@work-shape/catalyst-api-contract 0.8.0-rc.7 → 0.8.0-rc.8

package/dist/index.js

@@ -10,7 +10,8 @@ import {
   IDEMPOTENCY_KEY_MAX_LENGTH,
   POLICY_VALUES,
   THEME_MODES,
-  WORKFLOW_RUN_STATUSES
+  WORKFLOW_RUN_STATUSES,
+  WORKFLOW_TEST_REVISIONS
 } from "@work-shape/catalyst-asset-schemas";
 import { z } from "zod";
 var APP_BRIDGE_MARK = "catalystBridge";
@@ -126,7 +127,23 @@ var appWorkflowRunSchema = z.strictObject({
   /** Why the run did not end `done`: a code and a sentence of the product. */
   error: z.strictObject({ code: z.string(), message: z.string() }).optional(),
   startedAt: z.string().optional(),
-  finishedAt: z.string().optional()
+  finishedAt: z.string().optional(),
+  /**
+   * `test` on a run a click in an App's draft started (DP-1): it ran in mode test, as the
+   * viewer bounded by the Workflow's principal, and nothing of it is live. Missing on a run of
+   * a published App.
+   */
+  mode: z.literal("test").optional(),
+  /**
+   * On a test run: the revision of the Workflow that ran, the draft or the published one, with
+   * its number where that revision is still the draft or the published one.
+   */
+  workflowRevision: z.strictObject({
+    kind: z.enum(WORKFLOW_TEST_REVISIONS),
+    number: z.number().int().positive().optional()
+  }).optional(),
+  /** On a test run: the steps whose calls were simulated, by step id. Their results are not real. */
+  simulatedSteps: z.array(z.string()).optional()
 });
 var callFailure = z.strictObject({
   /** `action_unknown`, `draft_safe_mode`, `forbidden`, `input_invalid` and so on. */
@@ -806,7 +823,7 @@ import { z as z46 } from "zod";
 // package.json
 var package_default = {
   name: "@work-shape/catalyst-api-contract",
-  version: "0.8.0-rc.7",
+  version: "0.8.0-rc.8",
   license: "MIT",
   repository: {
     type: "git",
@@ -1045,7 +1062,7 @@ var scheduledStartOperations = {
 };
 
 // src/operations/access.ts
-import { dataScopesSchema, scopeAssignmentInputSchema } from "@work-shape/catalyst-asset-schemas";
+import { dataScopesSchema as dataScopesSchema2, scopeAssignmentInputSchema as scopeAssignmentInputSchema2 } from "@work-shape/catalyst-asset-schemas";
 import { z as z11 } from "zod";
 
 // src/access.ts
@@ -1058,7 +1075,9 @@ import {
   PRINCIPAL_HOLDER_KINDS as PRINCIPAL_HOLDER_KINDS2,
   ROLE_GRANT_SCOPE_KINDS,
   ROLE_PENDING_CHANGES,
-  ROLE_PENDING_DECISIONS
+  ROLE_PENDING_DECISIONS,
+  dataScopesSchema,
+  scopeAssignmentInputSchema
 } from "@work-shape/catalyst-asset-schemas";
 import { z as z10 } from "zod";
 var grantHolderKindSchema = z10.enum(GRANT_HOLDER_KINDS);
@@ -1251,6 +1270,19 @@ var updateWorkspaceBuildLimitsRequestSchema = z10.object({
   allowedToolNames: buildLimitListSchema.optional(),
   allowedModelBindingIds: buildLimitListSchema.optional()
 });
+var dataScopeValuesSchema = z10.union([z10.literal("all"), z10.array(z10.string())]);
+var scopeAssignmentsOverviewSchema = z10.object({
+  dimensions: dataScopesSchema,
+  assignments: z10.array(scopeAssignmentInputSchema),
+  people: z10.array(
+    z10.object({
+      id: z10.string(),
+      displayLabel: z10.string(),
+      groups: z10.array(z10.string()),
+      effective: z10.record(z10.string(), dataScopeValuesSchema)
+    })
+  )
+});
 
 // src/operations/access.ts
 var accessOperations = {
@@ -1264,17 +1296,31 @@ var accessOperations = {
     scope: "user_admin:read",
     requires: ["users.manage"],
     effect: "reading",
-    query: scopeAssignmentInputSchema.pick({ holderKind: true, holderId: true }),
+    query: scopeAssignmentInputSchema2.pick({ holderKind: true, holderId: true }),
     response: json(
       z11.object({
-        dimensions: dataScopesSchema,
-        assignments: z11.array(scopeAssignmentInputSchema),
+        dimensions: dataScopesSchema2,
+        assignments: z11.array(scopeAssignmentInputSchema2),
