@wildo-ai/platform-core-shared 1.1.5 → 1.1.7

package/dist/esm/workbench/workbench-creation-plane.custom.shared.schemas.js

@@ -1,6 +1,8 @@
-import { MetaWorkflow_EvaluationVerdict } from '@wildo-ai/saas-models/meta-workflows';
+import { MetaWorkflow_ClarificationAction, MetaWorkflow_EvaluationVerdict } from '@wildo-ai/saas-models/meta-workflows';
+import { EngineCapability, } from '@wildo-ai/saas-models';
 import { z } from 'zod';
-import { initZodDecorators } from '@wildo-ai/zod-decorators';
+import { initZodDecorators, StringEditMode } from '@wildo-ai/zod-decorators';
+import { WorkbenchSpecificationArtifactConcern } from './workbench-resources.custom.shared.schemas.js';
 initZodDecorators(z);
 /**
  * The CREATION PLANE's shared vocabulary — schemas for the four companion-runtime resource
@@ -63,6 +65,8 @@ export var WorkbenchCreationPlaneBehavior;
     WorkbenchCreationPlaneBehavior["HOME_LINES"] = "creation-plane.home-lines";
     /** The four creation OUTCOMES with their standing, derived from the landed families and the build plan. */
     WorkbenchCreationPlaneBehavior["CREATION_OUTCOMES"] = "creation-plane.creation-outcomes";
+    /** The application's provider secrets per environment — what it needs and what is set, never a value (#1637). */
+    WorkbenchCreationPlaneBehavior["APPLICATION_SECRETS"] = "creation-plane.application-secrets";
 })(WorkbenchCreationPlaneBehavior || (WorkbenchCreationPlaneBehavior = {}));
 /** Membership test the companion's source routes by. */
 export const WORKBENCH_CREATION_PLANE_BEHAVIOR_IDS = Object.freeze(Object.values(WorkbenchCreationPlaneBehavior));
@@ -81,6 +85,21 @@ export const WORKBENCH_CREATION_PLANE_BEHAVIOR_IDS = Object.freeze(Object.values
 export function sanitizeWorkbenchCreationPlaneIdentity(value) {
     return value.replaceAll('.', '__').replace(/[^a-zA-Z0-9_-]/g, '-');
 }
+/**
+ * A dossier row's id — `sanitize(playbookRef)--sanitize(questionRef)` for the step itself, and
+ * `sanitize(playbookRef)--<instanceKey>--sanitize(questionRef)` for one of its INSTANCES (#1609).
+ *
+ * Shared for the same reason the sanitizer is: the companion's projection EMITS the id and the
+ * conversation's answer tool ADDRESSES a row by it, and two copies would let the two drift apart the
+ * first time the shape changed — which is exactly what adding an instance did. An instance key is a
+ * kebab slug, so it needs no sanitizing and cannot contain the `--` separator's ambiguity in a way the
+ * question ref does not already (both are refused as duplicates by the projection, never guessed at).
+ */
+export function workbenchDossierEntryIdentity(input) {
+    const step = sanitizeWorkbenchCreationPlaneIdentity(input.playbookRef);
+    const question = sanitizeWorkbenchCreationPlaneIdentity(input.questionRef);
+    return input.instanceKey ? `${step}--${input.instanceKey}--${question}` : `${step}--${question}`;
+}
 /**
  * The creation plane's CORRELATION VOCABULARY on the engine's actor task — the one named source for
  * the `context.correlation` envelope's domain and ref keys (#1348, #1330).
@@ -279,6 +298,23 @@ export const Workbench_Playbook_Schema = z.object({
         family: z.string().min(1),
         changedInputs: z.array(z.string()),
     })).isSummaryField(),
+    /**
+     * Whether the application's LINE runs this playbook at all (#1607): true when it is in the line's active
+     * set. Distinct from `eligible`, which asks whether an active playbook may run RIGHT NOW. Absent when the
+     * board was computed without a line.
+     */
+    activeInLine: z.boolean().optional().isSummaryField(),
+    /**
+     * Why it is, or is not, in the active set — one sentence, already rendered by the runtime, like `unmet`:
+     * in the line, outside it, producing only what does not apply, or waiting for the line to be declared.
+     * A sentence rather than the status value because this package does not import the vocabulary.
+     */
+    activationDetail: z.string().optional().isSummaryField(),
+    /**
+     * The instances of this playbook the creator opened and has not closed (#1609): each one's key and what it
+     * is for. The default instance is not listed; it is the playbook itself. Absent without a line.
