@paperclipai/server 2026.824.0 → 2026.825.0-beta.1

package/dist/routes/openapi.js

@@ -28,7 +28,7 @@ upsertSidebarOrderPreferenceSchema,
 // Execution workspaces
 reconcileExecutionWorkspaceBranchSchema, updateExecutionWorkspaceSchema, workspaceOverviewQuerySchema, workspaceRuntimeControlTargetSchema, 
 // Environments
-createEnvironmentSchema, cancelEnvironmentCustomImageSetupSessionSchema, createEnvironmentCustomImageTerminalSessionTokenSchema, environmentCustomImageSetupSessionSchema, environmentCustomImageTerminalSessionTokenSchema, environmentCustomImageTemplateSchema, finishEnvironmentCustomImageSetupSessionSchema, updateEnvironmentSchema, probeEnvironmentConfigSchema, startEnvironmentCustomImageSetupSessionSchema, 
+createEnvironmentSchema, cancelEnvironmentCustomImageSetupSessionSchema, createEnvironmentCustomImageTerminalSessionTokenSchema, environmentCustomImageSetupSessionSchema, environmentCustomImageTerminalSessionTokenSchema, environmentCustomImageTemplateSchema, finishEnvironmentCustomImageSetupSessionSchema, relinkEnvironmentCustomImageTemplateSchema, updateEnvironmentSchema, probeEnvironmentConfigSchema, startEnvironmentCustomImageSetupSessionSchema, 
 // Company skills
 companySkillCreateSchema, companySkillFileDeleteSchema, companySkillFileUpdateSchema, companySkillImportSchema, companySkillProjectBrowseRequestSchema, companySkillProjectBrowseResultSchema, companySkillProjectScanRequestSchema, companySkillProjectScanResultSchema, companySkillRenameResultSchema, companySkillRenameSchema, companySkillTestInputCreateSchema, companySkillTestInputUpdateSchema, companySkillTestRunCreateSchema, companySkillTestRunListQuerySchema, companySkillTestRunTemplateCreateSchema, companySkillTestRunTemplateUpdateSchema, evaluateSkillPolicySchema, replaceSkillPolicySchema, updateInboxAgentPolicySchema, 
 // Issue tree
@@ -54,141 +54,173 @@ createSecretProviderConfigSchema, updateSecretProviderConfigSchema, secretProvid
 // Tool access
 connectToolAppSchema, createToolApplicationSchema, updateToolApplicationSchema, createToolConnectionSchema, connectionTokenRequestSchema, startConnectionAuthorizationSchema, createToolStdioCommandTemplateSchema, disableToolStdioCommandTemplateSchema, finishToolAppSchema, reconnectToolAppSchema, updateToolConnectionSchema, putToolConnectionInstallsSchema, toolConnectionTestCallSchema, createToolPolicySchema, duplicateToolPolicySchema, createToolProfileBindingForProfileSchema, createToolProfileEntryForProfileSchema, createToolProfileWithEntriesSchema, deleteToolProfileSchema, duplicateToolProfileSchema, reorderToolPoliciesSchema, reviewToolProfileNewToolsSchema, updateToolPolicySchema, updateToolProfileEntrySchema, updateToolProfileWithEntriesSchema, createToolTrustRuleFromActionRequestSchema, revokeToolTrustRuleSchema, unbindToolProfileBindingSchema, importMcpJsonSchema, toolPolicyTestRequestSchema, createToolMcpGatewaySchema, startClaudeSetupTokenSessionRequestSchema, submitBrowserCodeRequestSchema, claudeSetupTokenSessionResponseSchema, claudeSetupTokenSessionPromptSchema, claudeSetupTokenSessionOwnerResponseSchema, claudeSetupTokenCompletionResponseSchema, claudeOAuthTokenStatusResponseSchema, } from "@paperclipai/shared";
 import { COMPANY_IMPORT_TRANSFERS_API_PATH, companyImportTransferDeclarationSchema, } from "@paperclipai/shared/company-import-transfer";
-const zodTypeName = (schema) => schema._def.typeName;
+const zodDef = (schema) => schema._def;
+const zodTypeName = (schema) => zodDef(schema).type;
 function unwrapSchema(schema) {
-    const typeName = zodTypeName(schema);
-    if (typeName === "ZodOptional" || typeName === "ZodDefault" || typeName === "ZodCatch") {
-        return unwrapSchema(schema._def.innerType);
+    const def = zodDef(schema);
+    if (def.type === "optional" || def.type === "default" || def.type === "catch") {
+        return unwrapSchema(def.innerType);
     }
-    if (typeName === "ZodEffects") {
-        return unwrapSchema(schema._def.schema);
+    // A `.transform()` or `.pipe()` becomes a pipe. Read the input schema so the
+    // published contract describes the value a client sends.
