@starlein/paperclip-plugin-company-wizard 0.4.18 → 0.4.21

package/dist/worker.js

@@ -4,7 +4,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// node_modules/.pnpm/@paperclipai+plugin-sdk@2026.529.0_react@19.2.4/node_modules/@paperclipai/plugin-sdk/dist/define-plugin.js
+// node_modules/.pnpm/@paperclipai+plugin-sdk@2026.707.0_react@19.2.4/node_modules/@paperclipai/plugin-sdk/dist/define-plugin.js
 function definePlugin(definition) {
   return Object.freeze({ definition });
 }
@@ -4050,7 +4050,7 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/constants.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/constants.js
 var COMPANY_STATUSES = ["active", "paused", "archived"];
 var DEFAULT_COMPANY_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
 var MAX_COMPANY_ATTACHMENT_MAX_BYTES = 1024 * 1024 * 1024;
@@ -4075,6 +4075,8 @@ var AGENT_ADAPTER_TYPES = [
   "codex_local",
   "cursor_cloud",
   "gemini_local",
+  "hermes_gateway",
+  "hermes_local",
   "opencode_local",
   "pi_local",
   "cursor",
@@ -4138,6 +4140,47 @@ var AGENT_ICON_NAMES = [
   "pentagon",
   "fingerprint"
 ];
+var PROJECT_ICON_NAMES = [
+  "folder",
+  "rocket",
+  "code",
+  "terminal",
+  "database",
+  "globe",
+  "package",
+  "boxes",
+  "box",
+  "layers",
+  "briefcase",
+  "compass",
+  "target",
+  "flame",
+  "zap",
+  "star",
+  "bug",
+  "wrench",
+  "hammer",
+  "lightbulb",
+  "sparkles",
+  "shield",
+  "lock",
+  "search",
+  "cog",
+  "brain",
+  "cpu",
+  "git-branch",
+  "file-code",
+  "puzzle",
+  "gem",
+  "atom",
+  "heart",
+  "mail",
+  "message-square",
+  "crown",
+  "radar",
+  "telescope",
+  "hexagon"
+];
 var ISSUE_STATUSES = [
   "backlog",
   "todo",
@@ -4157,7 +4200,7 @@ var INBOX_MINE_ISSUE_STATUSES = [
 ];
 var INBOX_MINE_ISSUE_STATUS_FILTER = INBOX_MINE_ISSUE_STATUSES.join(",");
 var ISSUE_PRIORITIES = ["critical", "high", "medium", "low"];
-var ISSUE_WORK_MODES = ["standard", "planning"];
+var ISSUE_WORK_MODES = ["standard", "ask", "planning"];
 var MAX_ISSUE_REQUEST_DEPTH = 1024;
 var ISSUE_COMMENT_AUTHOR_TYPES = ["user", "agent", "system"];
 var ISSUE_COMMENT_PRESENTATION_KINDS = ["message", "system_notice"];
@@ -4178,8 +4221,10 @@ function clampIssueRequestDepth(value) {
 var ISSUE_THREAD_INTERACTION_KINDS = [
   "suggest_tasks",
   "ask_user_questions",
-  "request_confirmation"
+  "request_confirmation",
+  "request_checkbox_confirmation"
 ];
+var REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT = 200;
 var ISSUE_THREAD_INTERACTION_STATUSES = [
   "pending",
   "accepted",
@@ -4194,10 +4239,13 @@ var ISSUE_THREAD_INTERACTION_CONTINUATION_POLICIES = [
   "wake_assignee",
   "wake_assignee_on_accept"
 ];
+var ISSUE_WATCHDOG_DISCOVERY_KINDS = ["product_bug", "platform_bug"];
 var ISSUE_SURFACE_VISIBILITIES = ["default", "plugin_operation"];
 var ISSUE_RECOVERY_ACTION_KINDS = [
   "missing_disposition",
   "stranded_assigned_issue",
+  "workspace_validation",
+  "configuration_validation",
   "active_run_watchdog",
   "issue_graph_liveness"
 ];
@@ -4224,7 +4272,11 @@ var ISSUE_RECOVERY_ACTION_OUTCOMES = [
 var ISSUE_TREE_CONTROL_MODES = ["pause", "resume", "cancel", "restore"];
 var ISSUE_TREE_HOLD_RELEASE_POLICY_STRATEGIES = ["manual", "after_active_runs_finish"];
 var ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY = "continuation-summary";
-var SYSTEM_ISSUE_DOCUMENT_KEYS = [ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY];
+var PIPELINE_CASE_BODY_DOCUMENT_KEY = "pipeline-case-body";
+var SYSTEM_ISSUE_DOCUMENT_KEYS = [
+  ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY,
+  PIPELINE_CASE_BODY_DOCUMENT_KEY
+];
 var SYSTEM_ISSUE_DOCUMENT_KEY_SET = new Set(SYSTEM_ISSUE_DOCUMENT_KEYS);
 var DOCUMENT_ANNOTATION_THREAD_STATUSES = ["open", "resolved"];
 var DOCUMENT_ANNOTATION_ANCHOR_STATES = ["active", "stale", "orphaned"];
@@ -4235,6 +4287,43 @@ var DOCUMENT_ANNOTATION_ANCHOR_CONFIDENCES = [
   "ambiguous",
   "missing"
 ];
+var EXTERNAL_OBJECT_STATUS_CATEGORIES = [
+  "unknown",
+  "open",
+  "waiting",
+  "running",
+  "succeeded",
+  "failed",
+  "blocked",
+  "closed",
+  "archived",
+  "auth_required",
+  "unreachable"
+];
+var EXTERNAL_OBJECT_STATUS_TONES = [
+  "neutral",
+  "info",
+  "success",
+  "warning",
+  "danger",
+  "muted"
+];
+var EXTERNAL_OBJECT_LIVENESS_STATES = [
+  "unknown",
+  "fresh",
+  "stale",
+  "auth_required",
+  "unreachable"
+];
+var EXTERNAL_OBJECT_MENTION_SOURCE_KINDS = [
+  "title",
+  "description",
+  "comment",
+  "document",
+  "property",
+  "plugin"
+];
+var EXTERNAL_OBJECT_MENTION_CONFIDENCES = ["exact", "likely", "possible"];
 var ISSUE_EXECUTION_POLICY_MODES = ["normal", "auto"];
 var ISSUE_EXECUTION_STAGE_TYPES = ["review", "approval"];
 var ISSUE_MONITOR_SCHEDULED_BY = ["assignee", "board"];
@@ -4269,14 +4358,40 @@ var PROJECT_STATUSES = [
 ];
 var ENVIRONMENT_DRIVERS = ["local", "ssh", "sandbox", "plugin"];
 var ENVIRONMENT_STATUSES = ["active", "archived"];
-var ENVIRONMENT_LEASE_STATUSES = ["active", "released", "expired", "failed", "retained"];
+var ENVIRONMENT_LEASE_STATUSES = ["active", "released", "expired", "failed", "retained", "pending_cleanup"];
 var ENVIRONMENT_LEASE_CLEANUP_STATUSES = ["pending", "success", "failed"];
+var ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_KINDS = [
+  "snapshot",
+  "image",
+  "provider_template",
+  "unknown"
+];
+var ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_STATUSES = [
+  "active",
+  "superseded",
+  "revoked",
+  "failed"
+];
+var ENVIRONMENT_CUSTOM_IMAGE_SETUP_SESSION_STATUSES = [
+  "starting",
+  "waiting_for_user",
+  "capturing",
+  "promoted",
+  "cancelled",
+  "timed_out",
+  "failed"
+];
+var ENVIRONMENT_CUSTOM_IMAGE_SETUP_CONNECTION_TYPES = [
+  "ssh",
+  "browser_terminal",
+  "unknown"
+];
 var ROUTINE_STATUSES = ["active", "paused", "archived"];
 var ROUTINE_CONCURRENCY_POLICIES = ["coalesce_if_active", "always_enqueue", "skip_if_active"];
 var ROUTINE_CATCH_UP_POLICIES = ["skip_missed", "enqueue_missed_with_cap"];
 var ROUTINE_TRIGGER_KINDS = ["schedule", "webhook", "api"];
 var ROUTINE_TRIGGER_SIGNING_MODES = ["bearer", "hmac_sha256", "github_hmac", "none"];
-var ROUTINE_VARIABLE_TYPES = ["text", "textarea", "number", "boolean", "select"];
+var ROUTINE_VARIABLE_TYPES = ["text", "textarea", "number", "boolean", "select", "date"];
 var APPROVAL_TYPES = [
   "hire_agent",
   "approve_ceo_strategy",
@@ -4364,12 +4479,14 @@ var JOIN_REQUEST_TYPES = ["human", "agent"];
 var JOIN_REQUEST_STATUSES = ["pending_approval", "approved", "rejected"];
 var PERMISSION_KEYS = [
   "agents:create",
+  "skills:create",
   "environments:manage",
   "users:invite",
   "users:manage_permissions",
   "tasks:assign",
   "tasks:assign_scope",
   "tasks:manage_active_checkouts",
+  "pipelines:write",
   "joins:approve"
 ];
 var PLUGIN_STATUSES = [
@@ -4439,6 +4556,10 @@ var PLUGIN_CAPABILITIES = [
   "telemetry.track",
   "database.namespace.migrate",
   "database.namespace.write",
+  "external.objects.detect",
+  "external.objects.read",
+  "external.objects.write",
+  "external.objects.refresh",
   // Plugin State
   "plugin.state.read",
   "plugin.state.write",
@@ -4502,6 +4623,8 @@ var PLUGIN_UI_SLOT_TYPES = [
   "settingsPage",
   "companySettingsPage"
 ];
+var WORKSPACE_OVERVIEW_DEFAULT_LIMIT = 50;
+var WORKSPACE_OVERVIEW_MAX_LIMIT = 100;
 var PLUGIN_RESERVED_COMPANY_ROUTE_SEGMENTS = [
   "dashboard",
   "onboarding",
@@ -4518,6 +4641,7 @@ var PLUGIN_RESERVED_COMPANY_ROUTE_SEGMENTS = [
   "costs",
   "activity",
   "inbox",
+  "workspaces",
   "design-guide",
   "tests"
 ];
@@ -4527,7 +4651,8 @@ var PLUGIN_RESERVED_COMPANY_SETTINGS_ROUTE_SEGMENTS = [
   "access",
   "members",
   "invites",
-  "secrets"
+  "secrets",
+  "instance"
 ];
 var PLUGIN_LAUNCHER_PLACEMENT_ZONES = [
   "page",
@@ -4587,11 +4712,17 @@ var PLUGIN_STATE_SCOPE_KINDS = [
   "run"
 ];
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/adapter-type.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/adapter-type.js
 var agentAdapterTypeSchema = external_exports.string().trim().min(1).default("process").describe(`Known built-in adapters: ${AGENT_ADAPTER_TYPES.join(", ")}. External adapters may register additional non-empty string types at runtime.`);
 var optionalAgentAdapterTypeSchema = external_exports.string().trim().min(1).optional();
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/network-bind.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/trust-policy.js
+var TRUST_PRESETS = ["standard", "low_trust_review"];
+var LOW_TRUST_REVIEW_PRESET = "low_trust_review";
+var LOW_TRUST_REVIEW_PRESET_VERSION = 1;
+var LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION = "quarantine";
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/network-bind.js
 function normalizeHost(host) {
   const trimmed = host?.trim();
   return trimmed ? trimmed : void 0;
@@ -4634,7 +4765,7 @@ function validateConfiguredBindMode(input) {
   return errors;
 }
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/types/instance.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/types/instance.js
 var DAILY_RETENTION_PRESETS = [3, 7, 14];
 var WEEKLY_RETENTION_PRESETS = [1, 2, 4];
 var MONTHLY_RETENTION_PRESETS = [1, 3, 6];
@@ -4647,13 +4778,13 @@ var DEFAULT_BACKUP_RETENTION = {
   monthlyMonths: 1
 };
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/types/search.js
-var COMPANY_SEARCH_SCOPES = ["all", "issues", "comments", "documents", "agents", "projects"];
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/types/search.js
+var COMPANY_SEARCH_SCOPES = ["all", "issues", "comments", "documents", "artifacts", "agents", "projects"];
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/types/resource-memberships.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/types/resource-memberships.js
 var RESOURCE_MEMBERSHIP_STATES = ["joined", "left"];
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/sidebar-preferences.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/sidebar-preferences.js
 var sidebarOrderedIdSchema = external_exports.string().uuid();
 var sidebarOrderPreferenceSchema = external_exports.object({
   orderedIds: external_exports.array(sidebarOrderedIdSchema),
@@ -4663,13 +4794,19 @@ var upsertSidebarOrderPreferenceSchema = external_exports.object({
   orderedIds: external_exports.array(sidebarOrderedIdSchema)
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/resource-memberships.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/resource-memberships.js
 var resourceMembershipStateSchema = external_exports.enum(RESOURCE_MEMBERSHIP_STATES);
 var updateResourceMembershipSchema = external_exports.object({
-  state: resourceMembershipStateSchema
+  state: resourceMembershipStateSchema.optional(),
+  starred: external_exports.boolean().optional()
+}).refine((value) => value.state !== void 0 || value.starred !== void 0, {
+  message: "state or starred is required"
+}).refine((value) => !(value.state === "left" && value.starred === true), {
+  message: "starred resources must be joined",
+  path: ["starred"]
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/execution-workspace.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/execution-workspace.js
 var executionWorkspaceStatusSchema = external_exports.enum([
   "active",
   "idle",
@@ -4677,6 +4814,23 @@ var executionWorkspaceStatusSchema = external_exports.enum([
   "archived",
   "cleanup_failed"
 ]);
+var workspaceOverviewStatusFilterSchema = external_exports.preprocess((value) => {
+  if (value === void 0 || value === null)
+    return void 0;
+  const rawValues = Array.isArray(value) ? value : [value];
+  const statuses = rawValues.flatMap((entry) => {
+    if (typeof entry !== "string")
+      return [];
+    return entry.split(",").map((part) => part.trim()).filter(Boolean);
+  });
+  return statuses.length > 0 ? statuses : void 0;
+}, external_exports.array(executionWorkspaceStatusSchema).optional());
+var workspaceOverviewQuerySchema = external_exports.object({
+  projectId: external_exports.string().uuid().optional(),
+  status: workspaceOverviewStatusFilterSchema,
+  limit: external_exports.coerce.number().int().min(1).max(WORKSPACE_OVERVIEW_MAX_LIMIT).optional().default(WORKSPACE_OVERVIEW_DEFAULT_LIMIT),
+  offset: external_exports.coerce.number().int().min(0).optional().default(0)
+}).strict();
 var executionWorkspaceConfigSchema = external_exports.object({
   environmentId: external_exports.string().uuid().optional().nullable(),
   provisionCommand: external_exports.string().optional().nullable(),
@@ -4789,14 +4943,14 @@ var updateExecutionWorkspaceSchema = external_exports.object({
   metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
 }).strict();
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/types/feedback.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/types/feedback.js
 var FEEDBACK_TARGET_TYPES = ["issue_comment", "issue_document_revision"];
 var FEEDBACK_VOTE_VALUES = ["up", "down"];
 var FEEDBACK_DATA_SHARING_PREFERENCES = ["allowed", "not_allowed", "prompt"];
 var DEFAULT_FEEDBACK_DATA_SHARING_PREFERENCE = "prompt";
 var FEEDBACK_TRACE_STATUSES = ["local_only", "pending", "sent", "failed"];
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/feedback.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/feedback.js
 var feedbackTargetTypeSchema = external_exports.enum(FEEDBACK_TARGET_TYPES);
 var feedbackTraceStatusSchema = external_exports.enum(FEEDBACK_TRACE_STATUSES);
 var feedbackVoteValueSchema = external_exports.enum(FEEDBACK_VOTE_VALUES);
@@ -4809,7 +4963,7 @@ var upsertIssueFeedbackVoteSchema = external_exports.object({
   allowSharing: external_exports.boolean().optional()
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/instance.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/instance.js
 function presetSchema(presets, label) {
   return external_exports.number().refine((v) => presets.includes(v), { message: `${label} must be one of: ${presets.join(", ")}` });
 }
@@ -4822,24 +4976,46 @@ var instanceGeneralSettingsSchema = external_exports.object({
   censorUsernameInLogs: external_exports.boolean().default(false),
   keyboardShortcuts: external_exports.boolean().default(false),
   feedbackDataSharingPreference: feedbackDataSharingPreferenceSchema.default(DEFAULT_FEEDBACK_DATA_SHARING_PREFERENCE),
-  backupRetention: backupRetentionPolicySchema.default(DEFAULT_BACKUP_RETENTION)
+  backupRetention: backupRetentionPolicySchema.default(DEFAULT_BACKUP_RETENTION),
+  // Execution policy. Absent/"any" = unrestricted; "kubernetes" forces the
+  // Kubernetes sandbox provider and denies local/ssh execution (cloud_tenant).
