@tickernelz/paperclip-pro 2026.1002.8 → 2026.1004.1

package/dist/index.js

@@ -52,7 +52,7 @@ function clampIssueRequestDepth(value) {
   if (typeof value !== "number" || !Number.isFinite(value)) return 0;
   return Math.min(MAX_ISSUE_REQUEST_DEPTH, Math.max(0, Math.floor(value)));
 }
-var COMPANY_STATUSES, DEPLOYMENT_MODES, DEPLOYMENT_EXPOSURES, BIND_MODES, AUTH_BASE_URL_MODES, AGENT_STATUSES, AGENT_ADAPTER_TYPES, AGENT_ROLES, AGENT_ICON_NAMES, PROJECT_ICON_NAMES, ISSUE_STATUSES, INBOX_MINE_ISSUE_STATUSES, INBOX_MINE_ISSUE_STATUS_FILTER, ISSUE_PRIORITIES, ISSUE_REVIEW_POLICIES, ISSUE_WORK_MODES, ISSUE_HARNESS_KINDS, MAX_ISSUE_REQUEST_DEPTH, SUMMARY_SLOT_SCOPE_KINDS, SUMMARY_SLOT_KEYS, SUMMARY_SLOT_STATUSES, ISSUE_COMMENT_AUTHOR_TYPES, ISSUE_COMMENT_DELIVERY_MODES, ISSUE_COMMENT_PRESENTATION_KINDS, ISSUE_COMMENT_PRESENTATION_TONES, ISSUE_COMMENT_PRESENTATION_DENSITIES, ISSUE_COMMENT_METADATA_ROW_TYPES, ISSUE_THREAD_INTERACTION_KINDS, ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES, ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES, ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES, ISSUE_THREAD_INTERACTION_RESOLVER_POLICY_PROVENANCES, ISSUE_THREAD_INTERACTION_EFFECTIVE_RESOLVER_POLICY_SOURCES, REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT, REQUEST_ITEM_VERDICTS_ITEM_LIMIT, ISSUE_THREAD_INTERACTION_STATUSES, ISSUE_THREAD_INTERACTION_CONTINUATION_POLICIES, ISSUE_WATCHDOG_DISCOVERY_KINDS, ISSUE_SURFACE_VISIBILITIES, ISSUE_RECOVERY_ACTION_KINDS, ISSUE_RECOVERY_ACTION_STATUSES, ISSUE_RECOVERY_ACTION_OWNER_TYPES, ISSUE_RECOVERY_ACTION_OUTCOMES, ISSUE_TREE_CONTROL_MODES, ISSUE_TREE_HOLD_RELEASE_POLICY_STRATEGIES, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, PIPELINE_CASE_BODY_DOCUMENT_KEY, SYSTEM_ISSUE_DOCUMENT_KEYS, SYSTEM_ISSUE_DOCUMENT_KEY_SET, DOCUMENT_ANNOTATION_THREAD_STATUSES, DOCUMENT_ANNOTATION_ANCHOR_STATES, DOCUMENT_ANNOTATION_ANCHOR_CONFIDENCES, EXTERNAL_OBJECT_STATUS_CATEGORIES, EXTERNAL_OBJECT_STATUS_TONES, EXTERNAL_OBJECT_LIVENESS_STATES, EXTERNAL_OBJECT_MENTION_SOURCE_KINDS, EXTERNAL_OBJECT_MENTION_CONFIDENCES, ISSUE_EXECUTION_POLICY_MODES, ISSUE_EXECUTION_STAGE_TYPES, ISSUE_MONITOR_SCHEDULED_BY, ISSUE_EXECUTION_MONITOR_KINDS, ISSUE_EXECUTION_MONITOR_RECOVERY_POLICIES, ISSUE_EXECUTION_STATE_STATUSES, ISSUE_EXECUTION_MONITOR_STATE_STATUSES, ISSUE_EXECUTION_MONITOR_CLEAR_REASONS, ISSUE_EXECUTION_DECISION_OUTCOMES, GOAL_LEVELS, GOAL_STATUSES, PROJECT_STATUSES, ENVIRONMENT_DRIVERS, ENVIRONMENT_STATUSES, ENVIRONMENT_LEASE_STATUSES, ENVIRONMENT_LEASE_CLEANUP_STATUSES, ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_KINDS, ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_STATUSES, ENVIRONMENT_CUSTOM_IMAGE_SETUP_SESSION_STATUSES, ENVIRONMENT_CUSTOM_IMAGE_SETUP_CONNECTION_TYPES, ROUTINE_STATUSES, ROUTINE_CONCURRENCY_POLICIES, ROUTINE_CATCH_UP_POLICIES, ROUTINE_ACTIVITY_GATE_POLICIES, ROUTINE_ACTIVITY_GATE_SCOPES, ROUTINE_TRIGGER_KINDS, ROUTINE_TRIGGER_SIGNING_MODES, ROUTINE_VARIABLE_TYPES, APPROVAL_TYPES, SECRET_PROVIDERS, SECRET_PROVIDER_CONFIG_STATUSES, SECRET_STATUSES, SECRET_MANAGED_MODES, SECRET_BINDING_TARGET_TYPES, SECRET_PROJECTION_CLASSES, STORAGE_PROVIDERS, BILLING_TYPES, COST_STATUSES, FINANCE_EVENT_KINDS, FINANCE_DIRECTIONS, FINANCE_UNITS, BUDGET_SCOPE_TYPES, BUDGET_METRICS, BUDGET_WINDOW_KINDS, BUDGET_INCIDENT_RESOLUTION_ACTIONS, HUMAN_COMPANY_MEMBERSHIP_ROLES, INVITE_JOIN_TYPES, JOIN_REQUEST_TYPES, JOIN_REQUEST_STATUSES, PERMISSION_KEYS, TOOL_APPLICATION_TYPES, TOOL_APPLICATION_STATUSES, TOOL_CONNECTION_KINDS, TOOL_CONNECTION_HEALTH_STATUSES, TOOL_CATALOG_ENTRY_KINDS, TOOL_CATALOG_ENTRY_STATUSES, TOOL_RISK_LEVELS, TOOL_PROFILE_STATUSES, TOOL_PROFILE_DEFAULT_ACTIONS, TOOL_PROFILE_ENTRY_SELECTOR_TYPES, TOOL_PROFILE_ENTRY_EFFECTS, TOOL_PROFILE_BINDING_TARGET_TYPES, TOOL_MCP_GATEWAY_STATUSES, TOOL_MCP_GATEWAY_DEFAULT_PROFILE_MODES, TOOL_MCP_GATEWAY_CONTEXT_SCOPE_TYPES, TOOL_MCP_GATEWAY_TOKEN_SUBJECT_TYPES, TOOL_MCP_GATEWAY_TOKEN_ACTIONS, CONNECTION_TOKEN_ISSUANCE_PATHS, TOOL_POLICY_TYPES, TOOL_POLICY_DECISIONS, TOOL_INVOCATION_STATUSES, TOOL_INVOCATION_APPROVAL_STATES, TOOL_ACTION_REQUEST_STATUSES, TOOL_AUDIT_EVENT_TYPES, TOOL_AUDIT_OUTCOMES, TOOL_RUNTIME_KINDS, TOOL_RUNTIME_SLOT_STATUSES, TOOL_RATE_LIMIT_WINDOW_KINDS, PLUGIN_STATUSES, PLUGIN_CATEGORIES, PLUGIN_CAPABILITIES, PLUGIN_DATABASE_CORE_READ_TABLES, PLUGIN_API_ROUTE_METHODS, PLUGIN_API_ROUTE_AUTH_MODES, PLUGIN_API_ROUTE_CHECKOUT_POLICIES, PLUGIN_UI_SLOT_TYPES, WORKSPACE_OVERVIEW_DEFAULT_LIMIT, WORKSPACE_OVERVIEW_MAX_LIMIT, PLUGIN_RESERVED_COMPANY_ROUTE_SEGMENTS, PLUGIN_RESERVED_COMPANY_SETTINGS_ROUTE_SEGMENTS, PLUGIN_LAUNCHER_PLACEMENT_ZONES, PLUGIN_LAUNCHER_ACTIONS, PLUGIN_LAUNCHER_BOUNDS, PLUGIN_LAUNCHER_RENDER_ENVIRONMENTS, PLUGIN_UI_SLOT_ENTITY_TYPES, PLUGIN_STATE_SCOPE_KINDS;
+var COMPANY_STATUSES, DEPLOYMENT_MODES, DEPLOYMENT_EXPOSURES, BIND_MODES, AUTH_BASE_URL_MODES, AGENT_STATUSES, AGENT_ADAPTER_TYPES, AGENT_ROLES, AGENT_ICON_NAMES, PROJECT_ICON_NAMES, ISSUE_STATUSES, INBOX_MINE_ISSUE_STATUSES, INBOX_MINE_ISSUE_STATUS_FILTER, ISSUE_PRIORITIES, ISSUE_REVIEW_POLICIES, ISSUE_WORK_MODES, ISSUE_HARNESS_KINDS, MAX_ISSUE_REQUEST_DEPTH, SUMMARY_SLOT_SCOPE_KINDS, SUMMARY_SLOT_KEYS, SUMMARY_SLOT_STATUSES, ISSUE_COMMENT_AUTHOR_TYPES, ISSUE_COMMENT_DELIVERY_MODES, ISSUE_COMMENT_PRESENTATION_KINDS, ISSUE_COMMENT_PRESENTATION_TONES, ISSUE_COMMENT_PRESENTATION_DENSITIES, ISSUE_COMMENT_METADATA_ROW_TYPES, ISSUE_THREAD_INTERACTION_KINDS, ISSUE_THREAD_INTERACTION_REQUESTABLE_RESOLVER_POLICIES, ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES, ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES, ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES, ISSUE_THREAD_INTERACTION_RESOLVER_POLICY_PROVENANCES, ISSUE_THREAD_INTERACTION_EFFECTIVE_RESOLVER_POLICY_SOURCES, REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT, REQUEST_ITEM_VERDICTS_ITEM_LIMIT, ISSUE_THREAD_INTERACTION_STATUSES, ISSUE_THREAD_INTERACTION_CONTINUATION_POLICIES, ISSUE_WATCHDOG_DISCOVERY_KINDS, ISSUE_SURFACE_VISIBILITIES, ISSUE_RECOVERY_ACTION_KINDS, ISSUE_RECOVERY_ACTION_STATUSES, ISSUE_RECOVERY_ACTION_OWNER_TYPES, ISSUE_RECOVERY_ACTION_OUTCOMES, ISSUE_TREE_CONTROL_MODES, ISSUE_TREE_HOLD_RELEASE_POLICY_STRATEGIES, ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY, PIPELINE_CASE_BODY_DOCUMENT_KEY, SYSTEM_ISSUE_DOCUMENT_KEYS, SYSTEM_ISSUE_DOCUMENT_KEY_SET, DOCUMENT_ANNOTATION_THREAD_STATUSES, DOCUMENT_ANNOTATION_ANCHOR_STATES, DOCUMENT_ANNOTATION_ANCHOR_CONFIDENCES, EXTERNAL_OBJECT_STATUS_CATEGORIES, EXTERNAL_OBJECT_STATUS_TONES, EXTERNAL_OBJECT_LIVENESS_STATES, EXTERNAL_OBJECT_MENTION_SOURCE_KINDS, EXTERNAL_OBJECT_MENTION_CONFIDENCES, ISSUE_EXECUTION_POLICY_MODES, ISSUE_EXECUTION_STAGE_TYPES, ISSUE_MONITOR_SCHEDULED_BY, ISSUE_EXECUTION_MONITOR_KINDS, ISSUE_EXECUTION_MONITOR_RECOVERY_POLICIES, ISSUE_EXECUTION_STATE_STATUSES, ISSUE_EXECUTION_MONITOR_STATE_STATUSES, ISSUE_EXECUTION_MONITOR_CLEAR_REASONS, ISSUE_EXECUTION_DECISION_OUTCOMES, GOAL_LEVELS, GOAL_STATUSES, PROJECT_STATUSES, ENVIRONMENT_DRIVERS, ENVIRONMENT_STATUSES, ENVIRONMENT_LEASE_STATUSES, ENVIRONMENT_LEASE_CLEANUP_STATUSES, ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_KINDS, ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_STATUSES, ENVIRONMENT_CUSTOM_IMAGE_SETUP_SESSION_STATUSES, ENVIRONMENT_CUSTOM_IMAGE_SETUP_CONNECTION_TYPES, ROUTINE_STATUSES, ROUTINE_CONCURRENCY_POLICIES, ROUTINE_CATCH_UP_POLICIES, ROUTINE_ACTIVITY_GATE_POLICIES, ROUTINE_ACTIVITY_GATE_SCOPES, ROUTINE_TRIGGER_KINDS, ROUTINE_TRIGGER_SIGNING_MODES, ROUTINE_VARIABLE_TYPES, APPROVAL_TYPES, SECRET_PROVIDERS, SECRET_PROVIDER_CONFIG_STATUSES, SECRET_STATUSES, SECRET_MANAGED_MODES, SECRET_BINDING_TARGET_TYPES, SECRET_PROJECTION_CLASSES, STORAGE_PROVIDERS, BILLING_TYPES, COST_STATUSES, FINANCE_EVENT_KINDS, FINANCE_DIRECTIONS, FINANCE_UNITS, BUDGET_SCOPE_TYPES, BUDGET_METRICS, BUDGET_WINDOW_KINDS, BUDGET_INCIDENT_RESOLUTION_ACTIONS, HUMAN_COMPANY_MEMBERSHIP_ROLES, INVITE_JOIN_TYPES, JOIN_REQUEST_TYPES, JOIN_REQUEST_STATUSES, PERMISSION_KEYS, TOOL_APPLICATION_TYPES, TOOL_APPLICATION_STATUSES, TOOL_CONNECTION_KINDS, TOOL_CONNECTION_HEALTH_STATUSES, TOOL_CATALOG_ENTRY_KINDS, TOOL_CATALOG_ENTRY_STATUSES, TOOL_RISK_LEVELS, TOOL_PROFILE_STATUSES, TOOL_PROFILE_DEFAULT_ACTIONS, TOOL_PROFILE_ENTRY_SELECTOR_TYPES, TOOL_PROFILE_ENTRY_EFFECTS, TOOL_PROFILE_BINDING_TARGET_TYPES, TOOL_MCP_GATEWAY_STATUSES, TOOL_MCP_GATEWAY_DEFAULT_PROFILE_MODES, TOOL_MCP_GATEWAY_CONTEXT_SCOPE_TYPES, TOOL_MCP_GATEWAY_TOKEN_SUBJECT_TYPES, TOOL_MCP_GATEWAY_TOKEN_ACTIONS, CONNECTION_TOKEN_ISSUANCE_PATHS, TOOL_POLICY_TYPES, TOOL_POLICY_DECISIONS, TOOL_INVOCATION_STATUSES, TOOL_INVOCATION_APPROVAL_STATES, TOOL_ACTION_REQUEST_STATUSES, TOOL_AUDIT_EVENT_TYPES, TOOL_AUDIT_OUTCOMES, TOOL_RUNTIME_KINDS, TOOL_RUNTIME_SLOT_STATUSES, TOOL_RATE_LIMIT_WINDOW_KINDS, PLUGIN_STATUSES, PLUGIN_CATEGORIES, PLUGIN_CAPABILITIES, PLUGIN_DATABASE_CORE_READ_TABLES, PLUGIN_API_ROUTE_METHODS, PLUGIN_API_ROUTE_AUTH_MODES, PLUGIN_API_ROUTE_CHECKOUT_POLICIES, PLUGIN_UI_SLOT_TYPES, WORKSPACE_OVERVIEW_DEFAULT_LIMIT, WORKSPACE_OVERVIEW_MAX_LIMIT, PLUGIN_RESERVED_COMPANY_ROUTE_SEGMENTS, PLUGIN_RESERVED_COMPANY_SETTINGS_ROUTE_SEGMENTS, PLUGIN_LAUNCHER_PLACEMENT_ZONES, PLUGIN_LAUNCHER_ACTIONS, PLUGIN_LAUNCHER_BOUNDS, PLUGIN_LAUNCHER_RENDER_ENVIRONMENTS, PLUGIN_UI_SLOT_ENTITY_TYPES, PLUGIN_STATE_SCOPE_KINDS;
