@qawolf/cli 1.24.0 → 1.25.0

package/dist/runner-sdk.js

@@ -5494,9 +5494,34 @@ var bigintProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("BigInt cannot be represented in JSON Schema");
   }
 };
+var symbolProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Symbols cannot be represented in JSON Schema");
+  }
+};
+var nullProcessor = (_schema, ctx, json, _params) => {
+  if (ctx.target === "openapi-3.0") {
+    json.type = "string";
+    json.nullable = true;
+    json.enum = [null];
+  } else {
+    json.type = "null";
+  }
+};
+var undefinedProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Undefined cannot be represented in JSON Schema");
+  }
+};
+var voidProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Void cannot be represented in JSON Schema");
+  }
+};
 var neverProcessor = (_schema, _ctx, json, _params) => {
   json.not = {};
 };
+var anyProcessor = (_schema, _ctx, _json, _params) => {};
 var unknownProcessor = (_schema, _ctx, _json, _params) => {};
 var dateProcessor = (_schema, ctx, _json, _params) => {
   if (ctx.unrepresentable === "throw") {
@@ -5550,16 +5575,71 @@ var literalProcessor = (schema, ctx, json, _params) => {
     json.enum = vals;
   }
 };
+var nanProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("NaN cannot be represented in JSON Schema");
+  }
+};
+var templateLiteralProcessor = (schema, _ctx, json, _params) => {
+  const _json = json;
+  const pattern = schema._zod.pattern;
+  if (!pattern)
+    throw new Error("Pattern not found in template literal");
+  _json.type = "string";
+  _json.pattern = pattern.source;
+};
+var fileProcessor = (schema, _ctx, json, _params) => {
+  const _json = json;
+  const file = {
+    type: "string",
+    format: "binary",
+    contentEncoding: "binary"
+  };
+  const { minimum, maximum, mime } = schema._zod.bag;
+  if (minimum !== undefined)
+    file.minLength = minimum;
+  if (maximum !== undefined)
+    file.maxLength = maximum;
+  if (mime) {
+    if (mime.length === 1) {
+      file.contentMediaType = mime[0];
+      Object.assign(_json, file);
+    } else {
+      Object.assign(_json, file);
+      _json.anyOf = mime.map((m) => ({ contentMediaType: m }));
+    }
+  } else {
+    Object.assign(_json, file);
+  }
+};
+var successProcessor = (_schema, _ctx, json, _params) => {
+  json.type = "boolean";
+};
 var customProcessor = (_schema, ctx, _json, _params) => {
   if (ctx.unrepresentable === "throw") {
     throw new Error("Custom types cannot be represented in JSON Schema");
   }
 };
+var functionProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Function types cannot be represented in JSON Schema");
+  }
+};
 var transformProcessor = (_schema, ctx, _json, _params) => {
   if (ctx.unrepresentable === "throw") {
     throw new Error("Transforms cannot be represented in JSON Schema");
   }
 };
+var mapProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Map cannot be represented in JSON Schema");
+  }
+};
+var setProcessor = (_schema, ctx, _json, _params) => {
+  if (ctx.unrepresentable === "throw") {
+    throw new Error("Set cannot be represented in JSON Schema");
+  }
+};
 var arrayProcessor = (schema, ctx, _json, params) => {
   const json = _json;
   const def = schema._zod.def;
@@ -5640,6 +5720,48 @@ var intersectionProcessor = (schema, ctx, json, params) => {
   ];
   json.allOf = allOf;
 };
+var tupleProcessor = (schema, ctx, _json, params) => {
+  const json = _json;
+  const def = schema._zod.def;
+  json.type = "array";
+  const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
+  const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
+  const prefixItems = def.items.map((x, i) => process2(x, ctx, {