+  executionMode: external_exports.enum(["kubernetes", "any"]).optional()
 }).strict();
 var patchInstanceGeneralSettingsSchema = instanceGeneralSettingsSchema.partial();
 var instanceExperimentalSettingsSchema = external_exports.object({
   enableEnvironments: external_exports.boolean().default(false),
   enableIsolatedWorkspaces: external_exports.boolean().default(false),
+  enableStreamlinedLeftNavigation: external_exports.boolean().default(true),
+  enablePipelines: external_exports.boolean().default(false),
+  enableConferenceRoomChat: external_exports.boolean().default(false),
+  enableTaskWatchdogs: external_exports.boolean().default(false),
   enableIssuePlanDecompositions: external_exports.boolean().default(false),
+  enableExperimentalFileViewer: external_exports.boolean().default(false),
   enableCloudSync: external_exports.boolean().default(false),
+  enableExternalObjects: external_exports.boolean().default(false),
+  enableServerInfoDebugView: external_exports.boolean().default(false),
   autoRestartDevServerWhenIdle: external_exports.boolean().default(false),
   enableIssueGraphLivenessAutoRecovery: external_exports.boolean().default(false),
+  enableWorkspaceBranchReconcileForward: external_exports.boolean().default(false),
   issueGraphLivenessAutoRecoveryLookbackHours: external_exports.number().int().min(MIN_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS).max(MAX_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS).default(DEFAULT_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS)
 }).strict();
 var patchInstanceExperimentalSettingsSchema = instanceExperimentalSettingsSchema.partial();
+var patchInstanceSettingsSchema = external_exports.object({
+  defaultEnvironmentId: external_exports.string().uuid().nullable().optional()
+}).strict();
 var issueGraphLivenessAutoRecoveryRequestSchema = external_exports.object({
   lookbackHours: external_exports.number().int().min(MIN_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS).max(MAX_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS).optional()
 }).strict();
+var instanceSettingsSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  defaultEnvironmentId: external_exports.string().uuid().nullable(),
+  general: instanceGeneralSettingsSchema,
+  experimental: instanceExperimentalSettingsSchema,
+  createdAt: external_exports.union([external_exports.date(), external_exports.string().datetime()]),
+  updatedAt: external_exports.union([external_exports.date(), external_exports.string().datetime()])
+}).strict();
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/budget.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/budget.js
 var upsertBudgetPolicySchema = external_exports.object({
   scopeType: external_exports.enum(BUDGET_SCOPE_TYPES),
   scopeId: external_exports.string().uuid(),
@@ -4865,7 +5041,7 @@ var resolveBudgetIncidentSchema = external_exports.object({
   }
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/company.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/company.js
 var logoAssetIdSchema = external_exports.string().uuid().nullable().optional();
 var brandColorSchema = external_exports.string().regex(/^#[0-9a-fA-F]{6}$/).nullable().optional();
 var feedbackDataSharingTermsVersionSchema = external_exports.string().min(1).nullable().optional();
@@ -4874,7 +5050,8 @@ var createCompanySchema = external_exports.object({
   name: external_exports.string().min(1),
   description: external_exports.string().optional().nullable(),
   budgetMonthlyCents: external_exports.number().int().nonnegative().optional().default(0),
-  attachmentMaxBytes: attachmentMaxBytesSchema.optional()
+  attachmentMaxBytes: attachmentMaxBytesSchema.optional(),
+  defaultResponsibleUserId: external_exports.string().min(1).nullable().optional()
 });
 var updateCompanySchema = createCompanySchema.partial().extend({
   status: external_exports.enum(COMPANY_STATUSES).optional(),
@@ -4895,109 +5072,622 @@ var updateCompanyBrandingSchema = external_exports.object({
   logoAssetId: logoAssetIdSchema
 }).strict().refine((value) => value.name !== void 0 || value.description !== void 0 || value.brandColor !== void 0 || value.logoAssetId !== void 0, "At least one branding field must be provided");
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/environment.js
-var environmentDriverSchema = external_exports.enum(ENVIRONMENT_DRIVERS);
-var environmentStatusSchema = external_exports.enum(ENVIRONMENT_STATUSES);
-var environmentLeaseStatusSchema = external_exports.enum(ENVIRONMENT_LEASE_STATUSES);
-var environmentLeaseCleanupStatusSchema = external_exports.enum(ENVIRONMENT_LEASE_CLEANUP_STATUSES);
-var environmentFields = {
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/secret.js
+var secretKeySchema = external_exports.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9_.-]+$/);
+var secretVersionSelectorSchema = external_exports.union([external_exports.literal("latest"), external_exports.number().int().positive()]);
+var creatableSecretStatusSchema = external_exports.enum(["active", "disabled", "archived"]);
+var envBindingPlainSchema = external_exports.object({
+  type: external_exports.literal("plain"),
+  value: external_exports.string()
+});
+var envBindingSecretRefSchema = external_exports.object({
+  type: external_exports.literal("secret_ref"),
+  secretId: external_exports.string().uuid(),
+  version: secretVersionSelectorSchema.optional()
+});
+var envBindingUserSecretRefSchema = external_exports.object({
+  type: external_exports.literal("user_secret_ref"),
+  key: secretKeySchema,
+  version: secretVersionSelectorSchema.optional(),
+  required: external_exports.boolean().optional().default(true),
+  allowMissingOverride: external_exports.boolean().optional().default(false)
+});
+var envBindingSchema = external_exports.union([
+  external_exports.string(),
+  envBindingPlainSchema,
+  envBindingSecretRefSchema,
+  envBindingUserSecretRefSchema
+]);
+var envConfigSchema = external_exports.record(external_exports.string(), envBindingSchema);
+var createSecretSchema = external_exports.object({
   name: external_exports.string().min(1),
+  key: secretKeySchema.optional(),
+  provider: external_exports.enum(SECRET_PROVIDERS).optional(),
+  providerConfigId: external_exports.string().uuid().optional().nullable(),
+  managedMode: external_exports.enum(SECRET_MANAGED_MODES).optional(),
+  value: external_exports.string().min(1).optional().nullable(),
   description: external_exports.string().optional().nullable(),
-  driver: environmentDriverSchema,
-  status: environmentStatusSchema.optional().default("active"),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional().default({}),
-  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
-};
-var createEnvironmentSchema = external_exports.object(environmentFields).strict();
-var updateEnvironmentSchema = external_exports.object({
-  name: external_exports.string().min(1).optional(),
-  description: external_exports.string().optional().nullable(),
-  driver: environmentDriverSchema.optional(),
-  status: environmentStatusSchema.optional(),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
-}).strict();
-var probeEnvironmentConfigSchema = external_exports.object({
+  externalRef: external_exports.string().optional().nullable(),
+  providerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
+  providerVersionRef: external_exports.string().optional().nullable()
+}).superRefine((value, ctx) => {
+  if ((value.managedMode ?? "paperclip_managed") === "external_reference") {
+    if (!value.externalRef?.trim()) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["externalRef"],
+        message: "External reference secrets require externalRef"
+      });
+    }
+    return;
+  }
+  if (value.externalRef?.trim()) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["externalRef"],
+      message: "Managed secrets cannot set externalRef"
+    });
+  }
+  if (!value.value?.trim()) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["value"],
+      message: "Managed secrets require value"
+    });
+  }
+});
+function requireSecretRotationInput(value, ctx) {
+  if (!value.value?.trim() && !value.externalRef?.trim() && value.providerVersionRef == null && value.providerConfigId == null) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["value"],
+      message: "Secret rotation requires value, externalRef, providerVersionRef, or providerConfigId"
+    });
+  }
+}
+var rotateSecretSchema = external_exports.object({
+  value: external_exports.string().min(1).optional().nullable(),
+  externalRef: external_exports.string().optional().nullable(),
+  providerVersionRef: external_exports.string().optional().nullable(),
+  providerConfigId: external_exports.string().uuid().optional().nullable()
+}).superRefine(requireSecretRotationInput);
+var updateSecretSchema = external_exports.object({
   name: external_exports.string().min(1).optional(),
+  key: secretKeySchema.optional(),
+  status: external_exports.enum(SECRET_STATUSES).optional(),
+  providerConfigId: external_exports.string().uuid().optional().nullable(),
   description: external_exports.string().optional().nullable(),
-  driver: environmentDriverSchema,
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional().default({}),
-  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
-}).strict();
-
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/company-skill.js
-var companySkillSourceTypeSchema = external_exports.enum(["local_path", "github", "url", "catalog", "skills_sh"]);
-var companySkillTrustLevelSchema = external_exports.enum(["markdown_only", "assets", "scripts_executables"]);
-var companySkillCompatibilitySchema = external_exports.enum(["compatible", "unknown", "invalid"]);
-var companySkillSourceBadgeSchema = external_exports.enum(["paperclip", "github", "local", "url", "catalog", "skills_sh"]);
-var companySkillFileInventoryEntrySchema = external_exports.object({
-  path: external_exports.string().min(1),
-  kind: external_exports.enum(["skill", "markdown", "reference", "script", "asset", "other"])
+  externalRef: external_exports.string().optional().nullable(),
+  providerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
 });
-var companySkillSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  companyId: external_exports.string().uuid(),
-  key: external_exports.string().min(1),
-  slug: external_exports.string().min(1),
-  name: external_exports.string().min(1),
-  description: external_exports.string().nullable(),
-  markdown: external_exports.string(),
-  sourceType: companySkillSourceTypeSchema,
-  sourceLocator: external_exports.string().nullable(),
-  sourceRef: external_exports.string().nullable(),
-  trustLevel: companySkillTrustLevelSchema,
-  compatibility: companySkillCompatibilitySchema,
-  fileInventory: external_exports.array(companySkillFileInventoryEntrySchema).default([]),
-  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
-  createdAt: external_exports.coerce.date(),
-  updatedAt: external_exports.coerce.date()
+var secretBindingTargetSchema = external_exports.object({
+  targetType: external_exports.enum(SECRET_BINDING_TARGET_TYPES),
+  targetId: external_exports.string().min(1),
+  configPath: external_exports.string().min(1)
 });
-var companySkillListItemSchema = companySkillSchema.extend({
-  attachedAgentCount: external_exports.number().int().nonnegative(),
-  editable: external_exports.boolean(),
-  editableReason: external_exports.string().nullable(),
-  sourceLabel: external_exports.string().nullable(),
-  sourceBadge: companySkillSourceBadgeSchema,
-  catalogKind: external_exports.enum(["bundled", "optional"]).nullable(),
-  originHash: external_exports.string().nullable(),
-  packageName: external_exports.string().nullable(),
-  packageVersion: external_exports.string().nullable()
+var createSecretBindingSchema = secretBindingTargetSchema.extend({
+  secretId: external_exports.string().uuid(),
+  versionSelector: secretVersionSelectorSchema.default("latest"),
+  required: external_exports.boolean().default(true),
+  label: external_exports.string().optional().nullable()
 });
-var companySkillUsageAgentSchema = external_exports.object({
-  id: external_exports.string().uuid(),
-  name: external_exports.string().min(1),
-  urlKey: external_exports.string().min(1),
-  adapterType: external_exports.string().min(1),
-  desired: external_exports.boolean(),
-  actualState: external_exports.string().nullable().describe("Runtime adapter skill state when explicitly fetched; company skill detail reads return null without probing agent runtimes.")
+var createUserSecretDefinitionSchema = external_exports.object({
+  key: secretKeySchema,
+  name: external_exports.string().trim().min(1).max(160),
+  description: external_exports.string().trim().max(500).optional().nullable(),
+  status: creatableSecretStatusSchema.optional(),
+  provider: external_exports.enum(SECRET_PROVIDERS).optional(),
+  providerConfigId: external_exports.string().uuid().optional().nullable(),
+  managedMode: external_exports.enum(SECRET_MANAGED_MODES).optional(),
+  providerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
+  usageGuidance: external_exports.string().trim().max(1e3).optional().nullable()
 });
-var companySkillDetailSchema = companySkillSchema.extend({
-  attachedAgentCount: external_exports.number().int().nonnegative(),
-  usedByAgents: external_exports.array(companySkillUsageAgentSchema).default([]),
-  editable: external_exports.boolean(),
-  editableReason: external_exports.string().nullable(),
-  sourceLabel: external_exports.string().nullable(),
-  sourceBadge: companySkillSourceBadgeSchema
+var updateUserSecretDefinitionSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(160).optional(),
+  description: external_exports.string().trim().max(500).optional().nullable(),
+  status: external_exports.enum(SECRET_STATUSES).optional(),
+  providerConfigId: external_exports.string().uuid().optional().nullable(),
+  providerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
+  usageGuidance: external_exports.string().trim().max(1e3).optional().nullable()
 });
-var companySkillUpdateStatusSchema = external_exports.object({
-  supported: external_exports.boolean(),
-  reason: external_exports.string().nullable(),
-  trackingRef: external_exports.string().nullable(),
-  currentRef: external_exports.string().nullable(),
-  latestRef: external_exports.string().nullable(),
-  hasUpdate: external_exports.boolean(),
-  installedHash: external_exports.string().nullable(),
-  originHash: external_exports.string().nullable(),
-  userModifiedAt: external_exports.string().nullable(),
-  updateHoldReason: external_exports.enum([
-    "local_modifications",
-    "audit_hard_stop",
-    "origin_unavailable",
-    "compatibility_invalid",
-    "operator_hold"
-  ]).nullable(),
-  auditVerdict: external_exports.enum(["pass", "warning", "fail"]).nullable(),
-  auditCodes: external_exports.array(external_exports.string())
+var createUserSecretValueSchema = external_exports.object({
+  definitionKey: secretKeySchema.optional(),
+  definitionId: external_exports.string().uuid().optional(),
+  value: external_exports.string().min(1).optional().nullable(),
+  externalRef: external_exports.string().optional().nullable(),
+  providerVersionRef: external_exports.string().optional().nullable(),
+  providerConfigId: external_exports.string().uuid().optional().nullable()
+}).superRefine((value, ctx) => {
+  if (!value.definitionKey && !value.definitionId) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["definitionId"],
+      message: "User secret value requires definitionId or definitionKey"
+    });
+  }
+  if (!value.value?.trim() && !value.externalRef?.trim()) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["value"],
+      message: "User secret value requires value or externalRef"
+    });
+  }
+});
+var updateUserSecretValueSchema = external_exports.object({
+  status: external_exports.enum(SECRET_STATUSES).optional(),
+  value: external_exports.string().min(1).optional().nullable(),
+  externalRef: external_exports.string().min(1).optional().nullable(),
+  providerVersionRef: external_exports.string().min(1).optional().nullable(),
+  providerConfigId: external_exports.string().uuid().optional().nullable()
+});
+var rotateUserSecretValueSchema = external_exports.object({
+  value: external_exports.string().min(1).optional().nullable(),
+  externalRef: external_exports.string().min(1).optional().nullable(),
+  providerVersionRef: external_exports.string().min(1).optional().nullable(),
+  providerConfigId: external_exports.string().uuid().optional().nullable()
+}).superRefine(requireSecretRotationInput);
+var createUserSecretDeclarationSchema = secretBindingTargetSchema.extend({
+  definitionKey: secretKeySchema,
+  envKey: external_exports.string().trim().min(1),
+  versionSelector: secretVersionSelectorSchema.default("latest"),
+  required: external_exports.boolean().default(true),
+  allowMissingOverride: external_exports.boolean().default(false),
+  label: external_exports.string().optional().nullable()
+});
+var safeShortText = external_exports.string().trim().min(1).max(160);
+var optionalSafeShortText = safeShortText.optional().nullable();
+var deniedProviderConfigKeyPattern = /^(access[-_]?key([-_]?id)?|secret[-_]?access[-_]?key|secret[-_]?key|token|password|passwd|credential|credentials|private[-_]?key|pem|jwt|session[-_]?token|service[-_]?account([-_]?json)?|client[-_]?secret|secret[-_]?id|unseal[-_]?key|recovery[-_]?key|key[-_]?file([-_]?path)?|token[-_]?file([-_]?path)?)$/i;
+function rejectSensitiveProviderConfigKeys(value, ctx) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  for (const key of Object.keys(value)) {
+    if (!deniedProviderConfigKeyPattern.test(key))
+      continue;
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["config", key],
+      message: `Provider vault config cannot persist sensitive field: ${key}`
+    });
+  }
+}
+var localEncryptedProviderConfigSchema = external_exports.object({
+  backupReminderAcknowledged: external_exports.boolean().optional()
+}).strict();
+var awsSecretsManagerProviderConfigSchema = external_exports.object({
+  region: external_exports.string().trim().regex(/^[a-z]{2}(?:-gov)?-[a-z]+-\d+$/, "Invalid AWS region"),
+  namespace: optionalSafeShortText,
+  secretNamePrefix: optionalSafeShortText,
+  kmsKeyId: external_exports.string().trim().min(1).max(512).optional().nullable(),
+  ownerTag: optionalSafeShortText,
+  environmentTag: optionalSafeShortText
+}).strict();
+var gcpSecretManagerProviderConfigSchema = external_exports.object({
+  projectId: external_exports.string().trim().min(1).max(128).regex(/^[a-z][a-z0-9-]{4,127}$/).optional().nullable(),
+  location: optionalSafeShortText,
+  namespace: optionalSafeShortText,
+  secretNamePrefix: optionalSafeShortText
+}).strict();
+var vaultAddressSchema = external_exports.preprocess((value) => typeof value === "string" ? value.trim() : value, external_exports.string().url().superRefine((value, ctx) => {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return;
+  }
+  const hasPath = url.pathname !== "" && url.pathname !== "/";
+  if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.search || url.hash || hasPath) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Vault address must be an origin-only HTTP(S) URL without credentials, path, query, or fragment"
+    });
+  }
+}).transform((value) => new URL(value).origin));
+function rejectUnsafeVaultAddress(value, ctx) {
+  if (value === void 0 || value === null)
+    return;
+  const parsed = vaultAddressSchema.safeParse(value);
+  if (parsed.success)
+    return;
+  for (const issue of parsed.error.issues) {
+    ctx.addIssue({
+      ...issue,
+      path: ["config", "address", ...issue.path]
+    });
+  }
+}
+var vaultProviderConfigSchema = external_exports.object({
+  address: vaultAddressSchema.optional().nullable(),
+  namespace: optionalSafeShortText,
+  mountPath: optionalSafeShortText,
+  secretPathPrefix: optionalSafeShortText
+}).strict();
+var secretProviderConfigPayloadSchema = external_exports.discriminatedUnion("provider", [
+  external_exports.object({ provider: external_exports.literal("local_encrypted"), config: localEncryptedProviderConfigSchema }),
+  external_exports.object({ provider: external_exports.literal("aws_secrets_manager"), config: awsSecretsManagerProviderConfigSchema }),
+  external_exports.object({ provider: external_exports.literal("gcp_secret_manager"), config: gcpSecretManagerProviderConfigSchema }),
+  external_exports.object({ provider: external_exports.literal("vault"), config: vaultProviderConfigSchema })
+]);
+var createSecretProviderConfigSchema = external_exports.object({
+  provider: external_exports.enum(SECRET_PROVIDERS),
+  displayName: external_exports.string().trim().min(1).max(120),
+  status: external_exports.enum(SECRET_PROVIDER_CONFIG_STATUSES).optional(),
+  isDefault: external_exports.boolean().optional(),
+  config: external_exports.record(external_exports.string(), external_exports.unknown()).default({})
+}).superRefine((value, ctx) => {
+  rejectSensitiveProviderConfigKeys(value.config, ctx);
+  const parsed = secretProviderConfigPayloadSchema.safeParse({
+    provider: value.provider,
+    config: value.config
+  });
+  if (!parsed.success) {
+    for (const issue of parsed.error.issues) {
+      ctx.addIssue({
+        ...issue,
+        path: issue.path[0] === "config" ? issue.path : ["config", ...issue.path]
+      });
+    }
+  }
+  const status = value.status ?? (["gcp_secret_manager", "vault"].includes(value.provider) ? "coming_soon" : "ready");
+  if ((value.provider === "gcp_secret_manager" || value.provider === "vault") && status !== "coming_soon" && status !== "disabled") {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["status"],
+      message: `${value.provider} provider vaults are locked while coming soon`
+    });
+  }
+  if ((status === "coming_soon" || status === "disabled") && value.isDefault) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["isDefault"],
+      message: "Only ready or warning provider vaults can be default"
+    });
+  }
+});
+var updateSecretProviderConfigSchema = external_exports.object({
+  displayName: external_exports.string().trim().min(1).max(120).optional(),
+  status: external_exports.enum(SECRET_PROVIDER_CONFIG_STATUSES).optional(),
+  isDefault: external_exports.boolean().optional(),
+  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}).superRefine((value, ctx) => {
+  if (value.config !== void 0) {
+    rejectSensitiveProviderConfigKeys(value.config, ctx);
+    rejectUnsafeVaultAddress(value.config.address, ctx);
+  }
+  if ((value.status === "coming_soon" || value.status === "disabled") && value.isDefault) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["isDefault"],
+      message: "Only ready or warning provider vaults can be default"
+    });
+  }
+});
+var remoteSecretImportPreviewSchema = external_exports.object({
+  providerConfigId: external_exports.string().uuid(),
+  query: external_exports.string().trim().max(200).optional().nullable(),