         effective: z11.record(z11.string(), z11.union([z11.literal("all"), z11.array(z11.string())])).optional()
       })
     ),
     errors: ["NOT_FOUND"],
     rateClass: "read"
   }),
+  "scope_assignments.overview": defineOperation({
+    id: "scope_assignments.overview",
+    method: "GET",
+    path: "/api/v1/instance/access/scope-assignments/overview",
+    summary: "Read the declared data scope, every assignment the reader may see, and each active person's groups and effective values",
+    tag: "Access",
+    auth: "user",
+    scope: "user_admin:read",
+    requires: ["users.manage"],
+    effect: "reading",
+    response: json(scopeAssignmentsOverviewSchema),
+    errors: [],
+    rateClass: "read"
+  }),
   "scope_assignments.set": defineRegisteredOperation({
     id: "scope_assignments.set",
     method: "PUT",
@@ -1285,8 +1331,8 @@ var accessOperations = {
     scope: "user_admin:write",
     requires: ["users.manage"],
     effect: "changing",
-    body: scopeAssignmentInputSchema,
-    response: json(scopeAssignmentInputSchema),
+    body: scopeAssignmentInputSchema2,
+    response: json(scopeAssignmentInputSchema2),
     errors: ["NOT_FOUND"],
     rateClass: "write"
   }),
@@ -2170,12 +2216,14 @@ import { z as z17 } from "zod";
 
 // src/assets.ts
 import {
+  AGENT_USE_SETTINGS,
   APP_AUDIENCES as APP_AUDIENCES2,
   OPERATION_EFFECTS as OPERATION_EFFECTS3,
   WORKSPACE_USE_ASSET_KINDS,
   ASSET_ACCESS_VERBS,
   ASSET_NAME_REFUSAL_REASONS,
-  ASSET_SYNC_CHANGE_TYPES
+  ASSET_SYNC_CHANGE_TYPES,
+  operationSourceSchema
 } from "@work-shape/catalyst-asset-schemas";
 import { z as z15 } from "zod";
 var ASSET_SYNC_MAX_ITEMS = 200;
@@ -2191,6 +2239,7 @@ var assetScopeSchema = z15.discriminatedUnion("kind", [
   z15.object({ kind: z15.literal("workspace"), workspaceId: z15.string() })
 ]);
 var revisionNumberSchema = z15.number().int().positive();
+var APP_PUBLISH_WORKFLOWS_MAX = 20;
 var expectedRevisionSchema = revisionNumberSchema.optional();
 var expectedRevisionOrNewSchema = revisionNumberSchema.nullable().optional();
 var NUL = "\0";
@@ -2204,6 +2253,7 @@ var assetDefinitionSchema = configAssetConfigSchema.refine(
 );
 var workspaceIdSchema = nameText(z15.string().min(1)).optional();
 var isDefaultSchema = z15.literal(true).optional();
+var agentUseSchema = z15.enum(AGENT_USE_SETTINGS);
 var dependencyAvailabilitySchema = z15.object({
   /** The workspaces reviewed by the publisher; a later change must be read again. */
   availability: agentAvailabilitySchema.nullable().optional(),
@@ -2278,11 +2328,7 @@ var publishNarrativeSchema = z15.object({
   warnings: z15.array(z15.string())
 });
 var saveApprovalSchema = z15.object({ approverNames: z15.array(z15.string()) });
-var workflowFactSourceSchema = z15.object({
-  kind: z15.enum(["connection", "data_store", "knowledge_base", "workflow", "other"]),
-  title: z15.string().optional(),
-  service: z15.string().optional()
-});
+var workflowFactSourceSchema = operationSourceSchema;
 var workflowOperationFactSchema = z15.object({
   source: workflowFactSourceSchema,
   title: z15.string().optional(),
@@ -2352,6 +2398,8 @@ var assetSchema = z15.object({
   availability: agentAvailabilitySchema.optional(),
   dependencyAvailability: dependencyAvailabilitySchema.optional(),
   canSetAvailability: z15.boolean().optional(),
+  /** Only on agent reads: who uses the agent where it is available (AGENT-USE-1). */
+  agentUse: agentUseSchema.optional(),
   /** Only on agent reads. The stored config stays intact; these references cannot run. */
   unavailableTools: z15.array(unavailableToolSchema).optional(),
   unavailableSkills: z15.array(unavailableSkillSchema).optional(),
@@ -2463,7 +2511,14 @@ var publishAssetRequestSchema = z15.object({
    * never means "whatever the draft is now". Naming an earlier number is the way back.