+    ...params,
+    path: [...params.path, prefixPath, i]
+  }));
+  const rest = def.rest ? process2(def.rest, ctx, {
+    ...params,
+    path: [...params.path, restPath, ...ctx.target === "openapi-3.0" ? [def.items.length] : []]
+  }) : null;
+  if (ctx.target === "draft-2020-12") {
+    json.prefixItems = prefixItems;
+    if (rest) {
+      json.items = rest;
+    }
+  } else if (ctx.target === "openapi-3.0") {
+    json.items = {
+      anyOf: prefixItems
+    };
+    if (rest) {
+      json.items.anyOf.push(rest);
+    }
+    json.minItems = prefixItems.length;
+    if (!rest) {
+      json.maxItems = prefixItems.length;
+    }
+  } else {
+    json.items = prefixItems;
+    if (rest) {
+      json.additionalItems = rest;
+    }
+  }
+  const { minimum, maximum } = schema._zod.bag;
+  if (typeof minimum === "number")
+    json.minItems = minimum;
+  if (typeof maximum === "number")
+    json.maxItems = maximum;
+};
 var recordProcessor = (schema, ctx, _json, params) => {
   const json = _json;
   const def = schema._zod.def;
@@ -5736,6 +5858,12 @@ var readonlyProcessor = (schema, ctx, json, params) => {
   seen.ref = def.innerType;
   json.readOnly = true;
 };
+var promiseProcessor = (schema, ctx, _json, params) => {
+  const def = schema._zod.def;
+  process2(def.innerType, ctx, params);
+  const seen = ctx.seen.get(schema);
+  seen.ref = def.innerType;
+};
 var optionalProcessor = (schema, ctx, _json, params) => {
   const def = schema._zod.def;
   process2(def.innerType, ctx, params);
@@ -5748,6 +5876,81 @@ var lazyProcessor = (schema, ctx, _json, params) => {
   const seen = ctx.seen.get(schema);
   seen.ref = innerType;
 };
+var allProcessors = {
+  string: stringProcessor,
+  number: numberProcessor,
+  boolean: booleanProcessor,
+  bigint: bigintProcessor,
+  symbol: symbolProcessor,
+  null: nullProcessor,
+  undefined: undefinedProcessor,
+  void: voidProcessor,
+  never: neverProcessor,
+  any: anyProcessor,
+  unknown: unknownProcessor,
+  date: dateProcessor,
+  enum: enumProcessor,
+  literal: literalProcessor,
+  nan: nanProcessor,
+  template_literal: templateLiteralProcessor,
+  file: fileProcessor,
+  success: successProcessor,
+  custom: customProcessor,
+  function: functionProcessor,
+  transform: transformProcessor,
+  map: mapProcessor,
+  set: setProcessor,
+  array: arrayProcessor,
+  object: objectProcessor,
+  union: unionProcessor,
+  intersection: intersectionProcessor,
+  tuple: tupleProcessor,
+  record: recordProcessor,
+  nullable: nullableProcessor,
+  nonoptional: nonoptionalProcessor,
+  default: defaultProcessor,
+  prefault: prefaultProcessor,
+  catch: catchProcessor,
+  pipe: pipeProcessor,
+  readonly: readonlyProcessor,
+  promise: promiseProcessor,
+  optional: optionalProcessor,
+  lazy: lazyProcessor
+};
+function toJSONSchema(input, params) {
+  if ("_idmap" in input) {
+    const registry = input;
+    const ctx = initializeContext({ ...params, processors: allProcessors });
+    const defs = {};
+    for (const entry of registry._idmap.entries()) {
+      const [_, schema] = entry;
+      process2(schema, ctx);
+    }
+    const schemas = {};
+    const external = {
+      registry,
+      uri: params?.uri,
+      defs
+    };
+    ctx.external = external;
+    for (const entry of registry._idmap.entries()) {
+      const [key, schema] = entry;
+      extractDefs(ctx, schema);
+      schemas[key] = finalize(ctx, schema);
+    }
+    if (Object.keys(defs).length > 0) {
+      const defsSegment = ctx.target === "draft-2020-12" ? "$defs" : "definitions";
+      schemas.__shared = {
+        [defsSegment]: defs
+      };
+    }
+    return { schemas };
+  }
