@work-shape/catalyst-asset-schemas 0.0.0-stage → 0.8.0-rc.10

package/dist/index.js

@@ -0,0 +1,2540 @@
+// src/asset-types.ts
+var ASSET_ACCESS_VERBS = ["read", "write", "delete", "publish"];
+var localeCodes = ["en", "de"];
+var REASONING_EFFORTS = ["none", "low", "medium", "high", "xhigh", "max"];
+var SKILL_STARTERS_MAX = 2;
+var AGENT_STARTERS_MAX = 4;
+var SKILL_STARTER_LINE_MAX_LENGTH = 60;
+var SKILL_SUMMARY_MAX_LENGTH = 120;
+var SKILL_ORIGINS = ["instance", "release"];
+var SKILL_RESOURCE_MEDIA_TYPES = [
+  "text/markdown",
+  "text/plain",
+  "application/json",
+  "application/yaml"
+];
+var APP_AUDIENCES = ["self", "workspace", "instance"];
+
+// src/contract-values/agent.ts
+var AGENT_ACTIONS = [
+  "agent.read",
+  "agent.write",
+  "agent.publish",
+  // Decides a held publish of an agent a workspace owns (WS-PUB-1b).
+  "agent.approve",
+  "agent.delete",
+  // Converse with the agent where it is available (AGENT-USE-1).
+  "agent.use"
+];
+
+// src/contract-values/skill.ts
+var SKILL_ACTIONS = [
+  "skill.read",
+  "skill.write",
+  "skill.delete",
+  "skill.approve"
+];
+
+// src/contract-values/connection.ts
+var CONNECTION_ACTIONS = [
+  "connection.read",
+  "connection.use",
+  "connection.write",
+  "connection.delete",
+  "connection.approve"
+];
+
+// src/contract-values/app.ts
+var APP_ACTIONS = [
+  "app.read",
+  "app.write",
+  "app.publish",
+  "app.approve",
+  "app.delete",
+  "app.use"
+];
+
+// src/contract-values/workflow.ts
+var WORKFLOW_ACTIONS = [
+  "workflow.read",
+  "workflow.write",
+  "workflow.publish",
+  "workflow.approve",
+  "workflow.delete",
+  "workflow.use",
+  "workflow.read_run_data"
+];
+
+// src/contract-values/data-store.ts
+var DATA_STORE_ACTIONS = [
+  "data_store.read",
+  "data_store.write",
+  "data_store.publish",
+  "data_store.delete",
+  "data_store.insert",
+  "data_store.execute",
+  "data_store.records"
+];
+
+// src/contract-values/knowledge-base.ts
+var KNOWLEDGE_BASE_ACTIONS = [
+  "knowledge_base.read",
+  "knowledge_base.write",
+  "knowledge_base.ingest",
+  "knowledge_base.publish",
+  "knowledge_base.delete",
+  "knowledge_base.use"
+];
+
+// src/contract-values/mail-sender.ts
+var MAIL_SENDER_ACTIONS = [
+  // Sending e-mail as one sender of the instance (`mail.send`). The `admin` role holds it on
+  // the sender `system`; a member only by a grant.
+  "mail_sender.use"
+];
+
+// src/contract-values/guardrail.ts
+var GUARDRAIL_ACTIONS = [
+  "guardrail.read",
+  "guardrail.write",
+  "guardrail.publish",
+  "guardrail.delete"
+];
+
+// src/contract-values/operations.ts
+var OPERATIONS_ACTIONS = ["operations.approve"];
+
+// src/contract-values/feedback.ts
+var FEEDBACK_ACTIONS = [
+  // Reading the written feedback on agent messages and marking it handled (LU-4): on the
+  // instance, or on one workspace for the agents it owns. No bundle carries it.
+  "feedback.review"
+];
+
+// src/contract-values/administration.ts
+var ADMINISTRATION_ACTIONS = [
+  "users.manage",
+  // Deleting a person's account and their data, beside `users.manage` (RIGHTS-1e, D5). Its
+  // default sits with `superadmin` alone.
+  "users.delete",
+  "usage.view",
+  // Setting the spend limits of the instance, of shared workspaces and of users (LU-2).
+  // Instance admins hold it; workspace owners do not.
+  "limits.manage",
+  // Usage by named person beyond one's own (LU-3, limits spec 3.4): the Users view of the
+  // instance, and an owner's figures per member of a workspace. A separate right because the
+  // works council has a say on it (BetrVG section 87(1) no. 6).
+  "usage.view_users",
+  "audit.view",
+  // Seeing how the instance runs: its background jobs, its Operation Runs, its modules and what
+  // it runs on, the Settings group "System" (RIGHTS-1e; UX audit ruling 2). Its default sits
+  // with `superadmin` alone, so a customer's admin keeps the audit log and not these pages.
+  "system.view",
+  // Running a background job again that failed or died (RIGHTS-1e; UX audit ruling 2). Its
+  // default sits with `superadmin` alone.
+  "jobs.retry",
+  "api_access.manage",
+  // Creating service principals, giving and taking their rights, enabling and disabling them.
+  // Their keys stay with `api_access.manage`.
+  "service_principals.manage",
+  "agent_models.manage",
+  // Editing and resetting the built-in roles `user` and `admin`, and deciding their pending
+  // actions (Felix, 2026-10-21). Its default sits with `superadmin` alone.
+  "roles.edit_built_in",
+  "assets.release"
+];
+
+// src/contract-values/workspace.ts
+var WORKSPACE_ACTIONS = [
+  // The two bundles of a workspace: one row each, expanded by the evaluator (`bundleCarries`).
+  "builder",
+  "publisher"
+];
+
+// src/contract-values.ts
+var AUTH_SCOPE_WILDCARD = "*";
+var CHAT_SESSION_AUTH_SCOPES = [
+  "me:read",
+  "me:delete",
+  "config:read",
+  "conversation:read",
+  "conversation:write",
+  "run:start",
+  "run:observe",
+  "run:cancel",
+  "run:command"
+];
+var FIRST_PARTY_AUTH_SCOPES = [
+  AUTH_SCOPE_WILDCARD,
+  ...CHAT_SESSION_AUTH_SCOPES,
+  "collaboration_workspace:read",
+  "collaboration_workspace:manage",
+  "me:write",
+  "governance:read",
+  "governance:write",
+  "user_admin:read",
+  "user_admin:write",
+  "api_access:read",
+  "api_access:write",
+  "config_assets:read",
+  "config_assets:write",
+  // Moving the published pointer of an asset. A credential that writes drafts with
+  // `config_assets:write` publishes none of them without this one.
+  "config_assets:publish",
+  "config_assets:release",
+  // The rows of a Data Store: reading them, and adding or loading them. The definition of a
+  // store and its migrations stay under `config_assets:*`. A scope caps what a key may be
+  // used for; whether its holder may do it is decided by the grants.
+  "data_store_rows:read",
+  "data_store_rows:write"
+];
+var ACTIONS = [
+  ...AGENT_ACTIONS,
+  ...SKILL_ACTIONS,
+  ...CONNECTION_ACTIONS,
+  ...APP_ACTIONS,
+  ...WORKFLOW_ACTIONS,
+  ...DATA_STORE_ACTIONS,
+  ...KNOWLEDGE_BASE_ACTIONS,
+  ...MAIL_SENDER_ACTIONS,
+  ...GUARDRAIL_ACTIONS,
+  ...OPERATIONS_ACTIONS,
+  ...FEEDBACK_ACTIONS,
+  ...ADMINISTRATION_ACTIONS,
+  ...WORKSPACE_ACTIONS
+];
+var APP_ERROR_STATUS_CODES = {
+  BAD_REQUEST: 400,
+  UNAUTHENTICATED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  CONFLICT: 409,
+  REVISION_CONFLICT: 412,
+  PRECONDITION_REQUIRED: 428,
+  TIMEOUT: 504,
+  VALIDATION_FAILED: 422,
+  RATE_LIMITED: 429,
+  POLICY_DENIED: 403,
+  GUARDRAIL_BLOCKED: 403,
+  DECLINED: 403,
+  IDEMPOTENCY_KEY_REUSED: 409,
+  OPERATION_IN_PROGRESS: 409,
+  OPERATION_EXPIRED: 409,
+  OUTPUT_NOT_RETAINED: 409,
+  INTERNAL: 500
+};
+var IDEMPOTENCY_KEY_MAX_LENGTH = 255;
+var PROVIDER_PORTS = ["models", "mail", "objectStorage", "sandbox", "secrets"];
+var PROVIDER_REGIONS = ["eu", "global"];
+var PROVIDER_CHECK_ERROR_CLASSES = [
+  "unreachable",
+  "timeout",
+  "access_denied",
+  "not_found",
+  // The bucket an object store is configured with does not exist. The check creates none.
+  "bucket_missing",
+  "rejected",
+  "failed"
+];
+var CONNECTION_NAME_PATTERN = /^[a-z][a-z0-9]*([_-][a-z0-9]+)*$/u;
+var CONNECTION_NAME_MAX_LENGTH = 64;
+var GUARDRAIL_NAME_PATTERN = /^[a-z][a-z0-9]*([_-][a-z0-9]+)*$/u;
+var GUARDRAIL_NAME_MAX_LENGTH = 64;
+var CONNECTION_EXPOSURES = ["agent", "bridge", "workflow", "outside"];
+var CONNECTION_HEALTH_STATES = [
+  "unknown",
+  "ok",
+  "failed",
+  "needs_configuration",
+  "secret_unreadable"
+];
+var GRANT_HOLDER_KINDS = ["user", "service_principal", "role", "group"];
+var GRANT_SCOPE_KINDS = ["instance", "workspace", "asset"];
+var ROLE_GRANT_SCOPE_KINDS = [
+  "instance",
+  "workspace",
+  "asset"
+];
+var ROLE_PENDING_CHANGES = ["added", "removed"];
+var ROLE_PENDING_DECISIONS = ["apply", "dismiss"];
+var GRANT_EFFECTS = ["allow", "deny"];
+var ACCESS_SOURCES = ["role", "legacy_ref", "grant", "membership"];
+var POLICY_VALUES = ["allow", "confirm", "approval", "deny"];
+var AUTH_PRINCIPAL_KINDS = ["user", "service"];
+var ADMINISTERED_USER_STATUSES = ["active", "disabled", "deleting"];
+var SERVICE_PRINCIPAL_STATUSES = ["active", "disabled"];
+var WORKFLOW_RIGHT_NEEDED_FOR = ["publish", "run"];
+var WORKFLOW_RIGHTS_REVISIONS = ["draft", "published"];
+var WORKFLOW_RUN_ACCOUNT_STATUSES = [...SERVICE_PRINCIPAL_STATUSES, "unknown"];
+var WORKFLOW_RIGHT_REFUSALS = [
+  "not_grantable",
+  "not_administrator",
+  "not_held",
+  "account_unavailable",
+  "asset_unavailable",
+  "not_visible"
+];
+var SERVICE_PRINCIPAL_PERMISSIONS = [
+  "config_assets.read",
+  "config_assets.release"
+];
+var API_CREDENTIAL_SCOPES = [
+  "config_assets:read",
+  "config_assets:release"
+];
+var APP_ERROR_CODES = [
+  "BAD_REQUEST",
+  "UNAUTHENTICATED",
+  "FORBIDDEN",
+  "NOT_FOUND",
+  "CONFLICT",
+  "REVISION_CONFLICT",
+  "PRECONDITION_REQUIRED",
+  "TIMEOUT",
+  "VALIDATION_FAILED",
+  "RATE_LIMITED",
+  "POLICY_DENIED",
+  "GUARDRAIL_BLOCKED",
+  "DECLINED",
+  "IDEMPOTENCY_KEY_REUSED",
+  "OPERATION_IN_PROGRESS",
+  "OPERATION_EXPIRED",
+  "OUTPUT_NOT_RETAINED",
+  "INTERNAL"
+];
+var OPERATION_EFFECTS = ["reading", "changing"];
+var CATALOGUE_PARTS = ["tools", "source"];
+var CATALOGUE_CATEGORIES = ["mail", "files", "accounting", "databases", "other"];
+var OPERATION_TARGETS = ["live", "test", "dry_run"];
+var OPERATION_RUN_STATUSES = [
+  "running",
+  "pending_confirmation",
+  "pending_approval",
+  "done",
+  "failed",
+  "denied",
+  "expired"
+];
+var OPERATION_ORIGIN_KINDS = [
+  "agent",
+  "user",
+  "cli",
+  "mcp",
+  "app",
+  "workflow",
+  "schedule"
+];
+var OPERATION_RUN_DECISION_MODES = [
+  "direct",
+  "confirmed",
+  "approved",
+  "declined"
+];
+var OPERATION_RUN_DECISION_REASONS = [
+  "inherited_approval_not_applied",
+  "workflow_publish",
+  "approved_by_caller"
+];
+var OPERATION_DENIAL_REASONS = [
+  "no_grant",
+  "denied",
+  "unknown_action",
+  "holder_inactive",
+  "holder_not_administrable",
+  "user_only",
+  "outside_key_scope"
+];
+var APPROVAL_REQUEST_STATUSES = [
+  "pending",
+  "approved",
+  "rejected",
+  "changes_requested",
+  "superseded",
+  "withdrawn",
+  "reverted"
+];
+var APPROVAL_CHECK_STATUSES = ["passed", "warned", "blocked"];
+var APPROVAL_EXECUTIONS = [
+  "queued",
+  "done",
+  "failed",
+  "interrupted",
+  "refused",
+  "expired",
+  // A confirmation in the Inbox whose Allow left the call waiting for an approver: it ended
+  // here, and the call waits as the approval request `approvalRequestId` of `applyResult`.