 var init_constants = __esm({
   "../packages/shared/src/constants.ts"() {
     "use strict";
@@ -238,17 +238,21 @@ var init_constants = __esm({
       "request_item_verdicts",
       "connection_intent"
     ];
-    ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES = [
+    ISSUE_THREAD_INTERACTION_REQUESTABLE_RESOLVER_POLICIES = [
       "anyone",
       "not_creator",
       "human_only"
     ];
+    ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES = [
+      ...ISSUE_THREAD_INTERACTION_REQUESTABLE_RESOLVER_POLICIES,
+      "chat_endpoint_owner"
+    ];
     ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES = [
       "board_or_agents",
       "board_only"
     ];
     ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES = [
-      ...ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES,
+      ...ISSUE_THREAD_INTERACTION_REQUESTABLE_RESOLVER_POLICIES,
       ...ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES
     ];
     ISSUE_THREAD_INTERACTION_RESOLVER_POLICY_PROVENANCES = [
@@ -2289,6 +2293,83 @@ var init_imessage_photon = __esm({
   }
 });
 
+// ../packages/shared/src/app-definitions/openwa.json
+var openwa_default;
+var init_openwa = __esm({
+  "../packages/shared/src/app-definitions/openwa.json"() {
+    openwa_default = {
+      schemaVersion: 1,
+      slug: "openwa",
+      name: "OpenWA",
+      description: "Let the owner and people on a WhatsApp number work with one Paperclip agent through a self-hosted OpenWA gateway.",
+      categories: [
+        "communication"
+      ],
+      featured: false,
+      branding: {
+        logoUrl: "/brands/apps/openwa.svg"
+      },
+      urlPatterns: [
+        "https://github.com/rmyndharis/OpenWA*"
+      ],
+      methods: [
+        {
+          key: "chat-agent",
+          label: "Chat with an agent",
+          purpose: "channel",
+          provider: "openwa",
+          transport: "chat_sdk",
+          auth: "api_key",
+          ownershipModes: [
+            "customer"
+          ],
+          whenToUse: "Let people in OpenWA start and continue work with one Paperclip agent.",
+          credentialFields: [
+            {
+              key: "baseUrl",
+              label: "Gateway URL",
+              type: "text",
+              required: true,
+              placeholder: "http://localhost:2785",
+              secret: false,
+              helperMd: "The OpenWA gateway origin. Loopback addresses are allowed for self-hosted gateways."
+            },
+            {
+              key: "apiKey",
+              label: "Operator API key",
+              type: "password",
+              required: true,
+              placeholder: "OpenWA operator key scoped to one session",
+              secret: true,
+              helperMd: "Create an operator key whose allowedSessions contains only the agent's session and no allowedChats."
+            },
+            {
+              key: "adminApiKey",
+              label: "Admin API key",
+              type: "password",
+              required: false,
+              placeholder: "Optional unscoped admin key",
+              secret: true,
+              advanced: true,
+              helperMd: "Only needed when gateway admin tools are enabled in Settings."
+            }
+          ],
+          guidanceMd: "Connect a self-hosted OpenWA gateway session. Paperclip inspects the gateway read-only, then asks you to confirm that send pacing is enabled and that Paperclip is the only client sending as the session before an owner sends a test WhatsApp message.",
+          consoleLinks: {
+            register: "https://github.com/rmyndharis/OpenWA",
+            docs: "https://github.com/rmyndharis/OpenWA"
+          },
+          riskTier: "S3",
+          requiredResourceFilters: [
+            "direct_message",
+            "group_chat"
+          ]
+        }
+      ]
+    };
+  }
+});
+
 // ../packages/shared/src/app-definitions/telegram.json
 var telegram_default;
 var init_telegram = __esm({
@@ -8065,6 +8146,7 @@ var init_app_definitions_generated = __esm({
     init_slack();
     init_microsoft_teams();
     init_imessage_photon();
+    init_openwa();
     init_telegram();
     init_discord();
     init_notion();
@@ -8131,7 +8213,7 @@ var init_app_definitions_generated = __esm({
     init_openai();
     init_openrouter();
     init_xai();
-    APP_DEFINITIONS = [agentmail_default, zapier_default, arcade_default, executor_default, railway_default, github_default, slack_default, microsoft_teams_default, imessage_photon_default, telegram_default, discord_default, notion_default, posthog_default, linear_default, context7_default, shopify_default, composio_default, oauth_generic_default, api_key_generic_default, sentry_default, vercel_default, anthropic_default, jira_default, airtable_default, beehiiv_default, bitly_default, candid_default, cloudflare_default, cloudinary_default, coda_default, hugging_face_default, kernel_default, local_falcon_default, make_default, manufact_default, miro_default, netlify_default, oreilly_default, planetscale_default, resend_default, ticktick_default, todoist_default, webflow_default, wix_default, brex_default, clickhouse_default, egnyte_default, embat_default, mixpanel_default, postman_default, razorpay_default, sanity_default, stripe_default, supabase_default, ticket_tailor_default, asana_default, box_default, mem0_default, pagerduty_default, similarweb_default, xero_default, youcom_default, fireflies_default, gmail_default, google_drive_default, google_docs_default, google_sheets_default, google_slides_default, google_calendar_default, google_chat_default, google_people_default, google_workspace_search_default, openai_default, openrouter_default, xai_default];
+    APP_DEFINITIONS = [agentmail_default, zapier_default, arcade_default, executor_default, railway_default, github_default, slack_default, microsoft_teams_default, imessage_photon_default, openwa_default, telegram_default, discord_default, notion_default, posthog_default, linear_default, context7_default, shopify_default, composio_default, oauth_generic_default, api_key_generic_default, sentry_default, vercel_default, anthropic_default, jira_default, airtable_default, beehiiv_default, bitly_default, candid_default, cloudflare_default, cloudinary_default, coda_default, hugging_face_default, kernel_default, local_falcon_default, make_default, manufact_default, miro_default, netlify_default, oreilly_default, planetscale_default, resend_default, ticktick_default, todoist_default, webflow_default, wix_default, brex_default, clickhouse_default, egnyte_default, embat_default, mixpanel_default, postman_default, razorpay_default, sanity_default, stripe_default, supabase_default, ticket_tailor_default, asana_default, box_default, mem0_default, pagerduty_default, similarweb_default, xero_default, youcom_default, fireflies_default, gmail_default, google_drive_default, google_docs_default, google_sheets_default, google_slides_default, google_calendar_default, google_chat_default, google_people_default, google_workspace_search_default, openai_default, openrouter_default, xai_default];
   }
 });
 
@@ -8250,7 +8332,8 @@ var init_app_definitions = __esm({
       "discord",
       "microsoft-teams",
       "telegram",
-      "imessage-photon"
+      "imessage-photon",
+      "openwa"
     ]);
     CONNECTABLE_APP_DEFINITIONS = APP_DEFINITIONS.filter(
       (app) => CONNECTABLE_APP_SLUGS.has(app.slug)
@@ -9720,7 +9803,7 @@ var init_issue = __esm({
     issueThreadInteractionKindSchema = z16.enum(
       ISSUE_THREAD_INTERACTION_KINDS
     );
-    issueThreadInteractionCanonicalResolverPolicySchema = z16.enum(ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES).describe("Canonical resolver audience: anyone, not_creator, or human_only.");
+    issueThreadInteractionCanonicalResolverPolicySchema = z16.enum(ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES).describe("Canonical resolver audience: anyone, not_creator, human_only, or chat_endpoint_owner (server-assigned to OpenWA approval cards).");
     issueThreadInteractionResolverPolicySchema = z16.enum(ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES).describe(
       "Resolver audience. Use anyone, not_creator, or human_only; board_or_agents and board_only are deprecated compatibility aliases."