+  const ctx = initializeContext({ ...params, processors: allProcessors });
+  process2(input, ctx);
+  extractDefs(ctx, input);
+  return finalize(ctx, input);
+}
 // node_modules/zod/v4/classic/iso.js
 var exports_iso = {};
 __export(exports_iso, {
@@ -6833,6 +7036,10 @@ var identityResponse = union([
     user: never().optional()
   }).transform(({ organization }) => ({ organization }))
 ]);
+// node_modules/@qawolf/api-contracts/dist/v1/identity/organizations.js
+var identityOrganizationsResponse = object({
+  organizations: array(identityOrganization)
+});
 // node_modules/@qawolf/api-contracts/dist/v1/ids.js
 var defaultIdSchemas = {
   aiTask: string2().min(1).describe("The id of the AI task."),
@@ -8537,11 +8744,82 @@ var makeContractsV1 = (ids) => {
 };
 var publicContractsV1 = makeContractsV1(defaultIdSchemas);
 
+// src/core/pluralize.ts
+function pluralize(count, singular, plural = `${singular}s`) {
+  return `${String(count)} ${count === 1 ? singular : plural}`;
+}
+
 // src/core/formatSeconds.ts
 function formatSeconds(ms) {
   return `${Math.round(ms / 1000)}s`;
 }
 
+// src/core/messages/authErrors.ts
+var authErrorMessages = {
+  identity: {
+    invalidOrUnauthorized: "API key is invalid or unauthorized",
+    unexpectedFormat: "Could not verify API key: unexpected response format",
+    couldNotVerify: (detail, status) => `Could not verify API key: ${detail || `HTTP ${status}`}`,
+    couldNotVerifyNetwork: (cause) => `Could not verify API key: ${cause}`,
+    timedOut: (timeoutMs) => `Could not verify API key: the QA Wolf API did not answer within ${formatSeconds(timeoutMs)}.`
+  },
+  request: {
+    rejected401: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 401). Check your API key.`,
+    rejected402: (noun) => `QA Wolf API refused the${noun ? ` ${noun}` : ""} request (HTTP 402): billing prevented it.`,
+    rejected403: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 403). Check that your API key has access to this environment.`,
+    notFound404: (noun) => `QA Wolf API could not find ${noun ? `${noun} for that environment` : "that environment"} (HTTP 404). Check the --env value.`,
+    failedWithStatus: (status, noun) => `QA Wolf API${noun ? ` ${noun}` : ""} request failed (HTTP ${status}).`,
+    networkUnreachable: (baseUrl, noun) => `Could not reach the QA Wolf API at ${baseUrl}${noun ? ` to fetch ${noun}` : ""}. Check your network connection and QAWOLF_HOST_URL.`,
+    timedOut: (timeoutMs, noun) => `The QA Wolf API${noun ? ` ${noun}` : ""} request timed out after ${formatSeconds(timeoutMs)}. The work may still be finishing on the platform.`,
+    unexpectedResponse: (noun) => `Unexpected${noun ? ` ${noun}` : ""} response from the QA Wolf API.`
+  },
+  workos: {
+    unexpectedResponse: "WorkOS returned an unexpected response",
+    unexpectedResponseWithStatus: (status) => `WorkOS returned an unexpected response (HTTP ${status})`,
+    unreachable: (detail) => `Could not reach WorkOS: ${detail}`,
+    redirected: "WorkOS answered with a redirect, which the CLI does not follow for a sign-in request",
+    noClientForSession: "This session names no WorkOS client"
+  },
+  bundle: {
+    linkExpired: "The flow bundle download link has expired. Please run `qawolf flows pull` again to refresh.",
+    failedWithStatus: (status) => `Could not download the flow bundle (HTTP ${status}).`,
+    networkUnreachable: "Could not reach the flow bundle storage. Check your network connection and try again.",
+    timedOut: (timeoutMs) => `Downloading the flow bundle stalled — no data arrived for ${formatSeconds(timeoutMs)}. Please try again.`,
+    malformed: "The flow bundle download was malformed. Please run `qawolf flows pull` again."