+    if (def.type === "pipe") {
+        return unwrapSchema(def.in);
     }
     return schema;
 }
 function isOptionalSchema(schema) {
-    const typeName = zodTypeName(schema);
-    if (typeName === "ZodOptional" || typeName === "ZodDefault" || typeName === "ZodCatch") {
+    const def = zodDef(schema);
+    if (def.type === "optional" || def.type === "default" || def.type === "catch") {
         return true;
     }
-    if (typeName === "ZodEffects") {
-        return isOptionalSchema(schema._def.schema);
+    if (def.type === "pipe") {
+        return isOptionalSchema(def.in);
     }
-    if (typeName === "ZodNullable") {
-        return isOptionalSchema(schema._def.innerType);
+    if (def.type === "nullable") {
+        return isOptionalSchema(def.innerType);
     }
     return false;
 }
+// Zod 4 stores each check as an object with a `_zod.def` that carries a `check`
+// name and the check members. Read that def to describe the constraint.
+function checkDef(check) {
+    return check._zod?.def;
+}
 function applyStringChecks(jsonSchema, checks) {
     for (const check of checks) {
-        if (check.kind === "min")
-            jsonSchema.minLength = check.value;
-        if (check.kind === "max")
-            jsonSchema.maxLength = check.value;
-        if (check.kind === "email")
-            jsonSchema.format = "email";
-        if (check.kind === "url")
-            jsonSchema.format = "uri";
-        if (check.kind === "uuid")
-            jsonSchema.format = "uuid";
-        if (check.kind === "datetime")
-            jsonSchema.format = "date-time";
-        if (check.kind === "regex" && check.regex instanceof RegExp) {
-            jsonSchema.pattern = check.regex.source;
+        const def = checkDef(check);
+        if (!def)
+            continue;
+        if (def.check === "min_length")
+            jsonSchema.minLength = def.minimum;
+        else if (def.check === "max_length")
+            jsonSchema.maxLength = def.maximum;
+        else if (def.check === "string_format") {
+            if (def.format === "email")
+                jsonSchema.format = "email";
+            else if (def.format === "url")
+                jsonSchema.format = "uri";
+            // Zod 3 `.uuid()` maps to `.guid()` in zod 4 to keep the loose UUID
+            // format. Publish both as the OpenAPI `uuid` format so the spec does not
+            // change.
+            else if (def.format === "uuid" || def.format === "guid")
+                jsonSchema.format = "uuid";
+            else if (def.format === "datetime")
+                jsonSchema.format = "date-time";
+            // Zod 4 stores a `.regex()` pattern as a `RegExp`; publish its source.
+            else if (def.format === "regex") {
+                if (def.pattern instanceof RegExp)
+                    jsonSchema.pattern = def.pattern.source;
+                else if (typeof def.pattern === "string")
+                    jsonSchema.pattern = def.pattern;
+            }
         }
     }
 }
 function applyNumberChecks(jsonSchema, checks) {
     for (const check of checks) {
-        if (check.kind === "int")
-            jsonSchema.type = "integer";
-        if (check.kind === "min") {
-            jsonSchema.minimum = check.value;
-            if (!check.inclusive)
+        const def = checkDef(check);
+        if (!def)
+            continue;
+        // `.int()` records a number-format check such as `safeint`.