     );
@@ -10094,7 +10177,8 @@ var init_issue = __esm({
       supersedeOnUserComment: z16.boolean().optional(),
       target: requestConfirmationTargetSchema.nullable().optional(),
       toolAction: requestConfirmationToolActionPayloadSchema.optional(),
-      secretProposal: requestConfirmationSecretProposalPayloadSchema.optional()
+      secretProposal: requestConfirmationSecretProposalPayloadSchema.optional(),
+      openwaApprovalRequestId: z16.string().uuid().optional()
     });
     requestCheckboxConfirmationOptionSchema = z16.object({
       id: z16.string().trim().min(1).max(120),
@@ -12857,7 +12941,7 @@ var init_app_definition = __esm({
       if (v.type === "select" && (!v.options || v.options.length === 0)) c.addIssue({ code: "custom", message: "Select fields need options", path: ["options"] });
       if (v.hidden && v.defaultValue === void 0) c.addIssue({ code: "custom", message: "Hidden fields need defaults", path: ["defaultValue"] });
     });
-    connectionMethodDefSchema = z22.object({ key: z22.string().min(1), label: z22.string().min(1).optional(), purpose: z22.union([toolConnectionPurposeSchema, z22.literal("ai")]).optional(), provider: z22.enum(["slack", "github", "discord", "microsoft-teams", "telegram", "agentmail", "imessage-photon"]).optional(), transport: z22.union([toolConnectionTransportSchema, z22.literal("runtime_auth")]), ai: aiConnectionMetadataSchema.optional(), auth: z22.enum(["oauth", "api_key", "none"]), oauthStrategy: z22.enum(["paperclip_cloud_connector", "paperclip_id_connector"]).optional(), connectorProfile: z22.string().regex(/^[a-z0-9]+(?:[.-][a-z0-9]+)*$/).optional(), capabilityProfile: z22.object({ key: z22.string().min(1), label: z22.string().min(1), description: z22.string().min(1).optional() }).optional(), grantKinds: z22.array(connectionGrantKindSchema).min(1).optional(), ownershipModes: z22.array(toolConnectionOwnershipSchema).min(1), whenToUse: z22.string().min(1), defaults: z22.object({ serverUrl: z22.string().url().optional(), serverUrlTemplate: z22.string().regex(/^https:\/\//).optional(), discoveryUrl: z22.string().url().nullable().optional(), serviceHost: z22.string().optional(), templateKey: z22.string().optional(), authorizationEndpoint: z22.string().url().optional(), tokenEndpoint: z22.string().url().optional(), metadataUrl: z22.string().url().optional(), scopesHint: z22.array(z22.string()).optional(), oauthAuthorizationParams: z22.object({ access_type: z22.literal("offline").optional(), prompt: z22.literal("consent").optional() }).optional(), toolArgumentDefaults: z22.record(z22.string(), z22.unknown()).optional() }).optional(), tenantFields: z22.array(field).optional(), extensionFields: z22.array(field).optional(), configRequirements: z22.object({ atLeastOneOf: z22.array(z22.string().min(1)).min(1).optional() }).optional(), credentialFields: z22.array(field).optional(), keyPlacement: z22.object({ location: z22.enum(["header", "query", "body_json", "env"]), name: z22.string().min(1), prefix: z22.string().nullable().optional() }).optional(), credentialSources: z22.object({ vercelConnect: z22.object({ services: z22.array(z22.string().min(1)).min(1), principalModes: z22.array(z22.enum(["app", "user"])).min(1), scopes: z22.array(z22.string().min(1)).min(1), header: z22.object({ name: z22.string().min(1), prefix: z22.string().nullable().optional() }) }).optional() }).optional(), guidanceMd: z22.string().min(1), consoleLinks: z22.object({ register: z22.string().url().optional(), keys: z22.string().url().optional(), settings: z22.string().url().optional(), docs: z22.string().url().optional() }).optional(), warnings: z22.array(z22.string()).optional(), variants: z22.array(z22.object({ key: z22.string(), label: z22.string(), whenToUse: z22.string(), tenantFields: z22.array(field).optional() })).optional(), riskTier: z22.enum(["S1", "S2", "S3", "S4"]), requiredResourceFilters: z22.array(z22.string()).optional() }).superRefine((v, c) => {
+    connectionMethodDefSchema = z22.object({ key: z22.string().min(1), label: z22.string().min(1).optional(), purpose: z22.union([toolConnectionPurposeSchema, z22.literal("ai")]).optional(), provider: z22.enum(["slack", "github", "discord", "microsoft-teams", "telegram", "agentmail", "imessage-photon", "openwa"]).optional(), transport: z22.union([toolConnectionTransportSchema, z22.literal("runtime_auth")]), ai: aiConnectionMetadataSchema.optional(), auth: z22.enum(["oauth", "api_key", "none"]), oauthStrategy: z22.enum(["paperclip_cloud_connector", "paperclip_id_connector"]).optional(), connectorProfile: z22.string().regex(/^[a-z0-9]+(?:[.-][a-z0-9]+)*$/).optional(), capabilityProfile: z22.object({ key: z22.string().min(1), label: z22.string().min(1), description: z22.string().min(1).optional() }).optional(), grantKinds: z22.array(connectionGrantKindSchema).min(1).optional(), ownershipModes: z22.array(toolConnectionOwnershipSchema).min(1), whenToUse: z22.string().min(1), defaults: z22.object({ serverUrl: z22.string().url().optional(), serverUrlTemplate: z22.string().regex(/^https:\/\//).optional(), discoveryUrl: z22.string().url().nullable().optional(), serviceHost: z22.string().optional(), templateKey: z22.string().optional(), authorizationEndpoint: z22.string().url().optional(), tokenEndpoint: z22.string().url().optional(), metadataUrl: z22.string().url().optional(), scopesHint: z22.array(z22.string()).optional(), oauthAuthorizationParams: z22.object({ access_type: z22.literal("offline").optional(), prompt: z22.literal("consent").optional() }).optional(), toolArgumentDefaults: z22.record(z22.string(), z22.unknown()).optional() }).optional(), tenantFields: z22.array(field).optional(), extensionFields: z22.array(field).optional(), configRequirements: z22.object({ atLeastOneOf: z22.array(z22.string().min(1)).min(1).optional() }).optional(), credentialFields: z22.array(field).optional(), keyPlacement: z22.object({ location: z22.enum(["header", "query", "body_json", "env"]), name: z22.string().min(1), prefix: z22.string().nullable().optional() }).optional(), credentialSources: z22.object({ vercelConnect: z22.object({ services: z22.array(z22.string().min(1)).min(1), principalModes: z22.array(z22.enum(["app", "user"])).min(1), scopes: z22.array(z22.string().min(1)).min(1), header: z22.object({ name: z22.string().min(1), prefix: z22.string().nullable().optional() }) }).optional() }).optional(), guidanceMd: z22.string().min(1), consoleLinks: z22.object({ register: z22.string().url().optional(), keys: z22.string().url().optional(), settings: z22.string().url().optional(), docs: z22.string().url().optional() }).optional(), warnings: z22.array(z22.string()).optional(), variants: z22.array(z22.object({ key: z22.string(), label: z22.string(), whenToUse: z22.string(), tenantFields: z22.array(field).optional() })).optional(), riskTier: z22.enum(["S1", "S2", "S3", "S4"]), requiredResourceFilters: z22.array(z22.string()).optional() }).superRefine((v, c) => {
       if (v.transport === "runtime_auth" !== Boolean(v.ai)) c.addIssue({ code: "custom", message: "Runtime authentication requires AI metadata and AI metadata requires runtime_auth", path: ["ai"] });
       if (v.ai && !AI_CONNECTION_CAPABILITIES[v.ai.provider].methods[v.ai.method]) c.addIssue({ code: "custom", message: "Unsupported AI sign-in method", path: ["ai", "method"] });
       if (v.ai && v.auth !== (v.ai.method === "subscription" ? "oauth" : "api_key")) c.addIssue({ code: "custom", message: "AI sign-in method must match authentication", path: ["auth"] });
@@ -12888,7 +12972,7 @@ var init_app_definition = __esm({
 });
 
 // ../packages/shared/src/types/chat-channels.ts
-var CHAT_PROVIDERS, CHAT_ENDPOINT_STATUSES, CHAT_CONCURRENCY_POLICIES, CHAT_EVENT_KINDS, CHAT_DELIVERY_STATES, CHAT_PUBLICATION_STATES, CHAT_FILE_TRANSFER_PHASES, CHAT_PRINCIPAL_KINDS, CHAT_IDENTITY_LINK_STATUSES, CHAT_RESOURCE_AVAILABILITIES;
+var CHAT_PROVIDERS, CHAT_ENDPOINT_STATUSES, CHAT_CONCURRENCY_POLICIES, CHAT_EVENT_KINDS, CHAT_DELIVERY_STATES, CHAT_PUBLICATION_STATES, CHAT_FILE_TRANSFER_PHASES, CHAT_PRINCIPAL_KINDS, CHAT_IDENTITY_LINK_STATUSES, CHAT_RESOURCE_AVAILABILITIES, CHAT_INFLIGHT_MODES, OPENWA_NUMBER_MODES, OPENWA_SENDER_POLICY_MODES, OPENWA_REPLY_POLICIES, OPENWA_CHAT_ACTIVATIONS, OPENWA_GATEWAY_ADMIN_TOOL_LEVELS, OPENWA_APPROVAL_CATEGORIES, OPENWA_GRANT_CATEGORIES, CHAT_SENDER_RULE_LISTS, CHAT_OWNER_APPROVAL_STATUSES;
 var init_chat_channels = __esm({
   "../packages/shared/src/types/chat-channels.ts"() {
     "use strict";
@@ -12899,7 +12983,8 @@ var init_chat_channels = __esm({
       "microsoft-teams",
       "telegram",
       "agentmail",
-      "imessage-photon"
+      "imessage-photon",
+      "openwa"
     ];
     CHAT_ENDPOINT_STATUSES = [
       "draft",
@@ -12982,6 +13067,26 @@ var init_chat_channels = __esm({
       "unavailable",
       "removed"
     ];
+    CHAT_INFLIGHT_MODES = ["steer", "queue"];
+    OPENWA_NUMBER_MODES = ["agent_number", "owner_number"];
+    OPENWA_SENDER_POLICY_MODES = ["all", "allowlist", "denylist"];
+    OPENWA_REPLY_POLICIES = ["allowed", "ask_owner", "owner_absent_only"];
+    OPENWA_CHAT_ACTIVATIONS = ["auto", "on", "off"];
+    OPENWA_GATEWAY_ADMIN_TOOL_LEVELS = ["off", "read", "full"];
+    OPENWA_APPROVAL_CATEGORIES = [
+      "create_task",
+      "external_tools",
+      "cross_chat_send",
+      "wa_admin",
+      "gateway_admin"
+    ];
+    OPENWA_GRANT_CATEGORIES = [
+      ...OPENWA_APPROVAL_CATEGORIES,
+      "reply_outside_allowlist",
+      "reply"
+    ];
+    CHAT_SENDER_RULE_LISTS = ["allow", "deny"];
+    CHAT_OWNER_APPROVAL_STATUSES = ["pending", "approved", "rejected", "cancelled"];
   }
 });
 
@@ -13133,7 +13238,20 @@ var init_chat_github2 = __esm({
 
 // ../packages/shared/src/validators/chat-channels.ts
 import { z as z24 } from "zod";
-var chatProviderSchema, chatEndpointStatusSchema, chatConcurrencyPolicySchema, chatEventKindSchema, chatDeliveryStateSchema, chatPublicationStateSchema, chatPrincipalKindSchema, chatIdentityLinkStatusSchema, chatResourceAvailabilitySchema, microsoftTeamsCredentialIdSchema, chatEndpointCredentialsSchema, createChatEndpointSchema, slackAppConfigurationSchema, updateChatEndpointSchema, photonProjectIdSchema, photonLineIdSchema, photonChannelConfigurationSchema, inspectPhotonProjectSchema, configureChatEndpointSchema, replaceChatEndpointResourcesSchema, publishChatCommentSchema, publishChatBoardMessageSchema, publishChatPublicationSchema, resolveChatPublicationSchema, resolveChatActionSchema, createChatIdentityLinkIntentSchema, confirmChatIdentityLinkSchema, replayChatDeliverySchema, chatPublicEndpointIdSchema;
+function openwaDefaultTriggerRules(numberMode) {
+  const agentNumber = numberMode === "agent_number";
+  return {
+    directMessage: agentNumber,
+    agentMentioned: agentNumber,
+    replyToAgent: true,
+    commandPrefix: { enabled: !agentNumber, prefix: OPENWA_DEFAULT_COMMAND_PREFIX },
+    selfChat: !agentNumber,
+    ownerMentionedAbsent: true,
+    keywords: [],
+    allMessages: false
+  };
+}
+var chatProviderSchema, chatEndpointStatusSchema, chatConcurrencyPolicySchema, chatEventKindSchema, chatDeliveryStateSchema, chatPublicationStateSchema, chatPrincipalKindSchema, chatIdentityLinkStatusSchema, chatResourceAvailabilitySchema, microsoftTeamsCredentialIdSchema, chatEndpointCredentialsSchema, createChatEndpointSchema, slackAppConfigurationSchema, updateChatEndpointSchema, photonProjectIdSchema, photonLineIdSchema, photonChannelConfigurationSchema, inspectPhotonProjectSchema, openwaBaseUrlSchema, openwaSessionIdSchema, openwaApiKeyInputSchema, inspectOpenwaGatewaySchema, openwaChannelConfigurationSchema, configureChatEndpointSchema, replaceChatEndpointResourcesSchema, publishChatCommentSchema, publishChatBoardMessageSchema, publishChatPublicationSchema, resolveChatPublicationSchema, resolveChatActionSchema, createChatIdentityLinkIntentSchema, confirmChatIdentityLinkSchema, replayChatDeliverySchema, chatInflightModeSchema, openwaNumberModeSchema, openwaSenderPolicyModeSchema, openwaReplyPolicySchema, openwaChatActivationSchema, openwaGatewayAdminToolLevelSchema, OPENWA_DEFAULT_COMMAND_PREFIX, OPENWA_DEFAULT_OWNER_NUMBER_PREFIX, OPENWA_CUSTOM_INSTRUCTIONS_MAX_LENGTH, OPENWA_CHAT_NOTE_MAX_LENGTH, openwaCommandPrefixSchema, openwaKeywordsSchema, openwaAbsenceSecondsSchema, openwaTriggerRulesInputSchema, openwaEndpointPolicySchema, openwaTriggerOverridesSchema, openwaChatSettingsSchema, openwaE164Schema, addOpenwaOwnerSchema, createOpenwaSenderRuleSchema, updateOpenwaChatSettingsSchema, updateOpenwaEndpointPolicySchema, resolveOpenwaApprovalSchema, listOpenwaApprovalsQuerySchema, chatPublicEndpointIdSchema;
 var init_chat_channels2 = __esm({
   "../packages/shared/src/validators/chat-channels.ts"() {