+     */
+    openInstances: z.array(z.object({ instanceKey: z.string().min(1), purpose: z.string().min(1) })).optional().isSummaryField(),
     /** When the served board was computed — the cache's honesty field, rendered as "as of". */
     computedAt: z.date().isSummaryField(),
 });
@@ -402,6 +438,18 @@ export var WorkbenchDossierEntryStanding;
     WorkbenchDossierEntryStanding["FROM_YOU"] = "from-you";
     /** The playbook asks it and nobody has answered. */
     WorkbenchDossierEntryStanding["STILL_NEEDED"] = "still-needed";
+    /**
+     * An opened INSTANCE of the step asks it and has no answer of its own, so it runs on the step's own
+     * answer (#1609). Answered, not needed: nothing is blocked, and an answer given here replaces the
+     * step's for this instance only.
+     */
+    WorkbenchDossierEntryStanding["FROM_THE_STEP"] = "from-the-step";
+    /**
+     * The PRODUCT answers it: a governed-document fact the application's own declarations establish,
+     * read rather than asked (#1454, gap 4; `compliance-is-derived-from-the-product.md`). Never
+     * "needed" and never editable here — its answer changes when what the product declares changes.
+     */
+    WorkbenchDossierEntryStanding["READ_FROM_PRODUCT"] = "read-from-product";
 })(WorkbenchDossierEntryStanding || (WorkbenchDossierEntryStanding = {}));
 export const Workbench_GovernanceDocument_Schema = z.object({
     /** The document's ref, sanitized — a definition ref carries `:` and `.`. */
@@ -492,7 +540,9 @@ export var WorkbenchPlaybooks_Operations;
     /** Answer a run that stopped at a clarification — accept with answers, decline, or cancel. */
     WorkbenchPlaybooks_Operations["RESUME"] = "resume_run";
     /**
-     * The interview this playbook declares, as a decision payload — `null` when it asks nothing. Read
+     * The questions this playbook still needs answered, as a decision payload — the declared interview
+     * minus what the dossier already answers (shared decisions included), and `null` when nothing is left
+     * to ask: the step declares none, or the dossier answers them all (#1454 review). Read
      * ON DEMAND, at the moment somebody chooses to run it, and deliberately not a field of the row: one
      * playbook alone declares fifteen questions, so carrying them on every row would pay for all of
      * them on every poll in order to show none of them.
@@ -563,12 +613,22 @@ export const Workbench_PlaybookRunRequest_Schema = z.object({
     })).optional(),
     /** Full pipe — generation, validation, rendering, judge — with NO filesystem writes. */
     dryRun: z.boolean().optional(),
+    /**
+     * The opened INSTANCE to run (#1609); omitted runs the step itself. An instance nobody opened is refused,
+     * and its pre-answers are filed as that instance's answers, never the step's.
+     */
+    instanceKey: z.string().min(1).optional(),
 });
 export const Workbench_PlaybookResumeRequest_Schema = z.object({
     /** The suspended run being answered — the handle `run` returned when it stopped to ask. */
     runId: z.string().min(1),
-    /** `accept` (requires ≥1 answer), `decline`, or `cancel` — the industry three-action model. */
-    action: z.string().min(1),
+    /**
+     * WHICH round of its questions this answers, declines or cancels — the waiting row's `round` (#1584). A
+     * run asks again after an answer under the same `runId`; a round it has moved past is refused 409.
+     */
+    round: z.number().int().min(1),
+    /** ACCEPT (every question answered), DECLINE (the rest delegated) or CANCEL — see `MetaWorkflow_ClarificationAction` (#1785). */
+    action: z.enum(MetaWorkflow_ClarificationAction),
     answers: z.array(z.object({
         ref: z.string().min(1),
         answer: z.string().min(1),
@@ -611,6 +671,21 @@ export const Workbench_RunWriteRevertRequest_Schema = z.object({
     /** Overwrite files edited since the run. NOT defaulted on — a human edit is never silently destroyed. */
     force: z.boolean().optional(),
 });
+/**
+ * What a playbook run's answer says about the run, when it says anything (#1781). Absent on a run that
+ * concluded, or on a detached submission that is still going.
+ *
+ * One named home for a vocabulary the companion writes and several readers compare — the run record,
+ * the clarification lifecycle, the resume route, and the workbench's summary of a RESUME, which used
+ * to read every answer carrying a `runId` as "Started", a cancelled clarification included.