    */
   revision: revisionNumberSchema,
-  workspaceId: workspaceIdSchema
+  workspaceId: workspaceIdSchema,
+  /**
+   * Of an App only: the Workflow drafts this publish makes live with it (DP-3), each with the
+   * revision the person reviewed, as `apps.publish_review` lists the pending ones. Each must be
+   * a Workflow the App's revision reaches, directly or as a child. They are published children
+   * first and then the App, in one transaction: a refusal of any publishes none of them.
+   */
+  workflows: z15.array(z15.object({ name: z15.string().min(1), revision: revisionNumberSchema }).strict()).max(APP_PUBLISH_WORKFLOWS_MAX).optional()
 });
 var discardAssetDraftRequestSchema = z15.object({
   /** The draft revision the caller last read. Required. */
@@ -2474,7 +2529,16 @@ var assetPointersResponseSchema = z15.object({
   draftRevision: revisionNumberSchema,
   publishedRevision: revisionNumberSchema,
   /** The revision that was published before a publish, left out on the first one. */
-  replacedRevision: revisionNumberSchema.optional()
+  replacedRevision: revisionNumberSchema.optional(),
+  /** The Workflows a publish of an App made live with it, in the order they were published. */
+  publishedWith: z15.array(
+    z15.object({
+      kind: z15.literal("workflow"),
+      name: z15.string(),
+      publishedRevision: revisionNumberSchema,
+      replacedRevision: revisionNumberSchema.optional()
+    })
+  ).optional()
 });
 var LIVE_ONCE_PART_MAX_LENGTH = 200;
 var runLiveOnceRequestSchema = z15.object({
@@ -3498,6 +3562,12 @@ var discardAgentDraftRequestSchema = z17.object({
   workspaceId: z17.string().optional()
 });
 var discardAgentDraftResponseSchema = z17.object({ discarded: z17.literal(true) });
+var setAgentUseRequestSchema = z17.object({
+  use: agentUseSchema,
+  /** The id of the agent as the caller read it. Another agent of the name is a conflict. */
+  expectedAssetId: z17.string().min(1).optional()
+});
+var setAgentUseResponseSchema = z17.object({ use: agentUseSchema });
 var agentTryConversationResponseSchema = z17.object({
   conversation: conversationSchema,
   /** A Try conversation is a preview: its head says so. */
@@ -3536,6 +3606,23 @@ var agentOperations = {
     errors: ["NOT_FOUND", "REVISION_CONFLICT"],
     rateClass: "write"
   }),
+  // Who uses the agent where it is available (AGENT-USE-1). The right is decided as for its
+  // availability: the agent's write right on the whole instance.
