@work-shape/catalyst-api-contract 0.8.0-rc.6 → 0.8.0-rc.8

package/dist/index.js

@@ -10,7 +10,8 @@ import {
   IDEMPOTENCY_KEY_MAX_LENGTH,
   POLICY_VALUES,
   THEME_MODES,
-  WORKFLOW_RUN_STATUSES
+  WORKFLOW_RUN_STATUSES,
+  WORKFLOW_TEST_REVISIONS
 } from "@work-shape/catalyst-asset-schemas";
 import { z } from "zod";
 var APP_BRIDGE_MARK = "catalystBridge";
@@ -126,7 +127,23 @@ var appWorkflowRunSchema = z.strictObject({
   /** Why the run did not end `done`: a code and a sentence of the product. */
   error: z.strictObject({ code: z.string(), message: z.string() }).optional(),
   startedAt: z.string().optional(),
-  finishedAt: z.string().optional()
+  finishedAt: z.string().optional(),
+  /**
+   * `test` on a run a click in an App's draft started (DP-1): it ran in mode test, as the
+   * viewer bounded by the Workflow's principal, and nothing of it is live. Missing on a run of
+   * a published App.
+   */
+  mode: z.literal("test").optional(),
+  /**
+   * On a test run: the revision of the Workflow that ran, the draft or the published one, with
+   * its number where that revision is still the draft or the published one.
+   */
+  workflowRevision: z.strictObject({
+    kind: z.enum(WORKFLOW_TEST_REVISIONS),
+    number: z.number().int().positive().optional()
+  }).optional(),
+  /** On a test run: the steps whose calls were simulated, by step id. Their results are not real. */
+  simulatedSteps: z.array(z.string()).optional()
 });
 var callFailure = z.strictObject({
   /** `action_unknown`, `draft_safe_mode`, `forbidden`, `input_invalid` and so on. */
@@ -806,7 +823,7 @@ import { z as z46 } from "zod";
 // package.json
 var package_default = {
   name: "@work-shape/catalyst-api-contract",
-  version: "0.8.0-rc.6",
+  version: "0.8.0-rc.8",
   license: "MIT",
   repository: {
     type: "git",
@@ -1045,19 +1062,22 @@ var scheduledStartOperations = {
 };
 
 // src/operations/access.ts
-import { dataScopesSchema, scopeAssignmentInputSchema } from "@work-shape/catalyst-asset-schemas";
+import { dataScopesSchema as dataScopesSchema2, scopeAssignmentInputSchema as scopeAssignmentInputSchema2 } from "@work-shape/catalyst-asset-schemas";
 import { z as z11 } from "zod";
 
 // src/access.ts
 import {
   ACCESS_SOURCES,
+  APP_AUDIENCES,
   GRANT_EFFECTS,
   GRANT_HOLDER_KINDS,
   GRANT_SCOPE_KINDS,
   PRINCIPAL_HOLDER_KINDS as PRINCIPAL_HOLDER_KINDS2,
   ROLE_GRANT_SCOPE_KINDS,
   ROLE_PENDING_CHANGES,
-  ROLE_PENDING_DECISIONS
+  ROLE_PENDING_DECISIONS,
+  dataScopesSchema,
+  scopeAssignmentInputSchema
 } from "@work-shape/catalyst-asset-schemas";
 import { z as z10 } from "zod";
 var grantHolderKindSchema = z10.enum(GRANT_HOLDER_KINDS);
@@ -1107,23 +1127,87 @@ var effectivePermissionsQuerySchema = z10.object({
   holderKind: z10.enum(PRINCIPAL_HOLDER_KINDS2),
   holderId: storedText
 });
+var accessEntrySchema = z10.object({
+  action: z10.string(),
+  effect: grantEffectSchema,
+  scopeKind: grantScopeKindSchema,
+  scopeId: z10.string().optional(),
+  /**
+   * `membership`: held by being a member of the workspace the entry names, such as opening
+   * the published Apps of that workspace. A legacy permission list is grant rows since AP-4
+   * and reads as `grant`.
+   */
+  source: z10.enum(ACCESS_SOURCES),
+  /** The role the entry is held through, for the source `role`. */
+  roleId: z10.string().optional()
+});
 var effectivePermissionsSchema = z10.object({
   /** A holder that is not active holds nothing, whatever the entries say. */
   holderActive: z10.boolean(),
-  items: z10.array(
+  items: z10.array(accessEntrySchema)
+});
+var namedWorkspaceSchema = z10.object({ personal: z10.boolean(), name: z10.string().optional() });
+var namedPlaceSchema = z10.object({
+  scopeAsset: z10.object({
+    kind: z10.string(),
+    name: z10.string().optional(),
+    title: z10.string().optional(),
+    active: z10.boolean()
+  }).optional(),
+  scopeWorkspace: namedWorkspaceSchema.optional()
+});
+var rightConditionsSchema = z10.object({
+  availability: z10.enum(APP_AUDIENCES).optional(),
+  onlyInWorkspaces: z10.array(namedWorkspaceSchema).optional()
+});
+var accessOriginSchema = accessEntrySchema.omit({ action: true }).extend(namedPlaceSchema.shape);
+var accessOriginRoleSchema = z10.object({
+  id: z10.string(),
+  name: z10.string(),
+  builtIn: z10.boolean()
+});
+var REFUSAL_REASONS = ["denied", "no_grant", "holder_inactive"];
+var refusalReasonSchema = z10.enum(REFUSAL_REASONS);
+var ASSET_CHECK_VERBS = ["read", "use", "write", "delete"];
+var assetCheckVerbSchema = z10.enum(ASSET_CHECK_VERBS);
+var holderRightsSchema = z10.object({
+  holderActive: z10.boolean(),
+  /** Every role an origin names. */
+  roles: z10.array(accessOriginRoleSchema),
+  rights: z10.array(
     z10.object({
       action: z10.string(),
-      effect: grantEffectSchema,
       scopeKind: grantScopeKindSchema,
       scopeId: z10.string().optional(),
-      /**
-       * `membership`: held by being a member of the workspace the entry names, such as opening
-       * the published Apps of that workspace. A legacy permission list is grant rows since AP-4
-       * and reads as `grant`.
-       */
-      source: z10.enum(ACCESS_SOURCES),
-      /** The role the entry is held through, for the source `role`. */
-      roleId: z10.string().optional()
+      allowed: z10.boolean(),
+      /** For a right that is refused. */
+      reason: refusalReasonSchema.optional(),
+      grantedBy: z10.array(accessOriginSchema),
+      deniedBy: accessOriginSchema.optional()
+    }).extend(namedPlaceSchema.shape).extend(rightConditionsSchema.shape)
+  )
+});
+var assetRightsCheckQuerySchema = effectivePermissionsQuerySchema.extend({
+  /** A kind the instance registers. */
+  kind: storedText,
+  /**
+   * The asset, by the id its asset rows name. Left out for a name no asset and no row has:
+   * then only what holds on every asset of the kind decides.