+ */
+export var Workbench_PlaybookRunOutcomeStatus;
+(function (Workbench_PlaybookRunOutcomeStatus) {
+    /** Healthy, and waiting at a clarification: the run asked the creator something and holds until answered. */
+    Workbench_PlaybookRunOutcomeStatus["AWAITING_CREATOR_INPUT"] = "awaiting_creator_input";
+    /** The creator cancelled a clarification: the run was abandoned and does not continue. */
+    Workbench_PlaybookRunOutcomeStatus["CANCELLED"] = "cancelled";
+})(Workbench_PlaybookRunOutcomeStatus || (Workbench_PlaybookRunOutcomeStatus = {}));
 /**
  * Dispatch RESPONSES are LOOSE objects, deliberately: each names the fields the board branches on
  * and forwards the rest verbatim. The companion routes already spread the whole service result, and
@@ -619,8 +694,7 @@ export const Workbench_RunWriteRevertRequest_Schema = z.object({
  */
 export const Workbench_PlaybookRunOutcome_Schema = z.looseObject({
     runId: z.string().optional(),
-    /** Present exactly when the run is HEALTHY and waiting at a clarification. */
-    status: z.string().optional(),
+    status: z.enum(Workbench_PlaybookRunOutcomeStatus).optional(),
     note: z.string().optional(),
 });
 export const Workbench_BuildPlanDispatchOutcome_Schema = z.looseObject({
@@ -648,6 +722,11 @@ export const Workbench_RunWriteRevertOutcome_Schema = z.looseObject({
     reverted: z.array(z.string()).optional(),
     /** Files whose current bytes differ from what the run wrote — refused by name, revertable with force. */
     refusedDiverged: z.array(z.string()).optional(),
+    /**
+     * Files a LATER recorded run landed on (#1614): refused even under force, because the earlier bytes
+     * would destroy that run's work. Each names the run to revert first (#1666).
+     */
+    refusedLaterRun: z.array(z.object({ path: z.string(), runId: z.string() })).optional(),
     note: z.string().optional(),
 });
 /**
@@ -748,6 +827,12 @@ export const Workbench_BuildDispatch_Schema = z.object({
     workbenchBuildDispatchId: z.string().min(1).isPrimaryKey().isSummaryField(),
     /** The build-plan task this attempt ran. */
     taskRef: z.string().min(1).isSummaryField(),
+    /**
+     * What the task delivers, in its own sentence — joined from the plan by `taskRef` so a card, a pane
+     * title and a Home line name the run by what it does rather than by its key (#1454, gap 1). NULL when
+     * the plan no longer holds the task (a plan re-decomposed since): the ref is then the only name.
+     */
+    objective: z.string().min(1).isSummaryField().nullable(),
     /**
      * How the attempt ended, or that it has not.
      *
@@ -801,12 +886,12 @@ export const Workbench_BuildDispatch_Schema = z.object({
  * the presence of. Naming the state makes that explicit and makes the row renderable by one layout.
  *
  * The distinction that matters most is RUNNING vs RUNNING_DETACHED, and it is not cosmetic: the
- * first is the CHOREOGRAPHY single-flight marker and is null for every ordinary run, so a board that
- * read it alone reported "nothing is running" while a fifteen-minute run was in flight.
+ * first is a composite holding its instance's single-flight subject and never an ordinary run, so a board
+ * that read it alone reported "nothing is running" while a fifteen-minute run was in flight.
  */
 export var Workbench_PlaybookRunState;
 (function (Workbench_PlaybookRunState) {
-    /** The composite choreography's single-flight marker — at most one, and null for an ordinary run. */
+    /** A composite holding its instance's single-flight subject (#1610): one per running instance, several at once, never an ordinary run. */
     Workbench_PlaybookRunState["RUNNING"] = "running";
     /** An ordinary run this companion process is executing right now. */
     Workbench_PlaybookRunState["RUNNING_DETACHED"] = "running_detached";
@@ -834,12 +919,18 @@ export const Workbench_PlaybookRun_Schema = z.object({
     /** The row's own id, sanitized — run ids carry dots (see the playbook id note). */
     workbenchPlaybookRunId: z.string().min(1).isPrimaryKey().isSummaryField(),
     /**
-     * The run id as the companion records it. NULL for the RUNNING marker and for an INTERRUPTED
-     * entry, neither of which the companion identifies by run — they are known by their playbook.