+  "agents.use.set": defineRegisteredOperation({
+    id: "agents.use.set",
+    method: "PUT",
+    path: "/api/v1/agents/:name/use",
+    summary: "Set who uses one agent where it is available: everyone, or holders of agent.use",
+    tag: "Agents",
+    auth: "user",
+    scope: "config_assets:write",
+    requires: [],
+    effect: "changing",
+    body: setAgentUseRequestSchema,
+    response: json(setAgentUseResponseSchema),
+    errors: ["NOT_FOUND", "CONFLICT"],
+    rateClass: "write"
+  }),
   "agents.try.open": defineRegisteredOperation({
     id: "agents.try.open",
     method: "POST",
@@ -3637,7 +3724,9 @@ var apiAccessOperations = {
 import {
   APP_ACTION_CALL_STATUSES as APP_ACTION_CALL_STATUSES2,
   APP_MODES,
-  OPERATION_EFFECTS as OPERATION_EFFECTS4
+  OPERATION_EFFECTS as OPERATION_EFFECTS4,
+  WORKFLOW_RUN_STATUSES as WORKFLOW_RUN_STATUSES2,
+  WORKFLOW_TEST_REVISIONS as WORKFLOW_TEST_REVISIONS2
 } from "@work-shape/catalyst-asset-schemas";
 import { z as z19 } from "zod";
 
@@ -3858,6 +3947,63 @@ var appActionCallResultSchema = z19.union([
     result: z19.unknown()
   })
 ]);
+var appTryActionRequestSchema = z19.object({ input: z19.record(z19.string(), z19.unknown()).default({}) }).strict();
+var appTryActionResultSchema = z19.object({
+  operationRunId: z19.string().optional(),
+  status: z19.enum([...APP_ACTION_CALL_STATUSES2, "dry_run"]),
+  target: operationTargetSchema.optional(),
+  result: z19.unknown().optional(),
+  /** What a simulated call would have done. */
+  message: z19.string().optional(),
+  workflowRun: z19.object({
+    runId: z19.string(),
+    workflow: z19.string(),
+    status: z19.enum(WORKFLOW_RUN_STATUSES2),
+    revision: z19.object({
+      kind: z19.enum(WORKFLOW_TEST_REVISIONS2),
+      number: z19.number().int().positive().optional()
+    })
+  }).optional()
+});
+var appPublishRefusalSchema = z19.object({
+  /** `no_grant`, `workflow_not_published`, `workflow_unavailable` and the like. */
+  reason: z19.string(),
+  message: z19.string(),
+  /** The right the caller lacks, where a right is missing. */
+  right: z19.string().optional()
+});
+var appPublishReviewItemSchema = z19.object({
+  name: z19.string(),
+  title: z19.string(),
+  draftRevision: z19.number().int().positive(),
+  publishedRevision: z19.number().int().positive().optional(),
+  /** The draft holds changes its published revision does not, or nothing is published yet. */
+  pending: z19.boolean(),
+  /** The sentence the person's publish question leads with, for the draft revision. */
+  narrative: publishNarrativeSchema.optional(),
+  /** Who wrote the draft revision, as people read their name. */
+  lastChangedBy: z19.string().optional(),
+  refusals: z19.array(appPublishRefusalSchema)
+});
+var appPublishReviewSchema = z19.object({
+  app: appPublishReviewItemSchema,
+  workflows: z19.array(
+    appPublishReviewItemSchema.extend({
+      /** The actions of the App's draft that call it. None for a child of another Workflow. */
+      actions: z19.array(z19.string()),
+      /** The newest test run of the Workflow among its recent runs, by anyone. */
+      lastTestRun: z19.object({ runId: z19.string(), status: z19.enum(WORKFLOW_RUN_STATUSES2), at: z19.string() }).optional()
+    })
+  ),
+  /**
+   * One Publish of the App also publishes the pending Workflow drafts it reaches, when the
+   * publish names them in `workflows` (DP-3). Where false, each pending Workflow is published
+   * before the App, by its own publish.
+   */
+  publishesTogether: z19.boolean(),
+  /** Nothing in the review would be refused. */
+  ready: z19.boolean()
+});
 var appActionsListQuerySchema = listQuerySchema.extend({
   /**
    * The id of one App. Named, the answer holds that App alone: its draft for whoever writes
@@ -3893,8 +4039,9 @@ var listedAppAction = {
   /**
    * In the draft (ADR-0031): where the caller's next call of the action goes. `live` for a
    * reading action, and for a changing one the caller switched "Run live once" on for;
-   * `dry_run` for any other changing action, which is simulated. Missing for a published
-   * revision, every call of which is live.
+   * `dry_run` for any other changing action, which is simulated; `test` for a `workflow` action,
+   * which starts a test run of the Workflow (DP-1). Missing for a published revision, every
+   * call of which is live.