+  "held"
+];
+var SKILL_CHANGE_TYPES = ["replace", "add", "new_resource"];
+var GUARDRAIL_OUTCOMES = ["allow", "warn", "require_approval", "block"];
+var APP_MODES = ["published", "draft"];
+var ASSET_NAME_REFUSAL_REASONS = ["name_invalid", "name_taken"];
+var ASSET_SYNC_CHANGE_TYPES = ["put", "delete"];
+var ASSET_LIFECYCLES = ["active", "draft_published"];
+var ASSET_REPRESENTATIONS = ["config", "files"];
+var CONFIG_ASSET_KINDS = ["agent", "skill"];
+var CONFIG_ASSET_CHANGE_OPERATIONS = ["create", "update", "delete", "revert"];
+var AGENT_AVAILABILITY_MODES = ["all", "selected"];
+var AGENT_USE_SETTINGS = ["everyone", "granted"];
+var AGENT_EDITABLE_FIELDS = [
+  "displayName",
+  "description",
+  "welcomeMessage",
+  "welcomeSubtitle",
+  "instructions",
+  "modelBindingId",
+  "reasoningEffort",
+  "maxSteps",
+  "toolNames",
+  "skillNames",
+  "knowledgeBases",
+  "initialPrompts"
+];
+var ASSET_REPO_BUNDLE_KINDS = ["full", "incremental"];
+var WORKSPACE_FILE_KINDS = ["page", "upload", "generated_file"];
+var WORKSPACE_VISIBILITIES = ["discoverable", "private"];
+var WORKSPACE_MEMBERSHIP_ROLES = ["owner", "admin", "member"];
+var WORKSPACE_ACCENT_COLORS = [
+  "garnet",
+  "ruby",
+  "mahogany",
+  "copper",
+  "amber",
+  "olive",
+  "jade",
+  "emerald",
+  "teal",
+  "turquoise",
+  "azure",
+  "sapphire",
+  "indigo",
+  "violet",
+  "magenta",
+  "rose",
+  "stone",
+  "slate"
+];
+var COLLABORATION_WORKSPACE_KINDS = ["personal", "shared"];
+var WORKSPACE_ACCESS_STATES = ["member", "request_pending", "can_request"];
+var DELETION_STATES = ["deleting", "deleted"];
+var WORKSPACE_SECTIONS = ["agents", "apps"];
+var MODEL_USAGE_TIERS = [
+  "very_low",
+  "low",
+  "moderate",
+  "elevated",
+  "high",
+  "very_high"
+];
+var THEME_MODE_PREFERENCES = ["light", "dark", "system"];
+var TOOL_GROUPS = [
+  "documents",
+  "web",
+  "files",
+  "results",
+  "skills",
+  "platform",
+  "instance"
+];
+var INFRASTRUCTURE_SECRET_STATES = ["set", "missing"];
+var INFRASTRUCTURE_WITHHELD_FIELDS = ["endpointHost", "bucket"];
+var OPENAI_COMPATIBLE_APIS = ["chat_completions", "responses"];
+var MODEL_PROVIDER_AUTH_MODES = ["bearer", "api-key"];
+var CONVERSATION_VISIBILITIES = ["workspace", "private"];
+var CONVERSATION_KINDS = ["chat", "run_thread"];
+var WEB_SOURCE_PROVIDERS = [
+  "openai-native",
+  "serper",
+  "tavily",
+  "firecrawl",
+  "browserbase",
+  "direct"
+];
+var CHAT_MESSAGE_ROLES = ["user", "assistant", "system", "tool"];
+var CONVERSATION_ATTACHMENT_STATUSES = [
+  "queued",
+  "preprocessing",
+  "ready",
+  "failed",
+  "unsupported",
+  "deleted"
+];
+var ATTACHMENT_CREATE_OUTCOMES = ["created", "already_available"];
+var STRUCTURED_DATA_REVIEW_REASONS = ["uncertain", "conflicting"];
+var FOLLOW_UP_MODES = ["queue", "steer"];
+var FOLLOW_UP_STATUSES = ["pending", "dispatched", "consumed", "cancelled"];
+var AGENT_RUN_STATUSES = [
+  "queued",
+  "running",
+  "waiting_for_decision",
+  "waiting_for_subagents",
+  "cancelling",
+  "completed",
+  "cancelled",
+  "failed"
+];
+var AGENT_RUN_FAILURE_CATEGORIES = [
+  "app_error",
+  "internal_error",
+  "runtime_interrupted",
+  "abort_error",
+  "unknown_error"
+];
+var TOOL_INPUT_PARSE_ERROR_CODES = ["invalid_json", "invalid_text"];
+var WAITING_OPERATION_RUN_STATUSES = [
+  "pending_confirmation",
+  "pending_approval"
+];
+var OPERATION_CONFIRMATION_DECISIONS = ["confirm", "decline"];
+var PERSON_POLICY_SETTINGS = ["always_allow", "ask", "never"];
+var OPERATION_CHANGE_CLASSES = ["reversible", "irreversible", "outward"];
+var TOOL_DECISION_MODES = ["confirm", "approval"];
+var TOOL_DECISION_OUTCOMES = ["confirmed", "declined", "expired", "cancelled"];
+var TOOL_CALL_STATES = [
+  "input_available",
+  "waiting_for_decision",
+  "output_available",
+  "output_error"
+];
+var SUPPORTED_IMAGE_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/webp",
+  "image/gif"
+];
+var ARTIFACT_PREVIEW_IMAGE_FORMATS = ["png", "webp", "jpeg"];
+var ARTIFACT_PREVIEW_STATUSES = ["ready", "pending", "failed", "unsupported"];
+var WORKSPACE_COMMAND_STATUSES = [
+  "queued",
+  "running",
+  "cancelling",
+  "completed",
+  "failed",
+  "cancelled"
+];
+var TOOL_DISPLAY_MODES = ["inline", "side_panel", "fullscreen"];
+var JOB_STATUSES = [
+  "queued",
+  "running",
+  "succeeded",
+  "failed",
+  "dead",
+  "cancelled"
+];
+var AUDIT_ACTOR_KINDS = ["user", "assistant", "service", "system"];
+var AUDIT_TIERS = ["governance", "workflow", "runtime", "telemetry"];
+var AUDIT_OUTCOMES = ["success", "failed", "denied", "warning"];
+var MODEL_USAGE_EVENT_STATUSES = ["pending", "settled", "failed", "abandoned"];
+var MODEL_USAGE_SOURCES = ["provider_reported", "not_reported", "estimated"];
+var USAGE_COST_STATUSES = ["settled", "incomplete", "unpriced"];
+var CONNECTION_OPERATION_STATUSES = [
+  "ready",
+  /** Accepted, a discovering type, and no discovery has pinned it yet. */
+  "awaiting_discovery",
+  /** The catalog's fingerprint differs from the accepted one. */
+  "needs_review",
+  /** Accepted, and the last discovery did not list it or listed a schema nothing can check. */
+  "unknown",
+  "disabled"
+];
+var CONNECTION_SECRET_STATES = ["set", "not_set", "unreadable"];
+var CONNECTOR_TEST_STATUSES = [
+  "ready",
+  "unauthorized",
+  "network_denied",
+  "unavailable",
+  /** The server asks for an OAuth sign-in, or the Connection signs in and nobody has. */
+  "oauth_required"
+];
+var CONNECTION_CREDENTIAL_MODES = ["shared", "user"];
+var CONNECTION_BINDING_STATES = ["connected", "needs_reconnect", "revoked"];
+var CONNECTION_PROPOSAL_STATES = ["ready", "needs_setup"];
+var CONNECTION_PROPOSAL_BINDING_STATES = [
+  "connected",
+  "needs_reconnect",
+  "not_connected"
+];
+var CONNECTION_SIGN_IN_NEEDS = ["not_connected", "needs_reconnect"];
+var CONNECTION_OAUTH_REGISTRATIONS = ["dcr", "preregistered", "managed"];
+var CONNECTION_PROVIDER_REVOCATIONS = ["confirmed", "failed", "not_offered"];
+var CONNECTION_ORIGINS = ["release", "runtime"];
+var CONNECTION_NETWORKS = ["public", "private"];
+var DATA_STORE_SCALAR_TYPES = [
+  "text",
+  "integer",
+  "number",
+  "boolean",
+  "date",
+  "timestamp"
+];
+var DATA_STORE_LOAD_CONFLICT_MODES = ["fail", "skip", "update"];
+var DATA_STORE_INSERT_CONFLICT_MODES = [
+  "fail",
+  "skip"
+];
+var DATA_STORE_CONDITIONS = [
+  "server_databases_open",
+  "sessions_open",
+  "temp_files_unbounded"
+];
+var DATA_STORE_STATUSES = ["provisioning", "ready", "retired"];
+var DATA_STORE_MIGRATION_OUTCOMES = ["none", "pending", "applied", "failed"];
+var KNOWLEDGE_BASE_STATUSES = ["unchecked", "preparing", "ok", "needs_attention"];
+var KNOWLEDGE_EMBEDDING_STATES = [
+  "current",
+  "reindex_needed",
+  "reindex_available",
+  "reindexing",
+  "none"
+];
+var KNOWLEDGE_DOCUMENT_STATES = ["pending", "indexed", "failed"];
+var KNOWLEDGE_FILE_MAX_BYTES = 25 * 1024 * 1024;
+var KNOWLEDGE_DOCUMENT_FAILURE_CODES = [
+  // The extractor does not read the file's format.