     "use strict";
@@ -13205,6 +13323,33 @@ var init_chat_channels2 = __esm({
       projectId: photonProjectIdSchema,
       projectSecret: z24.string().min(1).max(4096)
     }).strict();
+    openwaBaseUrlSchema = z24.string().trim().min(1).max(2048).transform((value, ctx) => {
+      let url;
+      try {
+        url = new URL(value);
+      } catch {
+        ctx.addIssue({ code: z24.ZodIssueCode.custom, message: "Enter the OpenWA gateway URL, for example http://localhost:2785" });
+        return z24.NEVER;
+      }
+      if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" && url.pathname !== "" || url.search || url.hash) {
+        ctx.addIssue({ code: z24.ZodIssueCode.custom, message: "Use only the gateway origin: http(s)://host:port, without a path, query, or credentials" });
+        return z24.NEVER;
+      }
+      return url.origin;
+    });
+    openwaSessionIdSchema = z24.string().trim().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/);
+    openwaApiKeyInputSchema = z24.string().trim().min(1).max(4096);
+    inspectOpenwaGatewaySchema = z24.object({
+      baseUrl: openwaBaseUrlSchema,
+      apiKey: openwaApiKeyInputSchema,
+      adminApiKey: openwaApiKeyInputSchema.optional()
+    }).strict();
+    openwaChannelConfigurationSchema = z24.object({
+      baseUrl: openwaBaseUrlSchema,
+      sessionId: openwaSessionIdSchema,
+      numberMode: z24.enum(OPENWA_NUMBER_MODES).default("agent_number"),
+      attestations: z24.object({ pacing: z24.boolean(), soleClient: z24.boolean() }).strict()
+    }).strict();
     configureChatEndpointSchema = z24.object({
       action: z24.enum([
         "configure",
@@ -13215,9 +13360,10 @@ var init_chat_channels2 = __esm({
         "remove"
       ]),
       credentials: chatEndpointCredentialsSchema.optional(),
-      photon: photonChannelConfigurationSchema.optional()
+      photon: photonChannelConfigurationSchema.optional(),
+      openwa: openwaChannelConfigurationSchema.optional()
     }).strict().superRefine((value, ctx) => {
-      if ((value.credentials || value.photon) && value.action !== "configure" && value.action !== "reconnect") {
+      if ((value.credentials || value.photon || value.openwa) && value.action !== "configure" && value.action !== "reconnect") {
         ctx.addIssue({
           code: z24.ZodIssueCode.custom,
           path: ["credentials"],
@@ -13264,6 +13410,111 @@ var init_chat_channels2 = __esm({
       token: z24.string().min(32).max(4096)
     }).strict();
     replayChatDeliverySchema = z24.object({}).strict();
+    chatInflightModeSchema = z24.enum(CHAT_INFLIGHT_MODES);
+    openwaNumberModeSchema = z24.enum(OPENWA_NUMBER_MODES);
+    openwaSenderPolicyModeSchema = z24.enum(OPENWA_SENDER_POLICY_MODES);
+    openwaReplyPolicySchema = z24.enum(OPENWA_REPLY_POLICIES);
+    openwaChatActivationSchema = z24.enum(OPENWA_CHAT_ACTIVATIONS);
+    openwaGatewayAdminToolLevelSchema = z24.enum(OPENWA_GATEWAY_ADMIN_TOOL_LEVELS);
+    OPENWA_DEFAULT_COMMAND_PREFIX = "/ai";
+    OPENWA_DEFAULT_OWNER_NUMBER_PREFIX = "\u{1F916} *Assistant:*";
+    OPENWA_CUSTOM_INSTRUCTIONS_MAX_LENGTH = 8e3;
+    OPENWA_CHAT_NOTE_MAX_LENGTH = 2e3;
+    openwaCommandPrefixSchema = z24.string().trim().min(1).max(32).regex(/^\S+$/);
+    openwaKeywordsSchema = z24.array(z24.string().trim().min(1).max(100)).max(50);
+    openwaAbsenceSecondsSchema = z24.number().int().min(10).max(86400);
+    openwaTriggerRulesInputSchema = z24.object({
+      directMessage: z24.boolean().optional(),
+      agentMentioned: z24.boolean().optional(),
+      replyToAgent: z24.boolean().optional(),
+      commandPrefix: z24.object({
+        enabled: z24.boolean().optional(),
+        prefix: openwaCommandPrefixSchema.optional()
+      }).strict().optional(),
+      selfChat: z24.boolean().optional(),
+      ownerMentionedAbsent: z24.boolean().optional(),
+      keywords: openwaKeywordsSchema.optional(),
+      allMessages: z24.boolean().optional()
+    }).strict();
+    openwaEndpointPolicySchema = z24.object({
+      numberMode: openwaNumberModeSchema.default("agent_number"),
+      senderPolicyMode: openwaSenderPolicyModeSchema.default("allowlist"),
+      replyPolicy: openwaReplyPolicySchema.default("allowed"),
+      triggers: openwaTriggerRulesInputSchema.optional(),
+      absenceSeconds: openwaAbsenceSecondsSchema.default(120),
+      approvals: z24.object({
+        createTask: z24.boolean().default(true),
+        externalTools: z24.boolean().default(true),
+        crossChatSend: z24.boolean().default(true),
+        waAdmin: z24.boolean().default(true),
+        gatewayAdmin: z24.boolean().default(true),
+        reminderMinutes: z24.number().int().min(1).max(1440).default(30),
+        maxReminders: z24.number().int().min(0).max(10).default(3),
+        grantTtlHours: z24.number().int().min(1).max(720).default(24)
+      }).strict().prefault({}),
+      rotateAfterIdleHours: z24.number().int().min(1).max(720).default(24),
+      progressNudgeSeconds: z24.number().int().min(0).max(3600).default(60),
+      typingIndicator: z24.boolean().default(true),
+      ownerNumberPrefix: z24.object({
+        enabled: z24.boolean().default(true),
+        text: z24.string().trim().min(1).max(64).default(OPENWA_DEFAULT_OWNER_NUMBER_PREFIX)
+      }).strict().prefault({}),
+      gatewayAdminTools: openwaGatewayAdminToolLevelSchema.default("off"),
+      customInstructions: multilineTextSchema.pipe(z24.string().trim().max(OPENWA_CUSTOM_INSTRUCTIONS_MAX_LENGTH)).default(""),
+      auditContentRetentionDays: z24.number().int().min(1).max(3650).default(90),
+      attestations: z24.object({
+        pacing: z24.boolean().default(false),
+        soleClient: z24.boolean().default(false)
+      }).strict().prefault({})
+    }).strict().transform((value) => {
+      const defaults3 = openwaDefaultTriggerRules(value.numberMode);
+      const triggers = value.triggers ?? {};
+      return {
+        ...value,
+        triggers: {
+          directMessage: triggers.directMessage ?? defaults3.directMessage,
+          agentMentioned: triggers.agentMentioned ?? defaults3.agentMentioned,
+          replyToAgent: triggers.replyToAgent ?? defaults3.replyToAgent,
+          commandPrefix: {
+            enabled: triggers.commandPrefix?.enabled ?? defaults3.commandPrefix.enabled,
+            prefix: triggers.commandPrefix?.prefix ?? defaults3.commandPrefix.prefix
+          },
+          selfChat: triggers.selfChat ?? defaults3.selfChat,
+          ownerMentionedAbsent: triggers.ownerMentionedAbsent ?? defaults3.ownerMentionedAbsent,
+          keywords: triggers.keywords ?? defaults3.keywords,
+          allMessages: triggers.allMessages ?? defaults3.allMessages
+        }
+      };
+    });
+    openwaTriggerOverridesSchema = openwaTriggerRulesInputSchema;
+    openwaChatSettingsSchema = z24.object({
+      activation: openwaChatActivationSchema.default("auto"),
+      triggers: openwaTriggerOverridesSchema.optional(),
+      absenceSeconds: openwaAbsenceSecondsSchema.optional(),
+      replyPolicy: openwaReplyPolicySchema.optional(),
+      note: multilineTextSchema.pipe(z24.string().trim().max(OPENWA_CHAT_NOTE_MAX_LENGTH)).optional()
+    }).strict();
+    openwaE164Schema = z24.string().trim().regex(/^\+[1-9][0-9]{6,14}$/, "Use an E.164 number such as +6281234567890");
+    addOpenwaOwnerSchema = z24.object({
+      e164: openwaE164Schema,
+      expiresInSeconds: z24.number().int().min(300).max(86400).default(1800)
+    }).strict();
+    createOpenwaSenderRuleSchema = z24.object({
+      list: z24.enum(CHAT_SENDER_RULE_LISTS),
+      e164: openwaE164Schema,
+      label: z24.string().trim().min(1).max(120).optional()
+    }).strict();
+    updateOpenwaChatSettingsSchema = z24.object({
+      chatId: z24.string().trim().regex(/^[A-Za-z0-9._-]{1,128}@(c\.us|g\.us|lid)$/),
+      label: z24.string().trim().min(1).max(512).optional(),
+      settings: openwaChatSettingsSchema
+    }).strict();
+    updateOpenwaEndpointPolicySchema = z24.looseObject({ inflightMode: chatInflightModeSchema.optional() });
+    resolveOpenwaApprovalSchema = z24.object({
+      decision: z24.enum(["approve", "reject"]),
+      reason: z24.string().trim().min(1).max(2e3).optional()
+    }).strict();
+    listOpenwaApprovalsQuerySchema = z24.object({ status: z24.enum(CHAT_OWNER_APPROVAL_STATUSES).optional() }).strict();
     chatPublicEndpointIdSchema = z24.string().regex(/^[a-zA-Z0-9_-]{32,128}$/);
   }
 });
@@ -13431,7 +13682,7 @@ var init_smoke_lab = __esm({
 });
 
 // ../packages/shared/src/types/instance.ts
-var DAILY_RETENTION_PRESETS, WEEKLY_RETENTION_PRESETS, MONTHLY_RETENTION_PRESETS, DEFAULT_BACKUP_RETENTION, DEFAULT_MESSAGE_DELIVERY;
+var DAILY_RETENTION_PRESETS, WEEKLY_RETENTION_PRESETS, MONTHLY_RETENTION_PRESETS, DEFAULT_BACKUP_RETENTION, SPEECH_TO_TEXT_DEFAULTS, DEFAULT_MESSAGE_DELIVERY;
 var init_instance = __esm({
   "../packages/shared/src/types/instance.ts"() {
     "use strict";
@@ -13443,6 +13694,14 @@ var init_instance = __esm({
       weeklyWeeks: 4,
       monthlyMonths: 1
     };
+    SPEECH_TO_TEXT_DEFAULTS = {
+      enabled: false,
+      baseUrl: "",
+      model: "",
+      apiKeyEnvVar: "",
+      maxAudioSeconds: 600,
+      sttWaitSeconds: 15
+    };
     DEFAULT_MESSAGE_DELIVERY = "steer";
   }
 });
@@ -13971,7 +14230,19 @@ function presetSchema(presets, label2) {
     { message: `${label2} must be one of: ${presets.join(", ")}` }
   );
 }
-var messageDeliverySchema, backupRetentionPolicySchema, instanceGeneralSettingsSchema, patchInstanceGeneralSettingsSchema, instanceExperimentalSettingsSchema, patchInstanceExperimentalSettingsSchema, managedSettingMetadataSchema, instanceExperimentalSettingsWithManagedSchema, patchInstanceSettingsSchema, MAX_TASK_DRAIN_TTL_MS, startTaskDrainRequestSchema, instanceSettingsSchema;
+function isSpeechToTextBaseUrl(value) {
+  if (value === "") return true;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  if (url.username || url.password || url.search || url.hash) return false;
+  return ["/", "/v1", "/v1/"].includes(url.pathname);
+}
+var messageDeliverySchema, backupRetentionPolicySchema, speechToTextSettingsSchema, instanceGeneralSettingsSchema, patchInstanceGeneralSettingsSchema, instanceExperimentalSettingsSchema, patchInstanceExperimentalSettingsSchema, managedSettingMetadataSchema, instanceExperimentalSettingsWithManagedSchema, patchInstanceSettingsSchema, MAX_TASK_DRAIN_TTL_MS, startTaskDrainRequestSchema, instanceSettingsSchema;
 var init_instance2 = __esm({
   "../packages/shared/src/validators/instance.ts"() {
     "use strict";
@@ -13985,6 +14256,20 @@ var init_instance2 = __esm({
       weeklyWeeks: presetSchema(WEEKLY_RETENTION_PRESETS, "weeklyWeeks").default(DEFAULT_BACKUP_RETENTION.weeklyWeeks),
       monthlyMonths: presetSchema(MONTHLY_RETENTION_PRESETS, "monthlyMonths").default(DEFAULT_BACKUP_RETENTION.monthlyMonths)
     });
+    speechToTextSettingsSchema = z33.object({
+      enabled: z33.boolean().default(SPEECH_TO_TEXT_DEFAULTS.enabled),
+      baseUrl: z33.string().trim().max(2048).refine(isSpeechToTextBaseUrl, {
+        message: "Speech-to-text base URL must be an http(s) origin or end at /v1, without credentials, query or fragment"
+      }).default(SPEECH_TO_TEXT_DEFAULTS.baseUrl),
+      model: z33.string().trim().max(200).default(SPEECH_TO_TEXT_DEFAULTS.model),
+      apiKeyEnvVar: z33.string().trim().max(128).regex(/^(?:[A-Za-z_][A-Za-z0-9_]*)?$/, {
+        message: "Speech-to-text API key must name a server environment variable, not hold the key itself"
+      }).default(SPEECH_TO_TEXT_DEFAULTS.apiKeyEnvVar),
+      maxAudioSeconds: z33.number().int().min(1).max(7200).default(SPEECH_TO_TEXT_DEFAULTS.maxAudioSeconds),
+      sttWaitSeconds: z33.number().int().min(1).max(120).default(SPEECH_TO_TEXT_DEFAULTS.sttWaitSeconds)
+    }).strict().refine((value) => !value.enabled || value.baseUrl !== "" && value.model !== "" && value.apiKeyEnvVar !== "", {
+      message: "Speech-to-text needs a base URL, a model and an API key environment variable before it can be enabled"
+    });
     instanceGeneralSettingsSchema = z33.object({
       censorUsernameInLogs: z33.boolean().default(false),
       keyboardShortcuts: z33.boolean().default(false),
@@ -13993,6 +14278,7 @@ var init_instance2 = __esm({
       ),
       backupRetention: backupRetentionPolicySchema.default(DEFAULT_BACKUP_RETENTION),
       defaultMessageDelivery: messageDeliverySchema.default(DEFAULT_MESSAGE_DELIVERY),
+      speechToText: speechToTextSettingsSchema.default(SPEECH_TO_TEXT_DEFAULTS),
       // Execution policy. Absent/"any" = unrestricted; "kubernetes" forces the
       // Kubernetes sandbox provider and denies local/ssh execution (cloud_tenant).