+   */
+  assetId: storedText.optional()
+});
+var assetRightsCheckSchema = z10.object({
+  holderActive: z10.boolean(),
+  roles: z10.array(accessOriginRoleSchema),
+  actions: z10.array(
+    rightConditionsSchema.extend({
+      verb: assetCheckVerbSchema,
+      action: z10.string(),
+      allowed: z10.boolean(),
+      reason: refusalReasonSchema.optional(),
+      /** The covering deny that refuses, or the first covering allow. */
+      decidedBy: accessOriginSchema.optional(),
+      deniedThrough: assetCheckVerbSchema.optional()
     })
   )
 });
@@ -1186,6 +1270,19 @@ var updateWorkspaceBuildLimitsRequestSchema = z10.object({
   allowedToolNames: buildLimitListSchema.optional(),
   allowedModelBindingIds: buildLimitListSchema.optional()
 });
+var dataScopeValuesSchema = z10.union([z10.literal("all"), z10.array(z10.string())]);
+var scopeAssignmentsOverviewSchema = z10.object({
+  dimensions: dataScopesSchema,
+  assignments: z10.array(scopeAssignmentInputSchema),
+  people: z10.array(
+    z10.object({
+      id: z10.string(),
+      displayLabel: z10.string(),
+      groups: z10.array(z10.string()),
+      effective: z10.record(z10.string(), dataScopeValuesSchema)
+    })
+  )
+});
 
 // src/operations/access.ts
 var accessOperations = {
@@ -1199,17 +1296,31 @@ var accessOperations = {
     scope: "user_admin:read",
     requires: ["users.manage"],
     effect: "reading",
-    query: scopeAssignmentInputSchema.pick({ holderKind: true, holderId: true }),
+    query: scopeAssignmentInputSchema2.pick({ holderKind: true, holderId: true }),
     response: json(
       z11.object({
-        dimensions: dataScopesSchema,
-        assignments: z11.array(scopeAssignmentInputSchema),
+        dimensions: dataScopesSchema2,
+        assignments: z11.array(scopeAssignmentInputSchema2),
         effective: z11.record(z11.string(), z11.union([z11.literal("all"), z11.array(z11.string())])).optional()
       })
     ),
     errors: ["NOT_FOUND"],
     rateClass: "read"
   }),
+  "scope_assignments.overview": defineOperation({
+    id: "scope_assignments.overview",
+    method: "GET",
+    path: "/api/v1/instance/access/scope-assignments/overview",
+    summary: "Read the declared data scope, every assignment the reader may see, and each active person's groups and effective values",
+    tag: "Access",
+    auth: "user",
+    scope: "user_admin:read",
+    requires: ["users.manage"],
+    effect: "reading",
+    response: json(scopeAssignmentsOverviewSchema),
+    errors: [],
+    rateClass: "read"
+  }),
   "scope_assignments.set": defineRegisteredOperation({
     id: "scope_assignments.set",
     method: "PUT",
@@ -1220,8 +1331,8 @@ var accessOperations = {
     scope: "user_admin:write",
     requires: ["users.manage"],
     effect: "changing",
-    body: scopeAssignmentInputSchema,
-    response: json(scopeAssignmentInputSchema),
+    body: scopeAssignmentInputSchema2,
+    response: json(scopeAssignmentInputSchema2),
     errors: ["NOT_FOUND"],
     rateClass: "write"
   }),
@@ -1296,6 +1407,40 @@ var accessOperations = {
     errors: ["NOT_FOUND"],
     rateClass: "read"
   }),
+  "permissions.rights": defineOperation({
+    id: "permissions.rights",
+    method: "GET",
+    path: "/api/v1/instance/access/rights",
+    summary: "List what one holder holds and is refused, each right decided with where it comes from",
+    tag: "Access",
+    auth: "user",
+    scope: "user_admin:read",
+    // The read of `permissions.effective`: one's own, or another holder's behind the right
+    // to administer them. The handler checks it.
+    requires: [],
+    effect: "reading",
+    query: effectivePermissionsQuerySchema,
+    response: json(holderRightsSchema),
+    errors: ["NOT_FOUND"],
+    rateClass: "read"
+  }),
+  "permissions.check": defineOperation({
+    id: "permissions.check",
+    method: "GET",
+    path: "/api/v1/instance/access/check",
+    summary: "Decide what one holder may do with one asset, with the entry that decides each right",
+    tag: "Access",
+    auth: "user",
+    scope: "user_admin:read",
+    // The read of `permissions.effective`: one's own, or another holder's behind the right
+    // to administer them. The handler checks it.
+    requires: [],
+    effect: "reading",
+    query: assetRightsCheckQuerySchema,
+    response: json(assetRightsCheckSchema),
+    errors: ["NOT_FOUND"],
+    rateClass: "read"
+  }),
   "workspaces.limits.list": defineOperation({
     id: "workspaces.limits.list",
     method: "GET",
@@ -1354,6 +1499,7 @@ import {
   AUTH_PRINCIPAL_KINDS,
   DELETION_STATES,
   FIRST_PARTY_AUTH_SCOPES,
+  FOLLOW_UP_MODES,
   SERVICE_PRINCIPAL_PERMISSIONS,
   SERVICE_PRINCIPAL_STATUSES,
   USER_STATUSES
@@ -1404,6 +1550,12 @@ var apiUserSchema = z12.object({
   emailVerified: z12.boolean().optional(),
   /** The language the person chose. Left out, they get the instance's default language. */
   locale: localeCodeSchema.optional(),
+  /**
+   * What a message the person sends during their own run does: `steer` (the default) is read
+   * by the running turn, `queue` waits as the next turn. Left out where the answer names no
+   * record: `queue`.
+   */
+  followUpMode: z12.enum(FOLLOW_UP_MODES).optional(),
   /** An active instance admin a signed-in person can ask for help; no directory access needed. */
   instanceAdminName: z12.string().optional(),
   roles: z12.array(z12.string()),
@@ -1487,10 +1639,12 @@ var updateAdministeredUserRequestSchema = z12.object({
 });
 var updateCurrentUserRequestSchema = z12.object({
   displayLabel: z12.string().min(1).optional(),
-  locale: localeCodeSchema.nullable().optional()
-}).refine((body) => body.displayLabel !== void 0 || body.locale !== void 0, {
-  message: "Name displayLabel, locale or both"
-});
+  locale: localeCodeSchema.nullable().optional(),
+  followUpMode: z12.enum(FOLLOW_UP_MODES).optional()
+}).refine(
+  (body) => body.displayLabel !== void 0 || body.locale !== void 0 || body.followUpMode !== void 0,
+  { message: "Name displayLabel, locale, followUpMode or several" }
+);
 var changeCurrentUserPasswordRequestSchema = z12.object({
   currentPassword: z12.string().min(1),
   newPassword: z12.string().min(8)
@@ -2062,12 +2216,14 @@ import { z as z17 } from "zod";
 
 // src/assets.ts
 import {
-  APP_AUDIENCES,
+  AGENT_USE_SETTINGS,
+  APP_AUDIENCES as APP_AUDIENCES2,
   OPERATION_EFFECTS as OPERATION_EFFECTS3,
   WORKSPACE_USE_ASSET_KINDS,
   ASSET_ACCESS_VERBS,
   ASSET_NAME_REFUSAL_REASONS,
-  ASSET_SYNC_CHANGE_TYPES
+  ASSET_SYNC_CHANGE_TYPES,
+  operationSourceSchema
 } from "@work-shape/catalyst-asset-schemas";
 import { z as z15 } from "zod";
 var ASSET_SYNC_MAX_ITEMS = 200;
@@ -2083,6 +2239,7 @@ var assetScopeSchema = z15.discriminatedUnion("kind", [
   z15.object({ kind: z15.literal("workspace"), workspaceId: z15.string() })
 ]);
 var revisionNumberSchema = z15.number().int().positive();
+var APP_PUBLISH_WORKFLOWS_MAX = 20;
 var expectedRevisionSchema = revisionNumberSchema.optional();
 var expectedRevisionOrNewSchema = revisionNumberSchema.nullable().optional();
 var NUL = "\0";
@@ -2096,6 +2253,7 @@ var assetDefinitionSchema = configAssetConfigSchema.refine(
 );
 var workspaceIdSchema = nameText(z15.string().min(1)).optional();
 var isDefaultSchema = z15.literal(true).optional();
+var agentUseSchema = z15.enum(AGENT_USE_SETTINGS);
 var dependencyAvailabilitySchema = z15.object({
   /** The workspaces reviewed by the publisher; a later change must be read again. */
   availability: agentAvailabilitySchema.nullable().optional(),
@@ -2163,18 +2321,14 @@ var assetFileSchema = z15.object({
   text: z15.string().optional(),
   base64: z15.string().optional()
 });
-var appAudienceSchema = z15.enum(APP_AUDIENCES);
+var appAudienceSchema = z15.enum(APP_AUDIENCES2);
 var publishNarrativeSchema = z15.object({
   summary: z15.string(),
   /** Empty where no guardrail in force stops a step, and for an App. */
   warnings: z15.array(z15.string())
 });
 var saveApprovalSchema = z15.object({ approverNames: z15.array(z15.string()) });
-var workflowFactSourceSchema = z15.object({
-  kind: z15.enum(["connection", "data_store", "knowledge_base", "workflow", "other"]),
-  title: z15.string().optional(),
-  service: z15.string().optional()
-});
+var workflowFactSourceSchema = operationSourceSchema;
 var workflowOperationFactSchema = z15.object({
   source: workflowFactSourceSchema,
   title: z15.string().optional(),
@@ -2244,6 +2398,8 @@ var assetSchema = z15.object({
   availability: agentAvailabilitySchema.optional(),
   dependencyAvailability: dependencyAvailabilitySchema.optional(),
   canSetAvailability: z15.boolean().optional(),
+  /** Only on agent reads: who uses the agent where it is available (AGENT-USE-1). */
+  agentUse: agentUseSchema.optional(),
   /** Only on agent reads. The stored config stays intact; these references cannot run. */
   unavailableTools: z15.array(unavailableToolSchema).optional(),
   unavailableSkills: z15.array(unavailableSkillSchema).optional(),
@@ -2355,7 +2511,14 @@ var publishAssetRequestSchema = z15.object({
    * never means "whatever the draft is now". Naming an earlier number is the way back.