+  nextToken: external_exports.string().trim().min(1).max(4096).optional().nullable(),
+  pageSize: external_exports.number().int().min(1).max(100).optional()
+});
+var secretProviderConfigDiscoveryPreviewSchema = external_exports.object({
+  provider: external_exports.enum(SECRET_PROVIDERS),
+  config: external_exports.record(external_exports.unknown()).default({}),
+  query: external_exports.string().trim().max(200).optional().nullable(),
+  nextToken: external_exports.string().trim().min(1).max(4096).optional().nullable(),
+  pageSize: external_exports.number().int().min(1).max(100).optional()
+}).superRefine((value, ctx) => {
+  rejectSensitiveProviderConfigKeys(value.config, ctx);
+  const parsed = secretProviderConfigPayloadSchema.safeParse({
+    provider: value.provider,
+    config: value.config
+  });
+  if (!parsed.success) {
+    for (const issue of parsed.error.issues) {
+      ctx.addIssue({
+        ...issue,
+        path: issue.path[0] === "config" ? issue.path : ["config", ...issue.path]
+      });
+    }
+  }
+});
+var remoteSecretImportSelectionSchema = external_exports.object({
+  externalRef: external_exports.string().trim().min(1).max(2048),
+  name: external_exports.string().trim().min(1).max(160).optional().nullable(),
+  key: external_exports.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9_.-]+$/).optional().nullable(),
+  description: external_exports.string().trim().max(500).optional().nullable(),
+  providerVersionRef: external_exports.string().trim().min(1).max(512).optional().nullable(),
+  providerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
+});
+var remoteSecretImportSchema = external_exports.object({
+  providerConfigId: external_exports.string().uuid(),
+  secrets: external_exports.array(remoteSecretImportSelectionSchema).min(1).max(100)
+});
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/environment.js
+var environmentDriverSchema = external_exports.enum(ENVIRONMENT_DRIVERS);
+var environmentStatusSchema = external_exports.enum(ENVIRONMENT_STATUSES);
+var environmentLeaseStatusSchema = external_exports.enum(ENVIRONMENT_LEASE_STATUSES);
+var environmentLeaseCleanupStatusSchema = external_exports.enum(ENVIRONMENT_LEASE_CLEANUP_STATUSES);
+var environmentFields = {
+  name: external_exports.string().min(1),
+  description: external_exports.string().optional().nullable(),
+  driver: environmentDriverSchema,
+  status: environmentStatusSchema.optional().default("active"),
+  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional().default({}),
+  envVars: envConfigSchema.optional().default({}),
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
+};
+var createEnvironmentSchema = external_exports.object(environmentFields).strict();
+var updateEnvironmentSchema = external_exports.object({
+  name: external_exports.string().min(1).optional(),
+  description: external_exports.string().optional().nullable(),
+  driver: environmentDriverSchema.optional(),
+  status: environmentStatusSchema.optional(),
+  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  envVars: envConfigSchema.optional(),
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
+}).strict();
+var probeEnvironmentConfigSchema = external_exports.object({
+  name: external_exports.string().min(1).optional(),
+  description: external_exports.string().optional().nullable(),
+  driver: environmentDriverSchema,
+  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional().default({}),
+  envVars: envConfigSchema.optional().default({}),
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
+}).strict();
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/environment-custom-images.js
+var isoDateTime = external_exports.union([external_exports.date(), external_exports.string().datetime()]);
+var providerKeySchema = external_exports.string().min(1).max(200);
+var optionalRecordSchema = external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable();
+var environmentCustomImageTemplateKindSchema = external_exports.enum(ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_KINDS);
+var environmentCustomImageTemplateStatusSchema = external_exports.enum(ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_STATUSES);
+var environmentCustomImageSetupSessionStatusSchema = external_exports.enum(ENVIRONMENT_CUSTOM_IMAGE_SETUP_SESSION_STATUSES);
+var environmentCustomImageSetupConnectionTypeSchema = external_exports.enum(ENVIRONMENT_CUSTOM_IMAGE_SETUP_CONNECTION_TYPES);
+var environmentCustomImageSetupConnectionSummarySchema = external_exports.object({
+  type: environmentCustomImageSetupConnectionTypeSchema,
+  username: external_exports.string().min(1).max(200).optional().nullable(),
+  hostRedacted: external_exports.literal(true).optional().default(true),
+  portRedacted: external_exports.literal(true).optional().default(true),
+  label: external_exports.string().min(1).max(200).optional().nullable(),
+  instructions: external_exports.string().min(1).max(1e3).optional().nullable()
+}).strict();
+var environmentCustomImageTemplateSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  environmentId: external_exports.string().uuid(),
+  provider: providerKeySchema,
+  templateKind: environmentCustomImageTemplateKindSchema,
+  templateRef: external_exports.string().min(1).nullable(),
+  sourceTemplateRef: external_exports.string().min(1).nullable(),
+  sourceEnvironmentConfigFingerprint: external_exports.string().min(1).nullable(),
+  status: environmentCustomImageTemplateStatusSchema,
+  createdByUserId: external_exports.string().min(1).nullable(),
+  createdByAgentId: external_exports.string().uuid().nullable(),
+  capturedAt: isoDateTime.nullable(),
+  lastUsedAt: isoDateTime.nullable(),
+  supersededByTemplateId: external_exports.string().uuid().nullable(),
+  metadata: optionalRecordSchema,
+  createdAt: isoDateTime,
+  updatedAt: isoDateTime
+}).strict();
+var environmentCustomImageSetupSessionSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  environmentId: external_exports.string().uuid(),
+  templateId: external_exports.string().uuid().nullable(),
+  promotedTemplateId: external_exports.string().uuid().nullable(),
+  provider: providerKeySchema,
+  providerLeaseId: external_exports.string().min(1).nullable(),
+  environmentLeaseId: external_exports.string().uuid().nullable(),
+  status: environmentCustomImageSetupSessionStatusSchema,
+  startedByUserId: external_exports.string().min(1).nullable(),
+  startedByAgentId: external_exports.string().uuid().nullable(),
+  baseTemplateRef: external_exports.string().min(1).nullable(),
+  expiresAt: isoDateTime.nullable(),
+  finishedAt: isoDateTime.nullable(),
+  failureReason: external_exports.string().min(1).nullable(),
+  connectionSummary: environmentCustomImageSetupConnectionSummarySchema.nullable(),
+  connectionSecretRef: external_exports.string().min(1).nullable(),
+  metadata: optionalRecordSchema,
+  createdAt: isoDateTime,
+  updatedAt: isoDateTime
+}).strict();
+var startEnvironmentCustomImageSetupSessionSchema = external_exports.object({
+  templateId: external_exports.string().uuid().optional().nullable(),
+  ttlSeconds: external_exports.number().int().min(60).max(24 * 60 * 60).optional()
+}).strict();
+var finishEnvironmentCustomImageSetupSessionSchema = external_exports.object({
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}).strict();
+var cancelEnvironmentCustomImageSetupSessionSchema = external_exports.object({
+  reason: external_exports.string().min(1).max(1e3).optional()
+}).strict();
+var createEnvironmentCustomImageTerminalSessionTokenSchema = external_exports.object({}).strict().default({});
+var environmentCustomImageTerminalSessionTokenSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  token: external_exports.string().min(32),
+  expiresAt: isoDateTime,
+  setupSessionId: external_exports.string().min(1),
+  environmentId: external_exports.string().min(1),
+  connectionType: external_exports.literal("ssh"),
+  websocketPath: external_exports.string().min(1)
+}).strict();
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/external-object.js
+var externalObjectStatusCategorySchema = external_exports.enum(EXTERNAL_OBJECT_STATUS_CATEGORIES);
+var externalObjectStatusToneSchema = external_exports.enum(EXTERNAL_OBJECT_STATUS_TONES);
+var externalObjectLivenessStateSchema = external_exports.enum(EXTERNAL_OBJECT_LIVENESS_STATES);
+var externalObjectMentionSourceKindSchema = external_exports.enum(EXTERNAL_OBJECT_MENTION_SOURCE_KINDS);
+var externalObjectMentionConfidenceSchema = external_exports.enum(EXTERNAL_OBJECT_MENTION_CONFIDENCES);
+var externalObjectProviderKeySchema = external_exports.string().trim().min(1).max(80).regex(/^[a-z][a-z0-9_.-]*$/);
+var externalObjectTypeSchema = external_exports.string().trim().min(1).max(80).regex(/^[a-z][a-z0-9_]*$/);
+var externalObjectCanonicalIdentitySchema = external_exports.object({
+  scheme: external_exports.enum(["http", "https"]),
+  host: external_exports.string().trim().min(1),
+  path: external_exports.string().trim().min(1),
+  queryParamHashes: external_exports.record(external_exports.string().regex(/^[a-f0-9]{64}$/)).optional()
+}).strict();
+var externalObjectMentionSourceSchema = external_exports.object({
+  sourceKind: externalObjectMentionSourceKindSchema,
+  documentKey: external_exports.string().trim().min(1).optional().nullable(),
+  propertyKey: external_exports.string().trim().min(1).optional().nullable()
+}).strict();
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/company-skill.js
+var companySkillSourceTypeSchema = external_exports.enum(["local_path", "github", "url", "catalog", "skills_sh"]);
+var companySkillTrustLevelSchema = external_exports.enum(["markdown_only", "assets", "scripts_executables"]);
+var companySkillCompatibilitySchema = external_exports.enum(["compatible", "unknown", "invalid"]);
+var companySkillSourceBadgeSchema = external_exports.enum(["paperclip", "github", "local", "url", "catalog", "skills_sh"]);
+var companySkillSharingScopeSchema = external_exports.enum(["private", "company", "public_link"]);
+var companySkillListSortSchema = external_exports.enum(["alphabetical", "recent", "installs", "stars", "agents", "forks"]);
+var companySkillFileInventoryEntrySchema = external_exports.object({
+  path: external_exports.string().min(1),
+  kind: external_exports.enum(["skill", "markdown", "reference", "script", "asset", "other"])
+});
+var companySkillVersionFileInventoryEntrySchema = companySkillFileInventoryEntrySchema.extend({
+  content: external_exports.string()
+});
+var companySkillSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  companyId: external_exports.string().uuid(),
+  key: external_exports.string().min(1),
+  slug: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  description: external_exports.string().nullable(),
+  markdown: external_exports.string(),
+  sourceType: companySkillSourceTypeSchema,
+  sourceLocator: external_exports.string().nullable(),
+  sourceRef: external_exports.string().nullable(),
+  trustLevel: companySkillTrustLevelSchema,
+  compatibility: companySkillCompatibilitySchema,
+  fileInventory: external_exports.array(companySkillFileInventoryEntrySchema).default([]),
+  iconUrl: external_exports.string().nullable(),
+  color: external_exports.string().nullable(),
+  tagline: external_exports.string().nullable(),
+  authorName: external_exports.string().nullable(),
+  homepageUrl: external_exports.string().nullable(),
+  categories: external_exports.array(external_exports.string().min(1)).default([]),
+  sharingScope: companySkillSharingScopeSchema,
+  publicShareToken: external_exports.string().nullable(),
+  forkedFromSkillId: external_exports.string().uuid().nullable(),
+  forkedFromCompanyId: external_exports.string().uuid().nullable(),
+  starCount: external_exports.number().int().nonnegative(),
+  installCount: external_exports.number().int().nonnegative(),
+  forkCount: external_exports.number().int().nonnegative(),
+  currentVersionId: external_exports.string().uuid().nullable(),
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).nullable(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var companySkillListItemSchema = companySkillSchema.extend({
+  attachedAgentCount: external_exports.number().int().nonnegative(),
+  editable: external_exports.boolean(),
+  editableReason: external_exports.string().nullable(),
+  sourceLabel: external_exports.string().nullable(),
+  sourceBadge: companySkillSourceBadgeSchema,
+  catalogKind: external_exports.enum(["bundled", "optional"]).nullable(),
+  originHash: external_exports.string().nullable(),
+  packageName: external_exports.string().nullable(),
+  packageVersion: external_exports.string().nullable()
+});
+var companySkillUsageAgentSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  name: external_exports.string().min(1),
+  urlKey: external_exports.string().min(1),
+  adapterType: external_exports.string().min(1),
+  desired: external_exports.boolean(),
+  actualState: external_exports.string().nullable().describe("Runtime adapter skill state when explicitly fetched; company skill detail reads return null without probing agent runtimes."),
+  versionId: external_exports.string().uuid().nullable()
+});
+var companySkillListQuerySchema = external_exports.object({
+  q: external_exports.string().min(1).optional(),
+  sort: companySkillListSortSchema.optional(),
+  categories: external_exports.array(external_exports.string().min(1)).optional(),
+  scope: companySkillSharingScopeSchema.optional()
+});
+var companySkillCategoryCountSchema = external_exports.object({
+  slug: external_exports.string().min(1),
+  count: external_exports.number().int().nonnegative()
+});
+var companySkillVersionSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  companyId: external_exports.string().uuid(),
+  companySkillId: external_exports.string().uuid(),
+  revisionNumber: external_exports.number().int().positive(),
+  label: external_exports.string().nullable(),
+  fileInventory: external_exports.array(companySkillVersionFileInventoryEntrySchema).default([]),
+  authorAgentId: external_exports.string().uuid().nullable(),
+  authorUserId: external_exports.string().nullable(),
+  createdAt: external_exports.coerce.date()
+});
+var companySkillDetailSchema = companySkillSchema.extend({
+  attachedAgentCount: external_exports.number().int().nonnegative(),
+  usedByAgents: external_exports.array(companySkillUsageAgentSchema).default([]),
+  editable: external_exports.boolean(),
+  editableReason: external_exports.string().nullable(),
+  sourceLabel: external_exports.string().nullable(),
+  sourceBadge: companySkillSourceBadgeSchema,
+  currentVersion: companySkillVersionSchema.nullable(),
+  starredByCurrentActor: external_exports.boolean()
+});
+var companySkillVersionCreateSchema = external_exports.object({
+  label: external_exports.string().trim().min(1).nullable().optional()
+}).default({});
+var companySkillStarResultSchema = external_exports.object({
+  skillId: external_exports.string().uuid(),
+  starred: external_exports.boolean(),
+  starCount: external_exports.number().int().nonnegative()
+});
+var companySkillCommentSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  companyId: external_exports.string().uuid(),
+  companySkillId: external_exports.string().uuid(),
+  parentCommentId: external_exports.string().uuid().nullable(),
+  authorAgentId: external_exports.string().uuid().nullable(),
+  authorUserId: external_exports.string().nullable(),
+  body: external_exports.string(),
+  deletedAt: external_exports.coerce.date().nullable(),
+  createdAt: external_exports.coerce.date(),
+  updatedAt: external_exports.coerce.date()
+});
+var companySkillCommentCreateSchema = external_exports.object({
+  body: external_exports.string().min(1),
+  parentCommentId: external_exports.string().uuid().nullable().optional()
+});
+var companySkillCommentUpdateSchema = external_exports.object({
+  body: external_exports.string().min(1)
+});
+var companySkillForkSchema = external_exports.object({
+  name: external_exports.string().min(1).nullable().optional(),
+  slug: external_exports.string().min(1).nullable().optional(),
+  sharingScope: companySkillSharingScopeSchema.optional()
+}).default({});
+var companySkillUpdateSchema = external_exports.object({
+  description: external_exports.string().nullable().optional(),
+  iconUrl: external_exports.string().nullable().optional(),
+  color: external_exports.string().nullable().optional(),
+  tagline: external_exports.string().max(120).nullable().optional(),
+  authorName: external_exports.string().nullable().optional(),
+  homepageUrl: external_exports.string().nullable().optional(),
+  categories: external_exports.array(external_exports.string().min(1)).optional(),
+  sharingScope: companySkillSharingScopeSchema.optional()
+}).default({});
+var companySkillUpdateStatusSchema = external_exports.object({
+  supported: external_exports.boolean(),
+  reason: external_exports.string().nullable(),
+  trackingRef: external_exports.string().nullable(),
+  currentRef: external_exports.string().nullable(),
+  latestRef: external_exports.string().nullable(),
+  hasUpdate: external_exports.boolean(),
+  installedHash: external_exports.string().nullable(),
+  originHash: external_exports.string().nullable(),
+  userModifiedAt: external_exports.string().nullable(),
+  updateHoldReason: external_exports.enum([
+    "local_modifications",
+    "audit_hard_stop",
+    "origin_unavailable",
+    "compatibility_invalid",
+    "operator_hold"
+  ]).nullable(),
+  auditVerdict: external_exports.enum(["pass", "warning", "fail"]).nullable(),
+  auditCodes: external_exports.array(external_exports.string())
 });
 var companySkillAuditFindingSchema = external_exports.object({
   code: external_exports.string().min(1),
@@ -5063,7 +5753,15 @@ var companySkillCreateSchema = external_exports.object({
   name: external_exports.string().min(1),
   slug: external_exports.string().min(1).nullable().optional(),
   description: external_exports.string().nullable().optional(),
-  markdown: external_exports.string().nullable().optional()
+  markdown: external_exports.string().nullable().optional(),
+  iconUrl: external_exports.string().nullable().optional(),
+  color: external_exports.string().nullable().optional(),
+  tagline: external_exports.string().max(120).nullable().optional(),
+  authorName: external_exports.string().nullable().optional(),
+  homepageUrl: external_exports.string().nullable().optional(),
+  categories: external_exports.array(external_exports.string().min(1)).optional(),
+  sharingScope: companySkillSharingScopeSchema.optional(),
+  forkedFromSkillId: external_exports.string().uuid().nullable().optional()
 });
 var companySkillFileDetailSchema = external_exports.object({
   skillId: external_exports.string().uuid(),
@@ -5085,6 +5783,17 @@ var catalogSkillFileSchema = external_exports.object({
   sizeBytes: external_exports.number().int().nonnegative(),
   sha256: external_exports.string().min(1)
 });
+var catalogSkillGitHubSourceSchema = external_exports.object({
+  type: external_exports.literal("github"),
+  hostname: external_exports.string().min(1),
+  owner: external_exports.string().min(1),
+  repo: external_exports.string().min(1),
+  ref: external_exports.string().min(1),
+  commit: external_exports.string().regex(/^[0-9a-f]{40}$/i),
+  path: external_exports.string(),
+  url: external_exports.string().url()
+});
+var catalogSkillSourceSchema = catalogSkillGitHubSourceSchema;
 var catalogSkillSchema = external_exports.object({
   id: external_exports.string().min(1),
   key: external_exports.string().min(1),
@@ -5103,6 +5812,7 @@ var catalogSkillSchema = external_exports.object({
   tags: external_exports.array(external_exports.string()),
   files: external_exports.array(catalogSkillFileSchema),
   contentHash: external_exports.string().min(1),
+  source: catalogSkillSourceSchema.optional(),
   packageName: external_exports.string().min(1).optional(),
   packageVersion: external_exports.string().min(1).optional()
 });
@@ -5131,61 +5841,57 @@ var companySkillInstallCatalogResultSchema = external_exports.object({
   warnings: external_exports.array(external_exports.string())
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/adapter-skills.js
-var agentSkillStateSchema = external_exports.enum([
-  "available",
-  "configured",
-  "installed",
-  "missing",
-  "stale",
-  "external"
-]);
-var agentSkillOriginSchema = external_exports.enum([
-  "company_managed",
-  "paperclip_required",
-  "user_installed",
-  "external_unknown"
-]);
-var agentSkillSyncModeSchema = external_exports.enum([
-  "unsupported",
-  "persistent",
-  "ephemeral"
-]);
-var agentSkillEntrySchema = external_exports.object({
-  key: external_exports.string().min(1),
-  runtimeName: external_exports.string().min(1).nullable(),
-  desired: external_exports.boolean(),
-  managed: external_exports.boolean(),
-  required: external_exports.boolean().optional(),
-  requiredReason: external_exports.string().nullable().optional(),
-  state: agentSkillStateSchema,
-  origin: agentSkillOriginSchema.optional(),
-  originLabel: external_exports.string().nullable().optional(),
-  locationLabel: external_exports.string().nullable().optional(),
-  readOnly: external_exports.boolean().optional(),
-  sourcePath: external_exports.string().nullable().optional(),
-  targetPath: external_exports.string().nullable().optional(),
-  detail: external_exports.string().nullable().optional()
-});
-var agentSkillSnapshotSchema = external_exports.object({
-  adapterType: external_exports.string().min(1),
-  supported: external_exports.boolean(),
-  mode: agentSkillSyncModeSchema,
-  desiredSkills: external_exports.array(external_exports.string().min(1)),
-  entries: external_exports.array(agentSkillEntrySchema),
-  warnings: external_exports.array(external_exports.string())
-});
-var agentSkillSyncSchema = external_exports.object({
-  desiredSkills: external_exports.array(external_exports.string().min(1))
-});
-
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/text.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/text.js
 function normalizeEscapedLineBreaks(value) {
   return value.replace(/\\r\\n/g, "\n").replace(/\\n/g, "\n").replace(/\\r/g, "\n");
 }
 var multilineTextSchema = external_exports.string().transform(normalizeEscapedLineBreaks);
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/issue.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/trust-policy.js
+var trustPresetSchema = external_exports.enum(TRUST_PRESETS);
+var lowTrustOutputPromotionTargetSchema = external_exports.object({
+  type: external_exports.literal("issue"),
+  issueId: external_exports.string().uuid()
+}).strict();
+var lowTrustBoundarySchema = external_exports.object({
+  mode: external_exports.literal(LOW_TRUST_REVIEW_PRESET),
+  companyId: external_exports.string().uuid().optional(),
+  projectIds: external_exports.array(external_exports.string().uuid()).optional(),
+  rootIssueId: external_exports.string().uuid().optional(),
+  issueIds: external_exports.array(external_exports.string().uuid()).optional(),