+  }
+};
+
+// src/core/messages/whoami.ts
+var whoamiMessages = {
+  source: (source) => `Source: ${source}`,
+  authFailed: (source, error) => `Authentication failed (source: ${source}): ${error}`,
+  authenticatedAs: (teamName, source) => `Authenticated as ${teamName} (source: ${source})`,
+  teamNote: (input) => [
+    `Workspace: ${input.team.name}`,
+    `ID:        ${input.team.id}`,
+    input.team.slug ? `Slug:      ${input.team.slug}` : undefined,
+    input.teamUrl ? `URL:       ${input.teamUrl}` : undefined,
+    `Source:    ${input.source}`
+  ].filter((line) => Boolean(line)).join(`
+`),
+  organizationNote: (input) => [
+    `Organization: ${input.organization.name}`,
+    `ID:           ${input.organization.id}`,
+    `Source:       ${input.source}`
+  ].join(`
+`),
+  activeWorkspace: (workspaceId, found) => found ? `${found.workspace} (${found.organization})` : `${workspaceId} — no longer in reach; run 'qawolf auth switch'`,
+  userNote: (input) => [
+    `User:         ${input.user.email}`,
+    `ID:           ${input.user.id}`,
+    `Organization: ${input.organization.name}`,
+    input.activeWorkspace ? `Workspace:    ${input.activeWorkspace}` : undefined,
+    input.organizations.length > 0 ? `Workspaces:   ${input.organizations.map((o) => `${o.name}: ${o.workspaces.map((w) => w.name).join(", ")}`).join(" | ")}` : undefined,
+    `Source:       ${input.source}`
+  ].filter((line) => Boolean(line)).join(`
+`)
+};
+
 // src/core/messages/auth.ts
 var authMessages = {
   title: "QA Wolf Authentication",
@@ -8559,7 +8837,47 @@ var authMessages = {
   whoamiFailed: "Not authenticated",
   login: {
     nonInteractive: "auth login requires an interactive terminal. Set the QAWOLF_API_KEY environment variable for CI authentication.",
-    reAuthPrompt: "You are already authenticated. Re-authenticate?"
+    reAuthPrompt: "You are already authenticated. Re-authenticate?",
+    chooseMethod: "How do you want to sign in?",
+    methodBrowser: "Browser",
+    methodBrowserHint: "Sign in with your QA Wolf account",
+    methodApiKey: "API key",
+    methodApiKeyHint: "Paste a team key — needed for flows pull and flows run",
+    apiKeyPrecedence: {
+      env: "QAWOLF_API_KEY is set, and an API key takes precedence over a browser session. Commands continue to use that key until you unset the variable.",
+      stored: "A stored API key takes precedence over a browser session. Commands continue to use that key until you run 'qawolf auth logout' and sign in again."
+    }
+  },
+  device: {
+    unavailable: "This QA Wolf deployment does not offer browser sign-in. Run 'qawolf auth login' again and choose 'API key'.",
+    configUnreachable: "Could not ask this QA Wolf deployment whether it offers browser sign-in. Check your connection, then try again.",
+    confirmCode: (userCode) => `Your code is ${userCode}`,
+    visitUrl: (url) => `Confirm it at ${url}`,
+    visitUrlPlain: (url) => `Or go to ${url} and enter the code`,
+    openFailed: (url) => `Could not open a browser automatically. Open ${url} yourself to continue.`,
+    waiting: "Waiting for you to finish in the browser",
+    signedIn: (email) => `Signed in as ${email}.`,
+    failed: {
+      "access-denied": "The sign-in request was rejected.",
+      expired: "The sign-in request expired. Run 'qawolf auth login' to retry.",
+      timeout: "The sign-in request timed out. Run 'qawolf auth login' to retry.",
+      network: "Could not reach WorkOS to complete sign-in.",
+      unavailable: "Could not start browser sign-in.",
+      cancelled: "Sign-in cancelled."