    */
   target: operationTargetSchema.optional(),
   /** An agent that lists `toolName` carries the action as a tool now. */
@@ -4049,6 +4196,38 @@ var appOperations = {
     errors: ["NOT_FOUND"],
     rateClass: "read"
   }),
+  // An agent tries an action of an App's draft as the person's click would (DP-2): the same
+  // draft context and answer, without a frame. An agent tries only the conversation's subject
+  // App or an App the conversation created.
+  "apps.try_action": defineRegisteredOperation({
+    id: "apps.try_action",
+    method: "POST",
+    path: "/api/v1/apps/:app/draft-actions/:action/tries",
+    summary: "Try one action of an App's draft as its button does: reads read, changes are simulated, and a workflow action starts a test run",
+    tag: "Apps",
+    auth: "user",
+    scope: "config_assets:write",
+    requires: [],
+    effect: "changing",
+    body: appTryActionRequestSchema,
+    response: json(appTryActionResultSchema),
+    errors: ["NOT_FOUND", "FORBIDDEN", "CONFLICT", "TIMEOUT", "VALIDATION_FAILED"],
+    rateClass: "write"
+  }),
+  "apps.publish_review": defineRegisteredOperation({
+    id: "apps.publish_review",
+    method: "GET",
+    path: "/api/v1/apps/:app/publish-review",
+    summary: "Read what publishing an App's draft comes to: the App and the Workflows it calls, their pending drafts, publish questions and what would refuse them",
+    tag: "Apps",
+    auth: "user",
+    scope: "config_assets:read",
+    requires: [],
+    effect: "reading",
+    response: json(appPublishReviewSchema),
+    errors: ["NOT_FOUND", "FORBIDDEN"],
+    rateClass: "read"
+  }),
   // POST because it carries the token of the frame's address, which never stands in a path.
   "apps.sessions.context": defineOperation({
     id: "apps.sessions.context",
@@ -5036,6 +5215,8 @@ var configAssetOperations = {
 
 // src/operations/connections.ts
 import {
+  CATALOGUE_CATEGORIES,
+  CATALOGUE_PARTS,
   PUBLISHED_DATA_CONSUMER_KINDS,
   CONNECTION_BINDING_STATES,
   GRANT_HOLDER_KINDS as GRANT_HOLDER_KINDS2,
@@ -5221,11 +5402,67 @@ var connectorTypeOffersSchema = z24.object({
         })
       )
     })
-  )
+  ),
+  /**
+   * The catalogue's entries (CAT-1): one card each in "Dienste". `offered` is false for one
+   * the operator has not named, which is shown greyed and cannot be installed. A part lists the
+   * operations it proposes; none of them is enabled before the admin confirms the review step.
+   */
+  entries: z24.array(
+    z24.object({
+      id: z24.string(),
+      version: z24.number().int(),
+      service: z24.string(),
+      title: localizedTextSchema,
+      description: localizedTextSchema,
+      category: z24.enum(CATALOGUE_CATEGORIES),
+      examplePrompts: z24.array(localizedTextSchema),
+      mark: z24.object({ color: z24.string().optional(), logo: z24.string().optional() }),
+      offered: z24.boolean(),
+      parts: z24.array(
+        z24.object({
+          part: z24.enum(CATALOGUE_PARTS),
+          connectorType: z24.string(),
+          name: z24.string(),
+          title: localizedTextSchema.optional(),
+          description: localizedTextSchema,
+          authScheme: z24.string(),
+          settings: z24.record(z24.string(), z24.unknown()),
+          fields: z24.array(
+            z24.object({
+              label: localizedTextSchema,
+              help: localizedTextSchema.optional(),
+              optional: z24.boolean(),
+              setting: z24.string().optional(),
+              secret: z24.boolean(),
+              default: z24.string().optional()
+            })
+          ),
+          prerequisites: z24.array(
+            z24.object({ text: localizedTextSchema, value: z24.string().optional() })
+          ),
+          hosts: z24.array(z24.string()),
+          operations: z24.array(
+            z24.object({
+              name: z24.string(),
+              title: z24.string().optional(),
+              description: z24.string().optional(),
+              effect: z24.enum(OPERATION_EFFECTS5),
+              recommended: z24.boolean(),