+  allowedAgentIds: external_exports.array(external_exports.string().uuid()).optional(),
+  allowedSecretBindingIds: external_exports.array(external_exports.string().uuid()).optional(),
+  allowedToolClasses: external_exports.array(external_exports.string().trim().min(1)).optional(),
+  outputPromotionTarget: lowTrustOutputPromotionTargetSchema.optional()
+}).strict();
+var lowTrustReviewPresetPolicySchema = external_exports.object({
+  id: external_exports.literal(LOW_TRUST_REVIEW_PRESET),
+  version: external_exports.literal(LOW_TRUST_REVIEW_PRESET_VERSION),
+  rawOutputDisposition: external_exports.literal(LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION)
+}).strict();
+var trustAuthorizationPolicySchema = external_exports.object({
+  trustPreset: trustPresetSchema.optional(),
+  reviewPreset: lowTrustReviewPresetPolicySchema.optional(),
+  trustBoundary: lowTrustBoundarySchema.optional()
+}).catchall(external_exports.unknown());
+var sourceTrustArtifactKindSchema = external_exports.enum(["issue", "comment", "document", "work_product"]);
+var sourceTrustMetadataSchema = external_exports.object({
+  preset: trustPresetSchema,
+  disposition: external_exports.enum(["quarantined", "promoted"]),
+  sourceIssueId: external_exports.string().uuid().nullable().optional(),
+  sourceRunId: external_exports.string().uuid().nullable().optional(),
+  sourceAgentId: external_exports.string().uuid().nullable().optional(),
+  promotedFrom: external_exports.object({
+    artifactKind: sourceTrustArtifactKindSchema,
+    artifactId: external_exports.string().uuid(),
+    issueId: external_exports.string().uuid().nullable().optional()
+  }).strict().nullable().optional(),
+  promotedByActorType: external_exports.enum(["agent", "user", "system"]).nullable().optional(),
+  promotedByActorId: external_exports.string().trim().min(1).nullable().optional(),
+  promotedAt: external_exports.string().datetime({ offset: true }).nullable().optional()
+}).strict();
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/issue.js
 var issueBlockedInboxStateSchema = external_exports.enum([
   "needs_attention",
   "awaiting_decision",
@@ -5333,7 +6039,9 @@ var issueExecutionPolicySchema = external_exports.object({
   mode: external_exports.enum(ISSUE_EXECUTION_POLICY_MODES).optional().default("normal"),
   commentRequired: external_exports.boolean().optional().default(true),
   stages: external_exports.array(issueExecutionStageSchema).default([]),
-  monitor: issueExecutionMonitorPolicySchema.optional().nullable()
+  monitor: issueExecutionMonitorPolicySchema.optional().nullable(),
+  reviewPreset: lowTrustReviewPresetPolicySchema.optional(),
+  authorizationPolicy: trustAuthorizationPolicySchema.optional()
 });
 var issueExecutionMonitorStateSchema = external_exports.object({
   status: external_exports.enum(ISSUE_EXECUTION_MONITOR_STATE_STATUSES),
@@ -5482,21 +6190,36 @@ var createIssueBaseSchema = external_exports.object({
   assigneeAgentId: external_exports.string().uuid().optional().nullable(),
   assigneeUserId: external_exports.string().optional().nullable(),
   requestDepth: issueRequestDepthInputSchema.optional().default(0),
+  createdByUserId: external_exports.string().optional().nullable(),
+  responsibleUserId: external_exports.string().optional().nullable(),
   billingCode: external_exports.string().optional().nullable(),
   assigneeAdapterOverrides: issueAssigneeAdapterOverridesSchema.optional().nullable(),
   executionPolicy: issueExecutionPolicySchema.optional().nullable(),
   executionWorkspaceId: external_exports.string().uuid().optional().nullable(),
   executionWorkspacePreference: external_exports.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
   executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
-  labelIds: external_exports.array(external_exports.string().uuid()).optional()
+  labelIds: external_exports.array(external_exports.string().uuid()).optional(),
+  watchdogDiscovery: external_exports.object({
+    kind: external_exports.enum(ISSUE_WATCHDOG_DISCOVERY_KINDS),
+    evidenceMarkdown: multilineTextSchema.optional().nullable()
+  }).strict().optional().nullable(),
+  watchdog: external_exports.object({
+    agentId: external_exports.string().uuid(),
+    instructions: multilineTextSchema.optional().nullable()
+  }).strict().optional().nullable()
 });
 var createIssueInputSchema = createIssueBaseSchema.extend({
   status: createIssueBaseSchema.shape.status.optional()
 });
 var createIssueSchema = withCreateIssueStatusDefault(createIssueBaseSchema);
+var upsertIssueWatchdogSchema = external_exports.object({
+  agentId: external_exports.string().uuid(),
+  instructions: multilineTextSchema.optional().nullable()
+}).strict();
 var createChildIssueSchema = withCreateIssueStatusDefault(createIssueBaseSchema.omit({
   parentId: true,
-  inheritExecutionWorkspaceFromIssueId: true
+  inheritExecutionWorkspaceFromIssueId: true,
+  watchdogDiscovery: true
 }).extend({
   acceptanceCriteria: external_exports.array(external_exports.string().trim().min(1).max(500)).max(20).optional(),
   blockParentUntilDone: external_exports.boolean().optional().default(false)
@@ -5509,7 +6232,11 @@ var createIssueLabelSchema = external_exports.object({
   name: external_exports.string().trim().min(1).max(48),
   color: external_exports.string().regex(/^#(?:[0-9a-fA-F]{6})$/, "Color must be a 6-digit hex value")
 });
-var updateIssueSchema = createIssueBaseSchema.partial().extend({
+var updateIssueSchema = createIssueBaseSchema.omit({
+  createdByUserId: true,
+  responsibleUserId: true,
+  watchdog: true
+}).partial().extend({
   requestDepth: issueRequestDepthInputSchema.optional(),
   assigneeAgentId: external_exports.string().trim().min(1).optional().nullable(),
   comment: multilineTextSchema.pipe(external_exports.string().min(1)).optional(),
@@ -5677,6 +6404,7 @@ var askUserQuestionsPayloadSchema = external_exports.object({
   version: external_exports.literal(1),
   title: external_exports.string().trim().max(240).nullable().optional(),
   submitLabel: external_exports.string().trim().max(120).nullable().optional(),
+  supersedeOnUserComment: external_exports.boolean().optional(),
   questions: external_exports.array(askUserQuestionsQuestionSchema).min(1).max(10)
 }).superRefine((value, ctx) => {
   const seenQuestionIds = /* @__PURE__ */ new Set();
@@ -5704,19 +6432,25 @@ var askUserQuestionsPayloadSchema = external_exports.object({
 });
 var askUserQuestionsAnswerSchema = external_exports.object({
   questionId: external_exports.string().trim().min(1).max(120),
-  optionIds: external_exports.array(external_exports.string().trim().min(1).max(120)).max(20)
+  optionIds: external_exports.array(external_exports.string().trim().min(1).max(120)).max(20),
+  otherText: multilineTextSchema.pipe(external_exports.string().trim().max(4e3)).nullable().optional()
 });
 var askUserQuestionsResultSchema = external_exports.object({
   version: external_exports.literal(1),
   answers: external_exports.array(askUserQuestionsAnswerSchema).max(20),
   cancelled: external_exports.literal(true).optional(),
   cancellationReason: external_exports.string().trim().max(4e3).nullable().optional(),
+  expirationReason: external_exports.literal("superseded_by_comment").optional(),
+  commentId: external_exports.string().uuid().nullable().optional(),
   summaryMarkdown: external_exports.string().max(2e4).nullable().optional()
 });
 var requestConfirmationHrefSchema = external_exports.string().trim().min(1).max(2e3).refine((value) => {
-  const lower = value.toLowerCase();
-  return !lower.startsWith("javascript:") && !lower.startsWith("data:") && !value.startsWith("//");
-}, "href must not use javascript:, data:, or protocol-relative URLs");
+  if (value.startsWith("#"))
+    return true;
+  if (value.startsWith("/"))
+    return !value.startsWith("//");
+  return /^https?:\/\//i.test(value);
+}, "href must be a root-relative path, same-page fragment, or http(s) URL");
 var requestConfirmationTargetBaseSchema = external_exports.object({
   label: external_exports.string().trim().min(1).max(120).nullable().optional(),
   href: requestConfirmationHrefSchema.nullable().optional()
@@ -5729,28 +6463,119 @@ var requestConfirmationIssueDocumentTargetSchema = requestConfirmationTargetBase
   revisionId: external_exports.string().uuid(),
   revisionNumber: external_exports.number().int().positive().nullable().optional()
 });
-var requestConfirmationCustomTargetSchema = requestConfirmationTargetBaseSchema.extend({
-  type: external_exports.literal("custom"),
-  key: external_exports.string().trim().min(1).max(120),
-  revisionId: external_exports.string().trim().min(1).max(255).nullable().optional(),
-  revisionNumber: external_exports.number().int().positive().nullable().optional()
+var requestConfirmationCustomTargetSchema = requestConfirmationTargetBaseSchema.extend({
+  type: external_exports.literal("custom"),
+  key: external_exports.string().trim().min(1).max(120),
+  revisionId: external_exports.string().trim().min(1).max(255).nullable().optional(),
+  revisionNumber: external_exports.number().int().positive().nullable().optional()
+});
+var requestConfirmationTargetSchema = external_exports.discriminatedUnion("type", [
+  requestConfirmationIssueDocumentTargetSchema,
+  requestConfirmationCustomTargetSchema
+]);
+var requestConfirmationPayloadSchema = external_exports.object({
+  version: external_exports.literal(1),
+  prompt: external_exports.string().trim().min(1).max(1e3),
+  acceptLabel: external_exports.string().trim().min(1).max(80).nullable().optional(),
+  rejectLabel: external_exports.string().trim().min(1).max(80).nullable().optional(),
+  rejectRequiresReason: external_exports.boolean().optional(),
+  rejectReasonLabel: external_exports.string().trim().min(1).max(160).nullable().optional(),
+  allowDeclineReason: external_exports.boolean().optional().default(true),
+  declineReasonPlaceholder: external_exports.string().trim().min(1).max(240).nullable().optional(),
+  detailsMarkdown: external_exports.string().max(2e4).nullable().optional(),
+  supersedeOnUserComment: external_exports.boolean().optional(),
+  target: requestConfirmationTargetSchema.nullable().optional()
+});
+var requestCheckboxConfirmationOptionSchema = external_exports.object({
+  id: external_exports.string().trim().min(1).max(120),
+  label: external_exports.string().trim().min(1).max(120),
+  description: external_exports.string().trim().max(500).nullable().optional()
 });
-var requestConfirmationTargetSchema = external_exports.discriminatedUnion("type", [
-  requestConfirmationIssueDocumentTargetSchema,
-  requestConfirmationCustomTargetSchema
-]);
-var requestConfirmationPayloadSchema = external_exports.object({
+var requestCheckboxConfirmationPayloadSchema = external_exports.object({
   version: external_exports.literal(1),
   prompt: external_exports.string().trim().min(1).max(1e3),
+  detailsMarkdown: external_exports.string().max(2e4).nullable().optional(),
+  options: external_exports.array(requestCheckboxConfirmationOptionSchema).min(1).max(REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT),
+  defaultSelectedOptionIds: external_exports.array(external_exports.string().trim().min(1).max(120)).max(REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT).optional().default([]),
+  minSelected: external_exports.number().int().min(0).optional().default(0),
+  maxSelected: external_exports.number().int().min(0).nullable().optional(),
   acceptLabel: external_exports.string().trim().min(1).max(80).nullable().optional(),
   rejectLabel: external_exports.string().trim().min(1).max(80).nullable().optional(),
   rejectRequiresReason: external_exports.boolean().optional(),
   rejectReasonLabel: external_exports.string().trim().min(1).max(160).nullable().optional(),
   allowDeclineReason: external_exports.boolean().optional().default(true),
   declineReasonPlaceholder: external_exports.string().trim().min(1).max(240).nullable().optional(),
-  detailsMarkdown: external_exports.string().max(2e4).nullable().optional(),
   supersedeOnUserComment: external_exports.boolean().optional(),
   target: requestConfirmationTargetSchema.nullable().optional()
+}).superRefine((value, ctx) => {
+  const optionIds = /* @__PURE__ */ new Set();
+  for (const [index, option] of value.options.entries()) {
+    if (optionIds.has(option.id)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Option ids must be unique within one checkbox confirmation",
+        path: ["options", index, "id"]
+      });
+    }
+    optionIds.add(option.id);
+  }
+  const defaultSelectedOptionIds = /* @__PURE__ */ new Set();
+  for (const [index, optionId] of value.defaultSelectedOptionIds.entries()) {
+    if (defaultSelectedOptionIds.has(optionId)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "defaultSelectedOptionIds must be unique",
+        path: ["defaultSelectedOptionIds", index]
+      });
+      continue;
+    }
+    defaultSelectedOptionIds.add(optionId);
+    if (!optionIds.has(optionId)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "defaultSelectedOptionIds must reference existing option ids",
+        path: ["defaultSelectedOptionIds", index]
+      });
+    }
+  }
+  const maxSelected = value.maxSelected ?? null;
+  if (value.minSelected > value.options.length) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "minSelected cannot exceed the option count",
+      path: ["minSelected"]
+    });
+  }
+  if (value.defaultSelectedOptionIds.length < value.minSelected) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "defaultSelectedOptionIds must satisfy minSelected",
+      path: ["defaultSelectedOptionIds"]
+    });
+  }
+  if (maxSelected != null) {
+    if (maxSelected < value.minSelected) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "maxSelected must be greater than or equal to minSelected",
+        path: ["maxSelected"]
+      });
+    }
+    if (maxSelected > value.options.length) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "maxSelected cannot exceed the option count",
+        path: ["maxSelected"]
+      });
+    }
+    if (value.defaultSelectedOptionIds.length > maxSelected) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "defaultSelectedOptionIds cannot exceed maxSelected",
+        path: ["defaultSelectedOptionIds"]
+      });
+    }
+  }
 });
 var requestConfirmationResultSchema = external_exports.object({
   version: external_exports.literal(1),
@@ -5759,6 +6584,22 @@ var requestConfirmationResultSchema = external_exports.object({
   commentId: external_exports.string().uuid().nullable().optional(),
   staleTarget: requestConfirmationTargetSchema.nullable().optional()
 });
+var requestCheckboxConfirmationResultSchema = requestConfirmationResultSchema.extend({
+  selectedOptionIds: external_exports.array(external_exports.string().trim().min(1).max(120)).max(REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT).optional()
+}).superRefine((value, ctx) => {
+  const selectedOptionIds = value.selectedOptionIds ?? [];
+  const seenOptionIds = /* @__PURE__ */ new Set();
+  for (const [index, optionId] of selectedOptionIds.entries()) {
+    if (seenOptionIds.has(optionId)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "selectedOptionIds must be unique",
+        path: ["selectedOptionIds", index]
+      });
+    }
+    seenOptionIds.add(optionId);
+  }
+});
 var createIssueThreadInteractionSchema = external_exports.discriminatedUnion("kind", [
   external_exports.object({
     kind: external_exports.literal("suggest_tasks"),
@@ -5781,306 +6622,121 @@ var createIssueThreadInteractionSchema = external_exports.discriminatedUnion("ki
     payload: askUserQuestionsPayloadSchema
   }),
   external_exports.object({
-    kind: external_exports.literal("request_confirmation"),
-    idempotencyKey: external_exports.string().trim().max(255).nullable().optional(),
-    sourceCommentId: external_exports.string().uuid().nullable().optional(),
-    sourceRunId: external_exports.string().uuid().nullable().optional(),
-    title: external_exports.string().trim().max(240).nullable().optional(),
-    summary: external_exports.string().trim().max(1e3).nullable().optional(),
-    continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("none"),
-    payload: requestConfirmationPayloadSchema
-  })
-]);
-var acceptIssueThreadInteractionSchema = external_exports.object({
-  selectedClientKeys: external_exports.array(external_exports.string().trim().min(1).max(120)).min(1).max(50).optional()
-}).superRefine((value, ctx) => {
-  const seenClientKeys = /* @__PURE__ */ new Set();
-  for (const [index, clientKey] of (value.selectedClientKeys ?? []).entries()) {
-    if (seenClientKeys.has(clientKey)) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        message: "selectedClientKeys must be unique",
-        path: ["selectedClientKeys", index]
-      });
-      continue;
-    }
-    seenClientKeys.add(clientKey);
-  }
-});
-var rejectIssueThreadInteractionSchema = external_exports.object({
-  reason: external_exports.string().trim().max(4e3).optional()
-});
-var cancelIssueThreadInteractionSchema = external_exports.object({
-  reason: external_exports.string().trim().max(4e3).optional()
-});
-var respondIssueThreadInteractionSchema = external_exports.object({
-  answers: external_exports.array(askUserQuestionsAnswerSchema).max(20),
-  summaryMarkdown: multilineTextSchema.pipe(external_exports.string().max(2e4)).nullable().optional()
-});
-var linkIssueApprovalSchema = external_exports.object({
-  approvalId: external_exports.string().uuid()
-});
-var createIssueAttachmentMetadataSchema = external_exports.object({
-  issueCommentId: external_exports.string().uuid().optional().nullable()
-});
-var ISSUE_DOCUMENT_FORMATS = ["markdown"];
-var issueDocumentFormatSchema = external_exports.enum(ISSUE_DOCUMENT_FORMATS);
-var upsertIssueDocumentSchema = external_exports.object({
-  title: external_exports.string().trim().max(200).nullable().optional(),
-  format: issueDocumentFormatSchema,
-  body: multilineTextSchema.pipe(external_exports.string().max(524288)),
-  changeSummary: external_exports.string().trim().max(500).nullable().optional(),
-  baseRevisionId: external_exports.string().uuid().nullable().optional()
-});
-var restoreIssueDocumentRevisionSchema = external_exports.object({});
-
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/secret.js
-var envBindingPlainSchema = external_exports.object({
-  type: external_exports.literal("plain"),
-  value: external_exports.string()
-});
-var envBindingSecretRefSchema = external_exports.object({
-  type: external_exports.literal("secret_ref"),
-  secretId: external_exports.string().uuid(),
-  version: external_exports.union([external_exports.literal("latest"), external_exports.number().int().positive()]).optional()
-});
-var envBindingSchema = external_exports.union([
-  external_exports.string(),
-  envBindingPlainSchema,
-  envBindingSecretRefSchema
-]);
-var envConfigSchema = external_exports.record(external_exports.string(), envBindingSchema);
-var createSecretSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  key: external_exports.string().min(1).regex(/^[a-zA-Z0-9_.-]+$/).optional(),
-  provider: external_exports.enum(SECRET_PROVIDERS).optional(),
-  providerConfigId: external_exports.string().uuid().optional().nullable(),
-  managedMode: external_exports.enum(SECRET_MANAGED_MODES).optional(),
-  value: external_exports.string().min(1).optional().nullable(),
-  description: external_exports.string().optional().nullable(),
-  externalRef: external_exports.string().optional().nullable(),
-  providerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
-  providerVersionRef: external_exports.string().optional().nullable()
-}).superRefine((value, ctx) => {
-  if ((value.managedMode ?? "paperclip_managed") === "external_reference") {
-    if (!value.externalRef?.trim()) {
-      ctx.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["externalRef"],
-        message: "External reference secrets require externalRef"
-      });
-    }
-    return;
-  }
-  if (value.externalRef?.trim()) {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["externalRef"],
-      message: "Managed secrets cannot set externalRef"
-    });
-  }
-  if (!value.value?.trim()) {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["value"],
-      message: "Managed secrets require value"
-    });
-  }
-});
-var rotateSecretSchema = external_exports.object({
-  value: external_exports.string().min(1).optional().nullable(),
-  externalRef: external_exports.string().optional().nullable(),
-  providerVersionRef: external_exports.string().optional().nullable(),
-  providerConfigId: external_exports.string().uuid().optional().nullable()
-});
-var updateSecretSchema = external_exports.object({
-  name: external_exports.string().min(1).optional(),
-  key: external_exports.string().min(1).regex(/^[a-zA-Z0-9_.-]+$/).optional(),
-  status: external_exports.enum(SECRET_STATUSES).optional(),
-  providerConfigId: external_exports.string().uuid().optional().nullable(),
-  description: external_exports.string().optional().nullable(),
-  externalRef: external_exports.string().optional().nullable(),
-  providerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
-});
-var secretBindingTargetSchema = external_exports.object({
-  targetType: external_exports.enum(SECRET_BINDING_TARGET_TYPES),
-  targetId: external_exports.string().min(1),
-  configPath: external_exports.string().min(1)
-});
-var createSecretBindingSchema = secretBindingTargetSchema.extend({
-  secretId: external_exports.string().uuid(),
-  versionSelector: external_exports.union([external_exports.literal("latest"), external_exports.number().int().positive()]).default("latest"),
-  required: external_exports.boolean().default(true),
-  label: external_exports.string().optional().nullable()
-});
-var safeShortText = external_exports.string().trim().min(1).max(160);
-var optionalSafeShortText = safeShortText.optional().nullable();
-var deniedProviderConfigKeyPattern = /^(access[-_]?key([-_]?id)?|secret[-_]?access[-_]?key|secret[-_]?key|token|password|passwd|credential|credentials|private[-_]?key|pem|jwt|session[-_]?token|service[-_]?account([-_]?json)?|client[-_]?secret|secret[-_]?id|unseal[-_]?key|recovery[-_]?key|key[-_]?file([-_]?path)?|token[-_]?file([-_]?path)?)$/i;
-function rejectSensitiveProviderConfigKeys(value, ctx) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return;
-  for (const key of Object.keys(value)) {
-    if (!deniedProviderConfigKeyPattern.test(key))
-      continue;
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["config", key],
-      message: `Provider vault config cannot persist sensitive field: ${key}`
-    });
-  }
-}
-var localEncryptedProviderConfigSchema = external_exports.object({
-  backupReminderAcknowledged: external_exports.boolean().optional()
-}).strict();
-var awsSecretsManagerProviderConfigSchema = external_exports.object({
-  region: external_exports.string().trim().regex(/^[a-z]{2}(?:-gov)?-[a-z]+-\d+$/, "Invalid AWS region"),
-  namespace: optionalSafeShortText,
-  secretNamePrefix: optionalSafeShortText,
-  kmsKeyId: external_exports.string().trim().min(1).max(512).optional().nullable(),