+        if (def.check === "number_format") {
+            if (typeof def.format === "string" && def.format.includes("int")) {
+                jsonSchema.type = "integer";
+            }
+        }
+        else if (def.check === "greater_than") {
+            jsonSchema.minimum = def.value;
+            if (!def.inclusive)
                 jsonSchema.exclusiveMinimum = true;
         }
-        if (check.kind === "max") {
-            jsonSchema.maximum = check.value;
-            if (!check.inclusive)
+        else if (def.check === "less_than") {
+            jsonSchema.maximum = def.value;
+            if (!def.inclusive)
                 jsonSchema.exclusiveMaximum = true;
         }
     }
 }
 function zodToOpenApiSchema(schema) {
     const unwrapped = unwrapSchema(schema);
-    const typeName = zodTypeName(unwrapped);
-    if (typeName === "ZodString") {
+    const def = zodDef(unwrapped);
+    const typeName = def.type;
+    if (typeName === "string") {
         const jsonSchema = { type: "string" };
-        applyStringChecks(jsonSchema, unwrapped._def.checks ?? []);
+        applyStringChecks(jsonSchema, def.checks ?? []);
         return jsonSchema;
     }
-    if (typeName === "ZodNumber") {
+    if (typeName === "number") {
         const jsonSchema = { type: "number" };
-        applyNumberChecks(jsonSchema, unwrapped._def.checks ?? []);
+        applyNumberChecks(jsonSchema, def.checks ?? []);
         return jsonSchema;
     }
-    if (typeName === "ZodBoolean")
+    if (typeName === "boolean")
         return { type: "boolean" };
-    if (typeName === "ZodDate")
+    if (typeName === "date")
         return { type: "string", format: "date-time" };
-    if (typeName === "ZodAny" || typeName === "ZodUnknown")
+    if (typeName === "any" || typeName === "unknown")
         return {};
-    if (typeName === "ZodLiteral") {
-        const value = unwrapped._def.value;
-        return { type: typeof value, enum: [value] };
-    }
-    if (typeName === "ZodEnum") {
-        return { type: "string", enum: unwrapped._def.values };
+    if (typeName === "literal") {
+        const values = def.values;
+        return { type: typeof values[0], enum: values };
     }
-    if (typeName === "ZodNativeEnum") {
-        const values = Object.values(unwrapped._def.values).filter((value) => typeof value === "string" || typeof value === "number");
-        return { enum: Array.from(new Set(values)) };
+    // Zod 4 merges string enums and native enums into one `enum` type and stores
+    // the members on `entries`. A pure string enum keeps `type: "string"`; a
+    // native enum can hold numbers, so it publishes the values without a type.
+    if (typeName === "enum") {
+        const values = Array.from(new Set(Object.values(def.entries).filter((value) => typeof value === "string" || typeof value === "number")));
+        if (values.every((value) => typeof value === "string")) {
+            return { type: "string", enum: values };
+        }
+        return { enum: values };
     }
-    if (typeName === "ZodArray") {
-        return { type: "array", items: zodToOpenApiSchema(unwrapped._def.type) };
+    if (typeName === "array") {
+        return { type: "array", items: zodToOpenApiSchema(def.element) };
     }
-    if (typeName === "ZodRecord") {
+    if (typeName === "record") {
         return {
             type: "object",
-            additionalProperties: zodToOpenApiSchema(unwrapped._def.valueType),
+            additionalProperties: zodToOpenApiSchema(def.valueType),
         };
     }
-    if (typeName === "ZodNullable") {
-        return { ...zodToOpenApiSchema(unwrapped._def.innerType), nullable: true };
-    }
-    if (typeName === "ZodUnion") {
-        return { oneOf: unwrapped._def.options.map((option) => zodToOpenApiSchema(option)) };
+    if (typeName === "nullable") {
+        return { ...zodToOpenApiSchema(def.innerType), nullable: true };
     }
-    if (typeName === "ZodDiscriminatedUnion") {
+    // Zod 4 represents a plain union and a discriminated union as one `union`
+    // type with the members on `options`.