+              declaration: z24.record(z24.string(), z24.unknown()).optional()
+            })
+          ),
+          sharedAccountNote: localizedTextSchema,
+          documentSource: z24.boolean()
+        })
+      )
+    })
+  ).default([])
 });
 var connectionSecretWriteSchema = z24.object({
   value: z24.string().min(1).max(SECRET_VALUE_MAX_CHARS),
-  expectedVersion: z24.number().int().positive().nullable()
+  expectedVersion: z24.number().int().positive().nullable(),
+  expectedRevision: z24.number().int().positive()
 });
 var connectionDiscoveryRequestSchema = z24.object({ status: z24.literal("queued") });
 var personContextSubjectSchema = z24.object({
@@ -6596,7 +6833,10 @@ var auditActivityTargetSchema = z30.object({
 var auditActivitySchema = z30.object({
   correlationId: z30.string(),
   at: timestampSchema,
-  label: z30.string(),
+  /** The type of the event that titles the activity; the interface words it. */
+  type: z30.string(),
+  /** What a tool says it did, such as `workspace.exec`, where a tool's event titles it. */
+  action: z30.string().optional(),
   tier: z30.enum(AUDIT_TIERS),
   outcome: z30.enum(AUDIT_OUTCOMES),
   actor: auditActivityActorSchema,
@@ -7609,6 +7849,7 @@ var knowledgeOperations = {
 
 // src/operations/operations.ts
 import {
+  callableOperationsPageSchema,
   OPERATION_CONFIRMATION_DECISIONS,
   OPERATION_EFFECTS as OPERATION_EFFECTS6,
   OPERATION_ORIGIN_KINDS
@@ -7675,6 +7916,31 @@ var operationRunOperations = {
     errors: [],
     rateClass: "read"
   }),
+  "operations.list_callable": defineRegisteredOperation({
+    id: "operations.list_callable",
+    method: "GET",
+    path: "/api/v1/operations/callable",
+    summary: "List a page of the operations a step of a Workflow may call, as far as the caller may call them",
+    tag: "Operations",
+    auth: "principal",
+    scope: "config_assets:read",
+    // No right of its own: each operation is listed exactly where its own check of a call
+    // from a Workflow step lets the caller call it. The listing grants nothing.
+    requires: [],
+    effect: "reading",
+    query: z38.object({
+      /** Who calls: a step of a Workflow. An App's listing is the agent's alone. */
+      for: z38.enum(["workflow"]).default("workflow"),
+      cursor: z38.string().min(1).optional(),
+      /** An exact full operation name. */
+      name: z38.string().min(1).optional(),
+      /** Only operation names starting with this, such as `connection.crm.`. */
+      prefix: z38.string().min(1).optional()
+    }),
+    response: json(callableOperationsPageSchema),
+    errors: [],
+    rateClass: "read"
+  }),
   "operations.decide": defineRegisteredOperation({
     id: "operations.decide",
     method: "POST",
@@ -8589,8 +8855,9 @@ import {
   WORKFLOW_RESERVED_STEP_TYPES,
   WORKFLOW_DATASET_STATES,
   WORKFLOW_RUN_MODES,
-  WORKFLOW_RUN_STATUSES as WORKFLOW_RUN_STATUSES2,
+  WORKFLOW_RUN_STATUSES as WORKFLOW_RUN_STATUSES3,
   WORKFLOW_STEP_RUN_STATUSES,
+  WORKFLOW_TEST_REVISIONS as WORKFLOW_TEST_REVISIONS3,
   WORKFLOW_STEP_TYPES,
   WORKFLOW_DATASET_DOWNLOAD_FORMATS,
   WORKFLOW_TRIGGER_KINDS
@@ -8599,7 +8866,7 @@ import { z as z44 } from "zod";
 var WORKFLOW_RUN_OUTPUT_PREVIEW_MAX_CHARS = 2e3;
 var WORKFLOW_RUN_KEY_MAX_CHARS = 200;
 var runKeySchema = z44.string().min(1).max(WORKFLOW_RUN_KEY_MAX_CHARS);
-var runStatusSchema = z44.enum(WORKFLOW_RUN_STATUSES2);
+var runStatusSchema = z44.enum(WORKFLOW_RUN_STATUSES3);
 var stepRunStatusSchema = z44.enum(WORKFLOW_STEP_RUN_STATUSES);
 var stepTypeSchema = z44.enum([...WORKFLOW_STEP_TYPES, ...WORKFLOW_RESERVED_STEP_TYPES]);
 var countsSchema = z44.object({
@@ -8675,6 +8942,18 @@ var workflowRunSchema = z44.object({
   }).optional(),
   /** The Operation Run of the call that started the run. */
   operationRunId: z44.string().optional(),
+  /**
+   * The action of an App's draft whose click started this test run (DP-1): the App, the
+   * revision of its draft and the action, by name, and whether the Workflow's draft or its
+   * published revision ran. Missing on every other run.