+     * The run id as the companion records it. NULL only for an INTERRUPTED entry, which the companion
+     * knows by the checkpoint it left (its playbook and instance), not by a run.
      */
     runId: z.string().min(1).isSummaryField().nullable(),
     /** The playbook this run is of. Every state has one; it is how a run is known. */
     playbookRef: z.string().min(1).isSummaryField(),
+    /**
+     * The playbook INSTANCE this run is of (#1609), or null for a run of the step itself. Two instances of
+     * one playbook run and settle side by side, so a reader telling runs apart by playbook alone would show
+     * one instance's outcome as the other's.
+     */
+    instanceKey: z.string().min(1).isSummaryField().nullable(),
     /**
      * The execution-trace session the run recorded under, as the companion RECORDED it at run time.
      * NULL when the request carried no session, and for the RUNNING and INTERRUPTED states.
@@ -950,6 +1041,12 @@ export const Workbench_WaitingPlaybookRun_Schema = z.object({
         /** The closed answer set, when the question has one. */
         options: z.array(z.string().min(1)),
     })).isSummaryField(),
+    /**
+     * The signed-in person the question is ROUTED to (#1751): whoever started the run from the workbench or
+     * the conversation. Only they may answer it; anybody else is refused as if nothing waited. NULL when the
+     * question is unrouted (a run started from the console) or the checkpoint could not be read.
+     */
+    routedToUserId: z.string().min(1).isSummaryField().nullable(),
 });
 /**
  * One coding run PARKED on a question.
@@ -985,6 +1082,24 @@ export const Workbench_CodingLaneStatus_Schema = z.object({
     workbenchCodingLaneStatusId: z.string().min(1).isPrimaryKey().isSummaryField(),
     /** Every declared coding agent resolves in the registry. NOT a claim that the transport works. */
     codingAgentRegistered: z.boolean().isSummaryField(),
+    /**
+     * The coding agent this host dispatches to (a provider ref: `anthropic`, `openai`, `opencode`).
+     * NULL when the selection cannot be resolved (#1637).
+     */
+    codingAgentProviderRef: z.string().min(1).isSummaryField().nullable(),
+    /**
+     * Whether that agent's operator is signed in on this host, read from the agent's own status command
+     * without a model call — what `codingAgentRegistered` cannot say: a registered agent with no login
+     * fails every run on its first prompt. `false` means a definite "not signed in" — the one state a
+     * dispatch refuses on. NULL when the state could not be read, and when the agent's status command is not
+     * installed: the Claude and Codex agents run through adapters that do not need it, so its absence says
+     * nothing about the login; {@link codingAgentLoginRemedy} then names the install (#1637).
+     */
+    codingAgentSignedIn: z.boolean().isSummaryField().nullable(),
+    /** What the status command reported, in one line. NULL when nothing was read. */
+    codingAgentLoginDetail: z.string().nullable(),
+    /** What to do when the agent is not signed in — the login or install command. NULL when nothing is owed. */
+    codingAgentLoginRemedy: z.string().nullable(),
     /**
      * The durable actor-task row of the run in flight — the edge from this lane into the control
      * plane, which is why it is a foreign key rather than a printed id. NULL when none is running,
@@ -1045,6 +1160,12 @@ export const Workbench_ParkedCodingQuestion_Schema = z.object({
      * before answering rather than after.
      */
     resumable: z.boolean().isSummaryField(),
+    /**
+     * WHICH of the run's questions this row shows — opaque, echoed back by an answer (#1581, eighth review).
+     * A run may ask again after an answer, under the same task id, so the task id alone cannot say which
+     * question a person was looking at when they typed; an answer carrying this continues only that one.
+     */
+    suspensionRef: z.string().min(1),
 });
 /**
  * One dossier entry: a question a playbook declares, and what the creator said to it, if anything.
@@ -1055,10 +1176,18 @@ export const Workbench_ParkedCodingQuestion_Schema = z.object({
  * surface can ASK it without a second read.
  */
 export const Workbench_DossierEntry_Schema = z.object({
-    /** EMITTED BY THE BEHAVIOR: `sanitize(playbookRef)--sanitize(questionRef)`. */
+    /** EMITTED BY THE BEHAVIOR through `workbenchDossierEntryIdentity`. */
     workbenchDossierEntryId: z.string().min(1).isPrimaryKey().isSummaryField(),
     playbookRef: z.string().min(1).isSummaryField(),
     questionRef: z.string().min(1).isSummaryField(),
+    /**
+     * The INSTANCE of the step this question is asked for (#1609), or null for the step itself. An opened
+     * instance asks its own questions, so the same question appears once per instance; an instance that
+     * has not answered one falls back to the step's own answer when it runs.