+    }
+  },
+  workspace: {
+    chooseOrganization: "Which organization do you want to work in?",
+    choose: "Which workspace do you want to use?",
+    workspaceCount: (count) => pluralize(count, "workspace"),
+    working: (organization, workspace) => `Working in ${workspace} (${organization}).`,
+    none: "This account reaches no organizations yet.",
+    cancelled: "Workspace not changed.",
+    notSignedIn: "Workspace switching needs a browser sign-in. Run 'qawolf auth login' and choose Browser.",
+    sessionExpired: "Your session could not be renewed. Run 'qawolf auth login' to sign in again.",
+    nonInteractive: "auth switch needs an interactive terminal, or set QAWOLF_WORKSPACE to name a workspace.",
+    sessionChanged: "The stored sign-in changed while you made your choice. Run the command again.",
+    saveFailed: (detail) => `Could not save the workspace choice: ${detail}`
   },
   logout: {
     title: "Log Out",
@@ -8571,58 +8889,8 @@ var authMessages = {
     success: "Logged out successfully.",
     cancelled: "Logout cancelled."
   },
-  errors: {
-    identity: {
-      invalidOrUnauthorized: "API key is invalid or unauthorized",
-      unexpectedFormat: "Could not verify API key: unexpected response format",
-      couldNotVerify: (detail, status) => `Could not verify API key: ${detail || `HTTP ${status}`}`,
-      couldNotVerifyNetwork: (cause) => `Could not verify API key: ${cause}`,
-      timedOut: (timeoutMs) => `Could not verify API key: the QA Wolf API did not answer within ${formatSeconds(timeoutMs)}.`
-    },
-    request: {
-      rejected401: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 401). Check your API key.`,
-      rejected402: (noun) => `QA Wolf API refused the${noun ? ` ${noun}` : ""} request (HTTP 402): billing prevented it.`,
-      rejected403: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 403). Check that your API key has access to this environment.`,
-      notFound404: (noun) => `QA Wolf API could not find ${noun ? `${noun} for that environment` : "that environment"} (HTTP 404). Check the --env value.`,
-      failedWithStatus: (status, noun) => `QA Wolf API${noun ? ` ${noun}` : ""} request failed (HTTP ${status}).`,
-      networkUnreachable: (baseUrl, noun) => `Could not reach the QA Wolf API at ${baseUrl}${noun ? ` to fetch ${noun}` : ""}. Check your network connection and QAWOLF_HOST_URL.`,
-      timedOut: (timeoutMs, noun) => `The QA Wolf API${noun ? ` ${noun}` : ""} request timed out after ${formatSeconds(timeoutMs)}. The work may still be finishing on the platform.`,
-      unexpectedResponse: (noun) => `Unexpected${noun ? ` ${noun}` : ""} response from the QA Wolf API.`
-    },
-    bundle: {
-      linkExpired: "The flow bundle download link has expired. Please run `qawolf flows pull` again to refresh.",
-      failedWithStatus: (status) => `Could not download the flow bundle (HTTP ${status}).`,
-      networkUnreachable: "Could not reach the flow bundle storage. Check your network connection and try again.",
-      timedOut: (timeoutMs) => `Downloading the flow bundle stalled — no data arrived for ${formatSeconds(timeoutMs)}. Please try again.`,
-      malformed: "The flow bundle download was malformed. Please run `qawolf flows pull` again."