+  "knowledge_file_format_unsupported",
+  // The file is over a limit of the extraction: its size or the size of its text.
+  "knowledge_file_over_limit",
+  // The file is corrupt, encrypted, or not the format it claims.
+  "knowledge_file_unreadable",
+  // The copy the Knowledge Base owns, or its bytes, are gone.
+  "knowledge_file_missing",
+  // Extraction failed on every attempt.
+  "knowledge_extraction_failed",
+  // A PDF or DOCX on an instance without document processing.
+  "knowledge_file_format_unavailable",
+  // A text file whose bytes are not text.
+  "knowledge_text_unreadable",
+  // No text to search, such as a scanned PDF without a text layer.
+  "knowledge_text_empty",
+  // Indexing failed on every attempt.
+  "knowledge_index_failed",
+  // A PDF or DOCX with more pages than `knowledge.maxPagesPerDocument`, counted before its text
+  // is read.
+  "knowledge_file_too_many_pages",
+  // A built-in or Workflow processor returned output outside its contract.
+  "knowledge_processor_output_invalid",
+  // Conversion exceeded its page-aware deadline.
+  "knowledge_conversion_timeout"
+];
+var KNOWLEDGE_DOCUMENT_WAIT_CODES = [
+  // A usage limit of the instance or the workspace refuses the embedding calls. Indexing goes
+  // on when the limit resets or is raised.
+  "knowledge_usage_limit_reached"
+];
+var KNOWLEDGE_SOURCE_FAILURE_CODES = [
+  // The source did not answer.
+  "knowledge_source_unreachable",
+  // The credential or the account's access was refused for the whole source.
+  "knowledge_source_refused",
+  // A fetch failed on every attempt.
+  "knowledge_fetch_failed",
+  // The Knowledge Base holds its document limit; the listing stopped discovering there.
+  "knowledge_source_limit_reached",
+  "knowledge_item_invalid",
+  "knowledge_fetch_not_allowed",
+  // The Workflow run that called `ingest` ended before the pass did; what it wrote stays.
+  "knowledge_ingest_cancelled",
+  // A person removed the item by hand: no pass puts it back until a publisher lifts the hold.
+  "knowledge_item_removed"
+];
+var KNOWLEDGE_SOURCE_ITEM_FAILURE_CODES = [
+  ...KNOWLEDGE_SOURCE_FAILURE_CODES,
+  "knowledge_file_over_limit",
+  "knowledge_file_format_unsupported"
+];
+var KNOWLEDGE_SOURCE_ITEM_STATES = [
+  "discovered",
+  "fetched",
+  "failed",
+  "withdrawn"
+];
+var KNOWLEDGE_SYNC_MODES = ["initial", "changes", "full", "ingest"];
+var KNOWLEDGE_SYNC_RUN_STATES = ["running", "done", "failed", "superseded"];
+var KNOWLEDGE_SYNC_COUNTS = [
+  "discovered",
+  "added",
+  "changed",
+  "moved",
+  "withdrawn",
+  "failed",
+  "skipped"
+];
+var KNOWLEDGE_SEARCH_SIGNALS = ["semantic", "keyword", "title"];
+var DATABASE_RELATION_TYPES = [
+  "table",
+  "view",
+  "materialized_view",
+  "foreign_table"
+];
+var WORKFLOW_RUN_STATUSES = [
+  "continued",
+  "queued",
+  "running",
+  "waiting",
+  "done",
+  "failed",
+  "cancelled",
+  "limit_reached"
+];
+var WORKFLOW_STEP_TYPES = [
+  "trigger",
+  "operation",
+  "loop",
+  "code",
+  "output",
+  "agent",
+  "notify",
+  /** Starts another Workflow as a child run and waits for it. */
+  "workflow"
+];
+var WORKFLOW_EXECUTED_STEP_TYPES = [...WORKFLOW_STEP_TYPES];
+var WORKFLOW_RESERVED_STEP_TYPES = [
+  /** Reserved in the contract: drawn, and run by no engine yet. */
+  "condition",
+  "parallel"
+];
+var WORKFLOW_TRIGGER_KINDS = ["manual", "schedule", "parent"];
+var NOTIFY_CHANNELS = ["inbox", "mail"];
+var WORKFLOW_STEP_SOURCE_KINDS = [
+  "connection",
+  "data_store",
+  "knowledge_base",
+  "workflow",
+  "mail_sender",
+  "other"
+];
+var OPERATION_SOURCE_KINDS = [
+  "connection",
+  "data_store",
+  "knowledge_base",
+  "workflow",
+  "other"
+];
+var PRINCIPAL_HOLDER_KINDS = [
+  "user",
+  "service_principal"
+];
+var ASSET_OWNER_KINDS = [
+  "instance",
+  "workspace"
+];
+var READING_POLICY_VALUES = ["allow", "deny"];
+var CONNECTION_OPERATION_POLICIES = [
+  "deny",
+  "approval"
+];
+var WORKFLOW_RUN_MODES = ["live", "test"];
+var WORKFLOW_TEST_REVISIONS = ["draft", "published"];
+var APP_ACTION_CALL_STATUSES = [
+  "done",
+  "pending_approval"
+];
+var OPERATIONS_AUDIENCES = [
+  "workflow",
+  "app"
+];
+var DECIDED_APPROVAL_REQUEST_STATUSES = [
+  "approved",
+  "rejected",
+  "changes_requested",
+  "superseded",
+  "withdrawn",
+  "reverted"
+];
+var ENDED_APPROVAL_EXECUTIONS = [
+  "done",
+  "failed",
+  "interrupted",
+  "refused",
+  "expired",
+  "held"
+];
+var GUARDRAIL_HIT_OUTCOMES = [
+  "warn",
+  "require_approval",
+  "block"
+];
+var APPROVAL_CHECK_FAILURE_OUTCOMES = [
+  "warn",
+  "block"
+];
+var THEME_MODES = ["light", "dark"];
+var USER_STATUSES = [
+  "active",
+  "disabled"
+];
+var MESSAGE_FINISH_STATUSES = [
+  "completed",
+  "cancelled"
+];
+var ENDED_AGENT_RUN_STATUSES = [
+  "completed",
+  "cancelled",
+  "failed"
+];
+var ACTIVE_AGENT_RUN_STATUSES = [
+  "queued",
+  "running",
+  "waiting_for_decision",
+  "waiting_for_subagents",
+  "cancelling"
+];
+var ARTIFACT_PREVIEW_IMAGE_MIME_TYPES = [
+  "image/png",
+  "image/jpeg",
+  "image/webp"
+];
+var LIVE_JOB_STATUSES = ["queued", "running"];
+var FAILED_JOB_STATUSES = ["failed", "dead"];
+var AUDIT_EVENT_STATUSES = [
+  "success",
+  "failed",
+  "denied"
+];
+var LISTED_DATA_STORE_STATUSES = [
+  "provisioning",
+  "ready"
+];
+var KNOWLEDGE_CHECK_STATUSES = [
+  "preparing",
+  "ok",
+  "needs_attention"
+];
+var WORKFLOW_STEP_RUN_STATUSES = [
+  "queued",
+  "running",
+  "waiting",
+  "done",
+  "failed",
+  "cancelled"
+];
+var WORKFLOW_ENDED_STATUSES = [
+  "continued",
+  "done",
+  "failed",
+  "cancelled",
+  "limit_reached"
+];
+var MANAGED_FILE_STATUSES = ["available", "released", "deleted"];
+var WORKFLOW_KINDS = ["process", "data"];
+var WORKFLOW_DATASET_DOWNLOAD_FORMATS = ["jsonl", "csv"];
+var WORKSPACE_USE_ASSET_KINDS = ["knowledge_base", "connection"];
+var PUBLISHED_DATA_CONSUMER_KINDS = ["app", "workflow", "knowledge_base"];
+var SCHEDULED_START_STATES = ["active", "paused"];
+var AGENT_PREVIEW_SOURCES = ["draft", "live"];
+
+// src/schemas.ts
+import { z } from "zod";
+
+// src/yaml-bounds.ts
+function yamlValueIssue(value, maxDepth = Number.POSITIVE_INFINITY) {
+  const seen = /* @__PURE__ */ new Set();
+  const open = [{ value, depth: 0 }];
+  let deepest = 0;
+  for (let next = open.pop(); next !== void 0; next = open.pop()) {
+    if (typeof next.value !== "object" || next.value === null) continue;
+    if (seen.has(next.value)) return "alias";
+    seen.add(next.value);
+    deepest = Math.max(deepest, next.depth + 1);
+    for (const child of Array.isArray(next.value) ? next.value : Object.values(next.value)) {
+      open.push({ value: child, depth: next.depth + 1 });
+    }
+  }
+  return deepest > maxDepth ? "depth" : void 0;
+}
+function yamlValueIssueSentence(issue, maxDepth) {
+  return issue === "alias" ? "it uses a YAML anchor with an alias or a merge key, which is not read: write the value out where it is used" : `it nests deeper than ${maxDepth ?? "its reader takes"} levels`;
+}
+
+// src/schemas.ts
+var providerRegionSchema = z.string().trim().min(1).max(32);
+var localizedStringMapSchema = z.object({
+  en: z.string().min(1).optional(),
+  de: z.string().min(1).optional()
+}).strict().refine((value) => value.en !== void 0 || value.de !== void 0, {
+  message: "At least one localized value is required"
+});
+var localizedStringSchema = z.union([z.string().min(1), localizedStringMapSchema]);
+var SKILL_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/u;
+var SKILL_NAME_RULE = "Skill name must start with a letter or a number and contain only letters, numbers, dots, underscores, or hyphens";
+var SKILL_PORTABLE_NAME_MAX_CHARS = 64;
+var SKILL_PORTABLE_DESCRIPTION_MAX_CHARS = 1024;
+var SKILL_PORTABLE_NAME_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/u;
+function skillPortabilityIssues(skill) {
+  const issues = [];
+  if (typeof skill.name === "string" && (!SKILL_PORTABLE_NAME_PATTERN.test(skill.name) || skill.name.length > SKILL_PORTABLE_NAME_MAX_CHARS)) {
+    issues.push({
+      code: "skill_name_not_portable",
+      message: `The name '${skill.name}' is outside the public skill convention: lowercase letters, digits and single hyphens, at most ${SKILL_PORTABLE_NAME_MAX_CHARS} characters. The skill works here and may not be taken as it is elsewhere.`
+    });
+  }
+  if (typeof skill.description === "string" && skill.description.length > SKILL_PORTABLE_DESCRIPTION_MAX_CHARS) {
+    issues.push({
+      code: "skill_description_not_portable",
+      message: `The description has ${skill.description.length} characters. The public skill convention takes at most ${SKILL_PORTABLE_DESCRIPTION_MAX_CHARS}.`
+    });
+  }
+  return issues;
+}
+var skillNameSchema = z.string().min(1).regex(SKILL_NAME_PATTERN, { message: SKILL_NAME_RULE });
+var skillResourcePathSchema = z.string().min(1).superRefine((path, context) => {
+  const segments = path.split("/");
+  if (path.startsWith("/") || /^[A-Za-z]:/u.test(path) || path.includes("\\") || /[\u0000-\u001f\u007f]/u.test(path) || segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+    context.addIssue({
+      code: "custom",
+      message: "Skill resource path must be a normalized relative path"
+    });
+  }
+  if (path.toLowerCase() === "skill.md" || path.toLowerCase().endsWith("/skill.md")) {
+    context.addIssue({
+      code: "custom",
+      message: "SKILL.md is the skill root and cannot also be a resource"
+    });
+  }
+});
+function skillResourceMediaTypeForPath(path) {