-  ownerTag: optionalSafeShortText,
-  environmentTag: optionalSafeShortText
-}).strict();
-var gcpSecretManagerProviderConfigSchema = external_exports.object({
-  projectId: external_exports.string().trim().min(1).max(128).regex(/^[a-z][a-z0-9-]{4,127}$/).optional().nullable(),
-  location: optionalSafeShortText,
-  namespace: optionalSafeShortText,
-  secretNamePrefix: optionalSafeShortText
-}).strict();
-var vaultAddressSchema = external_exports.preprocess((value) => typeof value === "string" ? value.trim() : value, external_exports.string().url().superRefine((value, ctx) => {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return;
-  }
-  const hasPath = url.pathname !== "" && url.pathname !== "/";
-  if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.search || url.hash || hasPath) {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      message: "Vault address must be an origin-only HTTP(S) URL without credentials, path, query, or fragment"
-    });
-  }
-}).transform((value) => new URL(value).origin));
-function rejectUnsafeVaultAddress(value, ctx) {
-  if (value === void 0 || value === null)
-    return;
-  const parsed = vaultAddressSchema.safeParse(value);
-  if (parsed.success)
-    return;
-  for (const issue of parsed.error.issues) {
-    ctx.addIssue({
-      ...issue,
-      path: ["config", "address", ...issue.path]
-    });
-  }
-}
-var vaultProviderConfigSchema = external_exports.object({
-  address: vaultAddressSchema.optional().nullable(),
-  namespace: optionalSafeShortText,
-  mountPath: optionalSafeShortText,
-  secretPathPrefix: optionalSafeShortText
-}).strict();
-var secretProviderConfigPayloadSchema = external_exports.discriminatedUnion("provider", [
-  external_exports.object({ provider: external_exports.literal("local_encrypted"), config: localEncryptedProviderConfigSchema }),
-  external_exports.object({ provider: external_exports.literal("aws_secrets_manager"), config: awsSecretsManagerProviderConfigSchema }),
-  external_exports.object({ provider: external_exports.literal("gcp_secret_manager"), config: gcpSecretManagerProviderConfigSchema }),
-  external_exports.object({ provider: external_exports.literal("vault"), config: vaultProviderConfigSchema })
+    kind: external_exports.literal("request_confirmation"),
+    idempotencyKey: external_exports.string().trim().max(255).nullable().optional(),
+    sourceCommentId: external_exports.string().uuid().nullable().optional(),
+    sourceRunId: external_exports.string().uuid().nullable().optional(),
+    title: external_exports.string().trim().max(240).nullable().optional(),
+    summary: external_exports.string().trim().max(1e3).nullable().optional(),
+    continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("none"),
+    payload: requestConfirmationPayloadSchema
+  }),
+  external_exports.object({
+    kind: external_exports.literal("request_checkbox_confirmation"),
+    idempotencyKey: external_exports.string().trim().max(255).nullable().optional(),
+    sourceCommentId: external_exports.string().uuid().nullable().optional(),
+    sourceRunId: external_exports.string().uuid().nullable().optional(),
+    title: external_exports.string().trim().max(240).nullable().optional(),
+    summary: external_exports.string().trim().max(1e3).nullable().optional(),
+    continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("wake_assignee"),
+    payload: requestCheckboxConfirmationPayloadSchema
+  })
 ]);
-var createSecretProviderConfigSchema = external_exports.object({
-  provider: external_exports.enum(SECRET_PROVIDERS),
-  displayName: external_exports.string().trim().min(1).max(120),
-  status: external_exports.enum(SECRET_PROVIDER_CONFIG_STATUSES).optional(),
-  isDefault: external_exports.boolean().optional(),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).default({})
+var acceptIssueThreadInteractionSchema = external_exports.object({
+  selectedClientKeys: external_exports.array(external_exports.string().trim().min(1).max(120)).min(1).max(50).optional(),
+  selectedOptionIds: external_exports.array(external_exports.string().trim().min(1).max(120)).max(REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT).optional()
 }).superRefine((value, ctx) => {
-  rejectSensitiveProviderConfigKeys(value.config, ctx);
-  const parsed = secretProviderConfigPayloadSchema.safeParse({
-    provider: value.provider,
-    config: value.config
-  });
-  if (!parsed.success) {
-    for (const issue of parsed.error.issues) {
+  const seenClientKeys = /* @__PURE__ */ new Set();
+  for (const [index, clientKey] of (value.selectedClientKeys ?? []).entries()) {
+    if (seenClientKeys.has(clientKey)) {
       ctx.addIssue({
-        ...issue,
-        path: issue.path[0] === "config" ? issue.path : ["config", ...issue.path]
+        code: external_exports.ZodIssueCode.custom,
+        message: "selectedClientKeys must be unique",
+        path: ["selectedClientKeys", index]
       });
+      continue;
     }
+    seenClientKeys.add(clientKey);
   }
-  const status = value.status ?? (["gcp_secret_manager", "vault"].includes(value.provider) ? "coming_soon" : "ready");
-  if ((value.provider === "gcp_secret_manager" || value.provider === "vault") && status !== "coming_soon" && status !== "disabled") {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["status"],
-      message: `${value.provider} provider vaults are locked while coming soon`
-    });
-  }
-  if ((status === "coming_soon" || status === "disabled") && value.isDefault) {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["isDefault"],
-      message: "Only ready or warning provider vaults can be default"
-    });
-  }
-});
-var updateSecretProviderConfigSchema = external_exports.object({
-  displayName: external_exports.string().trim().min(1).max(120).optional(),
-  status: external_exports.enum(SECRET_PROVIDER_CONFIG_STATUSES).optional(),
-  isDefault: external_exports.boolean().optional(),
-  config: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-}).superRefine((value, ctx) => {
-  if (value.config !== void 0) {
-    rejectSensitiveProviderConfigKeys(value.config, ctx);
-    rejectUnsafeVaultAddress(value.config.address, ctx);
-  }
-  if ((value.status === "coming_soon" || value.status === "disabled") && value.isDefault) {
-    ctx.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["isDefault"],
-      message: "Only ready or warning provider vaults can be default"
-    });
-  }
-});
-var remoteSecretImportPreviewSchema = external_exports.object({
-  providerConfigId: external_exports.string().uuid(),
-  query: external_exports.string().trim().max(200).optional().nullable(),
-  nextToken: external_exports.string().trim().min(1).max(4096).optional().nullable(),
-  pageSize: external_exports.number().int().min(1).max(100).optional()
-});
-var secretProviderConfigDiscoveryPreviewSchema = external_exports.object({
-  provider: external_exports.enum(SECRET_PROVIDERS),
-  config: external_exports.record(external_exports.unknown()).default({}),
-  query: external_exports.string().trim().max(200).optional().nullable(),
-  nextToken: external_exports.string().trim().min(1).max(4096).optional().nullable(),
-  pageSize: external_exports.number().int().min(1).max(100).optional()
-}).superRefine((value, ctx) => {
-  rejectSensitiveProviderConfigKeys(value.config, ctx);
-  const parsed = secretProviderConfigPayloadSchema.safeParse({
-    provider: value.provider,
-    config: value.config
-  });
-  if (!parsed.success) {
-    for (const issue of parsed.error.issues) {
+  const seenOptionIds = /* @__PURE__ */ new Set();
+  for (const [index, optionId] of (value.selectedOptionIds ?? []).entries()) {
+    if (seenOptionIds.has(optionId)) {
       ctx.addIssue({
-        ...issue,
-        path: issue.path[0] === "config" ? issue.path : ["config", ...issue.path]
+        code: external_exports.ZodIssueCode.custom,
+        message: "selectedOptionIds must be unique",
+        path: ["selectedOptionIds", index]
       });
+      continue;
     }
+    seenOptionIds.add(optionId);
   }
 });
-var remoteSecretImportSelectionSchema = external_exports.object({
-  externalRef: external_exports.string().trim().min(1).max(2048),
-  name: external_exports.string().trim().min(1).max(160).optional().nullable(),
-  key: external_exports.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9_.-]+$/).optional().nullable(),
-  description: external_exports.string().trim().max(500).optional().nullable(),
-  providerVersionRef: external_exports.string().trim().min(1).max(512).optional().nullable(),
-  providerMetadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
+var rejectIssueThreadInteractionSchema = external_exports.object({
+  reason: external_exports.string().trim().max(4e3).optional()
 });
-var remoteSecretImportSchema = external_exports.object({
-  providerConfigId: external_exports.string().uuid(),
-  secrets: external_exports.array(remoteSecretImportSelectionSchema).min(1).max(100)
+var cancelIssueThreadInteractionSchema = external_exports.object({
+  reason: external_exports.string().trim().max(4e3).optional()
+});
+var respondIssueThreadInteractionSchema = external_exports.object({
+  answers: external_exports.array(askUserQuestionsAnswerSchema).max(20),
+  summaryMarkdown: multilineTextSchema.pipe(external_exports.string().max(2e4)).nullable().optional()
+});
+var linkIssueApprovalSchema = external_exports.object({
+  approvalId: external_exports.string().uuid()
+});
+var createIssueAttachmentMetadataSchema = external_exports.object({
+  issueCommentId: external_exports.string().uuid().optional().nullable()
+});
+var ISSUE_DOCUMENT_FORMATS = ["markdown"];
+var issueDocumentFormatSchema = external_exports.enum(ISSUE_DOCUMENT_FORMATS);
+var upsertIssueDocumentSchema = external_exports.object({
+  title: external_exports.string().trim().max(200).nullable().optional(),
+  format: issueDocumentFormatSchema,
+  body: multilineTextSchema.pipe(external_exports.string().max(524288)),
+  changeSummary: external_exports.string().trim().max(500).nullable().optional(),
+  baseRevisionId: external_exports.string().uuid().nullable().optional()
+});
+var restoreIssueDocumentRevisionSchema = external_exports.object({});
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/routine-variables.js
+var HUMAN_TIMESTAMP_FORMATTER = new Intl.DateTimeFormat("en-US", {
+  year: "numeric",
+  month: "long",
+  day: "numeric",
+  hour: "numeric",
+  minute: "2-digit",
+  hour12: true,
+  timeZone: "UTC",
+  timeZoneName: "short"
 });
+function isValidRoutineDateString(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value);
+  if (!match)
+    return false;
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  if (month < 1 || month > 12)
+    return false;
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const daysInMonth = [
+    31,
+    leapYear ? 29 : 28,
+    31,
+    30,
+    31,
+    30,
+    31,
+    31,
+    30,
+    31,
+    30,
+    31
+  ][month - 1];
+  return day >= 1 && day <= daysInMonth;
+}
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/routine.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/routine.js
 var routineVariableValueSchema = external_exports.union([external_exports.string(), external_exports.number().finite(), external_exports.boolean()]);
 var routineVariableSchema = external_exports.object({
   name: external_exports.string().trim().regex(/^[A-Za-z][A-Za-z0-9_]*$/),
@@ -6113,6 +6769,15 @@ var routineVariableSchema = external_exports.object({
       });
     }
   }
+  if (value.type === "date" && value.defaultValue != null) {
+    if (typeof value.defaultValue !== "string" || !isValidRoutineDateString(value.defaultValue)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["defaultValue"],
+        message: "Date variable defaults must be valid YYYY-MM-DD calendar dates"
+      });
+    }
+  }
 });
 var createRoutineSchema = external_exports.object({
   projectId: external_exports.string().uuid().optional().nullable(),
@@ -6145,7 +6810,8 @@ var routineRevisionSnapshotRoutineV1Schema = external_exports.object({
   concurrencyPolicy: external_exports.enum(ROUTINE_CONCURRENCY_POLICIES),
   catchUpPolicy: external_exports.enum(ROUTINE_CATCH_UP_POLICIES),
   variables: external_exports.array(routineVariableSchema),
-  env: envConfigSchema.nullable().default(null)
+  env: envConfigSchema.nullable().default(null),
+  responsibleUserId: external_exports.string().nullable().default(null)
 }).strict();
 var routineRevisionSnapshotTriggerV1Schema = external_exports.object({
   id: external_exports.string().uuid(),
@@ -6195,6 +6861,7 @@ var runRoutineSchema = external_exports.object({
   payload: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
   variables: external_exports.record(external_exports.string(), routineVariableValueSchema).optional().nullable(),
   projectId: external_exports.string().uuid().optional().nullable(),
+  projectWorkspaceId: external_exports.string().uuid().optional().nullable(),
   assigneeAgentId: external_exports.string().uuid().optional().nullable(),
   idempotencyKey: external_exports.string().trim().max(255).optional().nullable(),
   source: external_exports.enum(["manual", "api"]).optional().default("manual"),
@@ -6204,7 +6871,7 @@ var runRoutineSchema = external_exports.object({
 });
 var rotateRoutineTriggerSecretSchema = external_exports.object({});
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/company-portability.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/company-portability.js
 var portabilityIncludeSchema = external_exports.object({
   company: external_exports.boolean().optional(),
   agents: external_exports.boolean().optional(),
@@ -6425,13 +7092,219 @@ var portabilityAdapterOverrideSchema = external_exports.object({
   adapterConfig: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
 });
 var companyPortabilityImportSchema = companyPortabilityPreviewSchema.extend({
-  adapterOverrides: external_exports.record(external_exports.string().min(1), portabilityAdapterOverrideSchema).optional()
+  adapterOverrides: external_exports.record(external_exports.string().min(1), portabilityAdapterOverrideSchema).optional(),
+  secretValues: external_exports.record(external_exports.string().min(1), external_exports.string()).optional()
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/agent.js
-var agentPermissionsSchema = external_exports.object({
-  canCreateAgents: external_exports.boolean().optional().default(false)
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/teams-catalog.js
+var catalogTeamKindSchema = external_exports.enum(["bundled", "optional"]);
+var catalogTeamTrustLevelSchema = external_exports.enum([
+  "markdown_only",
+  "assets",
+  "scripts_executables",
+  "external_sources"
+]);
+var catalogTeamCompatibilitySchema = external_exports.enum(["compatible", "unknown", "invalid"]);
+var catalogTeamFileKindSchema = external_exports.enum([
+  "team",
+  "agent",
+  "project",
+  "task",
+  "skill",
+  "extension",
+  "readme",
+  "reference",
+  "script",
+  "asset",
+  "markdown",
+  "other"
+]);
+var catalogTeamSkillRequirementTypeSchema = external_exports.enum([
+  "catalog",
+  "local",
+  "skills_sh",
+  "github",
+  "url",
+  "local_path",
+  "agent_package"
+]);
+var catalogTeamSkillRequirementSchema = external_exports.object({
+  type: catalogTeamSkillRequirementTypeSchema,
+  ref: external_exports.string().min(1),
+  agentSlugs: external_exports.array(external_exports.string().min(1)),
+  resolved: external_exports.boolean(),
+  catalogSkillId: external_exports.string().min(1).optional(),
+  catalogSkillKey: external_exports.string().min(1).optional(),
+  localPath: external_exports.string().min(1).optional(),
+  sourceLocator: external_exports.string().min(1).optional(),
+  sourceRef: external_exports.string().min(1).optional()
+});
+var catalogTeamEnvInputSummarySchema = external_exports.object({
+  key: external_exports.string().min(1),
+  agentSlug: external_exports.string().min(1).nullable(),
+  projectSlug: external_exports.string().min(1).nullable(),
+  kind: external_exports.enum(["secret", "plain"]),
+  requirement: external_exports.enum(["required", "optional"])
+});
+var catalogTeamSourceRefSchema = external_exports.object({
+  type: external_exports.enum(["skills_sh", "github", "url", "local_path", "agent_package", "include"]),
+  ref: external_exports.string().min(1),
+  pinned: external_exports.boolean()
+});
+var catalogTeamFileSchema = external_exports.object({
+  path: external_exports.string().min(1),
+  kind: catalogTeamFileKindSchema,
+  sizeBytes: external_exports.number().int().nonnegative(),
+  sha256: external_exports.string().min(1)
+});
+var catalogTeamSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  key: external_exports.string().min(1),
+  kind: catalogTeamKindSchema,
+  category: external_exports.string().min(1),
+  slug: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  description: external_exports.string(),
+  path: external_exports.string().min(1),
+  entrypoint: external_exports.literal("TEAM.md"),
+  schema: external_exports.literal("agentcompanies/v1"),
+  defaultInstall: external_exports.boolean(),
+  recommendedForCompanyTypes: external_exports.array(external_exports.string()),
+  tags: external_exports.array(external_exports.string()),
+  counts: external_exports.object({
+    agents: external_exports.number().int().nonnegative(),
+    projects: external_exports.number().int().nonnegative(),
+    tasks: external_exports.number().int().nonnegative(),
+    routines: external_exports.number().int().nonnegative(),
+    localSkills: external_exports.number().int().nonnegative(),
+    catalogSkills: external_exports.number().int().nonnegative(),
+    externalSkillSources: external_exports.number().int().nonnegative()
+  }),
+  rootAgentSlugs: external_exports.array(external_exports.string()),
+  agentSlugs: external_exports.array(external_exports.string()),
+  projectSlugs: external_exports.array(external_exports.string()),
+  requiredSkills: external_exports.array(catalogTeamSkillRequirementSchema),
+  envInputs: external_exports.array(catalogTeamEnvInputSummarySchema),
+  sourceRefs: external_exports.array(catalogTeamSourceRefSchema),
+  files: external_exports.array(catalogTeamFileSchema),
+  trustLevel: catalogTeamTrustLevelSchema,
+  compatibility: catalogTeamCompatibilitySchema,
+  contentHash: external_exports.string().min(1),
+  packageName: external_exports.string().min(1).optional(),
+  packageVersion: external_exports.string().min(1).optional()
+});
+var catalogTeamListQuerySchema = external_exports.object({
+  kind: catalogTeamKindSchema.optional(),
+  category: external_exports.string().min(1).optional(),
+  q: external_exports.string().min(1).optional()
+});
+var catalogTeamFileDetailSchema = external_exports.object({
+  catalogTeamId: external_exports.string().min(1),
+  path: external_exports.string().min(1),
+  kind: catalogTeamFileKindSchema,
+  content: external_exports.string(),
+  language: external_exports.string().nullable(),
+  markdown: external_exports.boolean()
+});
+var catalogTeamSourcePolicySchema = external_exports.object({
+  allowExternalSources: external_exports.boolean().optional(),
+  allowUnpinnedOptionalSources: external_exports.boolean().optional(),
+  allowLocalPathSources: external_exports.boolean().optional()
+}).strict();
+var catalogTeamPreviewSchema = external_exports.object({
+  targetManagerAgentId: external_exports.string().min(1).nullable().optional(),
+  targetManagerSlug: external_exports.string().min(1).nullable().optional(),
+  include: portabilityIncludeSchema.omit({ company: true }).strict().optional(),
+  agents: portabilityAgentSelectionSchema.optional(),
+  collisionStrategy: portabilityCollisionStrategySchema.optional(),
+  nameOverrides: external_exports.record(external_exports.string().min(1), external_exports.string().min(1)).optional(),
+  selectedFiles: external_exports.array(external_exports.string().min(1)).optional(),
+  sourcePolicy: catalogTeamSourcePolicySchema.optional()
+}).strict();
+var catalogTeamInstallSchema = catalogTeamPreviewSchema.extend({
+  adapterOverrides: external_exports.record(external_exports.string().min(1), portabilityAdapterOverrideSchema).optional(),
+  secretValues: external_exports.record(external_exports.string().min(1), external_exports.string()).optional()
+}).strict();
+var catalogTeamSkillPreparationSchema = external_exports.object({
+  type: catalogTeamSkillRequirementTypeSchema,
+  ref: external_exports.string().min(1),
+  agentSlugs: external_exports.array(external_exports.string().min(1)),
+  action: external_exports.enum([
+    "already_in_package",
+    "catalog_install_required",
+    "external_import_required",
+    "blocked"
+  ]),
+  catalogSkillId: external_exports.string().min(1).nullable(),
+  catalogSkillKey: external_exports.string().min(1).nullable(),
+  sourceLocator: external_exports.string().min(1).nullable(),
+  sourceRef: external_exports.string().min(1).nullable(),
+  reason: external_exports.string().min(1).nullable()
+});
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/adapter-skills.js
+var agentSkillStateSchema = external_exports.enum([
+  "available",
+  "configured",
+  "installed",
+  "missing",
+  "stale",
+  "external"
+]);
+var agentSkillOriginSchema = external_exports.enum([
+  "company_managed",
+  "user_installed",
+  "external_unknown"
+]);
+var agentSkillSyncModeSchema = external_exports.enum([
+  "unsupported",
+  "persistent",
+  "ephemeral"
+]);
+var agentDesiredSkillEntrySchema = external_exports.object({
+  key: external_exports.string().min(1),
+  versionId: external_exports.string().uuid().nullable()
+});
+var agentDesiredSkillSelectionSchema = external_exports.union([
+  external_exports.string().min(1),
+  agentDesiredSkillEntrySchema
+]);
+var agentSkillEntrySchema = external_exports.object({
+  key: external_exports.string().min(1),
+  runtimeName: external_exports.string().min(1).nullable(),
+  versionId: external_exports.string().uuid().nullable().optional(),
+  currentVersionId: external_exports.string().uuid().nullable().optional(),
+  desired: external_exports.boolean(),
+  managed: external_exports.boolean(),
+  state: agentSkillStateSchema,
+  origin: agentSkillOriginSchema.optional(),
+  originLabel: external_exports.string().nullable().optional(),
+  locationLabel: external_exports.string().nullable().optional(),
+  readOnly: external_exports.boolean().optional(),
+  sourcePath: external_exports.string().nullable().optional(),
+  targetPath: external_exports.string().nullable().optional(),
+  detail: external_exports.string().nullable().optional()
+});
+var agentSkillSnapshotSchema = external_exports.object({
+  adapterType: external_exports.string().min(1),
+  supported: external_exports.boolean(),
+  mode: agentSkillSyncModeSchema,
+  desiredSkills: external_exports.array(external_exports.string().min(1)),
+  desiredSkillEntries: external_exports.array(agentDesiredSkillEntrySchema).optional(),
+  entries: external_exports.array(agentSkillEntrySchema),
+  warnings: external_exports.array(external_exports.string())
