hosting|storage-connections)(?:\/[^/]+(?:\/(?:validate|rotate|[a-f0-9]{64}))?)?$/);
+      if (hosting)
+        return url.pathname.replace(/^\/api\/organizations\//, "/orgs/") + url.search;
       if (url.pathname === "/api/marketplace/toolkits" && method === "GET" && url.searchParams.get("project"))
         return null;
       if (!["/api/marketplace/toolkits/import", "/api/marketplace/toolkits/inspect"].includes(url.pathname) && /^\/api\/marketplace\/toolkits(?:\/[^/]+(?:\/(?:publish|resolve|members|versions))?)?$/.test(url.pathname))
@@ -14233,10 +16344,10 @@ var require_routing = __commonJS({
       if (/^\/api\/workspace-admin\/(?:overview|members(?:\/[^/]+)?|invites(?:\/[^/]+)?)$/.test(url.pathname)) {
         return `${url.pathname.slice(4)}${url.search}`;
       }
-      if (/^\/api\/super-admin\/(?:access|overview|users|plugins(?:\/[^/]+)?|organizations(?:\/[^/]+)?)$/.test(url.pathname)) {
+      if (/^\/api\/super-admin\/(?:access|overview|users|billing\/catalog|billing\/health|plugins(?:\/[^/]+)?|organizations(?:\/[^/]+)?)$/.test(url.pathname)) {
         return `${url.pathname.slice(4)}${url.search}`;
       }
-      if (/^\/api\/billing\/(?:summary|checkout|portal|seats|usage-limits\/[^/]+)$/.test(url.pathname)) {
+      if (/^\/api\/billing\/(?:summary|catalog|change|change-preview|credits|cancel-change|checkout|portal|seats|usage-limits\/[^/]+)$/.test(url.pathname)) {
         return `${url.pathname.slice(4)}${url.search}`;
       }
       if (/^\/api\/remote-hosts(?:\/[^/]+)?$/.test(url.pathname))
@@ -14254,7 +16365,7 @@ var require_routing = __commonJS({
         /^\/api\/github\/(?:install|installations\/complete|repositories|jobs\/[^/]+(?:\/retry)?)$/,
         /^\/api\/slack\/(?:install|installations\/complete|connections(?:\/[^/]+)?|bindings(?:\/[^/]+)?)$/,
         /^\/api\/gitlab\/(?:install|installations\/complete|connections|repositories)$/,
-        /^\/api\/design-documents(?:\/[^/]+(?:\/(?:share|review-threads))?)?$/,
+        /^\/api\/design-documents(?:\/[^/]+(?:\/(?:share|review-threads|work-items))?)?$/,
         /^\/api\/architectures\/[^/]+\/github(?:\/pull-requests(?:\/\d+(?:\/reviews)?)?)?$/,
         /^\/api\/(?:review-threads\/[^/]+(?:\/(?:comments|resolve|github\/(?:resolve|unresolve)))?|review-comments\/[^/]+(?:\/github)?|review-suggestions\/[^/]+\/reject)$/
       ].some((pattern) => pattern.test(url.pathname));
@@ -14385,7 +16496,7 @@ var require_dist2 = __commonJS({
     };
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.compareWorkflowGraphs = exports2.edgeChanges = exports2.graphValues = exports2.graphValue = exports2.workspaceRef = exports2.controlPlanePath = exports2.installedPluginNodesPage = exports2.layeredLayout = exports2.packageCacheEnvironment = void 0;
-    __exportStar(require_constants5(), exports2);
+    __exportStar(require_constants11(), exports2);
     __exportStar(require_legal_constants(), exports2);
     var cache_js_1 = require_cache();
     Object.defineProperty(exports2, "packageCacheEnvironment", { enumerable: true, get: function() {
@@ -14546,7 +16657,7 @@ var require_dist3 = __commonJS({
   "packages/plugin-runtime/dist/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.PluginConnection = exports2.PluginNode = exports2.PluginManifest = exports2.pluginDefinitionPath = exports2.loadPluginDefinition = exports2.startPlugin = exports2.definePlugin = exports2.validate = exports2.disposeServiceInstances = exports2.NodeError = exports2.start = exports2.runNode = exports2.defineConst = exports2.defineClass = exports2.defineService = exports2.defineNode = void 0;
+    exports2.NODE_BUILD_TARGET = exports2.NODE_ENGINE_RANGE = exports2.PluginConnection = exports2.PluginNode = exports2.PluginManifest = exports2.pluginDefinitionPath = exports2.loadPluginDefinition = exports2.startPlugin = exports2.definePlugin = exports2.validate = exports2.disposeServiceInstances = exports2.NodeError = exports2.start = exports2.runNode = exports2.defineConst = exports2.defineClass = exports2.defineService = exports2.defineNode = void 0;
     var node_js_1 = require_node();
     Object.defineProperty(exports2, "defineNode", { enumerable: true, get: function() {
       return node_js_1.defineNode;
@@ -14573,7 +16684,7 @@ var require_dist3 = __commonJS({
     Object.defineProperty(exports2, "disposeServiceInstances", { enumerable: true, get: function() {
       return runner_js_1.disposeServiceInstances;
     } });
-    var schema_js_1 = require_schema4();
+    var schema_js_1 = require_schema6();
     Object.defineProperty(exports2, "validate", { enumerable: true, get: function() {
       return schema_js_1.validate;
     } });
@@ -14601,6 +16712,13 @@ var require_dist3 = __commonJS({
     Object.defineProperty(exports2, "PluginConnection", { enumerable: true, get: function() {
       return schema_1.PluginConnection;
     } });
+    var constants_js_1 = require_constants10();
+    Object.defineProperty(exports2, "NODE_ENGINE_RANGE", { enumerable: true, get: function() {
+      return constants_js_1.NODE_ENGINE_RANGE;
+    } });
+    Object.defineProperty(exports2, "NODE_BUILD_TARGET", { enumerable: true, get: function() {
+      return constants_js_1.NODE_BUILD_TARGET;
+    } });
   }
 });
 