+  const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
+  switch (extension) {
+    case ".md":
+      return "text/markdown";
+    case ".txt":
+      return "text/plain";
+    case ".json":
+      return "application/json";
+    case ".yaml":
+    case ".yml":
+      return "application/yaml";
+    default:
+      return void 0;
+  }
+}
+var skillResourceConfigSchema = z.object({
+  path: skillResourcePathSchema,
+  mediaType: z.enum(SKILL_RESOURCE_MEDIA_TYPES),
+  content: z.string().refine((content) => !content.includes("\0"), {
+    message: "Skill resources must contain text, not binary data"
+  })
+}).superRefine((resource, context) => {
+  const expectedMediaType = skillResourceMediaTypeForPath(resource.path);
+  if (!expectedMediaType) {
+    context.addIssue({
+      code: "custom",
+      path: ["path"],
+      message: "Unsupported skill resource extension"
+    });
+  } else if (resource.mediaType !== expectedMediaType) {
+    context.addIssue({
+      code: "custom",
+      path: ["mediaType"],
+      message: `Skill resource '${resource.path}' must use media type '${expectedMediaType}'`
+    });
+  }
+});
+var starterLineSchema = localizedStringSchema.refine(
+  (value) => (typeof value === "string" ? [value] : Object.values(value)).every(
+    (line) => line.length <= SKILL_STARTER_LINE_MAX_LENGTH && !/[\r\n]/u.test(line)
+  ),
+  { message: `Must be one line of at most ${SKILL_STARTER_LINE_MAX_LENGTH} characters` }
+);
+var skillStarterSchema = z.strictObject({
+  title: starterLineSchema,
+  hint: starterLineSchema.optional(),
+  prompt: localizedStringSchema,
+  tools: z.array(z.string().min(1)).optional()
+});
+var SKILL_FRONTMATTER_MAX_BYTES = 8192;
+var SKILL_FRONTMATTER_MAX_DEPTH = 8;
+var SKILL_FRONTMATTER_FIELDS = [
+  "name",
+  "title",
+  "description",
+  "summary",
+  "starters"
+];
+var skillFileEntrySchema = z.object({
+  path: z.string().min(1),
+  sha256: z.string().regex(/^[0-9a-f]{64}$/u),
+  bytes: z.number().int().min(0),
+  mediaType: z.string().min(1)
+});
+var skillConfigObjectSchema = z.object({
+  name: skillNameSchema,
+  title: z.string().min(1),
+  description: z.string().min(1),
+  summary: z.string().min(1).max(SKILL_SUMMARY_MAX_LENGTH, {
+    message: `Skill summary must be at most ${SKILL_SUMMARY_MAX_LENGTH} characters`
+  }).refine((summary) => !/[\r\n]/u.test(summary), {
+    message: "Skill summary must be one line"
+  }).optional(),
+  starters: z.array(skillStarterSchema).max(SKILL_STARTERS_MAX, {
+    message: `A skill carries at most ${SKILL_STARTERS_MAX} starters`
+  }).optional(),
+  content: z.string().min(1),
+  resources: z.array(skillResourceConfigSchema).optional(),
+  files: z.array(skillFileEntrySchema).optional(),
+  frontmatter: z.record(z.string(), z.unknown()).optional().refine(
+    (frontmatter) => frontmatter === void 0 || yamlValueIssue(frontmatter, SKILL_FRONTMATTER_MAX_DEPTH) === void 0 && JSON.stringify(frontmatter).length <= SKILL_FRONTMATTER_MAX_BYTES,
+    {
+      message: `Skill frontmatter holds at most ${SKILL_FRONTMATTER_MAX_BYTES} characters as JSON, nested at most ${SKILL_FRONTMATTER_MAX_DEPTH} levels`
+    }
+  ),
+  origin: z.literal("release").optional(),
+  icon: z.string().min(1).optional()
+});
+var skillConfigSchema = skillConfigObjectSchema.superRefine((skill, context) => {
+  for (const key2 of SKILL_FRONTMATTER_FIELDS) {
+    if (skill.frontmatter && Object.hasOwn(skill.frontmatter, key2)) {
+      context.addIssue({
+        code: "custom",
+        path: ["frontmatter", key2],
+        message: `Skill frontmatter cannot hold '${key2}': it is a field of the skill itself`
+      });
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, resource] of (skill.resources ?? []).entries()) {
+    const pathKey = resource.path.toLowerCase();
+    if (seen.has(pathKey)) {
+      context.addIssue({
+        code: "custom",
+        path: ["resources", index, "path"],
+        message: `Duplicate skill resource path: ${resource.path}`
+      });
+    }
+    seen.add(pathKey);
+  }
+});
+var skillFileFrontmatterSchema = z.looseObject({
+  name: skillNameSchema.optional(),
+  title: z.string().min(1).optional(),
+  description: z.string().min(1),
+  summary: skillConfigObjectSchema.shape.summary,
+  starters: skillConfigObjectSchema.shape.starters
+});
+var welcomeSubtitleSchema = z.union([
+  z.string(),
+  z.object({
+    en: z.string().optional(),
+    de: z.string().optional()
+  }).strict().refine((value) => value.en !== void 0 || value.de !== void 0, {
+    message: "At least one localized value is required"
+  })
+]);
+var agentNameSchema = z.string().min(1).refine((name2) => name2 !== "." && name2 !== "..", {
+  message: "Agent name must not be '.' or '..'"
+});
+var agentConfigSchema = z.object({
+  name: agentNameSchema,
+  displayName: localizedStringSchema,
+  description: localizedStringSchema.optional(),
+  welcomeMessage: localizedStringSchema.optional(),
+  welcomeSubtitle: welcomeSubtitleSchema.optional(),
+  instructions: z.string().min(1),
+  modelProviderId: z.string().min(1).optional(),
+  modelBindingId: z.string().min(1).optional(),
+  reasoningEffort: z.enum(REASONING_EFFORTS).optional(),
+  fastMode: z.boolean().optional(),
+  userSelectableModelBindingIds: z.array(z.string().min(1)).optional(),
+  modelReasoningEfforts: z.record(z.string().min(1), z.enum(REASONING_EFFORTS)).optional(),
+  maxSteps: z.number().int().positive().optional(),
+  toolNames: z.array(z.string().min(1)).default([]),
+  /**
+   * The agents this agent may start as subagents through `run_agent`, beside itself. Only an
+   * agent whose `toolNames` lists `run_agent` starts any.
+   */
+  subagentNames: z.array(agentNameSchema).refine((names) => new Set(names).size === names.length, {
+    message: "A subagent is listed once"
+  }).optional(),
+  skillNames: z.array(skillNameSchema).default([]),
+  knowledgeBases: z.array(z.string().min(1)).refine((names) => new Set(names).size === names.length, {
+    message: "A Knowledge Base is listed once"
+  }).optional(),
+  initialPrompts: z.array(
+    z.object({
+      title: localizedStringSchema,
+      prompt: localizedStringSchema
+    })
+  ).default([]),
+  /**
+   * An agent that ships with the platform, such as Workshaper: the fields as the release
+   * shipped them last. Only the release seed writes it, and every other write keeps it as
+   * stored. A field the instance left as shipped takes what the next release ships; one it
+   * changed stays the instance's.
+   */
+  shipped: z.record(z.string(), z.unknown()).optional()
+});
+var WORKFLOW_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,62}$/u;
+var WORKFLOW_NAME_RULE = "A Workflow id starts with a lowercase letter and holds lowercase letters, digits, '_' and '-', at most 63 characters";
+var workflowConfigSchema = z.strictObject({
+  name: z.string(),
+  manifest: z.looseObject({
+    id: z.string(),
+    name: z.string().min(1),
+    description: z.string().optional()
+  }),
+  files: z.array(z.strictObject({ path: z.string(), content: z.string() })).optional()
+});
+
+// src/skill-markdown.ts
+import yaml from "js-yaml";
+
+// src/yaml-data.ts
+import { JSON_SCHEMA, YAMLException, load } from "js-yaml";
+var YAML_DATA_MAX_VALUES = 1e5;
+function isStorableText(text2) {
+  return !text2.includes("\0") && !/\p{Surrogate}/u.test(text2);
+}
+function checkStorableTexts(value, maxValues) {
+  const pending = [value];
+  for (let seen = 1; pending.length > 0; seen += 1) {
+    if (seen > maxValues) return "too_large";
+    const next = pending.pop();
+    if (typeof next === "string") {
+      if (!isStorableText(next)) return "unstorable";
+    } else if (Array.isArray(next)) {
+      for (const entry of next) pending.push(entry);
+    } else if (typeof next === "object" && next !== null) {
+      for (const [key2, entry] of Object.entries(next)) {
+        if (!isStorableText(key2)) return "unstorable";
+        pending.push(entry);
+      }
+    }
+  }
+  return "storable";
+}
+function readYamlData(text2, file, options = {}) {
+  const fail = (code, message, line, column) => ({
+    ok: false,
+    issue: {
+      code,
+      message,
+      ...line === void 0 ? {} : { line },
+      ...column === void 0 ? {} : { column }
+    }
+  });
+  let value;
+  try {
+    value = load(text2, { schema: JSON_SCHEMA, filename: file });
+  } catch (error) {
+    if (error instanceof YAMLException) {
+      const markLine = error.mark?.line;
+      const line = markLine === void 0 ? void 0 : markLine + 1;
+      const markColumn = error.mark?.column;
+      const column = markColumn === void 0 ? void 0 : markColumn + 1;
+      return error.reason.startsWith("nesting exceeded") ? fail("yaml_too_deep", `'${file}' ${error.reason}.`, line) : fail("yaml_invalid", `'${file}' is not valid YAML: ${error.reason}.`, line, column);
+    }
+    throw error;
+  }
+  if (options.refuseAliases && yamlValueIssue(value) === "alias") {
+    return fail("yaml_alias", `'${file}' is not read: ${yamlValueIssueSentence("alias")}.`);
+  }
+  const texts = checkStorableTexts(value, YAML_DATA_MAX_VALUES);
+  if (texts === "too_large") {
+    return fail(
+      "yaml_too_large",
+      `'${file}' holds more than ${YAML_DATA_MAX_VALUES} values once its aliases are followed (YAML_DATA_MAX_VALUES).`
+    );
+  }
+  if (texts === "unstorable") {
+    return fail(
+      "text_invalid",
+      `'${file}' holds a NUL character or half of a surrogate pair, which cannot be stored.`
+    );
+  }
+  return { ok: true, value };
+}
+var YamlDataError = class extends Error {