+     */
+    instanceKey: z.string().nullable().isSummaryField(),
+    /** What the instance was opened FOR, in the creator's words; null for the step itself. */
+    instancePurpose: z.string().nullable().isSummaryField(),
     /** The authored question, verbatim from the playbook. */
     question: z.string().min(1).isSummaryField(),
     /**
@@ -1090,6 +1219,32 @@ export const Workbench_DossierEntry_Schema = z.object({
      * derived before the answer changed reads as stale on its playbook.
      */
     affectsFamilies: z.array(z.string()).isSummaryField(),
+    /**
+     * WHAT THE QUESTION IS ABOUT, on the axis the artifact list groups families by (#1454, gap 4): the
+     * concern of the family the asking step produces — or, for a step that produces none, of the first
+     * family its answer reaches. The dossier groups by it, so a creator reads "why it exists", "how it
+     * gets built" and "what it must promise" rather than three lists organised by machinery.
+     */
+    subject: z.enum(WorkbenchSpecificationArtifactConcern).systemEnum('WorkbenchSpecificationArtifactConcern').isSummaryField(),
+    /**
+     * OUT OF DATE: answered, and a step READING this answer made its result before one of the answers it
+     * reads changed (its stale outputs list `creator-inputs`; #1454, gap 4 and its review). Derived from `outOfDateStepRefs` (non-empty), and
+     * kept as its own boolean because it is what the row's badge and a list filter ask.
+     */
+    outOfDate: z.boolean().isSummaryField(),
+    /**
+     * WHICH steps are out of date for this answer: the asking step and every step sharing the decision
+     * (`sharedWithPlaybookRefs`) with a stale output whose changed inputs include `creator-inputs`. A shared decision is ONE row,
+     * so "Regenerate" has to name the step it reruns; before this carried the refs, a change to a shared
+     * answer marked and reran only the owner (#1454 review, LOW).
+     */
+    outOfDateStepRefs: z.array(z.string()).isSummaryField(),
+    /**
+     * The other steps that READ this decision (a `sameDecisionAs` fallback with no answer of its own,
+     * #1454 review). One decision is one row, at its owner; those steps' interviews show and answer it,
+     * so it is asked once.
+     */
+    sharedWithPlaybookRefs: z.array(z.string()).isSummaryField(),
 });
 /** The dossier resource's one write verb. */
 export var WorkbenchDossierEntries_Operations;
@@ -1380,19 +1535,26 @@ export var WorkbenchParkedCodingQuestions_Operations;
     /** Answer THIS parked run and resume the same agent session. A WRITE: it re-enters a workspace-mutating run behind the worktree lock. */
     WorkbenchParkedCodingQuestions_Operations["ANSWER"] = "answer";
     /**
-     * End the coding run that is active — collection-level, because there is ONE coding lane and one
-     * active run; the parked row is where an operator meets the decision, not what identifies the run.
+     * End THIS parked run. Per row since #1581 (seventh review): with waves (#1528) several runs may be
+     * live, and a collection-level cancel ended whatever this process drove — doing nothing for a park
+     * no chain held, and stopping other runs while this one stayed parked.
      */
     WorkbenchParkedCodingQuestions_Operations["CANCEL"] = "cancel";
 })(WorkbenchParkedCodingQuestions_Operations || (WorkbenchParkedCodingQuestions_Operations = {}));
 export const Workbench_ParkedQuestionAnswerRequest_Schema = z.object({
     /** The answer, in the operator's words. Empty is refused by the lane with its own sentence. */
     answer: z.string(),
+    /** The row's `suspensionRef`: the question this answers. Refused (409) once the run has asked another. */
+    suspensionRef: z.string().min(1),
 });
 /** The lane's admission of the resumed run — its own shape, carried loosely. */
 export const Workbench_ParkedQuestionAnswerOutcome_Schema = z.looseObject({});
+/**
+ * The row's `cancel` answers ONLY a run it ended or signalled: a run that moved on meanwhile is a 409 the
+ * gate shows, never a `cancelled: false` read as success (#1581, eleventh and twelfth reviews).