+   */
+  startedFrom: z44.object({
+    kind: z44.literal("app"),
+    app: z44.string(),
+    appRevisionId: z44.string(),
+    action: z44.string(),
+    workflowRevision: z44.enum(WORKFLOW_TEST_REVISIONS3)
+  }).optional(),
   parentRunId: z44.string().optional(),
   parentStepRunId: z44.string().optional(),
   rootRunId: z44.string(),
@@ -8817,6 +9096,8 @@ var workflowSummarySchema = z44.object({
   description: z44.string().optional(),
   /** The published revision: what a run started now has as its `definitionRevisionId`. */
   definitionRevisionId: z44.string(),
+  /** The workspace that owns the Workflow (WS-OWN-1b). Missing where the instance owns it. */
+  workspaceId: z44.string().optional(),
   /** Whether a start by hand is accepted now, as far as that is known before its input. */
   runnable: z44.boolean(),
   /** Why not. Empty exactly where `runnable` is true. */
@@ -8826,6 +9107,11 @@ var workflowSummarySchema = z44.object({
    * from which a page builds its start form. Missing where the definition cannot be read.
    */
   inputs: z44.record(z44.string(), z44.unknown()).optional(),
+  /**
+   * How the published revision is started, the kinds of its trigger: `manual`, `schedule`,
+   * `parent` (by a step of another Workflow). Missing where the definition cannot be read.
+   */
+  triggers: z44.array(z44.string()).optional(),
   /**
    * The display label of the service principal every run of the Workflow acts as. Missing
    * where that principal is disabled or gone, which `reasons` then says.
@@ -9163,6 +9449,7 @@ var schemas_exports = {};
 __export(schemas_exports, {
   API_ERROR_MEANINGS: () => API_ERROR_MEANINGS,
   APP_ASSET_KIND: () => APP_ASSET_KIND,
+  APP_PUBLISH_WORKFLOWS_MAX: () => APP_PUBLISH_WORKFLOWS_MAX,
   ASSET_CHECK_VERBS: () => ASSET_CHECK_VERBS,
   ASSET_GET_FILES_MAX_BYTES: () => ASSET_GET_FILES_MAX_BYTES,
   ASSET_PUT_FILES_MAX_BYTES: () => ASSET_PUT_FILES_MAX_BYTES,
@@ -9207,6 +9494,7 @@ __export(schemas_exports, {
   agentRuntimeMessageMetadataSchema: () => agentRuntimeMessageMetadataSchema,
   agentToolReferenceSchema: () => agentToolReferenceSchema,
   agentTryConversationResponseSchema: () => agentTryConversationResponseSchema,
+  agentUseSchema: () => agentUseSchema,
   allowDraftHostRequestSchema: () => allowDraftHostRequestSchema,
   allowDraftHostResponseSchema: () => allowDraftHostResponseSchema,
   annotateFeedbackRequestSchema: () => annotateFeedbackRequestSchema,
@@ -9228,11 +9516,15 @@ __export(schemas_exports, {
   appModeSchema: () => appModeSchema,
   appPreviewRequestSchema: () => appPreviewRequestSchema,
   appPreviewSchema: () => appPreviewSchema,
+  appPublishRefusalSchema: () => appPublishRefusalSchema,
+  appPublishReviewSchema: () => appPublishReviewSchema,
   appSessionContextRequestSchema: () => appSessionContextRequestSchema,
   appSessionContextSchema: () => appSessionContextSchema,
   appSqlActionUnavailableSchema: () => appSqlActionUnavailableSchema,
   appStorageWriteRequestSchema: () => appStorageWriteRequestSchema,