+  issue;
+  constructor(issue) {
+    super(issue.message);
+    this.name = "YamlDataError";
+    this.issue = issue;
+  }
+};
+function loadYamlData(text2, file) {
+  const read = readYamlData(text2, file);
+  if (!read.ok) throw new YamlDataError(read.issue);
+  return read.value;
+}
+
+// src/skill-markdown.ts
+var SkillMarkdownError = class extends Error {
+  details;
+  reason;
+  constructor(message, details, reason) {
+    super(message);
+    this.name = "SkillMarkdownError";
+    this.details = details;
+    this.reason = reason;
+  }
+};
+function parseSkillMarkdown(contents, skillFile, skillPath) {
+  const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/u.exec(contents);
+  if (!match) {
+    throw new SkillMarkdownError(`Skill file '${skillFile}' must start with YAML frontmatter`);
+  }
+  const frontmatterRaw = loadFrontmatter(match[1] ?? "", skillFile);
+  if (yamlValueIssue(frontmatterRaw, SKILL_FRONTMATTER_MAX_DEPTH) === "depth") {
+    throw new SkillMarkdownError(
+      `Skill file '${skillFile}' frontmatter is not read: ${yamlValueIssueSentence("depth", SKILL_FRONTMATTER_MAX_DEPTH)}`,
+      void 0,
+      "skill_frontmatter_too_deep"
+    );
+  }
+  const frontmatter = skillFileFrontmatterSchema.safeParse(frontmatterRaw);
+  if (!frontmatter.success) {
+    throw new SkillMarkdownError(`Skill file '${skillFile}' frontmatter is invalid`, {
+      issues: frontmatter.error.issues
+    });
+  }
+  const content = (match[2] ?? "").trim();
+  const { name: named, title, description, summary, starters, ...others } = frontmatter.data;
+  const name2 = named ?? deriveSkillName(skillPath);
+  const json = JSON.stringify(others);
+  if (json.length > SKILL_FRONTMATTER_MAX_BYTES) {
+    throw new SkillMarkdownError(
+      `Skill file '${skillFile}' holds ${json.length} characters of frontmatter beside the fields of the skill (${SKILL_FRONTMATTER_FIELDS.join(", ")}). It holds at most ${SKILL_FRONTMATTER_MAX_BYTES} (SKILL_FRONTMATTER_MAX_BYTES)`,
+      void 0,
+      "skill_frontmatter_too_large"
+    );
+  }
+  const kept = JSON.parse(json);
+  return {
+    name: name2,
+    title: title ?? deriveSkillTitle(name2, content),
+    description,
+    ...summary === void 0 ? {} : { summary },
+    ...starters === void 0 ? {} : { starters },
+    content,
+    ...Object.keys(others).length > 0 ? { frontmatter: kept } : {}
+  };
+}
+function loadFrontmatter(text2, skillFile) {
+  const read = readYamlData(text2, skillFile, { refuseAliases: true });
+  if (read.ok) return read.value;
+  const { issue } = read;
+  if (issue.code === "yaml_alias") {
+    throw new SkillMarkdownError(
+      `Skill file '${skillFile}' frontmatter is not read: ${yamlValueIssueSentence("alias")}`,
+      void 0,
+      "skill_frontmatter_alias"
+    );
+  }
+  if (issue.code === "yaml_too_deep") {
+    throw new SkillMarkdownError(
+      `Skill file '${skillFile}' frontmatter is not read: ${yamlValueIssueSentence("depth", SKILL_FRONTMATTER_MAX_DEPTH)}`,
+      void 0,
+      "skill_frontmatter_too_deep"
+    );
+  }
+  if (issue.code !== "yaml_invalid" || issue.line === void 0 || issue.column === void 0) {
+    throw new SkillMarkdownError(`Skill file '${skillFile}' frontmatter: ${issue.message}`);
+  }
+  const line = issue.line + 1;
+  const { column } = issue;
+  throw new SkillMarkdownError(
+    `Skill file '${skillFile}' frontmatter is not valid YAML at line ${line}, column ${column}: ${issue.message} A value that holds a colon and a space, as a description often does, is written in quotes: description: "Use this when: the user asks"`,
+    { issues: [{ message: issue.message, path: [], line, column }] }
+  );
+}
+function deriveSkillTitle(name2, content) {
+  let fence;
+  for (const line of content.split(/\r?\n/u)) {
+    const marker = /^\s{0,3}(`{3,}|~{3,})/u.exec(line)?.[1];
+    if (marker) {
+      fence = fence === void 0 ? marker : marker.startsWith(fence) ? void 0 : fence;
+      continue;
+    }
+    const heading = fence === void 0 ? /^ {0,3}#{1,6}\s+(.+?)(?:\s+#+)?\s*$/u.exec(line) : null;
+    if (heading?.[1]) return heading[1];
+  }
+  const words = name2.replace(/[-_]+/gu, " ").trim();
+  return words === "" ? name2 : words.charAt(0).toUpperCase() + words.slice(1);
+}
+function formatSkillMarkdown(skill) {
+  const content = skill.content.trim();
+  const frontmatter = yaml.dump(
+    {
+      name: skill.name,
+      ...skill.title === deriveSkillTitle(skill.name, content) ? {} : { title: skill.title },
+      description: skill.description,
+      ...skill.summary === void 0 ? {} : { summary: skill.summary },
+      ...skill.starters === void 0 ? {} : { starters: skill.starters },
+      ...skill.frontmatter
+    },
+    { lineWidth: -1, noCompatMode: true, noRefs: true, sortKeys: false }
+  );
+  return `---
+${frontmatter}---
+
+${content}
+`;
+}
+function deriveSkillName(skillPath) {
+  const filename = lastSegment(skillPath);
+  const sourceName = filename.toLowerCase() === "skill.md" ? lastSegment(parentPath(skillPath)) : withoutExtension(filename);
+  return sourceName.trim().toLowerCase().replace(/[^a-z0-9]+/gu, "_").replace(/^_+|_+$/gu, "");
+}
+function withoutTrailingSeparators(path) {
+  let end = path.length;
+  while (end > 0 && path[end - 1] === "/") {
+    end -= 1;
+  }
+  return path.slice(0, end);
+}
+function lastSegment(path) {
+  const trimmed = withoutTrailingSeparators(path);
+  return trimmed.slice(trimmed.lastIndexOf("/") + 1);
+}
+function parentPath(path) {
+  const trimmed = withoutTrailingSeparators(path);
+  return trimmed.slice(0, Math.max(trimmed.lastIndexOf("/"), 0));
+}
+function withoutExtension(filename) {
+  const dot = filename.lastIndexOf(".");
+  return dot > 0 ? filename.slice(0, dot) : filename;
+}
+
+// src/knowledge-write.ts
+import { z as z3 } from "zod";
+
+// src/operation-batch.ts
+import { z as z2 } from "zod";
+var workflowDatasetReferenceSchema = z2.strictObject({
+  $dataset: z2.string().min(1),
+  rowCount: z2.number().int().min(0),
+  // A view keeps the parent byte count as an upper bound.
+  bytes: z2.number().int().min(0),
+  /** Absolute offset in the parent; rowCount bounds the view. No rows are copied. */
+  offset: z2.number().int().nonnegative().optional()
+});
+var operationBatchFailureSchema = z2.strictObject({
+  item: z2.json(),
+  code: z2.string().min(1),
+  message: z2.string().min(1)
+});
+var operationBatchResultSchema = z2.strictObject({
+  done: z2.number().int().min(0),
+  failed: z2.number().int().min(0),
+  failures: workflowDatasetReferenceSchema
+});
+
+// src/knowledge-write.ts
+var id = z3.string().min(1).max(200);
+var count = z3.number().int().min(0);
+var hash = z3.string().regex(/^[a-f0-9]{64}$/u);
+var text = z3.string().max(KNOWLEDGE_FILE_MAX_BYTES).refine((value) => new TextEncoder().encode(value).byteLength <= KNOWLEDGE_FILE_MAX_BYTES, {
+  message: `Document text exceeds ${KNOWLEDGE_FILE_MAX_BYTES} bytes`
+});
+var knowledgeIngestFetchSchema = z3.strictObject({
+  connection: id,
+  operation: id,
+  input: z3.record(z3.string(), z3.json())
+});
+var ingestItemIdentity = z3.strictObject({
+  itemId: id,
+  version: id,
+  name: z3.string().min(1).max(1e3),
+  path: z3.string().startsWith("/").max(4e3).optional(),
+  originLink: z3.url({ protocol: /^https?$/u }).max(4e3).optional(),
+  metadata: z3.record(z3.string(), z3.json()).optional(),
+  text: z3.never().optional(),
+  fileId: z3.never().optional(),
+  fetch: z3.never().optional()
+});
+var knowledgeIngestItemSchema = z3.union(
+  [
+    ingestItemIdentity.extend({ text }),
+    ingestItemIdentity.extend({ fileId: id }),
+    ingestItemIdentity.extend({ fetch: knowledgeIngestFetchSchema })
+  ],
+  { error: "knowledge_item_invalid: Supply exactly one of text, fileId or fetch" }
+).superRefine((item, context) => {
+  if (item.fetch !== void 0)
+    context.addIssue({
+      code: "custom",
+      path: ["fetch"],
+      message: "not_supported_yet: fetch arrives with CONN-DL; supply text or fileId"
+    });
+});
+var knowledgeIngestInputSchema = z3.union([
+  z3.strictObject({ items: z3.array(knowledgeIngestItemSchema), complete: z3.boolean().optional() }),
+  z3.strictObject({ dataset: workflowDatasetReferenceSchema, complete: z3.boolean().optional() })
+]);
+var knowledgeIngestOutputSchema = operationBatchResultSchema.extend({
+  accepted: count,
+  withdrawn: count
+});
+var knowledgeWithdrawInputSchema = z3.strictObject({ itemIds: z3.array(id).min(1) });
+var knowledgeWithdrawOutputSchema = z3.strictObject({ withdrawn: count });
+var knowledgePendingInputSchema = z3.strictObject({
+  type: id.optional(),
+  since: z3.iso.datetime({ offset: true }).optional(),
+  limit: z3.number().int().positive()
+});
+var knowledgePendingRowSchema = z3.strictObject({
+  id,
+  type: id,
+  contentHash: hash,
+  pages: workflowDatasetReferenceSchema
+});
+var knowledgePendingOutputSchema = z3.strictObject({
+  documents: workflowDatasetReferenceSchema
+});
+var pageNumber = z3.number().int().positive();
+var range = z3.strictObject({ pageFrom: pageNumber, pageTo: pageNumber });
+var processorMetadataSchema = z3.strictObject({
+  documents: z3.array(range).min(1),
+  sections: z3.array(range.extend({ title: z3.string().min(1) })).optional(),
+  fields: z3.record(z3.string(), z3.json())
+});
+var knowledgeProcessorOutputSchema = processorMetadataSchema.extend({
+  // Count stays unbounded here: PROC-1/PROC-W must enforce the instance's
+  // knowledge.maxPagesPerDocument at runtime (KB-ISO-3a), not a new contract cap.