+ */
 export const Workbench_CodingRunCancelOutcome_Schema = z.looseObject({
-    cancelled: z.boolean(),
+    cancelled: z.literal(true),
 });
 /**
  * The governed document's one verb: LAND the facts a person established for it as the
@@ -1434,4 +1596,203 @@ export const Workbench_GovernanceFactsLandingOutcome_Schema = z.object({
     existedBefore: z.boolean(),
     wiringAlreadyInPlace: z.array(z.string()),
 });
+/**
+ * Where one secret stands for an application in one environment (#1637).
+ *
+ * The ONE vocabulary for `wildo secrets list`, the creation essentials of `wildo init`/`setup` and
+ * the workbench's secrets section, so the three cannot disagree about what "needed" means. Derived
+ * from what the application declares (the providers it scopes, the capabilities it enables, its systems
+ * of record and inbound endpoints), never from the provider catalogue.
+ */
+export var ApplicationSecretStanding;
+(function (ApplicationSecretStanding) {
+    /**
+     * Required by something the application uses, unset, and nothing else covers what it is for: a
+     * capability, a provider the application scoped on purpose, a system of record or an inbound endpoint
+     * cannot work until it is provided.
+     */
+    ApplicationSecretStanding["NEEDED"] = "needed";
+    /** It has a value in this environment, and something reads it. */
+    ApplicationSecretStanding["SET"] = "set";
+    /** Unset, and nothing waits for it: an optional key, or a capability another provider already serves. */
+    ApplicationSecretStanding["AVAILABLE"] = "available";
+    /**
+     * It has a value, and nothing CONSUMES it: a provider key no provider declares, a system-of-record key
+     * naming no declared instance or no slot its credential has, an inbound key naming no endpoint. It is
+     * listed to be REMOVED — the one verb it offers. Usually the remains of something renamed or retired
+     * (Odoo was a provider before it was a system of record).
+     *
+     * Unconsumed is not undelivered: the dev companion's `.env` carries EVERY provider key, and the backend
+     * receives a well-formed inbound name or a slot of a declared instance. So a row says which runtimes still
+     * receive it, and removing it regenerates their `.env` files like any other change — otherwise the value
+     * would stay on disk and in the running process after the person was told it was gone.
+     */
+    ApplicationSecretStanding["UNUSED"] = "unused";
+})(ApplicationSecretStanding || (ApplicationSecretStanding = {}));
+/**
+ * What a secret belongs to, and so which section of `secrets.json` holds it and how its name is formed.
+ * Three kinds because they are three different things, not three spellings of a provider key: a system of
+ * record is deliberately NOT a provider (#1049 D10) and an inbound endpoint secret proves a delivery rather
+ * than authenticating a call.
+ */
+export var ApplicationSecretKind;
+(function (ApplicationSecretKind) {
+    /** A provider's secret, declared by its secrets contract; `secrets.json` → `providerEnv`. */
+    ApplicationSecretKind["PROVIDER"] = "provider";
+    /**
+     * A credential slot of a declared system of record (#1055), named `WILDO_SOR_<NAME>__<SLOT>`;
+     * `secrets.json` → `systemsOfRecordEnv`. Read by the application backend only.
+     */
+    ApplicationSecretKind["SYSTEM_OF_RECORD"] = "system_of_record";
+    /**
+     * The verification secret of an application inbound endpoint (#1596), named
+     * `WILDO_INBOUND_<ENDPOINT_KEY>__SECRET`; `secrets.json` → `inboundEndpointEnv`. Read by the backend only.
+     */
+    ApplicationSecretKind["INBOUND_ENDPOINT"] = "inbound_endpoint";
+})(ApplicationSecretKind || (ApplicationSecretKind = {}));
+/**
+ * Which GitHub level holds a REMOTE environment's provider secret. Remote secrets are GitHub Actions
+ * secrets; the generated deploy job declares `environment: <env>`, so an environment secret applies to
+ * that environment alone and overrides a repository secret of the same name, which is the fallback.
+ * spec-cite: https://docs.github.com/en/actions/reference/security/secrets — "If an organization, repository, and environment all have a secret with the same name, the environment-level secret takes precedence."
+ */
+export var ApplicationSecretRemoteLevel;
+(function (ApplicationSecretRemoteLevel) {
+    ApplicationSecretRemoteLevel["ENVIRONMENT"] = "environment";
+    ApplicationSecretRemoteLevel["REPOSITORY"] = "repository";
+})(ApplicationSecretRemoteLevel || (ApplicationSecretRemoteLevel = {}));
+/**
+ * Joins the parts of a secret row's id. The separator must be something an environment id and a kind cannot
+ * contain, so the id splits back on its first two occurrences. Environment ids are `^[a-z0-9]+(?:-[a-z0-9]+)*$`
+ * (`WildoEnvironmentIdSchema`), and no {@link ApplicationSecretKind} value contains `--`.