   appStorageWriteResponseSchema: () => appStorageWriteResponseSchema,
+  appTryActionRequestSchema: () => appTryActionRequestSchema,
+  appTryActionResultSchema: () => appTryActionResultSchema,
   appWorkflowActionUnavailableSchema: () => appWorkflowActionUnavailableSchema,
   approvalCheckResultSchema: () => approvalCheckResultSchema,
   approvalDecisionMessageMetadataSchema: () => approvalDecisionMessageMetadataSchema,
@@ -9445,6 +9737,7 @@ __export(schemas_exports, {
   runObservationSchema: () => runObservationSchema,
   safeConfigSchema: () => safeConfigSchema,
   saveApprovalSchema: () => saveApprovalSchema,
+  scopeAssignmentsOverviewSchema: () => scopeAssignmentsOverviewSchema,
   sendAdministeredUserInvitationResponseSchema: () => sendAdministeredUserInvitationResponseSchema,
   sendFeedbackRequestSchema: () => sendFeedbackRequestSchema,
   servicePrincipalDetailSchema: () => servicePrincipalDetailSchema,
@@ -9452,6 +9745,8 @@ __export(schemas_exports, {
   servicePrincipalSchema: () => servicePrincipalSchema,
   servicePrincipalStatusSchema: () => servicePrincipalStatusSchema,
   sessionTokenDelegatedActorSchema: () => sessionTokenDelegatedActorSchema,
+  setAgentUseRequestSchema: () => setAgentUseRequestSchema,
+  setAgentUseResponseSchema: () => setAgentUseResponseSchema,
   setAssetAvailabilityRequestSchema: () => setAssetAvailabilityRequestSchema,
   setAssetDefaultRequestSchema: () => setAssetDefaultRequestSchema,
   setAssetDefaultResponseSchema: () => setAssetDefaultResponseSchema,
@@ -10202,6 +10497,7 @@ export {
   APP_BRIDGE_NAME_MAX_CHARS,
   APP_BRIDGE_REQUEST_ID_MAX_CHARS,
   APP_BRIDGE_VERSION,
+  APP_PUBLISH_WORKFLOWS_MAX,
   ASSET_CHECK_VERBS,
   ASSET_GET_FILES_MAX_BYTES,
   ASSET_PUT_FILES_MAX_BYTES,
@@ -10260,6 +10556,7 @@ export {
   agentRuntimeMessageMetadataSchema,
   agentToolReferenceSchema,
   agentTryConversationResponseSchema,
+  agentUseSchema,
   allowDraftHostRequestSchema,
   allowDraftHostResponseSchema,
   annotateFeedbackRequestSchema,
@@ -10288,12 +10585,16 @@ export {
   appModeSchema,
   appPreviewRequestSchema,
   appPreviewSchema,
+  appPublishRefusalSchema,
+  appPublishReviewSchema,
   appSessionContextRequestSchema,
   appSessionContextSchema,
   appSqlActionUnavailableSchema,
   appStorageMutationSchema,
   appStorageWriteRequestSchema,
   appStorageWriteResponseSchema,
+  appTryActionRequestSchema,
+  appTryActionResultSchema,
   appWorkflowActionUnavailableSchema,
   appWorkflowRunSchema,
   approvalCheckResultSchema,
@@ -10556,6 +10857,7 @@ export {
   scheduledStartFieldsSchema,
   scheduledStartRunSchema,
   scheduledStartSchema,
+  scopeAssignmentsOverviewSchema,
   selectContractBaseline,
   sendAdministeredUserInvitationResponseSchema,
   sendFeedbackRequestSchema,
@@ -10564,6 +10866,8 @@ export {
   servicePrincipalSchema,
   servicePrincipalStatusSchema,
   sessionTokenDelegatedActorSchema,
+  setAgentUseRequestSchema,
+  setAgentUseResponseSchema,
   setAssetAvailabilityRequestSchema,
   setAssetDefaultRequestSchema,
   setAssetDefaultResponseSchema,