@@ -16256,7 +18374,7 @@ function extractPluginArchive(bytes, stage) {
 var import_tar4 = require("tar");
 var import_node_crypto5 = require("node:crypto");
 var import_schema6 = __toESM(require_dist());
-var RemoteRegistry = class {
+var RemoteRegistry = class _RemoteRegistry {
   constructor(opts = {}) {
     const baseUrl = opts.baseUrl ?? (0, import_common5.OCTONODE_MARKETPLACE_URL)() ?? import_common5.DEFAULT_MARKETPLACE_URL;
     if (!baseUrl) {
@@ -16271,11 +18389,17 @@ var RemoteRegistry = class {
     this.token = opts.token ?? (0, import_common5.OCTONODE_MARKETPLACE_TOKEN)();
     this.workspace = opts.workspace ?? (0, import_common5.OCTONODE_USER)()?.match(/^workspace:((?:user|org|team):.+)$/)?.[1];
   }
+  forWorkspace(destination) {
+    const workspace = `${destination.kind}:${destination.id}`;
+    if (this.workspace && this.workspace !== workspace)
+      throw new Error("Toolkit destination must match the registry workspace");
+    return this.workspace === workspace ? this : new _RemoteRegistry({ baseUrl: this.baseUrl, token: this.token, workspace });
+  }
   async request(path, init = {}) {
     const headers = new Headers(init.headers);
     if (this.token) headers.set("authorization", `Bearer ${this.token}`);
     const url = new URL(`${this.baseUrl}${path}`);
-    if (this.workspace && url.searchParams.get("catalog") !== "public" && (init.method === void 0 || init.method === "GET" || url.pathname.endsWith("/install")))
+    if (this.workspace && url.searchParams.get("catalog") !== "public" && (init.method === void 0 || init.method === "GET" || url.pathname.endsWith("/install") || url.pathname.endsWith("/resolve")))
       url.searchParams.set("workspace", this.workspace);
     const res = await fetch(url.toString(), {
       ...init,
@@ -16362,11 +18486,14 @@ var RemoteRegistry = class {
     return page.items.map((item) => import_schema6.ToolkitResolvedMember.parse(item));
   }
   async resolveToolkit(id, body) {
-    const response = await this.request(`/marketplace/toolkits/${encodeURIComponent(id)}/resolve`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(body)
-    });
+    const response = await this.forWorkspace(body.destination).request(
+      `/marketplace/toolkits/${encodeURIComponent(id)}/resolve`,
+      {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
     return import_schema6.ToolkitRelease.parse(await response.json());
   }
   async saveToolkit(definition, id, revision) {
@@ -16683,14 +18810,11 @@ async function installFromLock(opts = {}) {
     for (const toolkit of Object.values(lock.toolkits ?? {})) {
       try {
         if (opts.offline) throw new Error("Toolkit access must be reauthorized online before restore");
-        const resolved = await new RemoteRegistry({ baseUrl: toolkit.registry, token: opts.token }).resolveToolkit(
-          toolkit.id,
-          {
-            version: toolkit.version,
-            sha256: toolkit.sha256,
-            destination: toolkit.destination
-          }
-        );
+        const resolved = await new RemoteRegistry({ baseUrl: toolkit.registry, token: opts.token }).forWorkspace(toolkit.destination).resolveToolkit(toolkit.id, {
+          version: toolkit.version,
+          sha256: toolkit.sha256,
+          destination: toolkit.destination
+        });
         const release2 = (0, import_schema7.toolkitForMode)(resolved, toolkit.mode ?? "development");
         if (!(0, import_node_util3.isDeepStrictEqual)(release2.actions ?? [], toolkit.actions ?? []) || release2.plugins.length !== toolkit.plugins.length || release2.plugins.some((member) => {
           const pin = lock.plugins[member.alias];
@@ -16711,11 +18835,13 @@ async function installFromLock(opts = {}) {
         const id = pin.pluginId ?? alias;
         const remoteId = pin.remoteId ?? id;
         const registry = opts.registry ?? pin.registry;
+        const toolkit = Object.values(lock.toolkits ?? {}).find((entry) => entry.plugins.includes(alias));
+        const registryClient = registry ? new RemoteRegistry({ baseUrl: registry, token: opts.token }) : void 0;
+        const remote = toolkit ? registryClient?.forWorkspace(toolkit.destination) : registryClient;
         if (opts.frozen && opts.registry && opts.registry !== pin.registry)
           throw new Error("Frozen restore cannot change the registry");
         if (pin.scope && pin.scope !== "public" && registry) {
           if (opts.offline) throw new Error("Private plugin access must be reauthorized online before restore");
-          const remote = new RemoteRegistry({ baseUrl: registry, token: opts.token });
           if (!await remote.matchesLockedRelease(id, pin))
             throw new Error("Locked private release is not authorized or changed");
         }
@@ -16726,7 +18852,7 @@ async function installFromLock(opts = {}) {
         } else {
           if (opts.offline) throw new Error("Plugin " + alias + " is not in the offline cache");
           if (!registry) throw new Error(alias + " has no registry recorded; reinstall this local artifact");
-          const downloaded = await new RemoteRegistry({ baseUrl: registry, token: opts.token }).downloadBundle(
+          const downloaded = await remote.downloadBundle(
             remoteId,
             pin.version,
             pin.scope,