+    if (typeName === "union") {
         return {
-            oneOf: Array.from(unwrapped._def.options.values()).map((option) => zodToOpenApiSchema(option)),
+            oneOf: def.options.map((option) => zodToOpenApiSchema(option)),
         };
     }
-    if (typeName === "ZodIntersection") {
+    if (typeName === "intersection") {
         return {
             allOf: [
-                zodToOpenApiSchema(unwrapped._def.left),
-                zodToOpenApiSchema(unwrapped._def.right),
+                zodToOpenApiSchema(def.left),
+                zodToOpenApiSchema(def.right),
             ],
         };
     }
-    if (typeName === "ZodObject") {
-        const shape = unwrapped._def.shape();
+    if (typeName === "object") {
+        const shape = def.shape;
         const properties = {};
         const required = [];
         for (const [key, value] of Object.entries(shape)) {
-            const propertySchema = value;
-            properties[key] = zodToOpenApiSchema(propertySchema);
-            if (!isOptionalSchema(propertySchema))
+            properties[key] = zodToOpenApiSchema(value);
+            if (!isOptionalSchema(value))
                 required.push(key);
         }
         const jsonSchema = { type: "object", properties };
         if (required.length > 0)
             jsonSchema.required = required;
-        // A `.strict()` Zod object forbids an unknown key. Publish that constraint
-        // as `additionalProperties: false`, so a client, a gateway, or a handler
-        // that treats the contract as authoritative rejects an extra property too.
-        if (unwrapped._def.unknownKeys === "strict")
+        // A `.strict()` Zod object forbids an unknown key. Zod 4 records that as a
+        // `never` catchall. Publish the constraint as `additionalProperties: false`,
+        // so a client, a gateway, or a handler that treats the contract as
+        // authoritative rejects an extra property too.
+        const catchall = def.catchall;
+        if (catchall && zodDef(catchall).type === "never") {
             jsonSchema.additionalProperties = false;
+        }
         return jsonSchema;
     }
     return {};
@@ -226,9 +258,9 @@ function normalizeResponses(responses = {}) {
 }
 function parametersFromSchema(schema, location) {
     const objectSchema = unwrapSchema(schema);
-    if (zodTypeName(objectSchema) !== "ZodObject")
+    if (zodTypeName(objectSchema) !== "object")
         return [];
-    const shape = objectSchema._def.shape();
+    const shape = zodDef(objectSchema).shape;
     return Object.entries(shape).map(([name, value]) => ({
         name,
         in: location,
@@ -281,7 +313,7 @@ const registry = new OpenAPIRegistry();
 // ─── Common schemas ──────────────────────────────────────────────────────────
 const ErrorSchema = registry.register("Error", z.object({ error: z.string() }));
 const responses = {
-    ok: (schema = z.record(z.unknown())) => ({
+    ok: (schema = z.record(z.string(), z.unknown())) => ({
         description: "Success",
         content: { "application/json": { schema } },
     }),
@@ -306,6 +338,14 @@ const responses = {
         description: "Conflict",
         content: { "application/json": { schema: ErrorSchema } },
     },
+    payloadTooLarge: {
+        description: "Payload too large",
+        content: { "application/json": { schema: ErrorSchema } },
+    },
+    unsupportedMediaType: {
+        description: "Unsupported media type",
+        content: { "application/json": { schema: ErrorSchema } },
+    },
     unprocessable: {
         description: "Unprocessable entity",
         content: { "application/json": { schema: ErrorSchema } },
@@ -357,10 +397,10 @@ const importRequestBody = (schema) => ({
 });
 const r = responses;
 const externalObjectSummariesBodySchema = z.object({
-    issueIds: z.array(z.string().uuid()).max(1000),
+    issueIds: z.array(z.string().guid()).max(1000),
 }).strict();
 const refreshExternalObjectsBodySchema = z.object({
-    objectIds: z.array(z.string().uuid()).max(50).optional(),
+    objectIds: z.array(z.string().guid()).max(50).optional(),
 }).strict();
 // The start route reads the body directly, so document the accepted fields
 // here. A sandbox environment is required. The time-to-live is optional.