+});
+var agentSkillSyncSchema = external_exports.object({
+  desiredSkills: external_exports.array(agentDesiredSkillSelectionSchema)
 });
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/agent.js
+var agentPermissionsSchema = external_exports.object({
+  canCreateAgents: external_exports.boolean().optional().default(false),
+  canCreateSkills: external_exports.boolean().optional().default(true),
+  trustPreset: trustPresetSchema.optional(),
+  authorizationPolicy: trustAuthorizationPolicySchema.optional()
+}).catchall(external_exports.unknown());
 var agentInstructionsBundleModeSchema = external_exports.enum(["managed", "external"]);
 var updateAgentInstructionsBundleSchema = external_exports.object({
   mode: agentInstructionsBundleModeSchema.optional(),
@@ -6480,7 +7353,7 @@ var createAgentSchema = external_exports.object({
   icon: external_exports.enum(AGENT_ICON_NAMES).optional().nullable(),
   reportsTo: external_exports.string().uuid().optional().nullable(),
   capabilities: external_exports.string().optional().nullable(),
-  desiredSkills: external_exports.array(external_exports.string().min(1)).optional(),
+  desiredSkills: external_exports.array(agentDesiredSkillSelectionSchema).optional(),
   adapterType: agentAdapterTypeSchema,
   adapterConfig: adapterConfigSchema.optional().default({}),
   instructionsBundle: createAgentInstructionsBundleSchema.optional(),
@@ -6504,8 +7377,34 @@ var updateAgentInstructionsPathSchema = external_exports.object({
   path: external_exports.string().trim().min(1).nullable(),
   adapterConfigKey: external_exports.string().trim().min(1).optional()
 });
+var taskBridgeAgentKeyScopeSchema = external_exports.object({
+  kind: external_exports.literal("task_bridge"),
+  projectId: external_exports.string().uuid().optional().nullable(),
+  projectIds: external_exports.array(external_exports.string().uuid()).max(50).optional(),
+  parentIssueId: external_exports.string().uuid().optional().nullable(),
+  parentIssueIds: external_exports.array(external_exports.string().uuid()).max(50).optional(),
+  allowedAssigneeAgentIds: external_exports.array(external_exports.string().uuid()).max(50).optional()
+}).strict().superRefine((value, ctx) => {
+  const hasProjectBoundary = Boolean(value.projectId) || Boolean(value.projectIds?.length);
+  const hasParentBoundary = Boolean(value.parentIssueId) || Boolean(value.parentIssueIds?.length);
+  if (!hasProjectBoundary && !hasParentBoundary) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "task_bridge keys require at least one project or parent issue boundary",
+      path: ["projectId"]
+    });
+  }
+});
+var standardAgentKeyScopeSchema = external_exports.object({
+  kind: external_exports.literal("standard")
+}).strict();
+var agentApiKeyScopeSchema = external_exports.union([
+  standardAgentKeyScopeSchema,
+  taskBridgeAgentKeyScopeSchema
+]);
 var createAgentKeySchema = external_exports.object({
-  name: external_exports.string().min(1).default("default")
+  name: external_exports.string().min(1).default("default"),
+  scope: agentApiKeyScopeSchema.optional().default({ kind: "standard" })
 });
 var agentMineInboxQuerySchema = external_exports.object({
   userId: external_exports.string().trim().min(1),
@@ -6534,10 +7433,13 @@ var testAdapterEnvironmentSchema = external_exports.object({
 });
 var updateAgentPermissionsSchema = external_exports.object({
   canCreateAgents: external_exports.boolean(),
-  canAssignTasks: external_exports.boolean()
+  canCreateSkills: external_exports.boolean().optional(),
+  canAssignTasks: external_exports.boolean(),
+  trustPreset: trustPresetSchema.optional(),
+  authorizationPolicy: trustAuthorizationPolicySchema.optional()
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/project.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/project.js
 var executionWorkspaceStrategySchema2 = external_exports.object({
   type: external_exports.enum(["project_primary", "git_worktree", "adapter_managed", "cloud_sandbox"]).optional(),
   baseRef: external_exports.string().optional().nullable(),
@@ -6557,7 +7459,8 @@ var projectExecutionWorkspacePolicySchema = external_exports.object({
   branchPolicy: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
   pullRequestPolicy: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
   runtimePolicy: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
-  cleanupPolicy: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
+  cleanupPolicy: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
+  authorizationPolicy: trustAuthorizationPolicySchema.optional().nullable()
 }).strict();
 var projectWorkspaceRuntimeConfigSchema = external_exports.object({
   workspaceRuntime: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
@@ -6623,6 +7526,7 @@ var projectFields = {
   leadAgentId: external_exports.string().uuid().optional().nullable(),
   targetDate: external_exports.string().optional().nullable(),
   color: external_exports.string().optional().nullable(),
+  icon: external_exports.enum(PROJECT_ICON_NAMES).optional().nullable(),
   env: envConfigSchema.optional().nullable(),
   executionWorkspacePolicy: projectExecutionWorkspacePolicySchema.optional().nullable(),
   archivedAt: external_exports.string().datetime().optional().nullable()
@@ -6633,7 +7537,7 @@ var createProjectSchema = external_exports.object({
 });
 var updateProjectSchema = external_exports.object(projectFields).partial();
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/document-annotation.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/document-annotation.js
 var documentAnnotationThreadStatusSchema = external_exports.enum(DOCUMENT_ANNOTATION_THREAD_STATUSES);
 var documentAnnotationAnchorStateSchema = external_exports.enum(DOCUMENT_ANNOTATION_ANCHOR_STATES);
 var documentAnnotationAnchorConfidenceSchema = external_exports.enum(DOCUMENT_ANNOTATION_ANCHOR_CONFIDENCES);
@@ -6671,10 +7575,12 @@ var createDocumentAnnotationThreadSchema = external_exports.object({
   baseRevisionId: external_exports.string().uuid(),
   baseRevisionNumber: external_exports.number().int().positive(),
   selector: documentAnnotationAnchorSelectorSchema,
-  body: multilineTextSchema.pipe(external_exports.string().min(1).max(2e4))
+  body: multilineTextSchema.pipe(external_exports.string().min(1).max(2e4)),
+  issueCommentId: external_exports.string().uuid().nullable().optional()
 }).strict();
 var createDocumentAnnotationCommentSchema = external_exports.object({
-  body: multilineTextSchema.pipe(external_exports.string().min(1).max(2e4))
+  body: multilineTextSchema.pipe(external_exports.string().min(1).max(2e4)),
+  issueCommentId: external_exports.string().uuid().nullable().optional()
 }).strict();
 var updateDocumentAnnotationThreadSchema = external_exports.object({
   status: documentAnnotationThreadStatusSchema.optional()
@@ -6682,7 +7588,7 @@ var updateDocumentAnnotationThreadSchema = external_exports.object({
   message: "At least one field must be provided"
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/search.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/search.js
 var COMPANY_SEARCH_MAX_QUERY_LENGTH = 200;
 var COMPANY_SEARCH_DEFAULT_LIMIT = 20;
 var COMPANY_SEARCH_MAX_LIMIT = 50;
@@ -6704,7 +7610,7 @@ var companySearchQuerySchema = external_exports.object({
   offset: external_exports.unknown().optional().transform((value) => clampInteger(value, 0, 0, COMPANY_SEARCH_MAX_OFFSET))
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/issue-tree-control.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/issue-tree-control.js
 var issueTreeControlModeSchema = external_exports.enum(ISSUE_TREE_CONTROL_MODES);
 var issueTreeHoldReleasePolicySchema = external_exports.object({
   strategy: external_exports.enum(ISSUE_TREE_HOLD_RELEASE_POLICY_STRATEGIES).default("manual"),
@@ -6726,7 +7632,96 @@ var releaseIssueTreeHoldSchema = external_exports.object({
   metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable()
 }).strict();
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/work-product.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/workspace-file-resource.js
+var workspaceFileListSearchMaxBytes = 128;
+function utf8ByteLength(value) {
+  return new TextEncoder().encode(value).length;
+}
+var workspaceFileWorkspaceKindSchema = external_exports.enum(["execution_workspace", "project_workspace"]);
+var workspaceFileSelectorSchema = external_exports.enum(["auto", "execution", "project"]).default("auto");
+var workspaceFileListModeSchema = external_exports.enum(["all", "recent", "changed"]).default("all");
+var workspaceFilePreviewKindSchema = external_exports.enum(["text", "image", "video", "pdf", "unsupported"]);
+var workspaceFileResourceKindSchema = external_exports.enum(["file", "directory", "remote_resource"]);
+var workspaceFileRefSchema = external_exports.object({
+  kind: external_exports.literal("workspace_file"),
+  issueId: external_exports.string().uuid().optional(),
+  projectId: external_exports.string().uuid().optional(),
+  projectName: external_exports.string().min(1).optional(),
+  workspaceKind: workspaceFileWorkspaceKindSchema,
+  workspaceId: external_exports.string().uuid(),
+  relativePath: external_exports.string().min(1),
+  line: external_exports.number().int().positive().nullable().optional(),
+  column: external_exports.number().int().positive().nullable().optional(),
+  displayPath: external_exports.string().min(1)
+});
+var workspaceFileResourceQuerySchema = external_exports.object({
+  projectId: external_exports.string().uuid().optional(),
+  workspaceId: external_exports.string().uuid().optional(),
+  path: external_exports.string().min(1).refine((value) => !/[\x00-\x1f\x7f]/.test(value), {
+    message: "Workspace file path contains an invalid character",
+    params: { code: "invalid_path" }
+  }),
+  workspace: workspaceFileSelectorSchema.optional()
+}).refine((value) => Boolean(value.projectId) === Boolean(value.workspaceId), {
+  message: "Workspace file target requires both projectId and workspaceId",
+  path: ["workspaceId"],
+  params: { code: "invalid_target" }
+});
+var workspaceFileListQuerySchema = external_exports.object({
+  projectId: external_exports.string().uuid().optional(),
+  workspaceId: external_exports.string().uuid().optional(),
+  workspace: workspaceFileSelectorSchema.optional(),
+  path: external_exports.string().min(1).refine((value) => !/[\x00-\x1f\x7f]/.test(value), {
+    message: "Workspace folder path contains an invalid character",
+    params: { code: "invalid_path" }
+  }).optional(),
+  mode: workspaceFileListModeSchema.optional(),
+  q: external_exports.string().refine((value) => !/[\x00-\x1f\x7f]/.test(value), {
+    message: "Workspace file search contains an invalid character",
+    params: { code: "invalid_query" }
+  }).refine((value) => utf8ByteLength(value.trim()) <= workspaceFileListSearchMaxBytes, {
+    message: "Workspace file search is too long",
+    params: { code: "invalid_query" }
+  }).optional(),
+  limit: external_exports.coerce.number().int().min(1).max(100).default(25),
+  offset: external_exports.coerce.number().int().min(0).max(1e4).default(0)
+}).refine((value) => Boolean(value.projectId) === Boolean(value.workspaceId), {
+  message: "Workspace file target requires both projectId and workspaceId",
+  path: ["workspaceId"],
+  params: { code: "invalid_target" }
+});
+var resolvedWorkspaceResourceSchema = external_exports.object({
+  kind: workspaceFileResourceKindSchema,
+  provider: external_exports.string().min(1),
+  title: external_exports.string().min(1),
+  displayPath: external_exports.string().min(1),
+  workspaceLabel: external_exports.string().min(1),
+  workspaceKind: workspaceFileWorkspaceKindSchema,
+  workspaceId: external_exports.string().uuid(),
+  projectId: external_exports.string().uuid().nullable().optional(),
+  projectName: external_exports.string().min(1).nullable().optional(),
+  contentType: external_exports.string().nullable().optional(),
+  byteSize: external_exports.number().int().nonnegative().nullable().optional(),
+  previewKind: workspaceFilePreviewKindSchema,
+  denialReason: external_exports.string().nullable().optional(),
+  capabilities: external_exports.object({
+    preview: external_exports.boolean(),
+    download: external_exports.boolean(),
+    listChildren: external_exports.boolean()
+  })
+});
+var workspaceFileContentSchema = external_exports.object({
+  resource: resolvedWorkspaceResourceSchema,
+  content: external_exports.object({
+    encoding: external_exports.enum(["utf8", "base64"]),
+    data: external_exports.string()
+  })
+});
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/work-product.js
+function attachmentContentPath(attachmentId) {
+  return `/api/attachments/${attachmentId}/content`;
+}
 var issueWorkProductTypeSchema = external_exports.enum([
   "preview_url",
   "runtime_service",
@@ -6753,6 +7748,41 @@ var issueWorkProductReviewStateSchema = external_exports.enum([
   "approved",
   "changes_requested"
 ]);
+var attachmentArtifactWorkProductMetadataSchema = external_exports.object({
+  attachmentId: external_exports.string().uuid(),
+  contentType: external_exports.string().min(1),
+  byteSize: external_exports.number().int().nonnegative(),
+  contentPath: external_exports.string().min(1),
+  openPath: external_exports.string().min(1),
+  downloadPath: external_exports.string().min(1),
+  originalFilename: external_exports.string().optional().nullable()
+}).superRefine((value, ctx) => {
+  const contentPath = attachmentContentPath(value.attachmentId);
+  if (value.contentPath !== contentPath) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["contentPath"],
+      message: "contentPath must point to the same-origin attachment content route"
+    });
+  }
+  if (value.openPath !== contentPath) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["openPath"],
+      message: "openPath must point to the same-origin attachment content route"
+    });
+  }
+  if (value.downloadPath !== `${contentPath}?download=1`) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["downloadPath"],
+      message: "downloadPath must point to the same-origin attachment download route"
+    });
+  }
+});
+var issueWorkProductMetadataSchema = external_exports.object({
+  resourceRef: workspaceFileRefSchema.optional().nullable()
+}).passthrough();
 var createIssueWorkProductSchema = external_exports.object({
   projectId: external_exports.string().uuid().optional().nullable(),
   executionWorkspaceId: external_exports.string().uuid().optional().nullable(),
@@ -6767,12 +7797,76 @@ var createIssueWorkProductSchema = external_exports.object({
   isPrimary: external_exports.boolean().optional().default(false),
   healthStatus: external_exports.enum(["unknown", "healthy", "unhealthy"]).optional().default("unknown"),
   summary: external_exports.string().optional().nullable(),
-  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional().nullable(),
+  metadata: issueWorkProductMetadataSchema.optional().nullable(),
   createdByRunId: external_exports.string().uuid().optional().nullable()
 });
 var updateIssueWorkProductSchema = createIssueWorkProductSchema.partial();
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/goal.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/artifact.js
+var COMPANY_ARTIFACTS_DEFAULT_LIMIT = 30;
+var COMPANY_ARTIFACTS_MAX_LIMIT = 100;
+var COMPANY_ARTIFACTS_MAX_QUERY_LENGTH = 160;
+var companyArtifactSourceSchema = external_exports.enum(["document", "attachment", "work_product"]);
+var companyArtifactMediaKindSchema = external_exports.enum(["image", "video", "text", "document", "file", "empty"]);
+var companyArtifactGroupBySchema = external_exports.enum(["none", "task", "parent_task"]);
+var companyArtifactsQuerySchema = external_exports.object({
+  kind: external_exports.enum(["image", "video", "text", "document", "file", "all"]).optional().default("all"),
+  projectId: external_exports.string().uuid().optional(),
+  q: external_exports.string().trim().max(COMPANY_ARTIFACTS_MAX_QUERY_LENGTH).optional(),
+  groupBy: companyArtifactGroupBySchema.optional().default("none"),
+  groupIssueId: external_exports.string().uuid().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(COMPANY_ARTIFACTS_MAX_LIMIT).optional().default(COMPANY_ARTIFACTS_DEFAULT_LIMIT),
+  cursor: external_exports.string().min(1).optional()
+});
+var companyArtifactSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  source: companyArtifactSourceSchema,
+  mediaKind: companyArtifactMediaKindSchema,
+  title: external_exports.string(),
+  previewText: external_exports.string().nullable(),
+  contentType: external_exports.string().nullable(),
+  contentPath: external_exports.string().nullable(),
+  openPath: external_exports.string().nullable(),
+  downloadPath: external_exports.string().nullable(),
+  issue: external_exports.object({
+    id: external_exports.string().uuid(),
+    identifier: external_exports.string(),
+    title: external_exports.string()
+  }),
+  project: external_exports.object({
+    id: external_exports.string().uuid(),
+    name: external_exports.string()
+  }).nullable(),
+  createdByAgent: external_exports.object({
+    id: external_exports.string().uuid(),
+    name: external_exports.string()
+  }).nullable(),
+  updatedAt: external_exports.string().datetime(),
+  href: external_exports.string().min(1)
+});
+var companyArtifactGroupSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  groupBy: companyArtifactGroupBySchema.exclude(["none"]),
+  issue: external_exports.object({
+    id: external_exports.string().uuid(),
+    identifier: external_exports.string(),
+    title: external_exports.string()
+  }),
+  title: external_exports.string(),
+  count: external_exports.number().int().min(0),
+  mediaKinds: external_exports.array(companyArtifactMediaKindSchema),
+  previewArtifacts: external_exports.array(companyArtifactSchema),
+  updatedAt: external_exports.string().datetime(),
+  href: external_exports.string().min(1)
+});
+var companyArtifactsResponseSchema = external_exports.object({
+  artifacts: external_exports.array(companyArtifactSchema),
+  groups: external_exports.array(companyArtifactGroupSchema).optional(),
+  selectedGroup: companyArtifactGroupSchema.nullable().optional(),
+  nextCursor: external_exports.string().nullable()
+});
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/goal.js
 var createGoalSchema = external_exports.object({
   title: external_exports.string().min(1),
   description: external_exports.string().optional().nullable(),
@@ -6783,7 +7877,7 @@ var createGoalSchema = external_exports.object({
 });
 var updateGoalSchema = createGoalSchema.partial();
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/approval.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/approval.js
 var createApprovalSchema = external_exports.object({
   type: external_exports.enum(APPROVAL_TYPES),
   requestedByAgentId: external_exports.string().uuid().optional().nullable(),
@@ -6803,7 +7897,7 @@ var addApprovalCommentSchema = external_exports.object({
   body: multilineTextSchema.pipe(external_exports.string().min(1))
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/cost.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/cost.js
 var createCostEventSchema = external_exports.object({
   agentId: external_exports.string().uuid(),
   issueId: external_exports.string().uuid().optional().nullable(),
@@ -6828,7 +7922,7 @@ var updateBudgetSchema = external_exports.object({
   budgetMonthlyCents: external_exports.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/finance.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/finance.js
 var createFinanceEventSchema = external_exports.object({
   agentId: external_exports.string().uuid().optional().nullable(),
   issueId: external_exports.string().uuid().optional().nullable(),
@@ -6859,12 +7953,144 @@ var createFinanceEventSchema = external_exports.object({
   currency: value.currency.toUpperCase()
 }));
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/asset.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/asset.js
 var createAssetImageMetadataSchema = external_exports.object({
   namespace: external_exports.string().trim().min(1).max(120).regex(/^[a-zA-Z0-9/_-]+$/).optional()
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/access.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/pipeline.js
+var routineVariableLikeNameSchema = external_exports.string().trim().regex(/^[A-Za-z][A-Za-z0-9_]*$/);
+var pipelineStageKindSchema = external_exports.enum(["working", "review", "done", "cancelled"]);
+var legacyPipelineStageKindSchema = external_exports.enum(["open", "working", "review", "done", "cancelled"]);
+var pipelineStageApproverSchema = external_exports.object({
+  kind: external_exports.enum(["any_human", "user", "agent"]).optional().default("any_human"),
+  id: external_exports.string().trim().min(1).max(200).optional()
+}).superRefine((value, ctx) => {
+  if (value.kind !== "any_human" && (typeof value.id !== "string" || value.id.length === 0)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["id"],
+      message: "Specific stage approvers require an id"
+    });
+  }
+});
+var pipelineStageOnEnterSchema = external_exports.object({
+  type: external_exports.literal("run_routine"),
+  routineId: external_exports.string().uuid(),
+  id: external_exports.string().trim().min(1).max(200).optional(),
+  projectId: external_exports.string().uuid().optional().nullable(),
+  projectWorkspaceId: external_exports.string().uuid().optional().nullable(),
+  executionWorkspaceId: external_exports.string().uuid().optional().nullable(),
+  executionWorkspacePreference: external_exports.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
+  executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable()
+}).passthrough();
+var pipelineStageAutomationSchema = external_exports.object({
+  routineId: external_exports.string().uuid().optional().nullable(),
+  assigneeAgentId: external_exports.string().uuid().optional().nullable(),
+  instructionsBody: external_exports.string().optional().nullable(),
+  projectId: external_exports.string().uuid().optional().nullable(),
+  projectWorkspaceId: external_exports.string().uuid().optional().nullable(),
+  executionWorkspaceId: external_exports.string().uuid().optional().nullable(),
+  executionWorkspacePreference: external_exports.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
+  executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable()
+}).passthrough();
+var pipelineStageCarryOverPolicySchema = external_exports.object({
+  version: external_exports.literal(1).default(1),
+  mode: external_exports.enum(["all_except", "only"]).default("all_except"),
+  includeFields: external_exports.array(routineVariableLikeNameSchema).max(100).default([]),
+  excludeFields: external_exports.array(routineVariableLikeNameSchema).max(100).default([])
+});
+var pipelineStageBreakdownSchema = external_exports.object({
+  targetPipelineId: external_exports.string().uuid(),
+  targetStageKey: external_exports.string().trim().min(1).max(120),