-    }
-  },
-  whoami: {
-    source: (source) => `Source: ${source}`,
-    authFailed: (source, error) => `Authentication failed (source: ${source}): ${error}`,
-    authenticatedAs: (teamName, source) => `Authenticated as ${teamName} (source: ${source})`,
-    teamNote: (input) => [
-      `Team:   ${input.team.name}`,
-      `ID:     ${input.team.id}`,
-      input.team.slug ? `Slug:   ${input.team.slug}` : undefined,
-      input.teamUrl ? `URL:    ${input.teamUrl}` : undefined,
-      `Source: ${input.source}`
-    ].filter((line) => Boolean(line)).join(`
-`),
-    organizationNote: (input) => [
-      `Organization: ${input.organization.name}`,
-      `ID:           ${input.organization.id}`,
-      `Source:       ${input.source}`
-    ].join(`
-`),
-    userNote: (input) => [
-      `User:         ${input.user.email}`,
-      `ID:           ${input.user.id}`,
-      `Organization: ${input.organization.name}`,
-      `Source:       ${input.source}`
-    ].join(`
-`)
-  }
+  errors: authErrorMessages,
+  whoami: whoamiMessages
 };
 // src/core/messages/toolNotFound.ts
 var installRemedy = "Run `qawolf install` to install the runtime dependencies.";
@@ -8638,11 +8906,6 @@ ${installRemedy}`;
 function packageLoadFailed(pkg, envDir, detail) {
   return toolNotRunnable(`Could not load ${pkg} from ${envDir}`, detail);
 }
-// src/core/pluralize.ts
-function pluralize(count, singular, plural = `${singular}s`) {
-  return `${String(count)} ${count === 1 ? singular : plural}`;
-}
-
 // src/core/messages/flows.ts
 var flowsMessages = {
   title: "Flows",
@@ -10365,6 +10628,176 @@ function makeDefaultFs() {
   };
 }
 
+// src/core/publicApi/flagKind.ts
+function flagKind(schema) {
+  if (schema.type === "string")
+    return { ok: true, kind: "string" };
+  if (schema.type === "number" || schema.type === "integer") {
+    return { ok: true, kind: "number" };
+  }
+  if (schema.type === "boolean")
+    return { ok: true, kind: "boolean" };
+  if (schema.type === "array") {
+    if (schema.items?.type !== "string") {
+      return {
+        ok: false,
+        reason: "only string arrays can be expressed as flags"
+      };
+    }
+    return { ok: true, kind: "string-array" };
+  }
+  if (schema.type === "object") {
+    if (schema.properties) {
+      return {
+        ok: false,
+        reason: "nested objects cannot be expressed as flags"
+      };
+    }
+    if (typeof schema.additionalProperties === "object" && schema.additionalProperties.type === "string") {
+      return { ok: true, kind: "key-value-record" };
+    }
+    return { ok: false, reason: "nested objects cannot be expressed as flags" };
+  }
+  return {
+    ok: false,
+    reason: `type ${schema.type ?? "unknown"} cannot be expressed as a flag`
+  };
+}
+
+// src/core/publicApi/objectShape.ts
+var asObjectShape = (schema) => schema.type === "object" && schema.properties ? { properties: schema.properties, required: new Set(schema.required) } : undefined;
+function mergeIntersection(members) {
+  const shape = { properties: {}, required: new Set };
+  for (const member of members) {
+    const memberShape = asObjectShape(member);
+    if (!memberShape) {
+      return {
+        ok: false,
+        field: "",
+        reason: "intersection members must be object schemas"
+      };
+    }
+    for (const [field, fieldSchema] of Object.entries(memberShape.properties)) {
+      if (field in shape.properties) {
+        return {
+          ok: false,
+          field,
+          reason: "field appears in multiple intersection members"
+        };
+      }
+      shape.properties[field] = fieldSchema;
+      if (memberShape.required.has(field))
+        shape.required.add(field);
+    }
+  }
+  return { ok: true, shape };
+}
+function mergeUnion(branches) {
+  const shapes = [];
+  for (const branch of branches) {
+    const branchShape = asObjectShape(branch);
+    if (!branchShape) {
+      return {
+        ok: false,