    */
   revision: revisionNumberSchema,
-  workspaceId: workspaceIdSchema
+  workspaceId: workspaceIdSchema,
+  /**
+   * Of an App only: the Workflow drafts this publish makes live with it (DP-3), each with the
+   * revision the person reviewed, as `apps.publish_review` lists the pending ones. Each must be
+   * a Workflow the App's revision reaches, directly or as a child. They are published children
+   * first and then the App, in one transaction: a refusal of any publishes none of them.
+   */
+  workflows: z15.array(z15.object({ name: z15.string().min(1), revision: revisionNumberSchema }).strict()).max(APP_PUBLISH_WORKFLOWS_MAX).optional()
 });
 var discardAssetDraftRequestSchema = z15.object({
   /** The draft revision the caller last read. Required. */
@@ -2366,7 +2529,16 @@ var assetPointersResponseSchema = z15.object({
   draftRevision: revisionNumberSchema,
   publishedRevision: revisionNumberSchema,
   /** The revision that was published before a publish, left out on the first one. */
-  replacedRevision: revisionNumberSchema.optional()
+  replacedRevision: revisionNumberSchema.optional(),
+  /** The Workflows a publish of an App made live with it, in the order they were published. */
+  publishedWith: z15.array(
+    z15.object({
+      kind: z15.literal("workflow"),
+      name: z15.string(),
+      publishedRevision: revisionNumberSchema,
+      replacedRevision: revisionNumberSchema.optional()
+    })
+  ).optional()
 });
 var LIVE_ONCE_PART_MAX_LENGTH = 200;
 var runLiveOnceRequestSchema = z15.object({
@@ -2588,7 +2760,7 @@ var assetPreconditionRequiredDetailsSchema = z15.object({
 // src/conversations.ts
 import {
   AGENT_PREVIEW_SOURCES,
-  FOLLOW_UP_MODES,
+  FOLLOW_UP_MODES as FOLLOW_UP_MODES2,
   FOLLOW_UP_STATUSES,
   TOOL_DECISION_MODES,
   TOOL_DECISION_OUTCOMES
@@ -2691,7 +2863,14 @@ var userMessageMetadataSchema = z16.object({
     revision: z16.number().int().positive(),
     source: z16.enum(AGENT_PREVIEW_SOURCES)
   }).optional(),
-  attachmentManifest: z16.unknown()
+  attachmentManifest: z16.unknown(),
+  /** Set on a message its person steered into their running turn (FU-2). */
+  steered: z16.object({
+    runId: z16.string(),
+    followUpId: z16.string(),
+    authorUserId: z16.string(),
+    typedAt: timestampSchema
+  }).optional()
 });
 var assistantToolCallsMessageMetadataSchema = z16.object({
   version: messageMetadataVersionSchema,
@@ -2996,6 +3175,20 @@ var agentRuntimeEventSchema = z16.discriminatedUnion("type", [
       metadata: z16.record(z16.string(), z16.unknown()).optional()
     })
   }),
+  z16.object({
+    type: z16.literal("user_message_steered"),
+    runId: z16.string(),
+    sequence: z16.number(),
+    createdAt: timestampSchema,
+    followUpId: z16.string(),
+    message: z16.object({
+      id: z16.string(),
+      role: z16.literal("user"),
+      text: z16.string(),
+      createdAt: timestampSchema,
+      metadata: z16.record(z16.string(), z16.unknown()).optional()
+    })
+  }),
   z16.object({
     type: z16.literal("tool_call_preparing"),
     runId: z16.string(),
@@ -3160,6 +3353,13 @@ var agentRunProjectionPartSchema = z16.discriminatedUnion("type", [
     text: z16.string(),
     open: z16.boolean()
   }),
+  z16.object({
+    /** A message the run's person steered into it, where the run took it in (FU-2). */
+    type: z16.literal("user_message"),
+    messageId: z16.string(),
+    text: z16.string(),
+    createdAt: timestampSchema
+  }),
   z16.object({
     type: z16.literal("tool_call"),
     toolCallId: z16.string(),
@@ -3246,7 +3446,7 @@ var conversationFollowUpSchema = z16.object({
   authorUserId: z16.string(),
   authorDisplayLabel: z16.string().optional(),
   text: z16.string(),
-  mode: z16.enum(FOLLOW_UP_MODES),
+  mode: z16.enum(FOLLOW_UP_MODES2),
   status: z16.enum(FOLLOW_UP_STATUSES),
   position: z16.number().int().positive(),
   agentName: z16.string(),
@@ -3261,8 +3461,8 @@ var queuedConversationRunResponseSchema = z16.object({
   followUp: conversationFollowUpSchema
 });
 var startConversationRunRequestSchema = z16.object({
-  followUp: z16.literal("queue").optional().describe(
-    "Queue the message when this conversation has an active run. Without this option, an active run still returns CONFLICT."
+  followUp: z16.enum(FOLLOW_UP_MODES2).optional().describe(
+    "What happens when this conversation has an active run. `queue` sends the message as the next turn. `steer` hands it to the running turn at its next step when the run is the caller's own under the same credential and the message has no attachments, and queues it otherwise. Without this option, an active run still returns CONFLICT."
   ),
   idempotencyKey: z16.string().min(1),
   agentName: z16.string().min(1).optional(),
@@ -3362,6 +3562,12 @@ var discardAgentDraftRequestSchema = z17.object({
   workspaceId: z17.string().optional()
 });
 var discardAgentDraftResponseSchema = z17.object({ discarded: z17.literal(true) });
+var setAgentUseRequestSchema = z17.object({
+  use: agentUseSchema,
+  /** The id of the agent as the caller read it. Another agent of the name is a conflict. */
+  expectedAssetId: z17.string().min(1).optional()
+});
+var setAgentUseResponseSchema = z17.object({ use: agentUseSchema });
 var agentTryConversationResponseSchema = z17.object({
   conversation: conversationSchema,
   /** A Try conversation is a preview: its head says so. */
@@ -3400,6 +3606,23 @@ var agentOperations = {
     errors: ["NOT_FOUND", "REVISION_CONFLICT"],
     rateClass: "write"
   }),
+  // Who uses the agent where it is available (AGENT-USE-1). The right is decided as for its
+  // availability: the agent's write right on the whole instance.