+  pages: z3.array(z3.strictObject({ page: pageNumber, text })).min(1)
+}).superRefine((output, context) => {
+  const pages = new Set(output.pages.map((page) => page.page));
+  if (output.pages.some(
+    (page, index) => index > 0 && page.page <= (output.pages[index - 1]?.page ?? 0)
+  )) {
+    context.addIssue({
+      code: "custom",
+      path: ["pages"],
+      message: "knowledge_processor_output_invalid: Pages must be ascending and unique"
+    });
+  }
+  const bytes = output.pages.reduce(
+    (size, page) => size + new TextEncoder().encode(page.text).byteLength,
+    0
+  );
+  if (bytes > KNOWLEDGE_FILE_MAX_BYTES)
+    context.addIssue({
+      code: "custom",
+      path: ["pages"],
+      message: "knowledge_processor_output_invalid: Document text exceeds the per-document limit"
+    });
+  for (const field of ["documents", "sections"]) {
+    output[field]?.forEach((entry, index) => {
+      if (entry.pageFrom > entry.pageTo || !pages.has(entry.pageFrom) || !pages.has(entry.pageTo)) {
+        context.addIssue({
+          code: "custom",
+          path: [field, index],
+          message: "knowledge_processor_output_invalid: Page range must be ordered and inside the document"
+        });
+      }
+    });
+  }
+});
+var knowledgePutProcessedInputSchema = z3.strictObject({
+  items: z3.union([
+    z3.array(
+      z3.strictObject({
+        documentId: id,
+        contentHash: hash,
+        workflowRevision: id,
+        // Mirror pending: page text lives outside step values and item dataset rows.
+        // PROC-W resolves the pages and validates the full processor output above.
+        output: processorMetadataSchema.extend({ pages: workflowDatasetReferenceSchema })
+      })
+    ),
+    workflowDatasetReferenceSchema
+  ])
+});
+var knowledgeFieldValueSchema = z3.json();
+var knowledgeExtractFieldsInputSchema = z3.strictObject({
+  documentId: id,
+  schema: z3.record(z3.string(), knowledgeFieldValueSchema)
+});
+var knowledgeExtractFieldsOutputSchema = z3.strictObject({
+  droppedFields: z3.number().int().nonnegative().optional(),
+  failedFields: z3.number().int().nonnegative().optional(),
+  path: z3.string(),
+  date: z3.iso.date().nullable(),
+  type: id,
+  fields: z3.record(
+    z3.string(),
+    z3.strictObject({ value: knowledgeFieldValueSchema, page: pageNumber, quote: z3.string().min(1) })
+  )
+});
+var knowledgeWorkflowSourceSchema = z3.strictObject({
+  id: z3.string().startsWith("workflow:"),
+  kind: z3.literal("workflow"),
+  workflowId: z3.string().regex(/^[a-z][a-z0-9_-]{0,62}$/u)
+}).refine(
+  (source) => source.id === `workflow:${source.workflowId}` || source.id.startsWith(`workflow:${source.workflowId}@`) && /^[1-9][0-9]{0,9}$/u.test(source.id.slice(`workflow:${source.workflowId}@`.length)),
+  {
+    path: ["id"],
+    message: "A Workflow source id is workflow:<workflowId>@<the revision that created the Workflow>"
+  }
+);
+var knowledgeWriteContracts = {
+  ingest: {
+    description: "Ingest items or a dataset into the calling data Workflow's source; complete promises a full pass, withdrawn only after the run succeeds.",
+    inputSchema: knowledgeIngestInputSchema,
+    outputSchema: knowledgeIngestOutputSchema,
+    effect: "changing",
+    right: "knowledge_base.ingest",
+    keyLevel: "write",
+    completion: "async",
+    batch: true
+  },
+  withdraw: {
+    description: "Withdraw item ids from the calling Workflow's source; removed from search immediately.",
+    inputSchema: knowledgeWithdrawInputSchema,
+    outputSchema: knowledgeWithdrawOutputSchema,
+    effect: "changing",
+    right: "knowledge_base.ingest",
+    keyLevel: "write"
+  },
+  pending: {
+    description: "Pull pending documents by type and time as a dataset; page text is another dataset reference.",
+    inputSchema: knowledgePendingInputSchema,
+    outputSchema: knowledgePendingOutputSchema,
+    rowSchema: knowledgePendingRowSchema,
+    effect: "reading",
+    right: "knowledge_base.read",
+    keyLevel: "read",
+    dataset: true
+  },
+  put_processed: {
+    description: "Write processor output by document, content hash and Workflow revision, with pages as a dataset reference like pending; the platform validates, chunks and indexes it, with per-item outcomes.",
+    inputSchema: knowledgePutProcessedInputSchema,
+    outputSchema: operationBatchResultSchema,
+    effect: "changing",
+    right: "knowledge_base.ingest",
+    keyLevel: "write",
+    batch: true
+  },
+  extract_fields: {
+    description: "Extract fields by schema through the approved model binding within the Knowledge Base budget; each value carries page and quote evidence.",
+    inputSchema: knowledgeExtractFieldsInputSchema,
+    outputSchema: knowledgeExtractFieldsOutputSchema,
+    effect: "reading",
+    right: "knowledge_base.read",
+    keyLevel: "read"
+  }
+};
+var knowledgeRecordsRefusalSchema = z3.never({
+  error: "'records' belongs in store.yaml. A data Workflow proposes fields into the Data Store's records mechanism."
+}).optional();
+
+// src/knowledge-sources.ts
+import { z as z4 } from "zod";
+var sourceIdSchema = z4.union([
+  z4.string().regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u).max(63),
+  // KBW-2c: a Workflow's source carries the revision that created the Workflow; one made
+  // before that release carries none.
+  knowledgeWorkflowSourceSchema.shape.id.regex(
+    /^workflow:[a-z][a-z0-9_-]{0,62}(?:@[1-9][0-9]{0,9})?$/u
+  )
+]);
+var countSchema = z4.number().int().min(0);
+var countsSchema = z4.strictObject({
+  discovered: countSchema,
+  added: countSchema,
+  changed: countSchema,
+  moved: countSchema,
+  withdrawn: countSchema,
+  failed: countSchema,
+  skipped: countSchema
+});
+var knowledgeSyncInputSchema = z4.strictObject({
+  /** The `id` of the source in the definition. */
+  source: sourceIdSchema,
+  /** `changes` unless `full`. The initial import is started by publish, not by this call. */
+  mode: z4.enum(["changes", "full"]).optional(),
+  /**
+   * Lets a first pass that waits for confirmation go on (KB-ISO-1b): a connector's first sync or
+   * a Workflow's first `ingest` above 10,000 items. Needs `knowledge_base.publish`; audited with
+   * the counts and the estimate.
+   */
+  confirm: z4.boolean().optional()
+});
+var knowledgeSyncResultSchema = z4.strictObject({
+  syncRunId: z4.string(),
+  source: z4.string(),
+  mode: z4.enum(KNOWLEDGE_SYNC_MODES),
+  /** Why a run is of another mode than asked, such as a cursor the source refused. */
+  reason: z4.enum(["cursor_expired"]).optional(),
+  state: z4.enum(KNOWLEDGE_SYNC_RUN_STATES),
+  counts: countsSchema,
+  bytesFetched: z4.number().int().min(0),
+  /** Why the whole sync failed, for a run in state `failed`. */
+  failureCode: z4.enum(KNOWLEDGE_SOURCE_FAILURE_CODES).optional(),
+  startedAt: z4.string(),
+  endedAt: z4.string().optional()
+});
+var KNOWLEDGE_SOURCE_ITEM_SHOWN_STATES = [
+  "discovered",
+  "fetched",
+  "indexed",
+  "failed",
+  "withdrawn"
+];
+var itemFailureCodeSchema = z4.union([
+  z4.enum(KNOWLEDGE_SOURCE_ITEM_FAILURE_CODES),
+  z4.enum(KNOWLEDGE_DOCUMENT_FAILURE_CODES)
+]);
+var rangeSchema = z4.strictObject({ min: z4.number().min(0), max: z4.number().min(0) });
+var knowledgeFirstPassConfirmationSchema = z4.strictObject({
+  syncRunId: z4.string(),
+  /** The items of the pass, listed or named, and their size in bytes. */
+  items: countSchema,
+  bytes: countSchema,
+  /** How many it fetches and indexes before it waits. */
+  stop: countSchema,
+  /** Estimated from the listed sizes; absent where the Knowledge Base does not search by meaning. */
+  tokens: rangeSchema.optional(),
+  passages: rangeSchema.optional(),
+  /** The embedding model it embeds with; absent where the Knowledge Base does not search by meaning. */
+  model: z4.string().optional(),
+  /** From the rate card; absent where nothing is embedded or the model has no price. */
+  cost: rangeSchema.extend({ currency: z4.string() }).optional(),
+  /**
+   * Whether the store's size limit holds the high estimate of passages and vectors, and that
+   * estimate; absent where nothing is embedded.
+   */
+  room: z4.boolean().optional(),
+  storeBytes: countSchema,
+  addedBytes: countSchema.optional(),
+  limitBytes: countSchema.optional()
+});
+var sourceStatusSchema = z4.strictObject({
+  id: z4.string(),
+  /** The name of the Connection it reads through. */
+  connection: z4.string(),
+  kind: z4.literal("connector").optional(),
+  /** Items by the state the page shows. */
+  items: z4.strictObject({
+    discovered: countSchema,
+    fetched: countSchema,
+    indexed: countSchema,
+    failed: countSchema,
+    withdrawn: countSchema
+  }),
+  /** Failed items per code. */
+  failures: z4.array(z4.strictObject({ code: itemFailureCodeSchema, count: countSchema })),
+  /** The sync that runs now, with its rate in items per minute and its estimated end. */
+  running: z4.strictObject({
+    syncRunId: z4.string(),
+    mode: z4.enum(KNOWLEDGE_SYNC_MODES),
+    startedAt: z4.string(),
+    itemsPerMinute: z4.number().min(0).optional(),
+    estimatedEndAt: z4.string().optional()
+  }).optional(),
+  /** The last sync that ended. */
+  last: knowledgeSyncResultSchema.optional(),
+  /** "Wartet auf Bestätigung": the running first pass stopped at 10,000 items. */
+  confirmation: knowledgeFirstPassConfirmationSchema.optional(),
+  /** "Letzte Änderung verarbeitet". */
+  lastChangeAt: z4.string().optional(),
+  /** "Älteste offene Änderung". */
+  oldestOpenChangeAt: z4.string().optional()
+});
+var knowledgeSourcesOutputSchema = z4.strictObject({
+  sources: z4.array(
+    z4.union([
+      sourceStatusSchema,
+      knowledgeWorkflowSourceSchema.safeExtend(
+        sourceStatusSchema.omit({ id: true, connection: true, kind: true }).shape
+      )
+    ])
+  )
+});
+var knowledgeSourceItemsInputSchema = z4.strictObject({
+  source: sourceIdSchema,
+  state: z4.enum(KNOWLEDGE_SOURCE_ITEM_SHOWN_STATES).optional(),
+  failureCode: itemFailureCodeSchema.optional(),
+  /** Items per page: 50 by default, at most 200. */
+  limit: z4.coerce.number().int().min(1).max(200).optional(),
+  cursor: z4.string().min(1).max(1e3).optional()
+});
+var knowledgeSourceItemsOutputSchema = z4.strictObject({
+  /** Newest change first. */
+  items: z4.array(
+    z4.strictObject({
+      /** The row in `source_items`: what `retry` and `locate` name. */
+      id: z4.string(),
+      /** The id of the item at the source. */
+      itemId: z4.string(),
+      name: z4.string(),
+      path: z4.string(),
+      state: z4.enum(KNOWLEDGE_SOURCE_ITEM_SHOWN_STATES),
+      failureCode: itemFailureCodeSchema.optional(),
+      documentId: z4.string().optional(),
+      originLink: z4.string().optional(),
+      changedAt: z4.string()
+    })
+  ),
+  nextCursor: z4.string().optional()
+});
+var RETRY_MAX = 100;
+var knowledgeRetryInputSchema = z4.union([
+  z4.strictObject({ documentIds: z4.array(z4.string().min(1).max(200)).min(1).max(RETRY_MAX) }),
+  z4.strictObject({
+    source: sourceIdSchema,
+    sourceItemIds: z4.array(z4.string().min(1).max(200)).min(1).max(RETRY_MAX)
+  }),
+  z4.strictObject({ source: sourceIdSchema, failureCode: itemFailureCodeSchema }),
+  z4.strictObject({ source: sourceIdSchema, all: z4.literal(true) })
+]);
+var knowledgeRetryOutputSchema = z4.strictObject({
+  /** For a retry by document ids: each named document, with its state after the retry. */
+  documents: z4.array(z4.strictObject({ id: z4.string(), state: z4.enum(KNOWLEDGE_DOCUMENT_STATES) })).optional(),
+  /** How many contents or items were queued again. */
+  queued: z4.number().int(),
+  /**
+   * For a Workflow-fed source: how many items removed by hand were allowed back. Its next pass
+   * that names one takes it again (KBW-2b).