@@ -390,13 +430,17 @@ const environmentCustomImageTemplateRollbackResultSchema = z.object({
     activeTemplate: environmentCustomImageTemplateSchema,
     supersededTemplate: environmentCustomImageTemplateSchema,
 }).strict();
+const environmentCustomImageTemplateRelinkResultSchema = z.object({
+    template: environmentCustomImageTemplateSchema,
+    classification: z.enum(["knob_only", "boot_source_drift", "unclassified"]),
+}).strict();
 const workTimelineQuerySchema = z.object({
     from: z.string().optional(),
     to: z.string().optional(),
     userId: z.string().optional(),
-    goalId: z.string().uuid().optional(),
-    projectId: z.string().uuid().optional(),
-    issueId: z.string().uuid().optional(),
+    goalId: z.string().guid().optional(),
+    projectId: z.string().guid().optional(),
+    issueId: z.string().guid().optional(),
     limit: z.string().optional(),
     offset: z.string().optional(),
 }).strict();
@@ -536,6 +580,7 @@ const BOARD_ONLY_OPERATIONS = new Set([
     "PATCH /api/companies/{companyId}/members/{memberId}/permissions",
     "GET /api/companies/{companyId}/user-directory",
     "POST /api/execution-workspaces/{id}/reconcile-branch",
+    "POST /api/execution-workspaces/{id}/login-handoff",
     "GET /api/board-api-keys",
     "POST /api/board-api-keys",
     "DELETE /api/board-api-keys/{keyId}",
@@ -1368,6 +1413,7 @@ registry.registerPath({
 });
 const AgentSecretListResponseSchema = z.object({
     secrets: z.array(z.object({
+        secretRef: z.string().guid(),
         key: z.string(),
         name: z.string(),
         description: z.string().nullable(),
@@ -1388,19 +1434,29 @@ const createAgentSecretProposalSchema = z.discriminatedUnion("kind", [
     }),
     z.object({
         kind: z.literal("binding"),
-        secretId: z.string().uuid().optional(),
-        secretProposalId: z.string().uuid().optional(),
-        targetAgentId: z.string().uuid().optional(),
+        secretId: z.string().guid().optional(),
+        sourceConfigPath: z.string().min(1).optional(),
+        secretProposalId: z.string().guid().optional(),
+        targetAgentId: z.string().guid().optional(),
         configPath: z.string().min(1),
         justification: z.string().min(1),
     }),
-]);
+]).superRefine((value, ctx) => {
+    if (value.kind === "binding"
+        && [value.secretId, value.sourceConfigPath, value.secretProposalId]
+            .filter((reference) => Boolean(reference)).length !== 1) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "Provide exactly one of secretId, sourceConfigPath, or secretProposalId",
+        });
+    }
+});
 const approveSecretProposalSchema = z.object({
     cascade: z.boolean().optional(),
     overrides: z.object({
         name: z.string().min(1).optional(),
         description: z.string().optional().nullable(),
-        providerConfigId: z.string().uuid().optional().nullable(),
+        providerConfigId: z.string().guid().optional().nullable(),
     }).optional(),
 });
 const rejectSecretProposalSchema = z.object({ reason: z.string().min(1) });
@@ -1424,7 +1480,7 @@ registry.registerPath({
     path: "/api/agents/me/secret-proposals/{id}",
     tags: ["secrets"],
     summary: "Withdraw a pending secret proposal",
-    request: { params: z.object({ id: z.string().uuid() }) },
+    request: { params: z.object({ id: z.string().guid() }) },
     responses: { 200: r.ok(), 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict },
 });
 registry.registerPath({
@@ -1808,7 +1864,7 @@ registry.registerPath({
         params: z.object({ companyId: z.string() }),
         body: jsonBody(createIssueSchema),
     },
-    responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
+    responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 422: r.unprocessable },
 });
 registry.registerPath({
     method: "get",
@@ -1827,7 +1883,7 @@ registry.registerPath({
         params: z.object({ id: z.string() }),
         body: jsonBody(updateIssueSchema.partial()),
     },
-    responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 404: r.notFound },
+    responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 404: r.notFound, 422: r.unprocessable },
 });
 registry.registerPath({
     method: "post",
@@ -1909,6 +1965,24 @@ registry.registerPath({
     },
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
 });
+registry.registerPath({
+    method: "post",
+    path: "/api/issues/{id}/work-products/{workProductId}/review-document",