+  "agents.use.set": defineRegisteredOperation({
+    id: "agents.use.set",
+    method: "PUT",
+    path: "/api/v1/agents/:name/use",
+    summary: "Set who uses one agent where it is available: everyone, or holders of agent.use",
+    tag: "Agents",
+    auth: "user",
+    scope: "config_assets:write",
+    requires: [],
+    effect: "changing",
+    body: setAgentUseRequestSchema,
+    response: json(setAgentUseResponseSchema),
+    errors: ["NOT_FOUND", "CONFLICT"],
+    rateClass: "write"
+  }),
   "agents.try.open": defineRegisteredOperation({
     id: "agents.try.open",
     method: "POST",
@@ -3501,7 +3724,9 @@ var apiAccessOperations = {
 import {
   APP_ACTION_CALL_STATUSES as APP_ACTION_CALL_STATUSES2,
   APP_MODES,
-  OPERATION_EFFECTS as OPERATION_EFFECTS4
+  OPERATION_EFFECTS as OPERATION_EFFECTS4,
+  WORKFLOW_RUN_STATUSES as WORKFLOW_RUN_STATUSES2,
+  WORKFLOW_TEST_REVISIONS as WORKFLOW_TEST_REVISIONS2
 } from "@work-shape/catalyst-asset-schemas";
 import { z as z19 } from "zod";
 
@@ -3553,6 +3778,18 @@ var pagePreviewRequestSchema = z18.object({
   /** The revision to show. Left out, the newest one. */
   fileSetId: z18.string().optional()
 }).strict();
+var draftHostsSchema = z18.object({
+  /**
+   * The held-back hosts the caller may allow for their own view of this draft with
+   * `apps.allow_draft_host`. Empty where the caller may not.
+   */
+  allowable: z18.array(z18.string()),
+  /**
+   * Whether the draft reads data through its actions, from a Connection, a Data Store or a
+   * Workflow: what the preview reads, it can send to an allowed host.
+   */
+  readsData: z18.boolean()
+});
 var pagePreviewSchema = z18.object({
   /** A path on the instance, ending with a slash. Relative files of the Page resolve below it. */
   url: z18.string(),
@@ -3560,7 +3797,13 @@ var pagePreviewSchema = z18.object({
   fileSetId: z18.string(),
   number: z18.number().int().positive(),
   /** Names this mount of the frame. A bridge call of the frame carries it. */
-  pageSessionId: z18.string()
+  pageSessionId: z18.string(),
+  /**
+   * The outside hosts the manifest lists that this frame may not connect to. A Page of a
+   * conversation connects to none until a person allows one for their own view (DRAFT-HOSTS-1).
+   */
+  heldBackHosts: z18.array(z18.string()).optional(),
+  draftHosts: draftHostsSchema.optional()
 });
 
 // src/apps.ts
@@ -3664,11 +3907,19 @@ var appPreviewSchema = pagePreviewSchema.extend({
   interfacePath: z19.string(),
   /**
    * The outside hosts the shown revision's manifest lists that its frame may not connect to:
-   * those a draft adds to what is published, until it is published. Always empty for the
-   * published view.
+   * those a draft adds to what is published, until it is published or the caller allowed one
+   * for their own view (DRAFT-HOSTS-1). Always empty for the published view.
    */
   heldBackHosts: z19.array(z19.string())
 });
+var allowDraftHostRequestSchema = z19.object({
+  fileSetId: z19.string().min(1).max(200),
+  host: z19.string().min(1).max(253)
+}).strict();
+var allowDraftHostResponseSchema = z19.object({
+  host: z19.string(),
+  allowed: z19.literal(true)
+});
 var pageSessionProof = {
   fileSetId: z19.string().min(1).max(200),
   token: z19.string().min(1).max(512)
@@ -3696,6 +3947,63 @@ var appActionCallResultSchema = z19.union([
     result: z19.unknown()
   })
 ]);
+var appTryActionRequestSchema = z19.object({ input: z19.record(z19.string(), z19.unknown()).default({}) }).strict();
+var appTryActionResultSchema = z19.object({
+  operationRunId: z19.string().optional(),
+  status: z19.enum([...APP_ACTION_CALL_STATUSES2, "dry_run"]),
+  target: operationTargetSchema.optional(),
+  result: z19.unknown().optional(),
+  /** What a simulated call would have done. */
+  message: z19.string().optional(),
+  workflowRun: z19.object({
+    runId: z19.string(),
+    workflow: z19.string(),
+    status: z19.enum(WORKFLOW_RUN_STATUSES2),
+    revision: z19.object({
+      kind: z19.enum(WORKFLOW_TEST_REVISIONS2),
+      number: z19.number().int().positive().optional()
+    })
+  }).optional()
+});
+var appPublishRefusalSchema = z19.object({
+  /** `no_grant`, `workflow_not_published`, `workflow_unavailable` and the like. */
+  reason: z19.string(),
+  message: z19.string(),
+  /** The right the caller lacks, where a right is missing. */
+  right: z19.string().optional()
+});
+var appPublishReviewItemSchema = z19.object({
+  name: z19.string(),
+  title: z19.string(),
+  draftRevision: z19.number().int().positive(),
+  publishedRevision: z19.number().int().positive().optional(),
+  /** The draft holds changes its published revision does not, or nothing is published yet. */
+  pending: z19.boolean(),
+  /** The sentence the person's publish question leads with, for the draft revision. */
+  narrative: publishNarrativeSchema.optional(),
+  /** Who wrote the draft revision, as people read their name. */
+  lastChangedBy: z19.string().optional(),
+  refusals: z19.array(appPublishRefusalSchema)
+});
+var appPublishReviewSchema = z19.object({
+  app: appPublishReviewItemSchema,
+  workflows: z19.array(
+    appPublishReviewItemSchema.extend({
+      /** The actions of the App's draft that call it. None for a child of another Workflow. */
+      actions: z19.array(z19.string()),
+      /** The newest test run of the Workflow among its recent runs, by anyone. */
+      lastTestRun: z19.object({ runId: z19.string(), status: z19.enum(WORKFLOW_RUN_STATUSES2), at: z19.string() }).optional()
+    })
+  ),
+  /**
+   * One Publish of the App also publishes the pending Workflow drafts it reaches, when the
+   * publish names them in `workflows` (DP-3). Where false, each pending Workflow is published
+   * before the App, by its own publish.
+   */
+  publishesTogether: z19.boolean(),
+  /** Nothing in the review would be refused. */
+  ready: z19.boolean()
+});
 var appActionsListQuerySchema = listQuerySchema.extend({
   /**
    * The id of one App. Named, the answer holds that App alone: its draft for whoever writes
@@ -3731,8 +4039,9 @@ var listedAppAction = {
   /**
    * In the draft (ADR-0031): where the caller's next call of the action goes. `live` for a
    * reading action, and for a changing one the caller switched "Run live once" on for;
-   * `dry_run` for any other changing action, which is simulated. Missing for a published
-   * revision, every call of which is live.
+   * `dry_run` for any other changing action, which is simulated; `test` for a `workflow` action,
+   * which starts a test run of the Workflow (DP-1). Missing for a published revision, every
+   * call of which is live.
    */
   target: operationTargetSchema.optional(),
   /** An agent that lists `toolName` carries the action as a tool now. */
@@ -3840,6 +4149,22 @@ var appOperations = {
     errors: ["NOT_FOUND", "CONFLICT", "REVISION_CONFLICT", "VALIDATION_FAILED"],
     rateClass: "write"
   }),
+  // Only where release config sets `apps.draftHosts.enabled`; elsewhere it answers 404.