       executionMode: z33.enum(["kubernetes", "any"]).optional()
@@ -17458,6 +17744,7 @@ var init_settings_visibility = __esm({
       "instance.general.keyboardShortcuts",
       "instance.general.backupRetention",
       "instance.general.feedbackDataSharingPreference",
+      "instance.general.speechToText",
       "instance.general.signOut"
     ];
     HIDEABLE_WORKSPACE_SECTIONS = ["workspaces.isolation"];
@@ -18091,6 +18378,190 @@ var init_slack_tools = __esm({
   }
 });
 
+// ../packages/shared/src/openwa-tools.ts
+import { z as z69 } from "zod";
+function tool2(name, risk, description, shape, refine) {
+  const base = z69.object(shape).strict();
+  const schema = refine ? base.superRefine(refine) : base;
+  const { $schema: _schema, ...inputSchema } = z69.toJSONSchema(schema, { io: "input" });
+  return { name: `openwa_${name}`, risk, description, schema, inputSchema };
+}
+var OPENWA_SEND_KINDS, chat, e164, messageId, mention, triggerIds, operation, cursor2, GRANT_CATEGORIES, OPENWA_APPROVAL_MESSAGE_MAX_LENGTH, MEDIA_KINDS, senderRule, OPENWA_TOOLS, openwaToolCallSchema;
+var init_openwa_tools = __esm({
+  "../packages/shared/src/openwa-tools.ts"() {
+    "use strict";
+    init_chat_channels2();
+    OPENWA_SEND_KINDS = ["text", "image", "video", "audio", "voice", "document", "sticker", "location", "contact", "poll"];
+    chat = z69.string().min(3).max(200).optional().describe("chatRef, group id or E.164 number; default: origin chat");
+    e164 = z69.string().regex(/^\+?[1-9]\d{6,14}$/);
+    messageId = z69.string().min(1).max(200);
+    mention = z69.string().regex(/^(\+?[1-9]\d{6,14}|openwa:[A-Za-z0-9-]{1,64}:\d{5,25}@(c\.us|lid))$/);
+    triggerIds = z69.array(z69.string().uuid()).min(1).max(50);
+    operation = z69.string().min(1).max(100);
+    cursor2 = z69.string().min(1).max(200).optional();
+    GRANT_CATEGORIES = ["create_task", "external_tools", "cross_chat_send", "wa_admin", "gateway_admin", "reply_outside_allowlist", "reply"];
+    OPENWA_APPROVAL_MESSAGE_MAX_LENGTH = 3500;
+    MEDIA_KINDS = /* @__PURE__ */ new Set(["image", "video", "audio", "voice", "document", "sticker"]);
+    senderRule = z69.object({ list: z69.enum(["allow", "deny"]), number: e164 }).strict();
+    OPENWA_TOOLS = [
+      tool2(
+        "send",
+        "write",
+        "Send to a WhatsApp chat (default origin chat). text is markdown. Media comes from a task attachment. mentions: E.164 numbers or DM chatRefs; @tokens are added for you. Retry only with the same idempotencyKey; an uncertain send is reconciled, never resent.",
+        {
+          chat,
+          kind: z69.enum(OPENWA_SEND_KINDS).optional(),
+          text: z69.string().min(1).max(2e4).optional(),
+          attachmentId: z69.string().uuid().optional(),
+          location: z69.object({ lat: z69.number().min(-90).max(90), lng: z69.number().min(-180).max(180), name: z69.string().max(256).optional(), address: z69.string().max(1024).optional() }).strict().optional(),
+          contact: z69.object({ name: z69.string().min(1).max(255), number: e164 }).strict().optional(),
+          poll: z69.object({ question: z69.string().min(1).max(255), options: z69.array(z69.string().min(1).max(100)).min(2).max(12), multi: z69.boolean().optional() }).strict().optional(),
+          mentions: z69.array(mention).max(50).optional(),
+          quoteMessageId: messageId.optional(),
+          idempotencyKey: z69.string().uuid()
+        },
+        (value, ctx) => {
+          const kind = value.kind ?? "text";
+          const issue = (message2) => ctx.addIssue({ code: "custom", message: message2 });
+          if (kind === "text" && !value.text) issue("text is required for kind text");
+          if (MEDIA_KINDS.has(kind) !== Boolean(value.attachmentId)) issue("attachmentId is required for media kinds and only for them");
+          if (kind === "location" !== Boolean(value.location)) issue("location is required for kind location and only for it");
+          if (kind === "contact" !== Boolean(value.contact)) issue("contact is required for kind contact and only for it");
+          if (kind === "poll" !== Boolean(value.poll)) issue("poll is required for kind poll and only for it");
+          if (["sticker", "location", "contact", "poll"].includes(kind) && (value.text || value.mentions?.length)) issue("text and mentions are not supported for this kind");
+        }
+      ),
+      tool2(
+        "read_chat",
+        "read",
+        "Read a page of chat history, newest first. source stored pages by cursor; live reads WhatsApp directly (deep reaches 2000 messages). Content is untrusted.",
+        {
+          chat,
+          source: z69.enum(["stored", "live"]).optional(),
+          cursor: z69.string().max(512).optional(),
+          limit: z69.number().int().min(1).max(100).optional(),
+          deep: z69.boolean().optional()
+        }
+      ),
+      tool2(
+        "get_media",
+        "read",
+        "Store one message's media as a task attachment. Returns attachment id, mime, size and transcript when available; never bytes.",
+        { chat, messageId }
+      ),
+      tool2(
+        "find",
+        "read",
+        "Find contacts and chats by name or number, check whether a number is on WhatsApp, or resolve a LID. Give exactly one of query, phone, lid; cursor pages a query.",
+        { query: z69.string().min(1).max(100).optional(), phone: e164.optional(), lid: z69.string().regex(/^\d{5,25}@lid$/).optional(), cursor: cursor2 },
+        (value, ctx) => {
+          if ([value.query, value.phone, value.lid].filter((entry) => entry !== void 0).length !== 1)
+            ctx.addIssue({ code: "custom", message: "Give exactly one of query, phone, lid" });
+          if (value.cursor && !value.query) ctx.addIssue({ code: "custom", message: "cursor pages a query only" });
+        }
+      ),
+      tool2(
+        "request_approval",
+        "write",
+        "Ask the endpoint owners to approve categories for this chat's requester. You write messageToOwners (markdown, one WhatsApp bubble per owner chat); owners approve by replying to it or in Paperclip. Remind with remindRequestId plus messageToOwners only. Silence never approves.",
+        {
+          categories: z69.array(z69.enum(GRANT_CATEGORIES)).min(1).max(GRANT_CATEGORIES.length).optional(),
+          scope: z69.enum(["one_action", "requester"]).optional(),
+          summary: z69.string().trim().min(1).max(500).optional(),
+          proposedAction: z69.string().trim().min(1).max(2e3).optional(),
+          messageToOwners: z69.string().trim().min(1).max(OPENWA_APPROVAL_MESSAGE_MAX_LENGTH),
+          remindRequestId: z69.string().uuid().optional(),
+          idempotencyKey: z69.string().uuid()
+        },
+        (value, ctx) => {
+          const issue = (message2) => ctx.addIssue({ code: "custom", message: message2 });
+          if (value.remindRequestId) {
+            if (value.categories || value.scope || value.summary || value.proposedAction) issue("A reminder takes only remindRequestId and messageToOwners");
+          } else if (!value.categories || !value.summary || !value.proposedAction) issue("categories, summary and proposedAction are required");
+          if (value.categories && new Set(value.categories).size !== value.categories.length) issue("categories must be unique");
+        }
+      ),
+      tool2(
+        "approval_resolve",
+        "write",
+        "Record the owner's decision on an approval request. Only in the run started by that owner's reply to the request bubble. clarify keeps it pending.",
+        {
+          requestId: z69.string().uuid(),
+          decision: z69.enum(["approve", "reject", "clarify"]),
+          conditions: z69.string().trim().min(1).max(2e3).optional()
+        }
+      ),
+      tool2(
+        "stay_silent",
+        "write",
+        "Deliberately leave triggers unanswered: marks the listed (default all visible pending) triggers silenced.",
+        { triggerIds: triggerIds.optional() }
+      ),
+      tool2(
+        "handoff",
+        "write",
+        "Hand owner triggers to a follow-up owner run carrying your note.",
+        { triggerIds, note: z69.string().min(1).max(2e3) }
+      ),
+      tool2(
+        "catalog",
+        "read",
+        "List OpenWA gateway operations with category and availability on this engine and key. Filter by category or text; page with cursor.",
+        {
+          category: z69.enum(["read", "write", "wa_admin", "gateway_admin", "paperclip"]).optional(),
+          query: z69.string().min(1).max(100).optional(),
+          cursor: cursor2
+        }
+      ),
+      tool2(
+        "endpoint_config",
+        "write",
+        "Owner-triggered runs only: change sender allow/deny lists, one chat's settings (default origin chat; null clears an override), approval toggles and reminders, or custom instructions. Empty call reads them. Credentials, number mode, owners and gateway admin level stay in Paperclip.",
+        {
+          senders: z69.object({
+            add: z69.array(senderRule.extend({ label: z69.string().trim().min(1).max(120).optional() })).max(50).optional(),
+            remove: z69.array(senderRule).max(50).optional()
+          }).strict().optional(),
+          chat,
+          chatSettings: z69.object({
+            activation: openwaChatActivationSchema.optional(),
+            triggers: openwaTriggerOverridesSchema.nullable().optional(),
+            absenceSeconds: z69.number().int().min(10).max(86400).nullable().optional(),
+            replyPolicy: openwaReplyPolicySchema.nullable().optional(),
+            note: z69.string().max(OPENWA_CHAT_NOTE_MAX_LENGTH).nullable().optional()
+          }).strict().optional(),
+          approvals: z69.object({
+            createTask: z69.boolean().optional(),
+            externalTools: z69.boolean().optional(),
+            crossChatSend: z69.boolean().optional(),
+            waAdmin: z69.boolean().optional(),
+            gatewayAdmin: z69.boolean().optional(),
+            reminderMinutes: z69.number().int().min(1).max(1440).optional(),
+            maxReminders: z69.number().int().min(0).max(10).optional()
+          }).strict().optional(),
+          customInstructions: z69.string().max(OPENWA_CUSTOM_INSTRUCTIONS_MAX_LENGTH).optional()
+        }
+      ),
+      tool2("describe", "read", "Argument schema and gates of one operation from openwa_catalog.", { operation }),
+      tool2(
+        "call",
+        "write",
+        "Run one catalog operation. args follow openwa_describe; the session is implied. Non-read operations need an idempotencyKey; retry only with the same key.",
+        {
+          operation,
+          args: z69.record(z69.string(), z69.unknown()).optional(),
+          idempotencyKey: z69.string().uuid().optional(),
+          cursor: cursor2
+        }
+      )
+    ];
+    openwaToolCallSchema = z69.object({
+      tool: z69.string().min(1).max(100),
+      arguments: z69.record(z69.string(), z69.unknown())
+    }).strict();
+  }
+});
+
 // ../packages/shared/src/index.ts
 var init_src = __esm({
   "../packages/shared/src/index.ts"() {
@@ -18190,6 +18661,7 @@ var init_src = __esm({
     init_remote_mcp_connectors();
     init_retired_composio();
     init_slack_tools();
+    init_openwa_tools();
   }
 });
 
@@ -23734,13 +24206,15 @@ import {
   uniqueIndex as uniqueIndex42,
   uuid as uuid59
 } from "drizzle-orm/pg-core";
-var chatEndpoints, chatEndpointResources, chatExternalPrincipals, chatIdentityLinks, chatConversations, chatDeliveries, chatPublications, chatMessageLinks, chatActions, chatAgentRoutes, chatEndpointLeases, chatSdkState;