+ */
+const APPLICATION_SECRET_ROW_ID_SEPARATOR = '--';
+const APPLICATION_SECRET_KIND_VALUES = new Set(Object.values(ApplicationSecretKind));
+/**
+ * The `id` of one secret row: environment, kind and name (`local--provider--OPENAI_API_KEY`). The same name is
+ * a different secret per environment, and per KIND too — each kind is its own `secrets.json` section, so a
+ * key left in the wrong section during a migration (an Odoo credential still in `providerEnv`) is a second
+ * secret beside the one that belongs, and must be addressable on its own rather than colliding with it.
+ *
+ * The id travels in the URL of the row's page and of its `set` / `unset` operations, and the engine checks
+ * it before any handler runs (`ExecutionContextCreator.validateParameterFormat`). It was
+ * `<environment>::<NAME>` until 2026-09-26: the list rendered, but the row's page and both operations
+ * answered `400 api_call_initiator_parameter_unsupported`, because that check then held every id to
+ * `^[a-zA-Z0-9_-]+$`. Since #2048 it holds an introspected row's id to the introspection format, which admits
+ * more; this id stays inside the narrower alphabet anyway, so it is valid under both, and
+ * `workbench-application-secret-row-id.test.ts` pins that.
+ */
+export function applicationSecretRowId(envName, kind, envVarName) {
+    return [envName, kind, envVarName].join(APPLICATION_SECRET_ROW_ID_SEPARATOR);
+}
+/**
+ * Splits a secret row's id back into environment, kind and name, or `null` when it cannot be a row id. It
+ * splits on the first two separators — neither the environment nor the kind can contain one — and the name
+ * keeps any it has. A well-formed id naming nothing real is refused later by `wildo secrets`, which states
+ * the reason itself.
+ */
+export function splitApplicationSecretRowId(rowId) {
+    const first = rowId.indexOf(APPLICATION_SECRET_ROW_ID_SEPARATOR);
+    if (first <= 0)
+        return null;
+    const kindStart = first + APPLICATION_SECRET_ROW_ID_SEPARATOR.length;
+    const second = rowId.indexOf(APPLICATION_SECRET_ROW_ID_SEPARATOR, kindStart);
+    if (second <= kindStart)
+        return null;
+    const kind = rowId.slice(kindStart, second);
+    const envVarName = rowId.slice(second + APPLICATION_SECRET_ROW_ID_SEPARATOR.length);
+    if (!APPLICATION_SECRET_KIND_VALUES.has(kind) || envVarName.length === 0)
+        return null;
+    return { envName: rowId.slice(0, first), kind: kind, envVarName };
+}
+/**
+ * One secret an application declares a use for (or still holds), in one environment — the workbench's
+ * secrets section. Names and standings only: a value never enters this row, in either direction of the wire.
+ */
+export const Workbench_ApplicationSecret_Schema = z.object({
+    /**
+     * `<environment>--<kind>--<NAME>` — see {@link applicationSecretRowId}. A SUMMARY field like every other
+     * workbench row's key: the list is read in summary mode, and a card whose row carries no id cannot open its
+     * row — which is where `set` and `unset` live (#1637).
+     */
+    workbenchApplicationSecretId: z.string().min(1).isPrimaryKey().isSummaryField(),
+    /** The environment this row describes (`local`, or a remote environment's name). */
+    environmentName: z.string().min(1).isSummaryField(),
+    /** The environment variable the runtime reads — the key in the `secrets.json` section its {@link kind} names. */
+    envVarName: z.string().min(1).isSummaryField(),
+    /** Where it stands: needed, set, available, or unused. */
+    standing: z.enum(ApplicationSecretStanding).systemEnum('ApplicationSecretStanding').isSummaryField(),
+    /** What it belongs to: a provider, a system of record, or an inbound endpoint. */
+    kind: z.enum(ApplicationSecretKind).systemEnum('ApplicationSecretKind').isSummaryField(),
+    /**
+     * WHICH one, in the vocabulary of its {@link kind}: the provider ref, the system-of-record instance name,
+     * or the inbound endpoint key. NULL only for an {@link ApplicationSecretStanding.UNUSED} key that names
+     * no owner: a provider key no provider declares, or a system-of-record or inbound name that does not parse.