+  "apps.allow_draft_host": defineRegisteredOperation({
+    id: "apps.allow_draft_host",
+    method: "POST",
+    path: "/api/v1/apps/draft-hosts",
+    summary: "Allow an outside host a draft lists for the caller's own view of that draft, before it is published",
+    tag: "Apps",
+    auth: "user",
+    scope: "config_assets:write",
+    requires: [],
+    effect: "changing",
+    body: allowDraftHostRequestSchema,
+    response: json(allowDraftHostResponseSchema),
+    errors: ["NOT_FOUND", "FORBIDDEN", "VALIDATION_FAILED"],
+    rateClass: "write"
+  }),
   "apps.get_from_page": defineOperation({
     id: "apps.get_from_page",
     method: "GET",
@@ -3871,6 +4196,38 @@ var appOperations = {
     errors: ["NOT_FOUND"],
     rateClass: "read"
   }),
+  // An agent tries an action of an App's draft as the person's click would (DP-2): the same
+  // draft context and answer, without a frame. An agent tries only the conversation's subject
+  // App or an App the conversation created.
+  "apps.try_action": defineRegisteredOperation({
+    id: "apps.try_action",
+    method: "POST",
+    path: "/api/v1/apps/:app/draft-actions/:action/tries",
+    summary: "Try one action of an App's draft as its button does: reads read, changes are simulated, and a workflow action starts a test run",
+    tag: "Apps",
+    auth: "user",
+    scope: "config_assets:write",
+    requires: [],
+    effect: "changing",
+    body: appTryActionRequestSchema,
+    response: json(appTryActionResultSchema),
+    errors: ["NOT_FOUND", "FORBIDDEN", "CONFLICT", "TIMEOUT", "VALIDATION_FAILED"],
+    rateClass: "write"
+  }),
+  "apps.publish_review": defineRegisteredOperation({
+    id: "apps.publish_review",
+    method: "GET",
+    path: "/api/v1/apps/:app/publish-review",
+    summary: "Read what publishing an App's draft comes to: the App and the Workflows it calls, their pending drafts, publish questions and what would refuse them",
+    tag: "Apps",
+    auth: "user",
+    scope: "config_assets:read",
+    requires: [],
+    effect: "reading",
+    response: json(appPublishReviewSchema),
+    errors: ["NOT_FOUND", "FORBIDDEN"],
+    rateClass: "read"
+  }),
   // POST because it carries the token of the frame's address, which never stands in a path.
   "apps.sessions.context": defineOperation({
     id: "apps.sessions.context",
@@ -4858,6 +5215,8 @@ var configAssetOperations = {
 
 // src/operations/connections.ts
 import {
+  CATALOGUE_CATEGORIES,
+  CATALOGUE_PARTS,
   PUBLISHED_DATA_CONSUMER_KINDS,
   CONNECTION_BINDING_STATES,
   GRANT_HOLDER_KINDS as GRANT_HOLDER_KINDS2,
@@ -4974,11 +5333,16 @@ var connectionDetailSchema = z24.object({
   oauth: connectionOAuthSchema.optional()
 });
 var connectionOAuthStartSchema = z24.object({
+  /** The sign-in, for `connections.oauth_sign_in`. It proves nothing and opens nothing. */
+  signInId: z24.string(),
   authorizationUrl: z24.string().url(),
   providerHost: z24.string(),
   scopes: z24.array(z24.string()),
   expiresAt: timestampSchema
 });
+var connectionOAuthSignInSchema = z24.object({
+  state: z24.enum(["waiting", "ended"])
+});
 var connectionDisconnectSchema = z24.object({
   state: z24.literal("revoked"),
   providerRevocation: z24.enum(CONNECTION_PROVIDER_REVOCATIONS)
@@ -5014,9 +5378,91 @@ var connectionToolsSchema = z24.object({
     })
   )
 });
+var localizedTextSchema = z24.union([
+  z24.string(),
+  z24.strictObject({ en: z24.string().optional(), de: z24.string().optional() })
+]);
+var connectorTypeOffersSchema = z24.object({
+  types: z24.array(
+    z24.object({
+      type: z24.string(),
+      title: localizedTextSchema,
+      description: localizedTextSchema,
+      service: z24.string().optional(),
+      documentSource: z24.boolean(),
+      authScheme: z24.string(),
+      settings: z24.record(z24.string(), z24.unknown()),
+      fields: z24.array(
+        z24.object({
+          label: localizedTextSchema,
+          help: localizedTextSchema.optional(),
+          optional: z24.boolean(),
+          setting: z24.string().optional(),
+          secret: z24.boolean()
+        })
+      )
+    })
+  ),
+  /**
+   * The catalogue's entries (CAT-1): one card each in "Dienste". `offered` is false for one
+   * the operator has not named, which is shown greyed and cannot be installed. A part lists the
+   * operations it proposes; none of them is enabled before the admin confirms the review step.
+   */
+  entries: z24.array(
+    z24.object({
+      id: z24.string(),
+      version: z24.number().int(),
+      service: z24.string(),
+      title: localizedTextSchema,
+      description: localizedTextSchema,
+      category: z24.enum(CATALOGUE_CATEGORIES),
+      examplePrompts: z24.array(localizedTextSchema),
+      mark: z24.object({ color: z24.string().optional(), logo: z24.string().optional() }),
+      offered: z24.boolean(),
+      parts: z24.array(
+        z24.object({
+          part: z24.enum(CATALOGUE_PARTS),
+          connectorType: z24.string(),
+          name: z24.string(),
+          title: localizedTextSchema.optional(),
+          description: localizedTextSchema,
+          authScheme: z24.string(),
+          settings: z24.record(z24.string(), z24.unknown()),
+          fields: z24.array(
+            z24.object({
+              label: localizedTextSchema,
+              help: localizedTextSchema.optional(),
+              optional: z24.boolean(),
+              setting: z24.string().optional(),
+              secret: z24.boolean(),
+              default: z24.string().optional()
+            })
+          ),
+          prerequisites: z24.array(
+            z24.object({ text: localizedTextSchema, value: z24.string().optional() })
+          ),
+          hosts: z24.array(z24.string()),
+          operations: z24.array(
+            z24.object({
+              name: z24.string(),
+              title: z24.string().optional(),
+              description: z24.string().optional(),
+              effect: z24.enum(OPERATION_EFFECTS5),
+              recommended: z24.boolean(),
+              declaration: z24.record(z24.string(), z24.unknown()).optional()
+            })
+          ),
+          sharedAccountNote: localizedTextSchema,
+          documentSource: z24.boolean()
+        })
+      )
+    })
+  ).default([])
+});
 var connectionSecretWriteSchema = z24.object({
   value: z24.string().min(1).max(SECRET_VALUE_MAX_CHARS),
-  expectedVersion: z24.number().int().positive().nullable()
+  expectedVersion: z24.number().int().positive().nullable(),
+  expectedRevision: z24.number().int().positive()
 });
 var connectionDiscoveryRequestSchema = z24.object({ status: z24.literal("queued") });
 var personContextSubjectSchema = z24.object({
@@ -5140,6 +5586,20 @@ var connectionOperations = {
     errors: ["NOT_FOUND", "CONFLICT"],
     rateClass: "write"
   }),
+  "connections.oauth_sign_in": defineRegisteredOperation({
+    id: "connections.oauth_sign_in",
+    method: "GET",
+    path: "/api/v1/connections/:name/oauth/sign-ins/:signInId",
+    summary: "Read whether a shared OAuth sign-in the caller started still waits for the browser to come back",
+    tag: "Connections",
+    auth: "user",
+    scope: "config_assets:read",
+    requires: [],
+    effect: "reading",
+    response: json(connectionOAuthSignInSchema),
+    errors: ["NOT_FOUND"],
+    rateClass: "read"
+  }),
   // One callback per Connection: a code sent back for one Connection is never taken for
   // another's sign-in.
   "connections.oauth_complete": defineRegisteredOperation({
@@ -5176,6 +5636,20 @@ var connectionOperations = {
     rateClass: "write"
   }),
   // A path of its own: `agent-tools` would be a valid Connection name under `/connections/`.