+var chatEndpoints, chatEndpointResources, chatExternalPrincipals, chatIdentityLinks, chatConversations, chatDeliveries, chatPublications, chatMessageLinks, chatActions, chatAgentRoutes, chatEndpointLeases, chatSdkState, chatEndpointOwners, chatSenderRules, chatScheduledWakes, chatOwnerApprovalRequests, chatOutboundMessages, chatOwnerApprovalBubbles, chatOwnerGrants, chatAuditEntries;
 var init_chat_channels3 = __esm({
   "../packages/db/src/schema/chat_channels.ts"() {
     "use strict";
     init_agents();
     init_companies();
+    init_heartbeat_runs();
     init_issue_comments();
+    init_issue_thread_interactions();
     init_issues();
     init_tool_access3();
     chatEndpoints = pgTable60(
@@ -23784,6 +24258,9 @@ var init_chat_channels3 = __esm({
           proactiveDirectMessages: false
         }),
         setup: jsonb42("setup").$type().notNull().default({ step: "provider_setup" }),
+        policy: jsonb42("policy").$type().notNull().default({}),
+        policyRevision: integer24("policy_revision").notNull().default(0),
+        inflightMode: text64("inflight_mode").$type().notNull().default("queue"),
         healthMessage: text64("health_message"),
         lastEventAt: timestamp61("last_event_at", { withTimezone: true }),
         lastPublicationAt: timestamp61("last_publication_at", { withTimezone: true }),
@@ -23799,7 +24276,15 @@ var init_chat_channels3 = __esm({
         check3("chat_endpoints_email_policy_check", sql18`${table.provider} <> 'agentmail' or (${table.publicationMode} = 'explicit' and ${table.externalExecutionPolicy} = 'agent')`),
         check3(
           "chat_endpoints_provider_check",
-          sql18`${table.provider} in ('slack', 'github', 'discord', 'microsoft-teams', 'telegram', 'agentmail', 'imessage-photon')`
+          sql18`${table.provider} in ('slack', 'github', 'discord', 'microsoft-teams', 'telegram', 'agentmail', 'imessage-photon', 'openwa')`
+        ),
+        check3(
+          "chat_endpoints_inflight_mode_check",
+          sql18`${table.inflightMode} in ('steer', 'queue')`
+        ),
+        check3(
+          "chat_endpoints_policy_revision_check",
+          sql18`${table.policyRevision} >= 0`
         ),
         check3(
           "chat_endpoints_status_check",
@@ -23835,6 +24320,8 @@ var init_chat_channels3 = __esm({
         // where concurrent setup in two guilds could otherwise claim that bot for
         // two Paperclip agents after both application-level prechecks passed.
         uniqueIndex42("chat_endpoints_photon_number_uq").on(table.botExternalId).where(sql18`${table.provider} = 'imessage-photon' and ${table.status} <> 'archived' and ${table.botExternalId} is not null`),
+        uniqueIndex42("chat_endpoints_openwa_account_uq").on(table.providerAccountId).where(sql18`${table.provider} = 'openwa' and ${table.status} <> 'archived' and ${table.providerAccountId} is not null`),
+        uniqueIndex42("chat_endpoints_openwa_number_uq").on(table.botExternalId).where(sql18`${table.provider} = 'openwa' and ${table.status} <> 'archived' and ${table.botExternalId} is not null`),
         uniqueIndex42("chat_endpoints_live_discord_bot_external_uq").on(table.provider, table.botExternalId).where(
           sql18`${table.provider} = 'discord'
           and ${table.status} in ('verifying', 'active', 'paused', 'attention')
@@ -23885,6 +24372,7 @@ var init_chat_channels3 = __esm({
         availability: text64("availability").$type().notNull().default("available"),
         enabled: boolean9("enabled").notNull().default(false),
         metadata: jsonb42("metadata").$type().notNull().default({}),
+        settings: jsonb42("settings").$type().notNull().default({}),
         createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
         updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
       },
@@ -23926,6 +24414,7 @@ var init_chat_channels3 = __esm({
         handle: text64("handle"),
         avatarUrl: text64("avatar_url"),
         isBot: boolean9("is_bot").notNull().default(false),
+        alternateExternalIds: text64("alternate_external_ids").array().notNull().default(sql18`'{}'::text[]`),
         lastSeenAt: timestamp61("last_seen_at", { withTimezone: true }),
         createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
         updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -23933,7 +24422,7 @@ var init_chat_channels3 = __esm({
       (table) => [
         check3(
           "chat_external_principals_provider_check",
-          sql18`${table.provider} in ('slack', 'github', 'discord', 'microsoft-teams', 'telegram', 'agentmail', 'imessage-photon')`
+          sql18`${table.provider} in ('slack', 'github', 'discord', 'microsoft-teams', 'telegram', 'agentmail', 'imessage-photon', 'openwa')`
         ),
         check3(
           "chat_external_principals_kind_check",
@@ -23981,6 +24470,7 @@ var init_chat_channels3 = __esm({
           table.endpointId,
           table.principalId
         ),
+        unique7("chat_identity_links_company_id_uq").on(table.companyId, table.id),
         foreignKey2({
           columns: [table.companyId, table.endpointId],
           foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
@@ -24081,6 +24571,9 @@ var init_chat_channels3 = __esm({
         attempts: integer24("attempts").notNull().default(0),
         redactedError: text64("redacted_error"),
         nextAttemptAt: timestamp61("next_attempt_at", { withTimezone: true }),
+        triggerClass: text64("trigger_class").$type(),
+        principalRole: text64("principal_role").$type(),
+        answerState: text64("answer_state").$type(),
         receivedAt: timestamp61("received_at", { withTimezone: true }).notNull().defaultNow(),
         processedAt: timestamp61("processed_at", { withTimezone: true }),
         createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -24091,7 +24584,20 @@ var init_chat_channels3 = __esm({
           "chat_deliveries_state_check",
           sql18`${table.state} in ('received', 'filtered', 'processing', 'processed', 'retry', 'failed')`
         ),
+        check3(
+          "chat_deliveries_trigger_class_check",
+          sql18`${table.triggerClass} is null or ${table.triggerClass} in ('owner', 'other', 'grant')`
+        ),
+        check3(
+          "chat_deliveries_principal_role_check",
+          sql18`${table.principalRole} is null or ${table.principalRole} in ('owner', 'allowed', 'outside_allowlist', 'denylisted')`
+        ),
+        check3(
+          "chat_deliveries_answer_state_check",
+          sql18`${table.answerState} is null or ${table.answerState} in ('pending', 'answered', 'silenced', 'handed_off')`
+        ),
         index53("chat_deliveries_work_idx").on(table.state, table.nextAttemptAt),
+        index53("chat_deliveries_pending_answer_idx").on(table.endpointId, table.conversationId, table.receivedAt).where(sql18`${table.answerState} = 'pending'`),
         unique7("chat_deliveries_company_id_uq").on(table.companyId, table.id),
         uniqueIndex42("chat_deliveries_event_uq").on(
           table.endpointId,
@@ -24372,6 +24878,391 @@ var init_chat_channels3 = __esm({
         }).onDelete("cascade")
       ]
     );
+    chatEndpointOwners = pgTable60(
+      "chat_endpoint_owners",
+      {
+        id: uuid59("id").primaryKey().defaultRandom(),
+        companyId: uuid59("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+        endpointId: uuid59("endpoint_id").notNull(),
+        identityLinkId: uuid59("identity_link_id").notNull(),
+        addedByUserId: text64("added_by_user_id"),
+        createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        uniqueIndex42("chat_endpoint_owners_link_uq").on(
+          table.endpointId,
+          table.identityLinkId
+        ),
+        unique7("chat_endpoint_owners_company_id_uq").on(table.companyId, table.id),
+        foreignKey2({
+          columns: [table.companyId, table.endpointId],
+          foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
+          name: "chat_endpoint_owners_company_endpoint_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.identityLinkId],
+          foreignColumns: [chatIdentityLinks.companyId, chatIdentityLinks.id],
+          name: "chat_endpoint_owners_company_identity_link_fk"
+        }).onDelete("cascade")
+      ]
+    );
+    chatSenderRules = pgTable60(
+      "chat_sender_rules",
+      {
+        id: uuid59("id").primaryKey().defaultRandom(),
+        companyId: uuid59("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+        endpointId: uuid59("endpoint_id").notNull(),
+        list: text64("list").$type().notNull(),
+        e164: text64("e164").notNull(),
+        label: text64("label"),
+        createdByUserId: text64("created_by_user_id"),
+        createdByPrincipalId: uuid59("created_by_principal_id").references(
+          () => chatExternalPrincipals.id,
+          { onDelete: "set null" }
+        ),
+        createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        check3("chat_sender_rules_list_check", sql18`${table.list} in ('allow', 'deny')`),
+        check3("chat_sender_rules_e164_check", sql18`${table.e164} ~ '^[+][1-9][0-9]{6,14}$'`),
+        uniqueIndex42("chat_sender_rules_entry_uq").on(
+          table.endpointId,
+          table.list,
+          table.e164
+        ),
+        foreignKey2({
+          columns: [table.companyId, table.endpointId],
+          foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
+          name: "chat_sender_rules_company_endpoint_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.createdByPrincipalId],
+          foreignColumns: [chatExternalPrincipals.companyId, chatExternalPrincipals.id],
+          name: "chat_sender_rules_company_principal_fk"
+        })
+      ]
+    );
+    chatScheduledWakes = pgTable60(
+      "chat_scheduled_wakes",
+      {
+        id: uuid59("id").primaryKey().defaultRandom(),
+        companyId: uuid59("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+        endpointId: uuid59("endpoint_id").notNull(),
+        chatKey: text64("chat_key").notNull(),
+        kind: text64("kind").$type().notNull(),
+        fireAt: timestamp61("fire_at", { withTimezone: true }).notNull(),
+        state: text64("state").$type().notNull().default("pending"),
+        relatedId: uuid59("related_id"),
+        payload: jsonb42("payload").$type().notNull().default({}),
+        createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        check3(
+          "chat_scheduled_wakes_kind_check",
+          sql18`${table.kind} in ('owner_absent', 'approval_reminder')`
+        ),
+        check3(
+          "chat_scheduled_wakes_state_check",
+          sql18`${table.state} in ('pending', 'fired', 'cancelled')`
+        ),
+        index53("chat_scheduled_wakes_pending_fire_idx").on(table.fireAt).where(sql18`${table.state} = 'pending'`),
+        uniqueIndex42("chat_scheduled_wakes_pending_absent_uq").on(table.endpointId, table.chatKey).where(sql18`${table.kind} = 'owner_absent' and ${table.state} = 'pending'`),
+        foreignKey2({
+          columns: [table.companyId, table.endpointId],
+          foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
+          name: "chat_scheduled_wakes_company_endpoint_fk"
+        }).onDelete("cascade")
+      ]
+    );
+    chatOwnerApprovalRequests = pgTable60(
+      "chat_owner_approval_requests",
+      {
+        id: uuid59("id").primaryKey().defaultRandom(),