+  pieceNoun: external_exports.string().trim().min(1).max(80).default("piece"),
+  carryOverPolicy: pipelineStageCarryOverPolicySchema.optional(),
+  inheritFields: external_exports.array(routineVariableLikeNameSchema).max(100).default([]),
+  advanceTo: external_exports.string().trim().min(1).max(120).optional(),
+  waitForPieces: external_exports.boolean().optional().default(false),
+  whenFinishedMoveTo: external_exports.string().trim().min(1).max(120).optional()
+}).superRefine((value, ctx) => {
+  if (value.waitForPieces && !value.whenFinishedMoveTo) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["whenFinishedMoveTo"],
+      message: "Breakdown stages that wait for pieces need a destination stage"
+    });
+  }
+});
+var pipelineStageVariableSchema = external_exports.object({
+  key: routineVariableLikeNameSchema,
+  label: external_exports.string().trim().max(120),
+  type: external_exports.enum(["select", "text", "multiline"]).default("text"),
+  options: external_exports.array(external_exports.string().trim().min(1).max(120)).max(50).optional().default([]),
+  required: external_exports.boolean().optional().default(false),
+  showInAddForm: external_exports.boolean().optional().default(false)
+}).superRefine((value, ctx) => {
+  if (value.type === "select" && value.options.length === 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["options"],
+      message: "Select variables require at least one option"
+    });
+  }
+  if (value.type !== "select" && value.options.length > 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["options"],
+      message: "Only select variables can define options"
+    });
+  }
+});
+var pipelineStageConfigSchema = external_exports.object({
+  variables: external_exports.array(pipelineStageVariableSchema).default([]),
+  disabled: external_exports.boolean().optional(),
+  disabledReason: external_exports.string().trim().max(1e3).nullable().optional(),
+  requireApproval: external_exports.boolean().optional(),
+  approver: pipelineStageApproverSchema.optional(),
+  /** Legacy input only; the server migrates it to requireApproval/approver. */
+  reviewerKind: external_exports.enum(["human", "any"]).optional(),
+  whatHappensHere: external_exports.string().trim().max(1e4).optional(),
+  onEnter: pipelineStageOnEnterSchema.optional(),
+  automation: pipelineStageAutomationSchema.optional(),
+  breakdown: pipelineStageBreakdownSchema.optional(),
+  approveToStageKey: external_exports.string().trim().min(1).max(120).optional(),
+  rejectToStageKey: external_exports.string().trim().min(1).max(120).optional(),
+  requestChangesToStageKey: external_exports.string().trim().min(1).max(120).optional(),
+  requireRejectReason: external_exports.boolean().optional(),
+  requireRequestChangesReason: external_exports.boolean().optional(),
+  requireChildrenTerminal: external_exports.boolean().optional(),
+  requireNoUnresolvedDrift: external_exports.boolean().optional()
+}).passthrough().superRefine((value, ctx) => {
+  const keys = /* @__PURE__ */ new Set();
+  value.variables.forEach((variable, index) => {
+    if (keys.has(variable.key)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["variables", index, "key"],
+        message: "Pipeline stage variable keys must be unique"
+      });
+    }
+    keys.add(variable.key);
+  });
+});
+var pipelineAutomationRetryScopeSchema = external_exports.enum(["current_stage", "previous_stage"]);
+var pipelineAutomationRetryCleanupOptionsSchema = external_exports.object({
+  retireDirectChildren: external_exports.boolean().default(true),
+  retireDescendants: external_exports.boolean().default(true),
+  cancelLinkedAutomationIssues: external_exports.boolean().default(true)
+});
+var pipelineAutomationRetryRequestSchema = external_exports.object({
+  scope: pipelineAutomationRetryScopeSchema,
+  targetStageId: external_exports.string().uuid().nullable().optional(),
+  expectedVersion: external_exports.number().int().positive(),
+  cleanup: pipelineAutomationRetryCleanupOptionsSchema.default({
+    retireDirectChildren: true,
+    retireDescendants: true,
+    cancelLinkedAutomationIssues: true
+  })
+});
+
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/access.js
 var createCompanyInviteSchema = external_exports.object({
   allowedJoinTypes: external_exports.enum(INVITE_JOIN_TYPES).default("both"),
   humanRole: external_exports.enum(HUMAN_COMPANY_MEMBERSHIP_ROLES).optional().nullable(),
@@ -6912,6 +8138,11 @@ var createCliAuthChallengeSchema = external_exports.object({
 var resolveCliAuthChallengeSchema = external_exports.object({
   token: external_exports.string().min(16).max(256)
 });
+var createBoardApiKeySchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120).default("paperclipai cli"),
+  expiresAt: external_exports.coerce.date().optional().nullable(),
+  requestedCompanyId: external_exports.string().uuid().optional().nullable()
+});
 var updateMemberPermissionsSchema = external_exports.object({
   grants: external_exports.array(external_exports.object({
     permissionKey: external_exports.enum(PERMISSION_KEYS),
@@ -6982,7 +8213,7 @@ var updateCurrentUserProfileSchema = external_exports.object({
   image: external_exports.union([profileImageSchema, external_exports.literal(""), external_exports.null()]).optional().transform((value) => value === "" ? null : value)
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/validators/plugin.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/plugin.js
 var jsonSchemaSchema = external_exports.record(external_exports.string(), external_exports.unknown()).refine((val) => {
   if (Object.keys(val).length === 0)
     return true;
@@ -7015,11 +8246,45 @@ var pluginToolDeclarationSchema = external_exports.object({
   description: external_exports.string().min(1),
   parametersSchema: jsonSchemaSchema
 });
+var pluginEnvironmentTemplateConfigFieldSchema = external_exports.string().min(1).max(100).regex(/^[A-Za-z_][A-Za-z0-9_-]*$/, "Template config binding fields must be top-level config keys using letters, digits, underscores, or hyphens").refine((value) => value !== "provider", {
+  message: "Template config binding must not replace the sandbox provider key"
+});
+var pluginEnvironmentTemplateConfigBindingSchema = external_exports.object({
+  field: pluginEnvironmentTemplateConfigFieldSchema,
+  unsetFields: external_exports.array(pluginEnvironmentTemplateConfigFieldSchema).max(20).optional()
+}).strict().superRefine((value, ctx) => {
+  const unsetFields = value.unsetFields ?? [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, field] of unsetFields.entries()) {
+    if (field === value.field) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Template config binding cannot unset the same field it sets",
+        path: ["unsetFields", index]
+      });
+    }
+    if (seen.has(field)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Template config binding unsetFields must be unique",
+        path: ["unsetFields", index]
+      });
+    }
+    seen.add(field);
+  }
+});
 var pluginEnvironmentDriverDeclarationSchema = external_exports.object({
   driverKey: external_exports.string().min(1).regex(/^[a-z0-9][a-z0-9._-]*$/, "Environment driver key must start with a lowercase alphanumeric and contain only lowercase letters, digits, dots, hyphens, or underscores"),
   kind: external_exports.enum(["environment_driver", "sandbox_provider"]).optional(),
   displayName: external_exports.string().min(1).max(100),
   description: external_exports.string().max(500).optional(),
+  supportsReusableLeases: external_exports.boolean().optional(),
+  supportsInteractiveSetup: external_exports.boolean().optional(),
+  interactiveSetupConnectionTypes: external_exports.array(external_exports.string().min(1).max(100)).max(10).optional(),
+  supportsTemplateCapture: external_exports.boolean().optional(),
+  templateRefKind: external_exports.string().min(1).max(100).optional(),
+  templateConfigBinding: pluginEnvironmentTemplateConfigBindingSchema.optional(),
+  supportsTemplateDelete: external_exports.boolean().optional(),
   configSchema: jsonSchemaSchema
 });
 var pluginManagedAgentDeclarationSchema = external_exports.object({
@@ -7340,6 +8605,44 @@ var pluginApiRouteDeclarationSchema = external_exports.object({
     external_exports.object({ from: external_exports.literal("issue"), param: external_exports.string().min(1) })
   ]).optional()
 });
+var pluginObjectReferenceRefreshPolicySchema = external_exports.object({
+  defaultTtlSeconds: external_exports.number().int().positive().max(86400).optional(),
+  staleAfterSeconds: external_exports.number().int().positive().max(604800).optional()
+}).superRefine((value, ctx) => {
+  if (value.defaultTtlSeconds != null && value.staleAfterSeconds != null && value.staleAfterSeconds < value.defaultTtlSeconds) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "staleAfterSeconds must be greater than or equal to defaultTtlSeconds",
+      path: ["staleAfterSeconds"]
+    });
+  }
+});
+var pluginObjectReferenceProviderDeclarationSchema = external_exports.object({
+  providerKey: externalObjectProviderKeySchema,
+  displayName: external_exports.string().min(1).max(100),
+  objectTypes: external_exports.array(externalObjectTypeSchema).min(1),
+  urlPatterns: external_exports.array(external_exports.string().trim().min(1).max(500)).optional(),
+  refreshPolicy: pluginObjectReferenceRefreshPolicySchema.optional(),
+  webhookEndpointKeys: external_exports.array(external_exports.string().min(1)).optional()
+}).superRefine((value, ctx) => {
+  const duplicateObjectTypes = value.objectTypes.filter((type, i) => value.objectTypes.indexOf(type) !== i);
+  if (duplicateObjectTypes.length > 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: `Duplicate objectTypes: ${[...new Set(duplicateObjectTypes)].join(", ")}`,
+      path: ["objectTypes"]
+    });
+  }
+  const webhookKeys = value.webhookEndpointKeys ?? [];
+  const duplicateWebhookKeys = webhookKeys.filter((key, i) => webhookKeys.indexOf(key) !== i);
+  if (duplicateWebhookKeys.length > 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: `Duplicate webhookEndpointKeys: ${[...new Set(duplicateWebhookKeys)].join(", ")}`,
+      path: ["webhookEndpointKeys"]
+    });
+  }
+});
 var pluginManifestV1Schema = external_exports.object({
   id: external_exports.string().min(1).regex(/^[a-z0-9][a-z0-9._-]*$/, "Plugin id must start with a lowercase alphanumeric and contain only lowercase letters, digits, dots, hyphens, or underscores"),
   apiVersion: external_exports.literal(1),
@@ -7367,6 +8670,7 @@ var pluginManifestV1Schema = external_exports.object({
   routines: external_exports.array(pluginManagedRoutineDeclarationSchema).optional(),
   skills: external_exports.array(pluginManagedSkillDeclarationSchema).optional(),
   localFolders: external_exports.array(pluginLocalFolderDeclarationSchema).optional(),
+  objectReferences: external_exports.array(pluginObjectReferenceProviderDeclarationSchema).optional(),
   launchers: external_exports.array(pluginLauncherDeclarationSchema).optional(),
   ui: external_exports.object({
     slots: external_exports.array(pluginUiSlotDeclarationSchema).min(1).optional(),
@@ -7479,6 +8783,29 @@ var pluginManifestV1Schema = external_exports.object({
       });
     }
   }
+  if (manifest2.objectReferences && manifest2.objectReferences.length > 0) {
+    for (const capability of ["external.objects.detect", "external.objects.read"]) {
+      if (!manifest2.capabilities.includes(capability)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `Capability '${capability}' is required when objectReferences are declared`,
+          path: ["capabilities"]
+        });
+      }
+    }
+    const declaredWebhookKeys = new Set((manifest2.webhooks ?? []).map((webhook) => webhook.endpointKey));
+    for (const [providerIndex, provider] of manifest2.objectReferences.entries()) {
+      for (const endpointKey of provider.webhookEndpointKeys ?? []) {
+        if (!declaredWebhookKeys.has(endpointKey)) {
+          ctx.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            message: `objectReferences webhookEndpointKey "${endpointKey}" must match a declared webhook endpoint`,
+            path: ["objectReferences", providerIndex, "webhookEndpointKeys"]
+          });
+        }
+      }
+    }
+  }
   if (manifest2.database) {
     const requiredCapabilities = [
       "database.namespace.migrate",
@@ -7622,6 +8949,17 @@ var pluginManifestV1Schema = external_exports.object({
       });
     }
   }
+  if (manifest2.objectReferences) {
+    const providerKeys = manifest2.objectReferences.map((provider) => provider.providerKey);
+    const duplicateProviders = providerKeys.filter((key, i) => providerKeys.indexOf(key) !== i);
+    if (duplicateProviders.length > 0) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: `Duplicate object reference provider keys: ${[...new Set(duplicateProviders)].join(", ")}`,
+        path: ["objectReferences"]
+      });
+    }
+  }
   if (manifest2.ui) {
     if (manifest2.ui.slots) {
       const slotIds = manifest2.ui.slots.map((s) => s.id);
@@ -7690,19 +9028,35 @@ var listPluginStateSchema = external_exports.object({
   namespace: external_exports.string().min(1).optional()
 });
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/api.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/api.js
 var API_PREFIX = "/api";
 var API = {
   health: `${API_PREFIX}/health`,
   companies: `${API_PREFIX}/companies`,
   agents: `${API_PREFIX}/agents`,
   projects: `${API_PREFIX}/projects`,
+  environments: `${API_PREFIX}/environments`,
+  environmentCustomImageTemplate: `${API_PREFIX}/environments/:environmentId/custom-image-template`,
+  environmentCustomImageTemplateDisable: `${API_PREFIX}/environments/:environmentId/custom-image-template`,
+  environmentCustomImageTemplateRollback: `${API_PREFIX}/environments/:environmentId/custom-image-template/rollback`,
+  environmentCustomImageSetupSessions: `${API_PREFIX}/environments/:environmentId/custom-image-setup-sessions`,
+  environmentCustomImageSetupSession: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId`,
+  environmentCustomImageSetupSessionTerminalToken: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId/terminal-session-token`,
+  environmentCustomImageSetupSessionTerminalWs: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId/terminal/ws`,
+  environmentCustomImageSetupSessionFinish: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId/finish`,
+  environmentCustomImageSetupSessionCancel: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId/cancel`,
   issues: `${API_PREFIX}/issues`,
+  issueWatchdog: `${API_PREFIX}/issues/:issueId/watchdog`,
   issueTreeControl: `${API_PREFIX}/issues/:issueId/tree-control`,
   issueTreeHolds: `${API_PREFIX}/issues/:issueId/tree-holds`,
   goals: `${API_PREFIX}/goals`,
   approvals: `${API_PREFIX}/approvals`,
   secrets: `${API_PREFIX}/secrets`,
+  userSecretDefinitions: `${API_PREFIX}/companies/:companyId/user-secret-definitions`,
+  userSecretDefinition: `${API_PREFIX}/companies/:companyId/user-secret-definitions/:definitionId`,
+  userSecretDefinitionCoverage: `${API_PREFIX}/companies/:companyId/user-secret-definitions/:definitionId/coverage`,
+  myUserSecrets: `${API_PREFIX}/companies/:companyId/me/user-secrets`,
+  myUserSecret: `${API_PREFIX}/companies/:companyId/me/user-secrets/:secretId`,
   secretProviderConfigs: `${API_PREFIX}/secret-provider-configs`,
   secretProviderConfigDiscoveryPreview: `${API_PREFIX}/companies/:companyId/secret-provider-configs/discovery/preview`,
   costs: `${API_PREFIX}/costs`,
@@ -7717,19 +9071,7 @@ var API = {
   admin: `${API_PREFIX}/admin`
 };
 
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/routine-variables.js
-var HUMAN_TIMESTAMP_FORMATTER = new Intl.DateTimeFormat("en-US", {
-  year: "numeric",
-  month: "long",
-  day: "numeric",
-  hour: "numeric",
-  minute: "2-digit",
-  hour12: true,
-  timeZone: "UTC",
-  timeZoneName: "short"
-});
-
-// node_modules/.pnpm/@paperclipai+shared@2026.529.0/node_modules/@paperclipai/shared/dist/config-schema.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/config-schema.js
 var configMetaSchema = external_exports.object({
   version: external_exports.literal(1),
   updatedAt: external_exports.string(),
@@ -7885,14 +9227,26 @@ var paperclipConfigSchema = external_exports.object({
   }
 });
 
-// node_modules/.pnpm/@paperclipai+plugin-sdk@2026.529.0_react@19.2.4/node_modules/@paperclipai/plugin-sdk/dist/worker-rpc-host.js
+// node_modules/.pnpm/@paperclipai+shared@2026.707.0/node_modules/@paperclipai/shared/dist/validators/adapter-registry.js
+var adapterRegistryEntrySchema = external_exports.object({
+  adapterType: external_exports.string().min(1),
+  enabled: external_exports.boolean().default(true),
+  runtimeImage: external_exports.string().optional(),
+  envKeys: external_exports.array(external_exports.string()).optional(),
+  allowFqdns: external_exports.array(external_exports.string()).optional(),
+  probeCommand: external_exports.array(external_exports.string()).optional(),
+  defaultEnv: external_exports.record(external_exports.string()).optional()
+}).strict();
+var adapterRegistrySchema = external_exports.array(adapterRegistryEntrySchema);
+
+// node_modules/.pnpm/@paperclipai+plugin-sdk@2026.707.0_react@19.2.4/node_modules/@paperclipai/plugin-sdk/dist/worker-rpc-host.js
 import fs from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import path from "node:path";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 
-// node_modules/.pnpm/@paperclipai+plugin-sdk@2026.529.0_react@19.2.4/node_modules/@paperclipai/plugin-sdk/dist/protocol.js
+// node_modules/.pnpm/@paperclipai+plugin-sdk@2026.707.0_react@19.2.4/node_modules/@paperclipai/plugin-sdk/dist/protocol.js
 var JSONRPC_VERSION = "2.0";
 var JSONRPC_ERROR_CODES = {
   /** Invalid JSON was received by the server. */
@@ -8024,7 +9378,7 @@ var JsonRpcCallError = class extends Error {
   }
 };
 
-// node_modules/.pnpm/@paperclipai+plugin-sdk@2026.529.0_react@19.2.4/node_modules/@paperclipai/plugin-sdk/dist/worker-rpc-host.js
+// node_modules/.pnpm/@paperclipai+plugin-sdk@2026.707.0_react@19.2.4/node_modules/@paperclipai/plugin-sdk/dist/worker-rpc-host.js
 var DEFAULT_RPC_TIMEOUT_MS = 3e4;
 function realpathOrResolvedPath(filePath) {
   const resolvedPath = path.resolve(filePath);
@@ -8572,6 +9926,17 @@ function startWorkerRpcHost(options) {
             authorAgentId: options2?.authorAgentId
           });
         },
+        async requestCheckboxConfirmation(issueId, interaction, companyId, options2) {
+          return callHost("issues.createInteraction", {
+            issueId,
+            companyId,
+            interaction: {
+              ...interaction,
+              kind: "request_checkbox_confirmation"
+            },
+            authorAgentId: options2?.authorAgentId
+          });
+        },
         documents: {
           async list(issueId, companyId) {
             return callHost("issues.documents.list", { issueId, companyId });
@@ -8901,6 +10266,12 @@ function startWorkerRpcHost(options) {
         return handlePerformAction(params);
       case "executeTool":
         return handleExecuteTool(params);
+      case "detectExternalObjects":
+        return handleDetectExternalObjects(params);
+      case "resolveExternalObject":
+        return handleResolveExternalObject(params);
+      case "refreshExternalObjects":
+        return handleRefreshExternalObjects(params);
       case "environmentValidateConfig":
         return handleEnvironmentValidateConfig(params);
       case "environmentProbe":
@@ -8917,6 +10288,16 @@ function startWorkerRpcHost(options) {
         return handleEnvironmentRealizeWorkspace(params);
       case "environmentExecute":
         return handleEnvironmentExecute(params);
+      case "environmentStartInteractiveSetup":
+        return handleEnvironmentStartInteractiveSetup(params);
+      case "environmentGetInteractiveSetup":
+        return handleEnvironmentGetInteractiveSetup(params);
+      case "environmentCaptureTemplate":
+        return handleEnvironmentCaptureTemplate(params);
+      case "environmentCancelInteractiveSetup":
+        return handleEnvironmentCancelInteractiveSetup(params);
+      case "environmentDeleteTemplate":
+        return handleEnvironmentDeleteTemplate(params);
       default:
         throw Object.assign(new Error(`Unknown method: ${method}`), { code: JSONRPC_ERROR_CODES.METHOD_NOT_FOUND });
     }
@@ -8941,6 +10322,12 @@ function startWorkerRpcHost(options) {
       supportedMethods.push("shutdown");
     if (plugin2.definition.onApiRequest)
       supportedMethods.push("handleApiRequest");
+    if (plugin2.definition.onDetectExternalObjects)
+      supportedMethods.push("detectExternalObjects");
+    if (plugin2.definition.onResolveExternalObject)
+      supportedMethods.push("resolveExternalObject");
+    if (plugin2.definition.onRefreshExternalObjects)
+      supportedMethods.push("refreshExternalObjects");
     if (plugin2.definition.onEnvironmentValidateConfig)
       supportedMethods.push("environmentValidateConfig");
     if (plugin2.definition.onEnvironmentProbe)
@@ -8957,6 +10344,16 @@ function startWorkerRpcHost(options) {
       supportedMethods.push("environmentRealizeWorkspace");
     if (plugin2.definition.onEnvironmentExecute)
       supportedMethods.push("environmentExecute");
+    if (plugin2.definition.onEnvironmentStartInteractiveSetup)
+      supportedMethods.push("environmentStartInteractiveSetup");
+    if (plugin2.definition.onEnvironmentGetInteractiveSetup)
+      supportedMethods.push("environmentGetInteractiveSetup");
+    if (plugin2.definition.onEnvironmentCaptureTemplate)
+      supportedMethods.push("environmentCaptureTemplate");
+    if (plugin2.definition.onEnvironmentCancelInteractiveSetup)
+      supportedMethods.push("environmentCancelInteractiveSetup");
+    if (plugin2.definition.onEnvironmentDeleteTemplate)
+      supportedMethods.push("environmentDeleteTemplate");
     return { ok: true, supportedMethods };
   }
   async function handleHealth() {
@@ -9077,6 +10474,24 @@ function startWorkerRpcHost(options) {
     }
     return entry.fn(params.parameters, params.runContext);
   }
+  async function handleDetectExternalObjects(params) {
+    if (!plugin2.definition.onDetectExternalObjects) {
+      throw methodNotImplemented("detectExternalObjects");
+    }
+    return plugin2.definition.onDetectExternalObjects(params);
+  }
+  async function handleResolveExternalObject(params) {
+    if (!plugin2.definition.onResolveExternalObject) {
+      throw methodNotImplemented("resolveExternalObject");
+    }
+    return plugin2.definition.onResolveExternalObject(params);
+  }
+  async function handleRefreshExternalObjects(params) {
+    if (!plugin2.definition.onRefreshExternalObjects) {
+      throw methodNotImplemented("refreshExternalObjects");
+    }
+    return plugin2.definition.onRefreshExternalObjects(params);
+  }
   function methodNotImplemented(method) {
     return Object.assign(new Error(`${method} is not implemented by this plugin`), { code: PLUGIN_RPC_ERROR_CODES.METHOD_NOT_IMPLEMENTED });