+  "connections.connector_types": defineRegisteredOperation({
+    id: "connections.connector_types",
+    method: "GET",
+    path: "/api/v1/connector-types",
+    summary: "List the Connector types a person who may make a Connection can connect from a form",
+    tag: "Connections",
+    auth: "principal",
+    scope: "config_assets:read",
+    requires: [],
+    effect: "reading",
+    response: json(connectorTypeOffersSchema),
+    errors: [],
+    rateClass: "read"
+  }),
   "connections.list_tools": defineRegisteredOperation({
     id: "connections.list_tools",
     method: "GET",
@@ -5195,7 +5669,7 @@ var connectionOperations = {
 // src/operations/data-stores.ts
 import { workflowDataFlowsSchema } from "@work-shape/catalyst-asset-schemas";
 import {
-  APP_AUDIENCES as APP_AUDIENCES2,
+  APP_AUDIENCES as APP_AUDIENCES3,
   DATA_STORE_CONDITIONS,
   DATA_STORE_INSERT_CONFLICT_MODES,
   DATA_STORE_MIGRATION_OUTCOMES,
@@ -5376,7 +5850,7 @@ var dataStoreSourceSchema = z25.object({
   title: z25.string()
 });
 var dataStoreAudienceSchema = z25.object({
-  app: z25.object({ audience: z25.enum(APP_AUDIENCES2), people: z25.number().int() }).optional(),
+  app: z25.object({ audience: z25.enum(APP_AUDIENCES3), people: z25.number().int() }).optional(),
   workspace: z25.object({ title: z25.string(), members: z25.number().int() }).optional(),
   /** The holders by a grant row, named only to a caller who administers users. */
   holders: z25.array(
@@ -5982,6 +6456,23 @@ var conversationOperations = {
     errors: ["NOT_FOUND", "FORBIDDEN", "CONFLICT"],
     rateClass: "write"
   }),
+  // As if it had been sent with `followUp: "steer"`: only its author, in their own run under the
+  // same credential, and only without attachments. Otherwise CONFLICT, and it stays queued.
+  "conversations.follow_ups.steer": defineOperation({
+    id: "conversations.follow_ups.steer",
+    method: "POST",
+    path: "/api/v1/conversations/:conversationId/follow-ups/:followUpId/steer",
+    summary: "Hand your pending follow-up message to your running turn after its current step",
+    tag: "Conversations",
+    auth: "user",
+    scope: "conversation:write",
+    requires: [],
+    effect: "changing",
+    body: z27.object({}),
+    response: json(z27.object({ followUp: conversationFollowUpSchema })),
+    errors: ["NOT_FOUND", "FORBIDDEN", "CONFLICT"],
+    rateClass: "write"
+  }),
   "conversations.follow_ups.dispatch": defineOperation({
     id: "conversations.follow_ups.dispatch",
     method: "POST",
@@ -6342,7 +6833,10 @@ var auditActivityTargetSchema = z30.object({
 var auditActivitySchema = z30.object({
   correlationId: z30.string(),
   at: timestampSchema,
-  label: z30.string(),
+  /** The type of the event that titles the activity; the interface words it. */
+  type: z30.string(),
+  /** What a tool says it did, such as `workspace.exec`, where a tool's event titles it. */
+  action: z30.string().optional(),
   tier: z30.enum(AUDIT_TIERS),
   outcome: z30.enum(AUDIT_OUTCOMES),
   actor: auditActivityActorSchema,
@@ -7355,6 +7849,7 @@ var knowledgeOperations = {
 
 // src/operations/operations.ts
 import {
+  callableOperationsPageSchema,
   OPERATION_CONFIRMATION_DECISIONS,
   OPERATION_EFFECTS as OPERATION_EFFECTS6,
   OPERATION_ORIGIN_KINDS
@@ -7421,6 +7916,31 @@ var operationRunOperations = {
     errors: [],
     rateClass: "read"
   }),
+  "operations.list_callable": defineRegisteredOperation({
+    id: "operations.list_callable",
+    method: "GET",
+    path: "/api/v1/operations/callable",
+    summary: "List a page of the operations a step of a Workflow may call, as far as the caller may call them",
+    tag: "Operations",
+    auth: "principal",
+    scope: "config_assets:read",
+    // No right of its own: each operation is listed exactly where its own check of a call
+    // from a Workflow step lets the caller call it. The listing grants nothing.
+    requires: [],
+    effect: "reading",
+    query: z38.object({
+      /** Who calls: a step of a Workflow. An App's listing is the agent's alone. */
+      for: z38.enum(["workflow"]).default("workflow"),
+      cursor: z38.string().min(1).optional(),
+      /** An exact full operation name. */
+      name: z38.string().min(1).optional(),
+      /** Only operation names starting with this, such as `connection.crm.`. */
+      prefix: z38.string().min(1).optional()
+    }),
+    response: json(callableOperationsPageSchema),
+    errors: [],
+    rateClass: "read"
+  }),
   "operations.decide": defineRegisteredOperation({
     id: "operations.decide",
     method: "POST",
@@ -7979,7 +8499,7 @@ var roleOperations = {
     id: "roles.update",
     method: "PATCH",
     path: "/api/v1/instance/access/roles/:roleId",
-    summary: "Change a role's name, description or grants. Only a superadmin edits `user` and `admin`; `superadmin` is never edited.",
+    summary: "Change a role's name, description or grants. Editing `user` and `admin` also needs `roles.edit_built_in`; `superadmin` is never edited.",
     tag: "Access",
     auth: "user",
     scope: "user_admin:write",
@@ -8008,7 +8528,7 @@ var roleOperations = {
     id: "roles.reset",
     method: "POST",
     path: "/api/v1/instance/access/roles/:roleId/reset",
-    summary: "Reset `user` or `admin` to the release's default, which also settles every pending action. Only a superadmin resets.",
+    summary: "Reset `user` or `admin` to the release's default, which also settles every pending action. Needs `users.manage` and `roles.edit_built_in`.",
     tag: "Access",
     auth: "user",
     scope: "user_admin:write",
@@ -8022,7 +8542,7 @@ var roleOperations = {
     id: "roles.pending.decide",
     method: "POST",
     path: "/api/v1/instance/access/roles/:roleId/pending",
-    summary: "Decide one action a release changed in the default of an edited `user` or `admin`: apply it or dismiss it. Only a superadmin decides.",
+    summary: "Decide one action a release changed in the default of an edited `user` or `admin`: apply it or dismiss it. Needs `users.manage` and `roles.edit_built_in`.",
     tag: "Access",
     auth: "user",
     scope: "user_admin:write",
@@ -8335,8 +8855,9 @@ import {
   WORKFLOW_RESERVED_STEP_TYPES,
   WORKFLOW_DATASET_STATES,
   WORKFLOW_RUN_MODES,
-  WORKFLOW_RUN_STATUSES as WORKFLOW_RUN_STATUSES2,
+  WORKFLOW_RUN_STATUSES as WORKFLOW_RUN_STATUSES3,
   WORKFLOW_STEP_RUN_STATUSES,
+  WORKFLOW_TEST_REVISIONS as WORKFLOW_TEST_REVISIONS3,
   WORKFLOW_STEP_TYPES,
   WORKFLOW_DATASET_DOWNLOAD_FORMATS,
   WORKFLOW_TRIGGER_KINDS
@@ -8345,7 +8866,7 @@ import { z as z44 } from "zod";
 var WORKFLOW_RUN_OUTPUT_PREVIEW_MAX_CHARS = 2e3;
 var WORKFLOW_RUN_KEY_MAX_CHARS = 200;
 var runKeySchema = z44.string().min(1).max(WORKFLOW_RUN_KEY_MAX_CHARS);
-var runStatusSchema = z44.enum(WORKFLOW_RUN_STATUSES2);
+var runStatusSchema = z44.enum(WORKFLOW_RUN_STATUSES3);
 var stepRunStatusSchema = z44.enum(WORKFLOW_STEP_RUN_STATUSES);
 var stepTypeSchema = z44.enum([...WORKFLOW_STEP_TYPES, ...WORKFLOW_RESERVED_STEP_TYPES]);
 var countsSchema = z44.object({
@@ -8421,6 +8942,18 @@ var workflowRunSchema = z44.object({
   }).optional(),
   /** The Operation Run of the call that started the run. */
   operationRunId: z44.string().optional(),
+  /**
+   * The action of an App's draft whose click started this test run (DP-1): the App, the
+   * revision of its draft and the action, by name, and whether the Workflow's draft or its
+   * published revision ran. Missing on every other run.