+   */
+  released: z4.number().int().optional()
+});
+var knowledgeLocateInputSchema = z4.strictObject({
+  /** The row in `source_items`. */
+  sourceItemId: z4.string().min(1).max(200)
+});
+var knowledgeLocateOutputSchema = z4.strictObject({
+  sourceItemId: z4.string(),
+  source: z4.string(),
+  itemId: z4.string(),
+  state: z4.enum(KNOWLEDGE_SOURCE_ITEM_SHOWN_STATES),
+  discoveredAt: z4.string(),
+  fetchedAt: z4.string().optional(),
+  withdrawnAt: z4.string().optional(),
+  purgedAt: z4.string().optional(),
+  /** A person removed it by hand; a pass leaves it out until a publisher lifts the hold. */
+  removedAt: z4.string().optional()
+});
+var knowledgeWorkflowSourcesOutputSchema = z4.strictObject({
+  knowledgeBases: z4.array(
+    z4.strictObject({ name: z4.string(), title: z4.string(), documents: countSchema })
+  ),
+  hidden: z4.strictObject({ knowledgeBases: countSchema, documents: countSchema })
+});
+
+// src/workflow-datasets.ts
+var WORKFLOW_DATASET_STATES = ["writing", "complete", "deleted"];
+
+// src/operation-paging.ts
+import { z as z5 } from "zod";
+var operationPagingSchema = z5.discriminatedUnion("by", [
+  z5.strictObject({
+    by: z5.enum(["page", "offset"]),
+    param: z5.string().min(1),
+    sizeParam: z5.string().min(1),
+    size: z5.number().int().min(1),
+    start: z5.number().int().min(0).optional()
+  }),
+  z5.strictObject({
+    by: z5.enum(["cursor", "next_link"]),
+    param: z5.string().min(1),
+    cursor: z5.string().min(1)
+  })
+]);
+
+// src/workflow-data-flows.ts
+import { z as z6 } from "zod";
+var workflowDataFlowsSchema = z6.object({
+  fills: z6.array(z6.object({ id: z6.string(), name: z6.string(), title: z6.string() })),
+  processes: z6.array(z6.object({ id: z6.string(), name: z6.string(), title: z6.string() })),
+  hidden: z6.object({ fills: z6.number().int().min(0), processes: z6.number().int().min(0) }),
+  truncated: z6.boolean()
+});
+
+// src/data-store-records.ts
+import { z as z7 } from "zod";
+var RECORDS_PROPOSE_MAX_ITEMS_PER_CALL = 1e3;
+var RECORDS_PROPOSE_MAX_FIELDS_PER_ITEM = 1e3;
+var RECORDS_FLAGGED_MAX_ITEMS_PER_PAGE = 1e4;
+var name = z7.string().min(1);
+var id2 = z7.string().min(1).max(200);
+var key = z7.union([z7.string().min(1), z7.number(), z7.boolean()]);
+var dataStoreRecordsRuleSchema = z7.strictObject({
+  table: name,
+  key: z7.union([
+    z7.strictObject({ column: name, fromPath: z7.string().startsWith("/").min(1) }),
+    z7.strictObject({ column: name, fromField: name })
+  ]),
+  precedence: z7.array(name).default([]),
+  review: z7.strictObject({ always: z7.array(name).default([]) }).prefault({}),
+  retainWithoutSource: z7.boolean().default(false)
+}).superRefine((rule, context) => {
+  if ("fromPath" in rule.key) {
+    const placeholders = rule.key.fromPath.match(/\{[^{}]*\}/gu);
+    if (placeholders?.length !== 1 || placeholders[0] !== `{${rule.key.column}}`) {
+      context.addIssue({
+        code: "custom",
+        path: ["key", "fromPath"],
+        message: "fromPath must contain exactly one placeholder naming the key column"
+      });
+    }
+  }
+});
+var recordEvidenceResultSchema = z7.discriminatedUnion("status", [
+  z7.strictObject({ status: z7.literal("passed") }),
+  z7.strictObject({
+    status: z7.literal("failed"),
+    reason: z7.enum(["page_not_found", "quote_not_found", "value_not_parsed"])
+  })
+]);
+var RECORD_FIELD_STATES = ["extracted", "confirmed", "corrected", "conflict"];
+var RECORD_FLAG_REASONS = [
+  "conflict",
+  "not_evidenced",
+  "confirmation_required",
+  "key_unresolved"
+];
+var RECORD_FIELD_FAILURE_CODES = ["record_field_unknown"];
+var fieldSchema = knowledgeExtractFieldsOutputSchema.shape.fields.valueType.extend({ name });
+var dataStoreRecordProposalItemSchema = z7.strictObject({
+  // Document ids are scoped by their Knowledge Base. Both ids travel with every citation.
+  knowledgeBaseId: id2,
+  documentId: id2,
+  kind: name,
+  documentDate: z7.iso.date().nullable(),
+  path: z7.string().startsWith("/").optional(),
+  fields: z7.array(fieldSchema).min(1).max(
+    RECORDS_PROPOSE_MAX_FIELDS_PER_ITEM,
+    "At most 1000 fields per item (RECORDS_PROPOSE_MAX_FIELDS_PER_ITEM); split larger proposals into batches"
+  )
+});
+var dataStoreRecordsProposeInputSchema = z7.strictObject({
+  table: name,
+  items: z7.array(dataStoreRecordProposalItemSchema).max(
+    RECORDS_PROPOSE_MAX_ITEMS_PER_CALL,
+    "At most 1000 items per call (RECORDS_PROPOSE_MAX_ITEMS_PER_CALL); send another batch"
+  )
+});
+var decisionSchema = z7.strictObject({
+  table: name,
+  key,
+  field: name,
+  documentId: id2.optional(),
+  knowledgeBaseId: id2.optional()
+});
+var dataStoreRecordsDecideInputSchema = z7.discriminatedUnion("action", [
+  decisionSchema.extend({ action: z7.literal("confirm") }),
+  decisionSchema.extend({ action: z7.literal("correct"), value: knowledgeFieldValueSchema }),
+  decisionSchema.extend({ action: z7.literal("assign"), documentId: id2, knowledgeBaseId: id2 })
+]).refine(
+  (decision) => decision.documentId === void 0 === (decision.knowledgeBaseId === void 0),
+  {
+    path: ["documentId"],
+    message: "A citation needs both knowledgeBaseId and documentId"
+  }
+);
+var dataStoreRecordsDecideOutputSchema = z7.strictObject({ decided: z7.literal(true) });
+var dataStoreRecordsFlaggedInputSchema = z7.strictObject({
+  table: name.optional(),
+  cursor: z7.string().min(1).optional(),
+  limit: z7.number().int().positive().max(
+    RECORDS_FLAGGED_MAX_ITEMS_PER_PAGE,
+    "At most 10000 items per page (RECORDS_FLAGGED_MAX_ITEMS_PER_PAGE); follow nextCursor"
+  )
+});
+var dataStoreRecordFieldSchema = fieldSchema.extend({
+  // `value` is what the document reads; a person's correction stands beside it, held exactly
+  // while the state is `corrected` (REC-KEEP).
+  correctedValue: knowledgeFieldValueSchema.nullable(),
+  table: name,
+  // Unresolved keys go to review, without writing a customer row.
+  key: key.nullable(),
+  knowledgeBaseId: id2,
+  documentId: id2,
+  kind: name,
+  documentDate: z7.iso.date().nullable(),
+  extractedAt: z7.iso.datetime({ offset: true }),
+  evidence: recordEvidenceResultSchema,
+  state: z7.enum(RECORD_FIELD_STATES),
+  decidedBy: id2.nullable(),
+  decidedAt: z7.iso.datetime({ offset: true }).nullable()
+});
+var dataStoreRecordsFlaggedOutputSchema = z7.strictObject({
+  // A citation is shown only after checking access to its Knowledge Base, even for a
+  // holder of data_store.records. Values/quotes never enter jobs, runs or audit metadata.
+  items: z7.array(
+    dataStoreRecordFieldSchema.extend({
+      reason: z7.enum(RECORD_FLAG_REASONS),
+      // REC-2: the cited document as its chip opens it, by the Knowledge Base's name. Absent
+      // where the document is no longer there to open.
+      document: z7.strictObject({ knowledgeBase: name, fileName: name }).optional(),
+      // REC-KEEP: the person who decided, by the name the instance shows for them, read when
+      // the list is. Absent where the account is gone or its deletion was requested.