+    tags: ["issues"],
+    summary: "Ensure the review document for a Markdown work product",
+    request: { params: z.object({ id: z.string(), workProductId: z.string() }) },
+    responses: {
+        200: r.ok(),
+        201: r.ok(),
+        401: r.unauthorized,
+        403: r.forbidden,
+        404: r.notFound,
+        409: r.conflict,
+        413: r.payloadTooLarge,
+        415: r.unsupportedMediaType,
+        422: r.unprocessable,
+    },
+});
 registry.registerPath({
     method: "patch",
     path: "/api/work-products/{id}",
@@ -2384,7 +2458,7 @@ registry.registerPath({
         params: z.object({ id: z.string() }),
         body: jsonBody(runRoutineSchema),
     },
-    responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
+    responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 422: r.unprocessable },
 });
 registry.registerPath({
     method: "post",
@@ -2524,7 +2598,7 @@ registry.registerPath({
     tags: ["secrets"],
     summary: "List company secret proposals for board review",
     request: {
-        params: z.object({ companyId: z.string().uuid() }),
+        params: z.object({ companyId: z.string().guid() }),
         query: z.object({ status: z.enum(["pending", "approved", "rejected", "withdrawn", "expired"]).optional() }),
     },
     responses: { 200: r.ok(), 401: r.unauthorized, 403: r.forbidden },
@@ -2535,7 +2609,7 @@ registry.registerPath({
     tags: ["secrets"],
     summary: "Approve and execute a secret proposal as the approving board user",
     request: {
-        params: z.object({ companyId: z.string().uuid(), id: z.string().uuid() }),
+        params: z.object({ companyId: z.string().guid(), id: z.string().guid() }),
         body: jsonBody(approveSecretProposalSchema),
     },
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict, 422: r.unprocessable },
@@ -2546,7 +2620,7 @@ registry.registerPath({
     tags: ["secrets"],
     summary: "Reject a pending secret proposal and dependent bindings",
     request: {
-        params: z.object({ companyId: z.string().uuid(), id: z.string().uuid() }),
+        params: z.object({ companyId: z.string().guid(), id: z.string().guid() }),
         body: jsonBody(rejectSecretProposalSchema),
     },
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict, 422: r.unprocessable },
@@ -2882,9 +2956,9 @@ registry.registerPath({
     request: {
         params: z.object({ companyId: z.string() }),
         query: z.object({
-            agentId: z.string().uuid().optional(),
+            agentId: z.string().guid().optional(),
             responsibleUserId: z.string().min(1).optional(),
-            runId: z.string().uuid().optional(),
+            runId: z.string().guid().optional(),
             entityType: z.string().min(1).optional(),
             entityId: z.string().min(1).optional(),
             action: z.string().min(1).optional(),
@@ -2905,9 +2979,9 @@ registry.registerPath({
     request: {
         params: z.object({ companyId: z.string() }),
         query: z.object({
-            agentId: z.string().uuid().optional(),
+            agentId: z.string().guid().optional(),
             responsibleUserId: z.string().min(1).optional(),
-            runId: z.string().uuid().optional(),
+            runId: z.string().guid().optional(),
             entityType: z.string().min(1).optional(),
             entityId: z.string().min(1).optional(),
             action: z.string().min(1).optional(),
@@ -2941,8 +3015,8 @@ registry.registerPath({
             action: z.string().min(1),
             entityType: z.string().min(1),
             entityId: z.string().min(1),
-            agentId: z.string().uuid().optional().nullable(),
-            details: z.record(z.unknown()).optional().nullable(),
+            agentId: z.string().guid().optional().nullable(),
+            details: z.record(z.string(), z.unknown()).optional().nullable(),
         })),
     },
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
@@ -3274,9 +3348,9 @@ registerCurrentRoute({
     summary: "List decisions",
     query: z.object({
         status: z.enum(["open", "decided", "expired", "cancelled"]).optional(),
-        bundleId: z.string().uuid().optional(),
-        targetIssueId: z.string().uuid().optional(),
-        originAgentId: z.string().uuid().optional(),
+        bundleId: z.string().guid().optional(),
+        targetIssueId: z.string().guid().optional(),