+   */
+  startedFrom: z44.object({
+    kind: z44.literal("app"),
+    app: z44.string(),
+    appRevisionId: z44.string(),
+    action: z44.string(),
+    workflowRevision: z44.enum(WORKFLOW_TEST_REVISIONS3)
+  }).optional(),
   parentRunId: z44.string().optional(),
   parentStepRunId: z44.string().optional(),
   rootRunId: z44.string(),
@@ -8563,6 +9096,8 @@ var workflowSummarySchema = z44.object({
   description: z44.string().optional(),
   /** The published revision: what a run started now has as its `definitionRevisionId`. */
   definitionRevisionId: z44.string(),
+  /** The workspace that owns the Workflow (WS-OWN-1b). Missing where the instance owns it. */
+  workspaceId: z44.string().optional(),
   /** Whether a start by hand is accepted now, as far as that is known before its input. */
   runnable: z44.boolean(),
   /** Why not. Empty exactly where `runnable` is true. */
@@ -8572,6 +9107,11 @@ var workflowSummarySchema = z44.object({
    * from which a page builds its start form. Missing where the definition cannot be read.
    */
   inputs: z44.record(z44.string(), z44.unknown()).optional(),
+  /**
+   * How the published revision is started, the kinds of its trigger: `manual`, `schedule`,
+   * `parent` (by a step of another Workflow). Missing where the definition cannot be read.
+   */
+  triggers: z44.array(z44.string()).optional(),
   /**
    * The display label of the service principal every run of the Workflow acts as. Missing
    * where that principal is disabled or gone, which `reasons` then says.
@@ -8606,7 +9146,9 @@ var workflowOperations = {
     response: json(
       z44.object({
         draftRevision: z44.number().int().positive(),
-        unpublishedRevision: z44.number().int().positive()
+        unpublishedRevision: z44.number().int().positive(),
+        /** The live Apps that start the Workflow and stop working without it (DP-0). */
+        warnings: z44.array(assetWarningSchema)
       })
     ),
     errors: ["NOT_FOUND", "VALIDATION_FAILED"],
@@ -8835,6 +9377,39 @@ import {
 } from "@work-shape/catalyst-asset-schemas";
 
 // src/operations/index.ts
+var operationAreas = {
+  access: accessOperations,
+  account: accountOperations,
+  agents: agentOperations,
+  "api-access": apiAccessOperations,
+  "approval-requests": approvalRequestOperations,
+  apps: appOperations,
+  assets: assetOperations,
+  "collaboration-workspaces": collaborationWorkspaceOperations,
+  "config-assets": configAssetOperations,
+  connections: connectionOperations,
+  "conversation-files": conversationFileOperations,
+  conversations: conversationOperations,
+  credentials: credentialOperations,
+  "data-stores": dataStoreOperations,
+  feedback: feedbackOperations,
+  governance: governanceOperations,
+  guardrails: guardrailOperations,
+  instance: instanceOperations,
+  jobs: jobOperations,
+  knowledge: knowledgeOperations,
+  operations: operationRunOperations,
+  pages: pageOperations,
+  "personal-api-keys": personalApiKeyOperations,
+  platform: platformOperations,
+  reference: referenceOperations,
+  roles: roleOperations,
+  "scheduled-starts": scheduledStartOperations,
+  system: systemOperations,
+  users: userOperations,
+  "workflow-principal-rights": workflowPrincipalRightsOperations,
+  workflows: workflowOperations
+};
 var apiOperations = {
   ...scheduledStartOperations,
   ...approvalRequestOperations,
@@ -8874,6 +9449,8 @@ var schemas_exports = {};
 __export(schemas_exports, {
   API_ERROR_MEANINGS: () => API_ERROR_MEANINGS,
   APP_ASSET_KIND: () => APP_ASSET_KIND,
+  APP_PUBLISH_WORKFLOWS_MAX: () => APP_PUBLISH_WORKFLOWS_MAX,
+  ASSET_CHECK_VERBS: () => ASSET_CHECK_VERBS,
   ASSET_GET_FILES_MAX_BYTES: () => ASSET_GET_FILES_MAX_BYTES,
   ASSET_PUT_FILES_MAX_BYTES: () => ASSET_PUT_FILES_MAX_BYTES,
   ASSET_RELEASE_SYNC_MAX_ITEMS: () => ASSET_RELEASE_SYNC_MAX_ITEMS,
@@ -8888,11 +9465,14 @@ __export(schemas_exports, {
   INVALID_JSON_BODY_REASON: () => INVALID_JSON_BODY_REASON,
   LIVE_ONCE_PART_MAX_LENGTH: () => LIVE_ONCE_PART_MAX_LENGTH,
   MAX_LIST_LIMIT: () => MAX_LIST_LIMIT,
+  REFUSAL_REASONS: () => REFUSAL_REASONS,
   ROLE_GRANTS_MAX: () => ROLE_GRANTS_MAX,
   UNKNOWN_OPERATION_REASON: () => UNKNOWN_OPERATION_REASON,
   VIEW_RUNTIME: () => VIEW_RUNTIME,
   VIEW_SHELL: () => VIEW_SHELL,
   VIEW_SHELL_MESSAGES: () => VIEW_SHELL_MESSAGES,
+  accessOriginRoleSchema: () => accessOriginRoleSchema,
+  accessOriginSchema: () => accessOriginSchema,
   activeRunSummarySchema: () => activeRunSummarySchema,
   addWorkspaceMemberRequestSchema: () => addWorkspaceMemberRequestSchema,
   administeredCollaborationWorkspaceSchema: () => administeredCollaborationWorkspaceSchema,
@@ -8914,6 +9494,9 @@ __export(schemas_exports, {
   agentRuntimeMessageMetadataSchema: () => agentRuntimeMessageMetadataSchema,
   agentToolReferenceSchema: () => agentToolReferenceSchema,
   agentTryConversationResponseSchema: () => agentTryConversationResponseSchema,
+  agentUseSchema: () => agentUseSchema,
+  allowDraftHostRequestSchema: () => allowDraftHostRequestSchema,
+  allowDraftHostResponseSchema: () => allowDraftHostResponseSchema,
   annotateFeedbackRequestSchema: () => annotateFeedbackRequestSchema,
   apiCredentialSchema: () => apiCredentialSchema,
   apiCredentialScopeSchema: () => apiCredentialScopeSchema,
@@ -8933,11 +9516,15 @@ __export(schemas_exports, {
   appModeSchema: () => appModeSchema,
   appPreviewRequestSchema: () => appPreviewRequestSchema,
   appPreviewSchema: () => appPreviewSchema,
+  appPublishRefusalSchema: () => appPublishRefusalSchema,
+  appPublishReviewSchema: () => appPublishReviewSchema,
   appSessionContextRequestSchema: () => appSessionContextRequestSchema,
   appSessionContextSchema: () => appSessionContextSchema,
   appSqlActionUnavailableSchema: () => appSqlActionUnavailableSchema,
   appStorageWriteRequestSchema: () => appStorageWriteRequestSchema,
   appStorageWriteResponseSchema: () => appStorageWriteResponseSchema,
+  appTryActionRequestSchema: () => appTryActionRequestSchema,
+  appTryActionResultSchema: () => appTryActionResultSchema,
   appWorkflowActionUnavailableSchema: () => appWorkflowActionUnavailableSchema,
   approvalCheckResultSchema: () => approvalCheckResultSchema,