   }
@@ -9128,6 +10543,36 @@ function startWorkerRpcHost(options) {
     }
     return plugin2.definition.onEnvironmentExecute(params);
   }
+  async function handleEnvironmentStartInteractiveSetup(params) {
+    if (!plugin2.definition.onEnvironmentStartInteractiveSetup) {
+      throw methodNotImplemented("environmentStartInteractiveSetup");
+    }
+    return plugin2.definition.onEnvironmentStartInteractiveSetup(params);
+  }
+  async function handleEnvironmentGetInteractiveSetup(params) {
+    if (!plugin2.definition.onEnvironmentGetInteractiveSetup) {
+      throw methodNotImplemented("environmentGetInteractiveSetup");
+    }
+    return plugin2.definition.onEnvironmentGetInteractiveSetup(params);
+  }
+  async function handleEnvironmentCaptureTemplate(params) {
+    if (!plugin2.definition.onEnvironmentCaptureTemplate) {
+      throw methodNotImplemented("environmentCaptureTemplate");
+    }
+    return plugin2.definition.onEnvironmentCaptureTemplate(params);
+  }
+  async function handleEnvironmentCancelInteractiveSetup(params) {
+    if (!plugin2.definition.onEnvironmentCancelInteractiveSetup) {
+      throw methodNotImplemented("environmentCancelInteractiveSetup");
+    }
+    return plugin2.definition.onEnvironmentCancelInteractiveSetup(params);
+  }
+  async function handleEnvironmentDeleteTemplate(params) {
+    if (!plugin2.definition.onEnvironmentDeleteTemplate) {
+      throw methodNotImplemented("environmentDeleteTemplate");
+    }
+    return plugin2.definition.onEnvironmentDeleteTemplate(params);
+  }
   function allowsEvent(filter, event) {
     const payload = event.payload;
     if (filter.companyId !== void 0) {
@@ -9270,11 +10715,12 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 var manifest = {
   id: "starlein.paperclip-plugin-company-wizard",
   apiVersion: 1,
-  version: "0.4.18",
+  version: "0.4.21",
   displayName: "Company Wizard",
   description: "AI-powered wizard to bootstrap agent companies from composable templates",
   author: "Sascha Pietrowski <sp@speednetwork.de>",
   categories: ["workspace", "ui"],
+  minimumHostVersion: "2026.707.0",
   capabilities: [
     "companies.read",
     "issues.create",
@@ -9284,6 +10730,7 @@ var manifest = {
     "goals.read",
     "agents.read",
     "projects.read",
+    "skills.managed",
     "plugin.state.read",
     "plugin.state.write",
     "secrets.read-ref",
@@ -9363,12 +10810,12 @@ import { join } from "node:path";
 
 // src/logic/ceo-defaults.js
 var DEFAULT_CEO_ADAPTER_TYPE = "codex_local";
-var DEFAULT_CEO_MODEL = "gpt-5.5";
+var DEFAULT_CEO_MODEL = "gpt-5.6";
 var DEFAULT_CEO_THINKING_LEVEL = "high";
 var DEFAULT_WORKER_THINKING_LEVEL = "auto";
 var DEFAULT_CEO_MAX_CONCURRENT_RUNS = 1;
 var DEFAULT_CEO_HEARTBEAT_INTERVAL_SEC = 3600;
-var DEFAULT_CLAUDE_CEO_MODEL = "claude-opus-4-6";
+var DEFAULT_CLAUDE_CEO_MODEL = "claude-opus-4-8";
 function asTrimmedString(value) {
   return typeof value === "string" ? value.trim() : "";
 }
@@ -9446,6 +10893,66 @@ function buildWorkerAgentRuntimeConfig() {
   };
 }
 
+// src/logic/resolve.js
+import { createHash } from "node:crypto";
+function skillSlug(baseName, variant) {
+  return variant === "fallback" ? `${baseName}-fallback` : baseName;
+}
+function humanizeSkillName(baseName, variant) {
+  const words = String(baseName).split(/[-_]/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+  return variant === "fallback" ? `${words} (fallback)` : words;
+}
+function hashSkillContent(markdown) {
+  return createHash("sha256").update(String(markdown), "utf-8").digest("hex").slice(0, 16);
+}
+function buildCompanySkillSet(records) {
+  const byBaseSlug = /* @__PURE__ */ new Map();
+  for (const rec of records) {
+    if (!byBaseSlug.has(rec.baseSlug)) byBaseSlug.set(rec.baseSlug, []);
+    byBaseSlug.get(rec.baseSlug).push(rec);
+  }
+  const companySkills = [];
+  const roleSkillSlugs = /* @__PURE__ */ new Map();
+  const addRoleSlug = (roleName, slug) => {
+    if (!roleSkillSlugs.has(roleName)) roleSkillSlugs.set(roleName, []);
+    const list = roleSkillSlugs.get(roleName);
+    if (!list.includes(slug)) list.push(slug);
+  };
+  for (const baseSlug of [...byBaseSlug.keys()].sort()) {
+    const byHash = /* @__PURE__ */ new Map();
+    for (const rec of byBaseSlug.get(baseSlug)) {
+      const hash = hashSkillContent(rec.markdown);
+      if (!byHash.has(hash)) byHash.set(hash, { hash, rec, roles: [] });
+      byHash.get(hash).roles.push(rec.roleName);
+    }
+    const groups = [...byHash.values()].map((g) => ({ ...g, repRole: [...g.roles].sort()[0] })).sort((a, b) => a.repRole.localeCompare(b.repRole));
+    groups.forEach((group, idx) => {
+      const slug = idx === 0 ? baseSlug : `${baseSlug}-${group.repRole}`;
+      companySkills.push({
+        slug,
+        name: group.rec.name,
+        description: group.rec.description,
+        categories: group.rec.categories,
+        markdown: group.rec.markdown,
+        contentHash: group.hash
+      });
+      for (const roleName of group.roles) addRoleSlug(roleName, slug);
+    });
+  }
+  return { companySkills, roleSkillSlugs };
+}
+
+// src/logic/routines.js
+function routineUsesProjectWorkspace(routine) {
+  return routine?.useProjectWorkspace !== false;
+}
+function routineProjectPayload(routine, mainProjectId, { sync = false } = {}) {
+  if (!routineUsesProjectWorkspace(routine)) {
+    return sync ? { projectId: null } : {};
+  }
+  return mainProjectId ? { projectId: mainProjectId } : {};
+}
+
 // src/logic/assemble.js
 async function exists(p) {
   try {
@@ -9704,6 +11211,7 @@ ${stages.join("\n")}
     });
   }
   initialIssues.unshift(...resolvedUserIssues);
+  const skillRecords = [];
   for (const moduleName of moduleNames) {
     const moduleDir = join(templatesDir, "modules", moduleName);
     if (!await exists(moduleDir)) {
@@ -9799,30 +11307,33 @@ ${stages.join("\n")}
     async function installSkill(roleName, fileName, label) {
       const resolved = await resolveSkillFile(roleName, fileName);
       if (!resolved) return false;
-      const destSkillsDir = join(companyDir, "agents", roleName, "skills");
-      await mkdir(destSkillsDir, { recursive: true });
-      const destFile = join(destSkillsDir, fileName);
-      await copyFile(resolved.path, destFile);
+      const baseName = fileName.replace(/\.md$/, "").replace(/\.fallback$/, "");
+      const variant = fileName.endsWith(".fallback.md") ? "fallback" : "primary";
+      let markdown = await readFile(resolved.path, "utf-8");
       let barApplied = false;
       if (enableEnrichedPersonas && label === "primary") {
-        const barFileName = fileName.replace(/\.md$/, ".bar.md");
-        const bar = await resolveSkillFile(roleName, barFileName);
+        const bar = await resolveSkillFile(roleName, fileName.replace(/\.md$/, ".bar.md"));
         if (bar) {
           const barContent = await readFile(bar.path, "utf-8");
-          await appendToFile(destFile, "\n" + barContent.trim() + "\n");
+          markdown = `${markdown.trimEnd()}
+
+${barContent.trim()}
+`;
           barApplied = true;
         }
       }
-      await appendToFile(
-        join(companyDir, "agents", roleName, "AGENTS.md"),
-        `
-Read and follow: \`skills/${fileName}\`
-`
-      );
+      skillRecords.push({
+        roleName,
+        baseSlug: skillSlug(baseName, variant),
+        name: humanizeSkillName(baseName, variant),
+        description: `${moduleName} \u2014 ${variant} skill`,
+        categories: [moduleName],
+        markdown
+      });
       const sourceTag = resolved.source === "shared" ? ", shared" : "";
       const barTag = barApplied ? ", output bar" : "";
       onProgress(
-        `+ agents/${roleName}/skills/${fileName} (${moduleName}, ${label}${sourceTag}${barTag})`
+        `+ skill ${skillSlug(baseName, variant)} \u2192 ${roleName} (${moduleName}, ${label}${sourceTag}${barTag})`
       );
       return true;
     }
@@ -9849,20 +11360,38 @@ Read and follow: \`skills/${fileName}\`
           const skillName = skillFile.replace(/\.md$/, "");
           const skillBaseName = skillName.replace(/\.fallback$/, "");
           if (capabilityOwners.has(skillBaseName)) continue;
-          const destSkillsDir = join(companyDir, "agents", role.name, "skills");
-          await mkdir(destSkillsDir, { recursive: true });
-          await copyFile(join(skillsDir, skillFile), join(destSkillsDir, skillFile));
-          await appendToFile(
-            join(companyDir, "agents", role.name, "AGENTS.md"),
-            `
-Read and follow: \`skills/${skillFile}\`
-`
-          );
-          onProgress(`+ agents/${role.name}/skills/${skillFile} (${moduleName})`);
+          const baseName = skillName.replace(/\.fallback$/, "");
+          const variant = skillFile.endsWith(".fallback.md") ? "fallback" : "primary";
+          const markdown = await readFile(join(skillsDir, skillFile), "utf-8");
+          skillRecords.push({
+            roleName: role.name,
+            baseSlug: skillSlug(baseName, variant),
+            name: humanizeSkillName(baseName, variant),
+            description: `${moduleName} \u2014 ${variant} skill`,
+            categories: [moduleName],
+            markdown
+          });
+          onProgress(`+ skill ${skillSlug(baseName, variant)} \u2192 ${role.name} (${moduleName})`);
         }
       }
     }
   }
+  const { companySkills, roleSkillSlugs } = buildCompanySkillSet(skillRecords);
+  const slugToSkillName = new Map(companySkills.map((s) => [s.slug, s.name]));
+  for (const [roleName, slugs] of roleSkillSlugs) {
+    if (!slugs.length) continue;
+    const lines = slugs.map((slug) => `- ${slugToSkillName.get(slug) ?? slug}`).join("\n");
+    await appendToFile(
+      join(companyDir, "agents", roleName, "AGENTS.md"),
+      `
+## Installed skills
+
+These skills are installed into your runtime and auto-discovered by your harness. Use them when relevant:
+
+${lines}
+`
+    );
+  }
   const HEARTBEAT_MARKER = "<!-- Module heartbeat sections are inserted above this line during assembly -->";
   for (const moduleName of moduleNames) {
     const moduleDir = join(templatesDir, "modules", moduleName);
@@ -10270,7 +11799,7 @@ Read: \`../../docs/${doc}\`
       ...executionWorkspacePolicy ? { executionWorkspacePolicy } : {}
     };
   })() : null;
-  const mainProjectPreCreated = initialRoutines.length > 0 && mainProjectInfo !== null;
+  const mainProjectPreCreated = initialRoutines.some(routineUsesProjectWorkspace) && mainProjectInfo !== null;
   if (resolvedProjects.length > 0) {
     bootstrap += `## Projects
 
@@ -10446,7 +11975,10 @@ Read: \`../../docs/${doc}\`
         ["schedule", routine.schedule],
         ["priority", routine.priority || "medium"],
         ["concurrencyPolicy", routine.concurrencyPolicy || "skip_if_active"],
-        ["projectId", `\u2192 "${mainProjectName}"`]
+        [
+          "projectId",
+          routineUsesProjectWorkspace(routine) ? `\u2192 "${mainProjectName}"` : "none (control-plane routine; no project worktree)"
+        ]
       ]);
       if (routine.description) {
         bootstrap += `${escapeBody(routine.description)}
@@ -10503,6 +12035,20 @@ Read: \`../../docs/${doc}\`
   }
   bootstrap += `${stepN}. **Start CEO heartbeat** (one-time initial wakeup)
 `;
+  if (companySkills.length > 0) {
+    bootstrap += `
+## Company Skills (pre-provisioned)
+
+These skills are installed in the Skills Store and assigned to agents via \`desiredSkills\`. Do not recreate them:
+
+`;
+    for (const skill of companySkills) {
+      bootstrap += `- \`${skill.slug}\` \u2014 ${skill.name}
+`;
+    }
+    bootstrap += `
+`;
+  }
   await writeFile(join(companyDir, "BOOTSTRAP.md"), bootstrap);
   onProgress("+ BOOTSTRAP.md");
   return {
@@ -10511,6 +12057,8 @@ Read: \`../../docs/${doc}\`
     initialIssues,
     initialRoutines,
     roleAdapterOverrides,
+    companySkills,
+    roleSkillSlugs,
     mainProject: mainProjectInfo
   };
 }
@@ -10683,6 +12231,27 @@ var PaperclipClient = class {
   async getCompany(companyId) {
     return this._fetch(`/api/companies/${companyId}`, { method: "GET" });
   }
+  async listCompanySkills(companyId) {
+    return this._fetch(`/api/companies/${companyId}/skills`, { method: "GET" });
+  }
+  async createCompanySkill(companyId, { name, slug, description, markdown, categories }) {
+    return this._fetch(`/api/companies/${companyId}/skills`, {
+      method: "POST",
+      body: JSON.stringify({
+        name,
+        ...slug !== void 0 ? { slug } : {},
+        ...description !== void 0 ? { description } : {},
+        ...markdown !== void 0 ? { markdown } : {},
+        ...categories !== void 0 ? { categories } : {}
+      })
+    });
+  }
+  async updateCompanySkill(companyId, skillId, updates) {
+    return this._fetch(`/api/companies/${companyId}/skills/${skillId}`, {
+      method: "PATCH",
+      body: JSON.stringify(updates || {})
+    });
+  }
   async listAgents(companyId) {
     return this._fetch(`/api/companies/${companyId}/agents`, { method: "GET" });
   }
@@ -10826,14 +12395,14 @@ var PaperclipClient = class {
     executionWorkspaceSettings,
     executionPolicy,
     blockedByIssueIds,
-    blockParentUntilDone
+    watchdog
   }) {
     return this._fetch(`/api/companies/${companyId}/issues`, {
       method: "POST",
       body: JSON.stringify({
         title,
         description: description || null,
-        status: status || void 0,
+        status: status || "todo",
         priority: priority || "medium",
         parentId: parentId || void 0,
         projectId: projectId || void 0,
@@ -10846,7 +12415,9 @@ var PaperclipClient = class {
         executionWorkspaceSettings: executionWorkspaceSettings || void 0,
         executionPolicy: executionPolicy || void 0,
         blockedByIssueIds: blockedByIssueIds || void 0,
-        blockParentUntilDone: blockParentUntilDone || void 0
+        // Task watchdog (native stall recovery): { agentId, instructions? }.
+        // The named agent is woken to recover the issue's subtree if it stalls.
+        watchdog: watchdog && watchdog.agentId ? watchdog : void 0
       })
     });
   }
@@ -10856,6 +12427,26 @@ var PaperclipClient = class {
       body: JSON.stringify(updates || {})
     });
   }
+  // Upsert a task watchdog on an existing issue. The watching agent must be
+  // invokable (active), so callers should treat failures as non-fatal.
+  async setIssueWatchdog(issueId, { agentId, instructions } = {}) {
+    if (!agentId) {
+      throw new Error("setIssueWatchdog requires agentId");
+    }
+    return this._fetch(`/api/issues/${issueId}/watchdog`, {
+      method: "PUT",
+      body: JSON.stringify({
+        agentId,
+        ...instructions ? { instructions } : {}
+      })
+    });
+  }
+  async getIssueWatchdog(issueId) {
+    return this._fetch(`/api/issues/${issueId}/watchdog`, { method: "GET" });
+  }
+  async deleteIssueWatchdog(issueId) {
+    return this._fetch(`/api/issues/${issueId}/watchdog`, { method: "DELETE" });
+  }
   async putIssueDocument(issueId, key, { title, format, body, baseRevisionId }) {
     return this._fetch(`/api/issues/${issueId}/documents/${encodeURIComponent(key)}`, {
       method: "PUT",
@@ -11482,15 +13073,50 @@ async function setExternalInstructionsBundle({
     );
   }
 }
-function preserveExistingSkillSync(existingAgent, nextAdapterConfig) {
-  const existingSync = existingAgent?.adapterConfig && typeof existingAgent.adapterConfig === "object" && "paperclipSkillSync" in existingAgent.adapterConfig ? existingAgent.adapterConfig.paperclipSkillSync : void 0;
-  if (!existingSync) {
-    return nextAdapterConfig;
+async function provisionCompanySkills(client, companyId, companySkills, log) {
+  const slugToKey = /* @__PURE__ */ new Map();
+  if (!Array.isArray(companySkills) || companySkills.length === 0) return slugToKey;
+  let existing = [];
+  try {
+    const listed = await client.listCompanySkills(companyId);
+    existing = Array.isArray(listed) ? listed : [];
+  } catch (err) {
+    log(
+      `\u26A0 Could not list existing company skills: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
-  return {
-    ...nextAdapterConfig,
-    paperclipSkillSync: existingSync
-  };
+  const bySlug = /* @__PURE__ */ new Map();
+  for (const s of existing) {
+    if (s && typeof s.slug === "string") bySlug.set(s.slug, s);
+  }
+  for (const skill of companySkills) {
+    const found = bySlug.get(skill.slug);
+    if (!found) {
+      const created = await client.createCompanySkill(companyId, {
+        name: skill.name,
+        slug: skill.slug,
+        description: skill.description,
+        markdown: skill.markdown,
+        categories: skill.categories
+      });
+      slugToKey.set(skill.slug, created?.key || created?.slug || skill.slug);
+      log(`\u2713 Created company skill "${skill.slug}"`);
+      continue;
+    }
+    slugToKey.set(skill.slug, found.key || skill.slug);
+    const updates = {};
+    if ((found.name ?? "") !== skill.name) updates.name = skill.name;
+    if ((found.description ?? "") !== (skill.description ?? "")) {
+      updates.description = skill.description ?? null;
+    }
+    if (Array.isArray(skill.categories)) updates.categories = skill.categories;
+    if ((found.markdown ?? "") !== skill.markdown) updates.markdown = skill.markdown;
+    if (Object.keys(updates).length > 0) {
+      await client.updateCompanySkill(companyId, found.id, updates);
+      log(`\u2713 Updated company skill "${skill.slug}"`);
+    }
+  }
+  return slugToKey;
 }
 function routineTemplateTitle(routine) {
   if (typeof routine?.title === "string" && routine.title.trim()) return routine.title.trim();
@@ -11596,6 +13222,7 @@ async function syncExistingCompanyRoutines({
       title,
       description: routine.description || null,
       assigneeAgentId,
+      ...routineProjectPayload(routine, void 0, { sync: true }),
       priority: routine.priority || "medium",
       status: routine.status || "active",
       concurrencyPolicy: routine.concurrencyPolicy || "skip_if_active",
@@ -12248,6 +13875,14 @@ var plugin = definePlugin({
         let routines = [];
         try {
           allRoleNames = [...assembleResult.allRoles ?? []].filter(Boolean).sort();
+          log("Provisioning company skills...");
+          const slugToKey = await provisionCompanySkills(
+            client,
+            companyId,
+            assembleResult.companySkills ?? [],
+            log
+          );
+          const desiredSkillsForRole = (roleName) => (assembleResult.roleSkillSlugs?.get(roleName) ?? []).map((slug) => slugToKey.get(slug)).filter((key) => Boolean(key));
           if (existingCompanyId) {
             try {
               const pluginId = await findPluginId(client);
@@ -12345,7 +13980,8 @@ var plugin = definePlugin({
               try {
                 const ceoPatch = {
                   adapterType,
-                  adapterConfig: preserveExistingSkillSync(existingCeo, adapterConfig),
+                  adapterConfig,
+                  desiredSkills: desiredSkillsForRole("ceo"),
                   runtimeConfig: ceoRuntimeConfig,
                   ...ceoMetadata ? { metadata: { ...existingCeo.metadata ?? {}, ...ceoMetadata } } : {}
                 };
@@ -12376,6 +14012,7 @@ var plugin = definePlugin({
                 reportsTo: null,
                 adapterType,
                 adapterConfig,
+                desiredSkills: desiredSkillsForRole("ceo"),
                 runtimeConfig: ceoRuntimeConfig,
                 permissions: { canCreateAgents: true },
                 ...boardOperationsIssue?.id ? { sourceIssueId: boardOperationsIssue.id } : {}
@@ -12395,6 +14032,7 @@ var plugin = definePlugin({
               reportsTo: null,
               adapterType,
               adapterConfig,
+              desiredSkills: desiredSkillsForRole("ceo"),
               runtimeConfig: ceoRuntimeConfig,
               permissions: { canCreateAgents: true },
               ...boardOperationsIssue?.id ? { sourceIssueId: boardOperationsIssue.id } : {}
@@ -12461,7 +14099,8 @@ var plugin = definePlugin({
               try {
                 await client.updateAgent(existingAgent.id, {
                   adapterType,
-                  adapterConfig: preserveExistingSkillSync(existingAgent, roleAdapterConfig),
+                  adapterConfig: roleAdapterConfig,
+                  desiredSkills: desiredSkillsForRole(roleName),
                   runtimeConfig: roleRuntimeConfig,
                   metadata: { ...existingAgent.metadata ?? {}, ...roleMetadata },
                   ...!existingAgent.title && roleTitle ? { title: roleTitle } : {},
@@ -12493,6 +14132,7 @@ var plugin = definePlugin({
               reportsTo: ceoAgentId,
               adapterType,
               adapterConfig: roleAdapterConfig,
+              desiredSkills: desiredSkillsForRole(roleName),
               runtimeConfig: roleRuntimeConfig,
               ...hiringPlanIssue?.id ? { sourceIssueId: hiringPlanIssue.id } : {}
             });
@@ -12515,7 +14155,7 @@ var plugin = definePlugin({
           if (!existingCompanyId) {
             let mainProjectId;
             const mainProject = assembleResult.mainProject;
-            if (routines.length > 0 && mainProject?.name) {
+            if (routines.some(routineUsesProjectWorkspace) && mainProject?.name) {
               try {
                 const createdProject = await client.createProject(companyId, {
                   name: mainProject.name,
@@ -12543,7 +14183,7 @@ var plugin = definePlugin({
                   title,
                   description: routine.description,
                   assigneeAgentId,
-                  projectId: mainProjectId,
+                  ...routineProjectPayload(routine, mainProjectId),
                   priority: routine.priority || "medium",
                   concurrencyPolicy: routine.concurrencyPolicy || "skip_if_active",
                   catchUpPolicy: routine.catchUpPolicy || "skip_missed"
@@ -12587,6 +14227,17 @@ var plugin = definePlugin({
           });
           bootstrapIssue = issue;
           log(`\u2713 Bootstrap task created: ${bootstrapIssue.identifier || bootstrapIssue.id}`);
+          try {
+            await client.setIssueWatchdog(bootstrapIssue.id, {
+              agentId: ceoAgentId,
+              instructions: "Bootstrap/setup stalled. Re-read this issue and BOOTSTRAP.md, then resume: create any missing goals/issues, link the pre-created projects and routines, and unblock or reassign whatever stopped. Do not archive or delete any execution workspace as part of recovery. Leave the issue in a clear final state."
+            });
+            log("\u2713 Watchdog attached to bootstrap task (CEO self-recovery).");
+          } catch (wdErr) {
+            log(
+              `\u26A0 Could not attach bootstrap watchdog (non-fatal \u2014 likely CEO pending approval): ${wdErr instanceof Error ? wdErr.message : String(wdErr)}`
+            );
+          }
         } catch (err) {
           log(`\u2717 Provisioning failed: ${err instanceof Error ? err.message : String(err)}`);
           if (createdCompany) {