+        field: "",
+        reason: "union branches must be object schemas"
+      };
+    }
+    shapes.push(branchShape);
+  }
+  const shape = { properties: {}, required: new Set };
+  for (const branchShape of shapes) {
+    for (const [field, fieldSchema] of Object.entries(branchShape.properties)) {
+      const existing = shape.properties[field];
+      if (!existing) {
+        shape.properties[field] = { ...fieldSchema };
+        continue;
+      }
+      const kinds = [flagKind(existing), flagKind(fieldSchema)];
+      if (kinds[0]?.ok && kinds[1]?.ok) {
+        if (kinds[0].kind !== kinds[1].kind) {
+          return {
+            ok: false,
+            field,
+            reason: "field has conflicting types across union branches"
+          };
+        }
+      } else if (JSON.stringify({ ...existing, description: undefined }) !== JSON.stringify({ ...fieldSchema, description: undefined })) {
+        return {
+          ok: false,
+          field,
+          reason: "field has conflicting object schemas across union branches"
+        };
+      }
+      if (!existing.description && fieldSchema.description) {
+        existing.description = fieldSchema.description;
+      }
+    }
+  }
+  const discriminator = Object.keys(shape.properties).find((field) => {
+    const values = shapes.map((branch) => branch.properties[field]?.const);
+    return values.every((value) => typeof value === "string") && new Set(values).size === shapes.length && shapes.every((branch) => branch.required.has(field));
+  });
+  for (const [field, fieldSchema] of Object.entries(shape.properties)) {
+    const occurrences = shapes.filter((branch) => (field in branch.properties));
+    if (occurrences.length === shapes.length && occurrences.every((branch) => branch.required.has(field))) {
+      shape.required.add(field);
+    }
+    if (field === discriminator) {
+      const values = shapes.map((branch) => branch.properties[field]?.const);
+      fieldSchema.description = `One of: ${values.join(", ")}`;
+    }
+  }
+  return { ok: true, shape };
+}
+function toObjectShape(schema) {
+  if (schema.allOf)
+    return mergeIntersection(schema.allOf);
+  const branches = schema.oneOf ?? schema.anyOf;
+  if (branches)
+    return mergeUnion(branches);
+  const shape = asObjectShape(schema);
+  if (shape)
+    return { ok: true, shape };
+  return {
+    ok: false,
+    field: "",
+    reason: "contract input must be an object schema"
+  };
+}
+
+// src/shell/platform/applyWorkspaceId.ts
+var acceptsWorkspace = new WeakMap;
+function takesWorkspaceId(inputSchema) {
+  const cached = acceptsWorkspace.get(inputSchema);
+  if (cached !== undefined)
+    return cached;
+  let accepted = false;
+  try {
+    const jsonSchema = toJSONSchema(inputSchema, {
+      io: "input"
+    });
+    const shape = toObjectShape(jsonSchema);
+    accepted = shape.ok && "workspaceId" in shape.shape.properties;
+  } catch {
+    accepted = false;
+  }
+  acceptsWorkspace.set(inputSchema, accepted);
+  return accepted;
+}
+function applyWorkspaceId(inputSchema, input, workspaceId) {
+  if (!workspaceId)
+    return input;
+  if (typeof input !== "object" || input === null)
+    return input;
+  const existing = input.workspaceId;
+  if (existing !== undefined)
+    return input;
+  if (!takesWorkspaceId(inputSchema))
+    return input;
+  return { ...input, workspaceId };
+}
+
 // src/shell/platform/parseErrorBody.ts
 var defaultMaxLength = 1024;
 function asRecord(value) {
@@ -10497,7 +10930,7 @@ function callPublicApi(trpc, contract, input, options) {
 }
 function makeCallPublicApiMethod(trpc, deps, readBackoffMs) {
   return async (contract, input, options) => requestWithRetry({
-    call: () => callPublicApi(trpc, contract, input, options),
+    call: () => callPublicApi(trpc, contract, applyWorkspaceId(contract.input, input, deps.workspaceId), options),
     backoffMs: contract.kind === "read" ? readBackoffMs : [],