   approvalDecisionMessageMetadataSchema: () => approvalDecisionMessageMetadataSchema,
@@ -8958,6 +9545,8 @@ __export(schemas_exports, {
   assetRevisionConflictDetailsSchema: () => assetRevisionConflictDetailsSchema,
   assetRevisionConflictSchema: () => assetRevisionConflictSchema,
   assetRevisionSelectorSchema: () => assetRevisionSelectorSchema,
+  assetRightsCheckQuerySchema: () => assetRightsCheckQuerySchema,
+  assetRightsCheckSchema: () => assetRightsCheckSchema,
   assetSchema: () => assetSchema,
   assetScopeQuerySchema: () => assetScopeQuerySchema,
   assetScopeSchema: () => assetScopeSchema,
@@ -9040,6 +9629,7 @@ __export(schemas_exports, {
   draftAttachmentSchema: () => draftAttachmentSchema,
   draftAttachmentStatusSchema: () => draftAttachmentStatusSchema,
   draftAttachmentUploadResponseSchema: () => draftAttachmentUploadResponseSchema,
+  draftHostsSchema: () => draftHostsSchema,
   effectivePermissionsQuerySchema: () => effectivePermissionsQuerySchema,
   effectivePermissionsSchema: () => effectivePermissionsSchema,
   exchangeApiKeyResponseSchema: () => exchangeApiKeyResponseSchema,
@@ -9049,6 +9639,7 @@ __export(schemas_exports, {
   grantHolderKindSchema: () => grantHolderKindSchema,
   grantScopeKindSchema: () => grantScopeKindSchema,
   healthSchema: () => healthSchema,
+  holderRightsSchema: () => holderRightsSchema,
   infrastructureCheckSchema: () => infrastructureCheckSchema,
   infrastructureClassSchema: () => infrastructureClassSchema,
   infrastructureOriginSchema: () => infrastructureOriginSchema,
@@ -9146,6 +9737,7 @@ __export(schemas_exports, {
   runObservationSchema: () => runObservationSchema,
   safeConfigSchema: () => safeConfigSchema,
   saveApprovalSchema: () => saveApprovalSchema,
+  scopeAssignmentsOverviewSchema: () => scopeAssignmentsOverviewSchema,
   sendAdministeredUserInvitationResponseSchema: () => sendAdministeredUserInvitationResponseSchema,
   sendFeedbackRequestSchema: () => sendFeedbackRequestSchema,
   servicePrincipalDetailSchema: () => servicePrincipalDetailSchema,
@@ -9153,6 +9745,8 @@ __export(schemas_exports, {
   servicePrincipalSchema: () => servicePrincipalSchema,
   servicePrincipalStatusSchema: () => servicePrincipalStatusSchema,
   sessionTokenDelegatedActorSchema: () => sessionTokenDelegatedActorSchema,
+  setAgentUseRequestSchema: () => setAgentUseRequestSchema,
+  setAgentUseResponseSchema: () => setAgentUseResponseSchema,
   setAssetAvailabilityRequestSchema: () => setAssetAvailabilityRequestSchema,
   setAssetDefaultRequestSchema: () => setAssetDefaultRequestSchema,
   setAssetDefaultResponseSchema: () => setAssetDefaultResponseSchema,
@@ -9903,6 +10497,8 @@ export {
   APP_BRIDGE_NAME_MAX_CHARS,
   APP_BRIDGE_REQUEST_ID_MAX_CHARS,
   APP_BRIDGE_VERSION,
+  APP_PUBLISH_WORKFLOWS_MAX,
+  ASSET_CHECK_VERBS,
   ASSET_GET_FILES_MAX_BYTES,
   ASSET_PUT_FILES_MAX_BYTES,
   ASSET_RELEASE_SYNC_MAX_ITEMS,
@@ -9927,6 +10523,7 @@ export {
   MAX_LIST_LIMIT,
   OPERATION_HEADERS,
   PUBLISHED_CLI_VERSION,
+  REFUSAL_REASONS,
   RELEASE_VERSION,
   ROLE_GRANTS_MAX,
   UNKNOWN_OPERATION_REASON,
@@ -9936,6 +10533,8 @@ export {
   WORKFLOW_RUN_KEY_MAX_CHARS,
   WORKFLOW_RUN_OUTPUT_PREVIEW_MAX_CHARS,
   WORKFLOW_STEP_SOURCE_KINDS,
+  accessOriginRoleSchema,
+  accessOriginSchema,
   activeRunSummarySchema,
   addWorkspaceMemberRequestSchema,
   administeredCollaborationWorkspaceSchema,
@@ -9957,6 +10556,9 @@ export {
   agentRuntimeMessageMetadataSchema,
   agentToolReferenceSchema,
   agentTryConversationResponseSchema,
+  agentUseSchema,
+  allowDraftHostRequestSchema,
+  allowDraftHostResponseSchema,
   annotateFeedbackRequestSchema,
   apiCredentialSchema,
   apiCredentialScopeSchema,
@@ -9983,12 +10585,16 @@ export {
   appModeSchema,
   appPreviewRequestSchema,
   appPreviewSchema,
+  appPublishRefusalSchema,
+  appPublishReviewSchema,
   appSessionContextRequestSchema,
   appSessionContextSchema,
   appSqlActionUnavailableSchema,
   appStorageMutationSchema,
   appStorageWriteRequestSchema,
   appStorageWriteResponseSchema,
+  appTryActionRequestSchema,
+  appTryActionResultSchema,
   appWorkflowActionUnavailableSchema,
   appWorkflowRunSchema,
   approvalCheckResultSchema,
@@ -10010,6 +10616,8 @@ export {
   assetRevisionConflictDetailsSchema,
   assetRevisionConflictSchema,
   assetRevisionSelectorSchema,
+  assetRightsCheckQuerySchema,
+  assetRightsCheckSchema,
   assetSchema,
   assetScopeQuerySchema,
   assetScopeSchema,
@@ -10061,6 +10669,7 @@ export {
   connectionDetailSchema,
   connectionDisconnectSchema,
   connectionNameParamsSchema,
+  connectionOAuthSignInSchema,
   connectionOAuthStartSchema,
   connectionOperationDetailSchema,
   connectionOperationStatusSchema,
@@ -10070,6 +10679,7 @@ export {
   connectionTestResultSchema,
   connectionToolSchema,
   connectionToolsSchema,
+  connectorTypeOffersSchema,
   conversationFollowUpSchema,
   conversationListItemSchema,
   conversationResourceBaseSchema,
@@ -10112,6 +10722,7 @@ export {
   draftAttachmentSchema,
   draftAttachmentStatusSchema,
   draftAttachmentUploadResponseSchema,
+  draftHostsSchema,
   dryRunGuardrailRequestSchema,
   dryRunGuardrailResponseSchema,
   effectivePermissionsQuerySchema,
@@ -10128,6 +10739,7 @@ export {
   guardrailHitsSchema,
   guardrailOperations,
   healthSchema,
+  holderRightsSchema,
   infrastructureCheckSchema,
   infrastructureClassSchema,
   infrastructureOriginSchema,
@@ -10184,6 +10796,7 @@ export {
   notReadySchema,
   openApiDocumentSchema,
   openConversationSubjectRequestSchema,
+  operationAreas,
   operationPathParamNames,
   operationRunOriginSchema,
   operationRunSchema,
@@ -10244,6 +10857,7 @@ export {
   scheduledStartFieldsSchema,
   scheduledStartRunSchema,
   scheduledStartSchema,
+  scopeAssignmentsOverviewSchema,
   selectContractBaseline,
   sendAdministeredUserInvitationResponseSchema,
   sendFeedbackRequestSchema,
@@ -10252,6 +10866,8 @@ export {
   servicePrincipalSchema,
   servicePrincipalStatusSchema,
   sessionTokenDelegatedActorSchema,
+  setAgentUseRequestSchema,
+  setAgentUseResponseSchema,
   setAssetAvailabilityRequestSchema,
   setAssetDefaultRequestSchema,
   setAssetDefaultResponseSchema,