+        originAgentId: z.string().guid().optional(),
         limit: z.coerce.number().int().positive().max(100).optional(),
     }),
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden },
@@ -3288,7 +3362,7 @@ registerCurrentRoute({
     summary: "Get decision telemetry grouped by rule key",
     query: z.object({
         groupBy: z.literal("ruleKey"),
-        originAgentId: z.string().uuid().optional(),
+        originAgentId: z.string().guid().optional(),
         since: z.string().datetime().optional(),
     }),
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden },
@@ -3336,8 +3410,8 @@ registerCurrentRoute({
     summary: "Capture a decision training example",
     body: z.object({
         sourceKind: decisionTrainingSourceKindSchema,
-        sourceId: z.string().uuid(),
-        issueId: z.string().uuid(),
+        sourceId: z.string().guid(),
+        issueId: z.string().guid(),
         notes: z.string().max(100_000).default(""),
     }).strict(),
     responses: { 201: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict },
@@ -3349,8 +3423,8 @@ registerCurrentRoute({
     summary: "Preview a decision training snapshot",
     body: z.object({
         sourceKind: decisionTrainingSourceKindSchema,
-        sourceId: z.string().uuid(),
-        issueId: z.string().uuid(),
+        sourceId: z.string().guid(),
+        issueId: z.string().guid(),
     }).strict(),
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict },
 });
@@ -3360,7 +3434,7 @@ registerCurrentRoute({
     tags: ["decision-training"],
     summary: "List decision training examples",
     query: z.object({
-        project: z.string().uuid().optional(),
+        project: z.string().guid().optional(),
         kind: decisionTrainingSourceKindSchema.optional(),
         author: z.string().optional(),
         q: z.string().max(500).optional(),
@@ -4101,7 +4175,7 @@ registry.registerPath({
     tags: ["issues"],
     summary: "Create child issues",
     request: { params: z.object({ id: z.string() }), body: jsonBody(createChildIssueSchema) },
-    responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
+    responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 422: r.unprocessable },
 });
 registry.registerPath({
     method: "post",
@@ -4624,6 +4698,32 @@ registry.registerPath({
     },
     responses: { 200: r.ok(), 401: r.unauthorized, 403: r.forbidden, 422: r.unprocessable },
 });
+registry.registerPath({
+    method: "post",
+    path: "/api/execution-workspaces/{id}/login-handoff",
+    tags: ["execution-workspaces"],
+    summary: "Issue a single-use workspace login handoff",
+    description: "Mints a short-lived, single-use ticket the isolated workspace exchanges for its own "
+        + "instance-scoped session, so opening a managed workspace does not depend on a cloned "
+        + "password. Board actors only. The response `url` must be navigated to, not stored: the "
+        + "workspace answers it with a redirect so the ticket never enters browser history. A refusal "
+        + "carries a machine `reason` and, where the control plane probed it, the workspace's own "
+        + "readiness.",
+    request: {
+        params: z.object({ id: z.string() }),
+        body: jsonBody(z.object({
+            next: z.string().optional().describe("Same-origin path to land on; anything else collapses to `/`."),
+        })),
+    },
+    responses: {
+        201: r.ok(),
+        401: r.unauthorized,
+        403: r.forbidden,
+        404: r.notFound,
+        409: r.conflict,
+        501: r.serverError,
+    },
+});
 registry.registerPath({
     method: "post",
     path: "/api/execution-workspaces/{id}/runtime-services/{action}",
@@ -4864,6 +4964,25 @@ registry.registerPath({
         404: r.notFound,
     },
 });
+registry.registerPath({
+    method: "post",
+    path: "/api/environments/{environmentId}/custom-image-template/relink",
+    tags: ["environments"],
+    summary: "Relink a detached environment customImage template to the current config",
+    request: {
+        params: z.object({ environmentId: z.string() }),
+        query: environmentCustomImageCompanyQuerySchema,
+        body: jsonBody(relinkEnvironmentCustomImageTemplateSchema),
+    },
+    responses: {
+        200: r.ok(environmentCustomImageTemplateRelinkResultSchema),
+        400: r.badRequest,
+        401: r.unauthorized,
+        403: r.forbidden,
+        404: r.notFound,