     describe: (err) => describeRequestError(err, deps.baseUrl, contract.name),
     sleep: deps.sleep
@@ -11497,10 +11930,16 @@ async function downloadBundle(signedUrl, deps) {
   return { ok: true, value: { tmpArchive } };
 }
 
-// src/shell/platform/getIdentity.ts
+// src/shell/platform/organizations.ts
+function parseOrganizationsResponse(json) {
+  const parsed = identityOrganizationsResponse.safeParse(json);
+  return parsed.success ? parsed.data.organizations : undefined;
+}
+
+// src/shell/platform/getAccessibleOrganizations.ts
 var timeoutMs = 1e4;
-async function getIdentity(apiKey, deps) {
-  const url = `${deps.baseUrl}/api/v0/identity`;
+async function getAccessibleOrganizations(apiKey, deps) {
+  const url = `${deps.baseUrl}/api/v0/identity/organizations`;
   let response;
   try {
     response = await deps.fetch(url, {
@@ -11511,6 +11950,51 @@ async function getIdentity(apiKey, deps) {
     if (isTimeoutError(error)) {
       return { ok: false, error: { kind: "timeout", timeoutMs } };
     }
+    return { ok: false, error: { kind: "network", cause: toError(error) } };
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    return {
+      ok: false,
+      error: { kind: "http", status: response.status, body }
+    };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return { ok: false, error: { kind: "timeout", timeoutMs } };
+    }
+    json = undefined;
+  }
+  const organizations = parseOrganizationsResponse(json);
+  if (!organizations) {
+    return {
+      ok: false,
+      error: {
+        kind: "parse",
+        cause: Error("organizations response did not match the contract")
+      }
+    };
+  }
+  return { ok: true, data: organizations };
+}
+
+// src/shell/platform/getIdentity.ts
+var timeoutMs2 = 1e4;
+async function getIdentity(apiKey, deps) {
+  const url = `${deps.baseUrl}/api/v0/identity`;
+  let response;
+  try {
+    response = await deps.fetch(url, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(timeoutMs2)
+    });
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs2 } };
+    }
     return {
       ok: false,
       error: { kind: "network", cause: toError(error) }
@@ -11528,7 +12012,7 @@ async function getIdentity(apiKey, deps) {
     json = await response.json();
   } catch (error) {
     if (isTimeoutError(error)) {
-      return { ok: false, error: { kind: "timeout", timeoutMs } };
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs2 } };
     }
     json = undefined;
   }
@@ -11539,6 +12023,24 @@ async function getIdentity(apiKey, deps) {
   return { ok: true, data: parsed.data };
 }
 
+// src/shell/platform/identityMethods.ts
+function createIdentityMethods(apiKey, deps, backoffMs) {
+  return {
+    getIdentity: () => requestWithRetry({
+      call: () => getIdentity(apiKey, deps),
+      backoffMs,
+      describe: describeIdentityError,
+      sleep: deps.sleep
+    }),
+    getAccessibleOrganizations: () => requestWithRetry({
+      call: () => getAccessibleOrganizations(apiKey, deps),
+      backoffMs,
+      describe: describeIdentityError,
+      sleep: deps.sleep
+    })
+  };
+}
+
 // src/shell/platform/types.ts
 var environmentListItemSchema = object({
   envId: string2(),
@@ -11838,14 +12340,7 @@ function createPlatformClient(apiKey, deps) {
     return { ok: true, value: { signedUrl: result.value.url } };
   }
   return {
-    async getIdentity() {
-      return requestWithRetry({
-        call: () => getIdentity(apiKey, deps),
-        backoffMs: requestBackoffMs2,
-        describe: describeIdentityError,
-        sleep: deps.sleep
-      });
-    },
+    ...createIdentityMethods(apiKey, deps, requestBackoffMs2),
     getFlowsBundleUrl: getFlowsBundleUrlImpl,
     callPublicApi: makeCallPublicApiMethod(trpc, deps, requestBackoffMs2),
     async getEnvVars(envId) {
@@ -12599,4 +13094,4 @@ export {
   createRunnerSdk
 };
 
-//# debugId=231C026DA9D7E0DD64756E2164756E21
+//# debugId=DD6DEC33C9C6693F64756E2164756E21