+     */
+    ownerRef: z.string().min(1).nullable().isSummaryField(),
+    /** Its owner's own description of it, when it has one. */
+    description: z.string().nullable(),
+    /** The enabled capabilities a provider serves for this application — why the secret is needed. Empty for the other kinds. */
+    capabilities: z.array(z.enum(EngineCapability).systemEnum('EngineCapability')),
+    /**
+     * The runtimes that RECEIVE it in their environment — the ones a change regenerates and restarts: `backend`,
+     * `companion`, `minions.<key>`, `workers.<key>`, `frontendServices.<key>`. For an UNUSED key this is where it
+     * is still carried, never where it is used.
+     */
+    runtimes: z.array(z.string()),
+    /** The companion's LLM key — the one secret `wildo init`/`setup` ask for, because the creation chat runs on it. */
+    creationEssential: z.boolean(),
+    /** Remote only: which GitHub level holds it. NULL locally, and NULL for a remote secret that is not set. */
+    remoteLevel: z.enum(ApplicationSecretRemoteLevel).systemEnum('ApplicationSecretRemoteLevel').nullable(),
+});
+/** The secret row's two verbs. Both run `wildo secrets set/unset`, which is the only writer of a secret. */
+export var WorkbenchApplicationSecrets_Operations;
+(function (WorkbenchApplicationSecrets_Operations) {
+    /**
+     * Provide THIS secret's value. Locally the runtimes that read it restart to pick it up; remotely it
+     * becomes the GitHub Environment secret the deploy reads.
+     */
+    WorkbenchApplicationSecrets_Operations["SET"] = "set";
+    /** Remove THIS secret from its environment. */
+    WorkbenchApplicationSecrets_Operations["UNSET"] = "unset";
+})(WorkbenchApplicationSecrets_Operations || (WorkbenchApplicationSecrets_Operations = {}));
+export const Workbench_ApplicationSecretSetRequest_Schema = z.object({
+    /**
+     * The value. Never returned, never logged, never stored by the companion: `.isWriteOnlySecret()` masks
+     * it in every RESPONSE, so once saved nothing shows it again.
+     *
+     * Entered in a multi-line box, visible while typed, as GitHub's own secret form does. Decided by
+     * practice rather than taste, and measured against the two alternatives:
+     * - A masked (`type=password`) input was tried first. It is single-line, so a pasted key file lost its
+     *   line breaks, and a browser treats it as a login: Chrome ignores `autocomplete="off"` on password
+     *   fields and still autofills or offers to save into `new-password` ones, so a provider key could be
+     *   saved as a localhost password or a saved one filled in unseen. The vocabulary has no `off` token.
+     * - A single-line text input strips newlines from a paste too (HTML value sanitization).
+     * The box preserves what was pasted, and a person can check a paste before saving it.
+     */
+    value: z.string().min(1).stringUI({ edit: { editMode: StringEditMode.TEXTAREA } }).isWriteOnlySecret(),
+});
+/**
+ * What a change did — the shape `wildo secrets set/unset --json` prints (#1637). The local fields are
+ * inert for a remote environment, whose change is the GitHub secret itself.
+ */
+export const Workbench_ApplicationSecretChangeOutcome_Schema = z.object({
+    envVarName: z.string(),
+    /** Which section the change was made in — with the name and the environment, the secret's identity. */
+    kind: z.enum(ApplicationSecretKind).systemEnum('ApplicationSecretKind'),
+    envName: z.string(),
+    /** Local: the runtimes a LIVE `wildo local dev` supervisor was asked to restart to read the change. */
+    restartSignalledRuntimes: z.array(z.string()),
+    /** Local: whether the runtimes' `.env` files were regenerated. */
+    envFilesRegenerated: z.boolean(),
+    /** Local: why the `.env` files were not regenerated, with the command to run; null when they were. */
+    envFilesRegenerationFailure: z.string().nullable(),
+    /** Local: the companion reads this key and applies the change itself instead of restarting. */
+    companionAppliesChange: z.boolean(),
+    /**
+     * Set by the COMPANION (never by the CLI) when it could not apply the change in-process: the value is
+     * saved and reaches the companion at its next start. Absent when nothing failed.
+     */
+    companionApplyFailure: z.string().optional(),
+});
 //# sourceMappingURL=workbench-creation-plane.custom.shared.schemas.js.map