+        409: r.conflict,
+    },
+});
 registry.registerPath({
     method: "delete",
     path: "/api/environments/{environmentId}/custom-image-template",
@@ -4993,7 +5112,7 @@ registry.registerPath({
     request: {
         body: jsonBody(z.object({
             tool: z.string(),
-            parameters: z.record(z.unknown()).optional(),
+            parameters: z.record(z.string(), z.unknown()).optional(),
             runContext: z.object({
                 agentId: z.string(),
                 runId: z.string(),
@@ -5092,7 +5211,7 @@ registry.registerPath({
     summary: "Set company-scoped plugin config",
     request: {
         params: z.object({ pluginId: z.string() }),
-        body: jsonBody(z.object({ companyId: z.string(), configJson: z.record(z.unknown()) })),
+        body: jsonBody(z.object({ companyId: z.string(), configJson: z.record(z.string(), z.unknown()) })),
     },
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
 });
@@ -5103,7 +5222,7 @@ registry.registerPath({
     summary: "Test company-scoped plugin config",
     request: {
         params: z.object({ pluginId: z.string() }),
-        body: jsonBody(z.object({ companyId: z.string(), configJson: z.record(z.unknown()) })),
+        body: jsonBody(z.object({ companyId: z.string(), configJson: z.record(z.string(), z.unknown()) })),
     },
     responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
 });
@@ -5159,7 +5278,7 @@ registry.registerPath({
         body: jsonBody(z.object({
             key: z.string(),
             companyId: z.string().optional(),
-            params: z.record(z.unknown()).optional(),
+            params: z.record(z.string(), z.unknown()).optional(),
         })),
     },
     responses: { 200: r.ok(), 401: r.unauthorized },
@@ -5174,7 +5293,7 @@ registry.registerPath({
         body: jsonBody(z.object({
             key: z.string(),
             companyId: z.string().optional(),
-            params: z.record(z.unknown()).optional(),
+            params: z.record(z.string(), z.unknown()).optional(),
         })),
     },
     responses: { 200: r.ok(), 401: r.unauthorized },
@@ -5188,7 +5307,7 @@ registry.registerPath({
         params: z.object({ pluginId: z.string(), key: z.string() }),
         body: jsonBody(z.object({
             companyId: z.string().optional(),
-            params: z.record(z.unknown()).optional(),
+            params: z.record(z.string(), z.unknown()).optional(),
         })),
     },
     responses: { 200: r.ok(), 401: r.unauthorized },
@@ -5202,7 +5321,7 @@ registry.registerPath({
         params: z.object({ pluginId: z.string(), key: z.string() }),
         body: jsonBody(z.object({
             companyId: z.string().optional(),
-            params: z.record(z.unknown()).optional(),
+            params: z.record(z.string(), z.unknown()).optional(),
         })),
     },
     responses: { 200: r.ok(), 401: r.unauthorized },
@@ -5880,7 +5999,7 @@ for (const route of [
         path: route[1],
         tags: ["skills"],
         summary: route[2],
-        ...(route[0] === "post" ? { body: z.record(z.unknown()).optional() } : {}),
+        ...(route[0] === "post" ? { body: z.record(z.string(), z.unknown()).optional() } : {}),
     });
 }
 registerCurrentRoute({
@@ -5946,7 +6065,7 @@ registerCurrentRoute({
     summary: "Promote quarantined low-trust output",
     body: z.object({
         sourceArtifactKind: z.enum(["comment", "document", "work_product", "issue"]),
-        sourceArtifactId: z.string().uuid(),
+        sourceArtifactId: z.string().guid(),
         title: z.string().trim().min(1).max(200),
         summary: z.string().trim().min(1).max(8_000),
     }),
@@ -6571,7 +6690,7 @@ const toolGatewaySessionSchema = z.object({
 });
 const toolGatewayCallSchema = z.object({
     tool: z.string(),
-    parameters: z.record(z.unknown()).optional(),
+    parameters: z.record(z.string(), z.unknown()).optional(),
     timeoutMs: z.number().int().positive().optional(),
     approvedActionRequestId: z.string().optional(),
     idempotencyKey: z.string().optional(),
@@ -6582,7 +6701,7 @@ const toolGatewayCompanyQuerySchema = z.object({
 const toolGatewayCompanyBodySchema = z.object({
     companyId: z.string(),
 }).passthrough();
-const mcpGatewayProtocolSchema = z.record(z.unknown());
+const mcpGatewayProtocolSchema = z.record(z.string(), z.unknown());
 registerCurrentRoute({
     method: "get",
     path: "/mcp/gateways/{gatewayPublicId}",