+        companyId: uuid59("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+        endpointId: uuid59("endpoint_id").notNull(),
+        originChatKey: text64("origin_chat_key").notNull(),
+        originConversationId: uuid59("origin_conversation_id").references(
+          () => chatConversations.id,
+          { onDelete: "set null" }
+        ),
+        interactionId: uuid59("interaction_id").references(
+          () => issueThreadInteractions.id,
+          { onDelete: "set null" }
+        ),
+        requestedByPrincipalId: uuid59("requested_by_principal_id").references(
+          () => chatExternalPrincipals.id,
+          { onDelete: "set null" }
+        ),
+        requestedInRunId: uuid59("requested_in_run_id").references(
+          () => heartbeatRuns.id,
+          { onDelete: "set null" }
+        ),
+        categories: text64("categories").array().$type().notNull(),
+        scope: text64("scope").$type().notNull(),
+        summary: text64("summary").notNull(),
+        proposedAction: text64("proposed_action").notNull(),
+        status: text64("status").$type().notNull().default("pending"),
+        reminderCount: integer24("reminder_count").notNull().default(0),
+        resolvedVia: text64("resolved_via").$type(),
+        resolvedByUserId: text64("resolved_by_user_id"),
+        ownerText: text64("owner_text"),
+        agentConditions: text64("agent_conditions"),
+        resolvedAt: timestamp61("resolved_at", { withTimezone: true }),
+        createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        check3(
+          "chat_owner_approval_requests_categories_check",
+          sql18`cardinality(${table.categories}) > 0 and ${table.categories} <@ array['create_task', 'external_tools', 'cross_chat_send', 'wa_admin', 'gateway_admin', 'reply_outside_allowlist', 'reply']::text[]`
+        ),
+        check3(
+          "chat_owner_approval_requests_scope_check",
+          sql18`${table.scope} in ('one_action', 'requester')`
+        ),
+        check3(
+          "chat_owner_approval_requests_status_check",
+          sql18`${table.status} in ('pending', 'approved', 'rejected', 'cancelled')`
+        ),
+        check3(
+          "chat_owner_approval_requests_resolved_via_check",
+          sql18`${table.resolvedVia} is null or ${table.resolvedVia} in ('whatsapp', 'paperclip')`
+        ),
+        check3(
+          "chat_owner_approval_requests_reminder_count_check",
+          sql18`${table.reminderCount} >= 0`
+        ),
+        index53("chat_owner_approval_requests_status_idx").on(
+          table.endpointId,
+          table.status
+        ),
+        unique7("chat_owner_approval_requests_company_id_uq").on(
+          table.companyId,
+          table.id
+        ),
+        foreignKey2({
+          columns: [table.companyId, table.endpointId],
+          foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
+          name: "chat_owner_approval_requests_company_endpoint_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.originConversationId],
+          foreignColumns: [chatConversations.companyId, chatConversations.id],
+          name: "chat_owner_approval_requests_company_conversation_fk"
+        }),
+        foreignKey2({
+          columns: [table.companyId, table.requestedByPrincipalId],
+          foreignColumns: [chatExternalPrincipals.companyId, chatExternalPrincipals.id],
+          name: "chat_owner_approval_requests_company_principal_fk"
+        })
+      ]
+    );
+    chatOutboundMessages = pgTable60(
+      "chat_outbound_messages",
+      {
+        id: uuid59("id").primaryKey().defaultRandom(),
+        companyId: uuid59("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+        endpointId: uuid59("endpoint_id").notNull(),
+        chatKey: text64("chat_key").notNull(),
+        source: text64("source").$type().notNull(),
+        runId: uuid59("run_id").references(() => heartbeatRuns.id, {
+          onDelete: "set null"
+        }),
+        providerMessageId: text64("provider_message_id"),
+        state: text64("state").$type().notNull().default("pending"),
+        bodyHash: text64("body_hash").notNull(),
+        clientNonce: text64("client_nonce").notNull(),
+        sentAt: timestamp61("sent_at", { withTimezone: true }),
+        createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        check3(
+          "chat_outbound_messages_source_check",
+          sql18`${table.source} in ('tool', 'publication', 'approval')`
+        ),
+        check3(
+          "chat_outbound_messages_state_check",
+          sql18`${table.state} in ('pending', 'sent', 'uncertain', 'failed')`
+        ),
+        uniqueIndex42("chat_outbound_messages_provider_message_uq").on(table.endpointId, table.providerMessageId).where(sql18`${table.providerMessageId} is not null`),
+        index53("chat_outbound_messages_chat_state_idx").on(
+          table.endpointId,
+          table.chatKey,
+          table.state
+        ),
+        index53("chat_outbound_messages_sent_at_idx").on(
+          table.endpointId,
+          table.sentAt
+        ),
+        unique7("chat_outbound_messages_company_id_uq").on(table.companyId, table.id),
+        foreignKey2({
+          columns: [table.companyId, table.endpointId],
+          foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
+          name: "chat_outbound_messages_company_endpoint_fk"
+        }).onDelete("cascade")
+      ]
+    );
+    chatOwnerApprovalBubbles = pgTable60(
+      "chat_owner_approval_bubbles",
+      {
+        id: uuid59("id").primaryKey().defaultRandom(),
+        companyId: uuid59("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+        endpointId: uuid59("endpoint_id").notNull(),
+        requestId: uuid59("request_id").notNull(),
+        ownerId: uuid59("owner_id").notNull(),
+        outboundMessageId: uuid59("outbound_message_id").notNull(),
+        createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        uniqueIndex42("chat_owner_approval_bubbles_outbound_uq").on(
+          table.endpointId,
+          table.outboundMessageId
+        ),
+        index53("chat_owner_approval_bubbles_request_idx").on(table.requestId),
+        foreignKey2({
+          columns: [table.companyId, table.endpointId],
+          foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
+          name: "chat_owner_approval_bubbles_company_endpoint_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.requestId],
+          foreignColumns: [chatOwnerApprovalRequests.companyId, chatOwnerApprovalRequests.id],
+          name: "chat_owner_approval_bubbles_company_request_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.ownerId],
+          foreignColumns: [chatEndpointOwners.companyId, chatEndpointOwners.id],
+          name: "chat_owner_approval_bubbles_company_owner_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.outboundMessageId],
+          foreignColumns: [chatOutboundMessages.companyId, chatOutboundMessages.id],
+          name: "chat_owner_approval_bubbles_company_outbound_fk"
+        }).onDelete("cascade")
+      ]
+    );
+    chatOwnerGrants = pgTable60(
+      "chat_owner_grants",
+      {
+        id: uuid59("id").primaryKey().defaultRandom(),
+        companyId: uuid59("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+        endpointId: uuid59("endpoint_id").notNull(),
+        requestId: uuid59("request_id").notNull(),
+        originChatKey: text64("origin_chat_key").notNull(),
+        requesterPrincipalId: uuid59("requester_principal_id").references(
+          () => chatExternalPrincipals.id,
+          { onDelete: "set null" }
+        ),
+        category: text64("category").$type().notNull(),
+        scope: text64("scope").$type().notNull(),
+        status: text64("status").$type().notNull().default("live"),
+        approvedByUserId: text64("approved_by_user_id"),
+        approvedVia: text64("approved_via").$type().notNull(),
+        expiresAt: timestamp61("expires_at", { withTimezone: true }).notNull(),
+        consumedAt: timestamp61("consumed_at", { withTimezone: true }),
+        consumedByRunId: uuid59("consumed_by_run_id").references(
+          () => heartbeatRuns.id,
+          { onDelete: "set null" }
+        ),
+        createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        check3(
+          "chat_owner_grants_category_check",
+          sql18`${table.category} in ('create_task', 'external_tools', 'cross_chat_send', 'wa_admin', 'gateway_admin', 'reply_outside_allowlist', 'reply')`
+        ),
+        check3(
+          "chat_owner_grants_scope_check",
+          sql18`${table.scope} in ('one_action', 'requester')`
+        ),
+        check3(
+          "chat_owner_grants_status_check",
+          sql18`${table.status} in ('live', 'consumed', 'revoked', 'expired')`
+        ),
+        check3(
+          "chat_owner_grants_approved_via_check",
+          sql18`${table.approvedVia} in ('whatsapp', 'paperclip')`
+        ),
+        index53("chat_owner_grants_lookup_idx").on(
+          table.endpointId,
+          table.originChatKey,
+          table.requesterPrincipalId,
+          table.status
+        ),
+        index53("chat_owner_grants_request_idx").on(table.requestId),
+        foreignKey2({
+          columns: [table.companyId, table.endpointId],
+          foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
+          name: "chat_owner_grants_company_endpoint_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.requestId],
+          foreignColumns: [chatOwnerApprovalRequests.companyId, chatOwnerApprovalRequests.id],
+          name: "chat_owner_grants_company_request_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.requesterPrincipalId],
+          foreignColumns: [chatExternalPrincipals.companyId, chatExternalPrincipals.id],
+          name: "chat_owner_grants_company_principal_fk"
+        })
+      ]
+    );
+    chatAuditEntries = pgTable60(
+      "chat_audit_entries",
+      {
+        id: uuid59("id").primaryKey().defaultRandom(),
+        companyId: uuid59("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+        endpointId: uuid59("endpoint_id").notNull(),
+        conversationId: uuid59("conversation_id").references(
+          () => chatConversations.id,
+          { onDelete: "set null" }
+        ),
+        chatKey: text64("chat_key"),
+        kind: text64("kind").$type().notNull(),
+        actorKind: text64("actor_kind").$type().notNull(),
+        actorRef: text64("actor_ref"),
+        runId: uuid59("run_id").references(() => heartbeatRuns.id, {
+          onDelete: "set null"
+        }),
+        metadata: jsonb42("metadata").$type().notNull().default({}),
+        content: jsonb42("content").$type(),
+        contentPurgeAt: timestamp61("content_purge_at", { withTimezone: true }),
+        occurredAt: timestamp61("occurred_at", { withTimezone: true }).notNull().defaultNow(),
+        createdAt: timestamp61("created_at", { withTimezone: true }).notNull().defaultNow(),
+        updatedAt: timestamp61("updated_at", { withTimezone: true }).notNull().defaultNow()
+      },
+      (table) => [
+        check3(
+          "chat_audit_entries_kind_check",
+          sql18`${table.kind} in ('trigger_admitted', 'trigger_filtered', 'message_sent', 'publication_suppressed', 'tool_called', 'approval_requested', 'approval_reminded', 'approval_resolved', 'approval_cancelled', 'config_changed', 'group_added', 'group_left', 'session_health')`
+        ),
+        check3(
+          "chat_audit_entries_actor_kind_check",
+          sql18`${table.actorKind} in ('user', 'agent', 'chat_principal', 'system')`
+        ),
+        index53("chat_audit_entries_endpoint_occurred_idx").on(
+          table.endpointId,
+          table.occurredAt.desc()
+        ),
+        index53("chat_audit_entries_content_purge_idx").on(table.contentPurgeAt).where(sql18`${table.content} is not null`),
+        foreignKey2({
+          columns: [table.companyId, table.endpointId],
+          foreignColumns: [chatEndpoints.companyId, chatEndpoints.id],
+          name: "chat_audit_entries_company_endpoint_fk"
+        }).onDelete("cascade"),
+        foreignKey2({
+          columns: [table.companyId, table.conversationId],
+          foreignColumns: [chatConversations.companyId, chatConversations.id],
+          name: "chat_audit_entries_company_conversation_fk"
+        })
+      ]
+    );
   }
 });
 
@@ -29452,10 +30343,12 @@ __export(schema_exports, {
   cases: () => cases,
   chatActions: () => chatActions,
   chatAgentRoutes: () => chatAgentRoutes,
+  chatAuditEntries: () => chatAuditEntries,
   chatConversations: () => chatConversations,
   chatDeliveries: () => chatDeliveries,
   chatDiscordCommandOwners: () => chatDiscordCommandOwners,
   chatEndpointLeases: () => chatEndpointLeases,
+  chatEndpointOwners: () => chatEndpointOwners,
   chatEndpointResources: () => chatEndpointResources,
   chatEndpoints: () => chatEndpoints,
   chatExternalPrincipals: () => chatExternalPrincipals,
@@ -29464,8 +30357,14 @@ __export(schema_exports, {
   chatGitHubReviews: () => chatGitHubReviews,
   chatIdentityLinks: () => chatIdentityLinks,
   chatMessageLinks: () => chatMessageLinks,
+  chatOutboundMessages: () => chatOutboundMessages,
+  chatOwnerApprovalBubbles: () => chatOwnerApprovalBubbles,
+  chatOwnerApprovalRequests: () => chatOwnerApprovalRequests,
+  chatOwnerGrants: () => chatOwnerGrants,
   chatPublications: () => chatPublications,
+  chatScheduledWakes: () => chatScheduledWakes,
   chatSdkState: () => chatSdkState,
+  chatSenderRules: () => chatSenderRules,
   chatTeamsFileTransfers: () => chatTeamsFileTransfers,
   chatTelegramDraftIds: () => chatTelegramDraftIds,
   cliAuthChallenges: () => cliAuthChallenges,
@@ -37443,10 +38342,12 @@ __export(src_exports, {
   cases: () => cases,
   chatActions: () => chatActions,
   chatAgentRoutes: () => chatAgentRoutes,
+  chatAuditEntries: () => chatAuditEntries,
   chatConversations: () => chatConversations,
   chatDeliveries: () => chatDeliveries,
   chatDiscordCommandOwners: () => chatDiscordCommandOwners,
   chatEndpointLeases: () => chatEndpointLeases,
+  chatEndpointOwners: () => chatEndpointOwners,
   chatEndpointResources: () => chatEndpointResources,
   chatEndpoints: () => chatEndpoints,
   chatExternalPrincipals: () => chatExternalPrincipals,
@@ -37455,8 +38356,14 @@ __export(src_exports, {
   chatGitHubReviews: () => chatGitHubReviews,
   chatIdentityLinks: () => chatIdentityLinks,
   chatMessageLinks: () => chatMessageLinks,
+  chatOutboundMessages: () => chatOutboundMessages,
+  chatOwnerApprovalBubbles: () => chatOwnerApprovalBubbles,
+  chatOwnerApprovalRequests: () => chatOwnerApprovalRequests,
+  chatOwnerGrants: () => chatOwnerGrants,
   chatPublications: () => chatPublications,
+  chatScheduledWakes: () => chatScheduledWakes,
   chatSdkState: () => chatSdkState,
+  chatSenderRules: () => chatSenderRules,
   chatTeamsFileTransfers: () => chatTeamsFileTransfers,
   chatTelegramDraftIds: () => chatTelegramDraftIds,
   cliAuthChallenges: () => cliAuthChallenges,
@@ -41416,10 +42323,10 @@ function detectInstallMode(executablePath = process.argv[1] ?? "", paths = resol
   const normalized = resolved.split(path26.sep).join("/");
   if (normalized.includes("/.npm/_npx/") || normalized.includes("/node_modules/.cache/npx/")) return "npx";
   if (normalized.includes("/node_modules/@tickernelz/paperclip-pro/")) return "global-npm";
-  let cursor2 = path26.dirname(resolved);
-  while (cursor2 !== path26.dirname(cursor2)) {
-    if (fs22.existsSync(path26.join(cursor2, ".git"))) return "source";
-    cursor2 = path26.dirname(cursor2);
+  let cursor3 = path26.dirname(resolved);
+  while (cursor3 !== path26.dirname(cursor3)) {
+    if (fs22.existsSync(path26.join(cursor3, ".git"))) return "source";
+    cursor3 = path26.dirname(cursor3);
   }
   return "unknown";
 }
@@ -49051,7 +49958,7 @@ function printToolCallEventTopLevel(parsed) {
   console.log(pc20.yellow(`tool_call: ${toolName}${subtype ? ` (${subtype})` : ""}`));
 }
 function printLegacyToolEvent(part) {
-  const tool2 = asString4(part.tool, "tool");
+  const tool3 = asString4(part.tool, "tool");
   const callId = asString4(part.callID, asString4(part.id, ""));
   const state = asRecord2(part.state);
   const status = asString4(state?.status);
@@ -49060,7 +49967,7 @@ function printLegacyToolEvent(part) {
   const metadata = asRecord2(state?.metadata);
   const exit = asNumber3(metadata?.exit, NaN);
   const isError = status === "failed" || status === "error" || status === "cancelled" || Number.isFinite(exit) && exit !== 0;
-  console.log(pc20.yellow(`tool_call: ${tool2}${callId ? ` (${callId})` : ""}`));
+  console.log(pc20.yellow(`tool_call: ${tool3}${callId ? ` (${callId})` : ""}`));
   if (input2 !== void 0) {
     try {
       console.log(pc20.gray(JSON.stringify(input2, null, 2)));
@@ -49804,13 +50711,13 @@ function printOpenCodeStreamEvent(raw, _debug) {
   }
   if (type === "tool_use") {
     const part = asRecord7(parsed.part);
-    const tool2 = asString9(part?.tool, "tool");
+    const tool3 = asString9(part?.tool, "tool");
     const callID = asString9(part?.callID);
     const state = asRecord7(part?.state);
     const status = asString9(state?.status);
     const isError = status === "error";
     const metadata = asRecord7(state?.metadata);
-    console.log(pc26.yellow(`tool_call: ${tool2}${callID ? ` (${callID})` : ""}`));
+    console.log(pc26.yellow(`tool_call: ${tool3}${callID ? ` (${callID})` : ""}`));
     if (status) {
       const metaParts = [`status=${status}`];
       if (metadata) {
@@ -50023,9 +50930,9 @@ function balancedObjectEnd(line, start) {
 function salvageRedactedEvents(line) {
   if (!line.includes(REDACTED_LOG_MARKER)) return [];
   const events = [];
-  let cursor2 = line.indexOf(REDACTED_LOG_MARKER);
-  while (cursor2 >= 0 && events.length < SALVAGE_MAX_EVENTS) {
-    const start = line.indexOf(SALVAGE_EVENT_PREFIX, cursor2 + REDACTED_LOG_MARKER.length);
+  let cursor3 = line.indexOf(REDACTED_LOG_MARKER);
+  while (cursor3 >= 0 && events.length < SALVAGE_MAX_EVENTS) {
+    const start = line.indexOf(SALVAGE_EVENT_PREFIX, cursor3 + REDACTED_LOG_MARKER.length);
     if (start < 0) break;
     const end = balancedObjectEnd(line, start);
     if (end > start) {
@@ -50036,7 +50943,7 @@ function salvageRedactedEvents(line) {
         break;
       }
     }
-    cursor2 = line.indexOf(REDACTED_LOG_MARKER, start);
+    cursor3 = line.indexOf(REDACTED_LOG_MARKER, start);
   }
   return events;
 }
@@ -51729,7 +52636,7 @@ import * as p21 from "@clack/prompts";
 import pc34 from "picocolors";
 
 // ../packages/shared/src/company-import-transfer.ts
-import { z as z69 } from "zod";
+import { z as z70 } from "zod";
 var COMPANY_IMPORT_TRANSFERS_ROUTE_PATH = "/import/transfers";
 var COMPANY_IMPORT_TRANSFERS_API_PATH = `/api/companies${COMPANY_IMPORT_TRANSFERS_ROUTE_PATH}`;
 function companyImportTransferPath(transferId) {
@@ -51746,16 +52653,16 @@ function companyImportTransferApplyPath(transferId) {
 }
 var COMPANY_IMPORT_TRANSFER_MAX_PARTS = 4096;
 var SHA256_HEX_RE = /^[0-9a-f]{64}$/;
-var companyImportTransferDeclaredPartSchema = z69.object({
-  index: z69.number().int().min(0),
-  byteSize: z69.number().int().min(1),
-  sha256: z69.string().regex(SHA256_HEX_RE, "sha256 must be 64 lowercase hex characters").describe("sha256 of this part, 64 lowercase hex characters")
+var companyImportTransferDeclaredPartSchema = z70.object({
+  index: z70.number().int().min(0),
+  byteSize: z70.number().int().min(1),
+  sha256: z70.string().regex(SHA256_HEX_RE, "sha256 must be 64 lowercase hex characters").describe("sha256 of this part, 64 lowercase hex characters")
 });
-var companyImportTransferDeclarationSchema = z69.object({
-  totalBytes: z69.number().int().min(1),
-  zipSha256: z69.string().regex(SHA256_HEX_RE, "sha256 must be 64 lowercase hex characters").describe("sha256 of the whole .zip, 64 lowercase hex characters"),
-  partSizeBytes: z69.number().int().min(1),
-  parts: z69.array(companyImportTransferDeclaredPartSchema).min(1).max(COMPANY_IMPORT_TRANSFER_MAX_PARTS)
+var companyImportTransferDeclarationSchema = z70.object({
+  totalBytes: z70.number().int().min(1),
+  zipSha256: z70.string().regex(SHA256_HEX_RE, "sha256 must be 64 lowercase hex characters").describe("sha256 of the whole .zip, 64 lowercase hex characters"),
+  partSizeBytes: z70.number().int().min(1),
+  parts: z70.array(companyImportTransferDeclaredPartSchema).min(1).max(COMPANY_IMPORT_TRANSFER_MAX_PARTS)
 });
 function buildAlreadyImportedMessage(company) {
   const location = company ? ` The earlier import landed in the company "${company.name ?? company.id}"${company.issuePrefix ? ` (${company.issuePrefix})` : ""} \u2014 open it from the company switcher.` : "";
@@ -51810,23 +52717,23 @@ function validateCentralDirectory(bytes, eocdOffset, localHeaderCount) {
     );
   }
   const directoryEnd = centralDirectoryStart + centralDirectorySize;
-  let cursor2 = centralDirectoryStart;
+  let cursor3 = centralDirectoryStart;
   let recordCount = 0;
-  while (cursor2 < directoryEnd) {
-    if (cursor2 + 46 > directoryEnd || readUint32(bytes, cursor2) !== CENTRAL_DIRECTORY_SIGNATURE) {
+  while (cursor3 < directoryEnd) {
+    if (cursor3 + 46 > directoryEnd || readUint32(bytes, cursor3) !== CENTRAL_DIRECTORY_SIGNATURE) {
       throw new Error("Invalid zip archive: malformed central directory record.");
     }
-    const fileNameLength = readUint16(bytes, cursor2 + 28);
-    const extraFieldLength = readUint16(bytes, cursor2 + 30);
-    const commentLength = readUint16(bytes, cursor2 + 32);
-    const localHeaderOffset = readUint32(bytes, cursor2 + 42);
+    const fileNameLength = readUint16(bytes, cursor3 + 28);
+    const extraFieldLength = readUint16(bytes, cursor3 + 30);
+    const commentLength = readUint16(bytes, cursor3 + 32);
+    const localHeaderOffset = readUint32(bytes, cursor3 + 42);
     if (localHeaderOffset + 4 > bytes.length || readUint32(bytes, localHeaderOffset) !== LOCAL_FILE_SIGNATURE) {
       throw new Error("Invalid zip archive: central directory references a missing local entry.");
     }
-    cursor2 += 46 + fileNameLength + extraFieldLength + commentLength;
+    cursor3 += 46 + fileNameLength + extraFieldLength + commentLength;
     recordCount += 1;
   }
-  if (cursor2 !== directoryEnd) {
+  if (cursor3 !== directoryEnd) {
     throw new Error("Invalid zip archive: central directory size does not match its records.");
   }
   if (recordCount !== declaredEntryCount || recordCount !== localHeaderCount) {
@@ -54937,9 +55844,9 @@ function kimiSkillsHome() {
   const base = fromEnv && fromEnv.length > 0 ? fromEnv : path41.join(os10.homedir(), ".kimi-code");
   return path41.join(base, "skills");
 }
-async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool2) {
+async function installSkillsForTarget(sourceSkillsDir, targetSkillsDir, tool3) {
   const summary = {
-    tool: tool2,
+    tool: tool3,
     target: targetSkillsDir,
     linked: [],
     removed: [],