+      decidedByName: z7.string().min(1).optional()
+    })
+  ).max(RECORDS_FLAGGED_MAX_ITEMS_PER_PAGE),
+  nextCursor: z7.string().optional()
+});
+var scalarSchemas = {
+  text: z7.string(),
+  integer: z7.number().int(),
+  number: z7.number(),
+  boolean: z7.boolean(),
+  date: z7.iso.date(),
+  timestamp: z7.iso.datetime({ offset: true })
+};
+function recordColumnTakes(column, value) {
+  return compatible(column, value);
+}
+function compatible(column, value) {
+  if (column.generated || column.type === "other") return false;
+  if (value === null) return column.nullable;
+  for (const [type, schema] of Object.entries(scalarSchemas)) {
+    if (column.type === type) return schema.safeParse(value).success;
+    if (column.type === `${type}[]`) return z7.array(schema.nullable()).safeParse(value).success;
+  }
+  return false;
+}
+function proposalItemSchemaFor(columns) {
+  const byName = new Map(columns.map((column) => [column.name, column]));
+  return dataStoreRecordProposalItemSchema.superRefine((item, context) => {
+    const seen = /* @__PURE__ */ new Set();
+    item.fields.forEach((field, index) => {
+      const column = byName.get(field.name);
+      if (!column || !compatible(column, field.value) || seen.has(field.name)) {
+        context.addIssue({
+          code: "custom",
+          path: ["fields", index],
+          message: `record_field_unknown: Field '${field.name}' has no writable column of a compatible type, or occurs twice`
+        });
+      }
+      seen.add(field.name);
+    });
+  });
+}
+var dataStoreRecordsContracts = {
+  propose: {
+    description: "Propose extracted fields with Knowledge Base/document/page/quote evidence. Validate each whole item against the published table before writing; failures are per item. Send at most 1000 items per call and 1000 fields per item; split larger work into batches. Merge by evidence precedence, then document date; unresolved keys and evidence go to review.",
+    inputSchema: dataStoreRecordsProposeInputSchema,
+    outputSchema: operationBatchResultSchema,
+    itemSchemaFor: proposalItemSchemaFor,
+    effect: "changing",
+    right: "data_store.records",
+    keyLevel: "write",
+    batch: true
+  },
+  decide: {
+    description: "Confirm or correct a field against its evidence, or assign a document to an object key. Decisions are pinned; audit table/field/action/actor only, never the value.",
+    inputSchema: dataStoreRecordsDecideInputSchema,
+    outputSchema: dataStoreRecordsDecideOutputSchema,
+    effect: "changing",
+    right: "data_store.records",
+    keyLevel: "write"
+  },
+  flagged: {
+    description: "Page through fields needing review, up to 10000 per call; pass nextCursor as cursor for the next page. Check Knowledge Base access before showing any document citation; the store right alone does not grant access to source documents.",
+    inputSchema: dataStoreRecordsFlaggedInputSchema,
+    outputSchema: dataStoreRecordsFlaggedOutputSchema,
+    effect: "reading",
+    right: "data_store.records",
+    keyLevel: "read"
+  }
+};
+
+// src/usage-limits.ts
+var MODEL_USAGE_LIMIT_PERIODS = ["day", "month"];
+var MODEL_USAGE_LIMIT_METRICS = ["modelCallCount", "tokens", "costMicros"];
+var MODEL_USAGE_LIMIT_SCOPES = ["instance", "user", "system", "workspace"];
+var USAGE_SPEND_LIMIT_LEVELS = [
+  "instance",
+  "workspace_default",
+  "workspace",
+  "user_default",
+  "user"
+];
+var PERSONAL_WORKSPACES_KEY = "personal";
+var USAGE_BREAKDOWN_DIMENSIONS = [
+  "workspace",
+  "agent",
+  "app",
+  "workflow",
+  "model",
+  "origin"
+];
+var USAGE_ORIGINS = [
+  "conversation",
+  "app",
+  "workflow",
+  "knowledge_base",
+  "system"
+];
+
+// src/workflow-text.ts
+var WORKFLOW_TEXT_FORMAT_MARKDOWN = "markdown";
+var WORKFLOW_TEXT_MAX_PARTS = 100;
+var WORKFLOW_MARKDOWN_MAX_ROWS = 100;
+var WORKFLOW_MARKDOWN_MAX_COLUMNS = 8;
+
+// src/mail-send.ts
+import { z as z8 } from "zod";
+var MAIL_SEND_OPERATION = "mail.send";
+var MAIL_SENDER_RESOURCE_KIND = "mail_sender";
+var MAIL_SENDER_USE_ACTION = "mail_sender.use";
+var MAIL_SENDER_SYSTEM = "system";
+var MAIL_SENDER_CONNECTION_PREFIX = "connection.";
+var MAIL_SENDER_SYSTEM_ICON = "system-mail";
+var MAIL_WORKFLOW_MESSAGE_TEMPLATE = "workflow-message";
+var MAIL_SEND_MAX_ADDRESSES = 50;
+var MAIL_SUBJECT_MAX_LENGTH = 200;
+var MAIL_BODY_MAX_BYTES = 64 * 1024;
+var MAIL_SENDER_NAME_MAX_LENGTH = 80;
+var MAIL_ADDRESS_MAX_LENGTH = 254;
+var MAIL_OUTBOUND_DEFAULT_LIMITS = {
+  perWorkflowPerHour: 200,
+  perInstancePerDay: 1e3
+};
+var MAIL_OUTBOUND_FOOTER_MAX_LENGTH = 2e3;
+var MAIL_AUDIT_MAX_DOMAINS = 10;
+var MAIL_ATTACHMENTS_MAX_FILES = 10;
+var MAIL_ATTACHMENTS_MAX_BYTES = 10 * 1024 * 1024;
+var MAIL_SEND_ERROR_CODES = {
+  recipientNotAllowed: "recipient_not_allowed",
+  noRecipient: "no_recipient",
+  mailRejected: "mail_rejected",
+  workspaceNotAllowed: "workspace_not_allowed"
+};
+var MAIL_SEND_REFUSAL_REASONS = [
+  MAIL_SEND_ERROR_CODES.recipientNotAllowed,
+  MAIL_SEND_ERROR_CODES.noRecipient,
+  MAIL_SEND_ERROR_CODES.mailRejected,
+  MAIL_SEND_ERROR_CODES.workspaceNotAllowed
+];
+var mailSendRefusalDetailsSchema = z8.discriminatedUnion("reason", [
+  z8.strictObject({
+    reason: z8.literal(MAIL_SEND_ERROR_CODES.recipientNotAllowed),
+    domain: z8.string().min(1).max(MAIL_ADDRESS_MAX_LENGTH)
+  }),
+  z8.strictObject({ reason: z8.literal(MAIL_SEND_ERROR_CODES.noRecipient) }),
+  z8.strictObject({ reason: z8.literal(MAIL_SEND_ERROR_CODES.workspaceNotAllowed) }),
+  z8.strictObject({
+    reason: z8.literal(MAIL_SEND_ERROR_CODES.mailRejected),
+    providerCode: z8.string().min(1).max(100).optional()
+  })
+]);
+var MAIL_RECIPIENT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/u;
+var principalId = z8.string().regex(MAIL_RECIPIENT_ID_PATTERN);
+var ONE_LINE_PATTERN = /^[^\u0000-\u001f\u007f\u2028\u2029]*$/u;
+var mailAddressSchema = z8.email().max(MAIL_ADDRESS_MAX_LENGTH);
+var MAIL_RECIPIENT_DOMAIN_PATTERN = /^(\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:[a-z]{2,63}|xn--[a-z0-9-]{1,59})$/u;
+var MAIL_RECIPIENT_DOMAINS_ANY = "*";
+var mailRecipientDomainSchema = z8.string().max(MAIL_ADDRESS_MAX_LENGTH).refine(
+  (domain) => domain === MAIL_RECIPIENT_DOMAINS_ANY || MAIL_RECIPIENT_DOMAIN_PATTERN.test(domain),
+  { message: "A recipient domain is lowercase, such as kanzlei.de or *.kanzlei.de, or * alone" }
+);
+var mailSenderIdSchema = z8.union([
+  z8.literal(MAIL_SENDER_SYSTEM),
+  z8.templateLiteral([MAIL_SENDER_CONNECTION_PREFIX, z8.string().regex(CONNECTION_NAME_PATTERN)])
+]).superRefine((sender, context) => {
+  if (sender !== MAIL_SENDER_SYSTEM)
+    context.addIssue({
+      code: "custom",
+      message: "not_supported_yet: a Connection sender arrives with MAIL-M365S; send as system"
+    });
+});
+var mailRecipientSchema = z8.union([
+  z8.strictObject({ address: mailAddressSchema }),
+  z8.strictObject({ user: principalId }),
+  z8.strictObject({ workspace: principalId })
+]);
+var recipientEntries = z8.array(
+  z8.union([mailAddressSchema, mailRecipientSchema, z8.looseObject({ email: mailAddressSchema })])
+).max(MAIL_SEND_MAX_ADDRESSES);
+var mailRecipientListSchema = z8.union([mailAddressSchema, recipientEntries.min(1)]);
+var mailCopyRecipientListSchema = z8.union([mailAddressSchema, recipientEntries]);
+var mailReplyToSchema = z8.union([
+  mailAddressSchema,
+  z8.strictObject({ address: mailAddressSchema }),
+  z8.strictObject({ user: principalId })
+]);
+var mailSubjectSchema = z8.string().min(1).max(MAIL_SUBJECT_MAX_LENGTH).regex(ONE_LINE_PATTERN, { message: "input_invalid: a subject is one line" }).refine((subject) => subject.trim().length > 0, { message: "input_invalid: a subject has text" });
+var mailBodySchema = z8.string().max(MAIL_BODY_MAX_BYTES).refine((body) => new TextEncoder().encode(body).byteLength <= MAIL_BODY_MAX_BYTES, {
+  message: `input_invalid: the body exceeds ${MAIL_BODY_MAX_BYTES} bytes`
+}).meta({ format: WORKFLOW_TEXT_FORMAT_MARKDOWN });
+var mailSenderNameSchema = z8.string().min(1).max(MAIL_SENDER_NAME_MAX_LENGTH).regex(ONE_LINE_PATTERN, { message: "input_invalid: a sender name is one line" }).refine((name2) => !name2.includes("@"), {
+  message: "input_invalid: a sender name holds no @"
+});
+var mailSendInputSchema = z8.strictObject({
+  sender: mailSenderIdSchema.default(MAIL_SENDER_SYSTEM),
+  to: mailRecipientListSchema,
+  cc: mailCopyRecipientListSchema.optional(),
+  bcc: mailCopyRecipientListSchema.optional(),
+  subject: mailSubjectSchema,
+  body: mailBodySchema,
+  senderName: mailSenderNameSchema.optional(),
+  replyTo: mailReplyToSchema.optional(),
+  /** The language of the frame around the body; the instance's default unless set. */
+  locale: z8.enum(localeCodes).optional()
+});
+var count2 = z8.number().int().min(0);
+var recipientCounts = z8.strictObject({ to: count2, cc: count2, bcc: count2 });
+var mailSendOutputSchema = z8.strictObject({
+  sentAt: z8.iso.datetime({ offset: true }),
+  messageId: z8.string().min(1).max(256).optional(),
+  recipients: recipientCounts,
+  skipped: count2,
+  test: z8.literal(true).optional()
+});
+var mailPreviewRecipientSchema = z8.strictObject({
+  kind: z8.enum(["person", "address"]),
+  label: z8.string().min(1).max(MAIL_ADDRESS_MAX_LENGTH)
+});
+var mailSendPreviewSchema = z8.strictObject({
+  from: z8.strictObject({ name: z8.string().min(1), address: mailAddressSchema }),
+  replyTo: mailAddressSchema.optional(),
+  to: z8.array(mailPreviewRecipientSchema),
+  cc: z8.array(mailPreviewRecipientSchema),
+  bcc: z8.array(mailPreviewRecipientSchema),
+  skipped: count2,
+  subject: z8.string(),
+  html: z8.string(),
+  text: z8.string()
+});
+var mailSendSimulatedOutputSchema = z8.strictObject({
+  simulated: z8.literal(true),
+  preview: mailSendPreviewSchema
+});
+var workflowMessageMailParamsSchema = z8.strictObject({
+  subject: mailSubjectSchema,
+  markdown: mailBodySchema,
+  sentBy: z8.discriminatedUnion("kind", [
+    z8.strictObject({ kind: z8.literal("workflow"), workflowName: z8.string().min(1).max(200) }),
+    z8.strictObject({ kind: z8.literal("agent"), onBehalfOf: z8.string().min(1).max(200) })
+  ]),
+  test: z8.strictObject({
+    intendedRecipients: z8.strictObject({
+      to: z8.array(mailPreviewRecipientSchema),
+      cc: z8.array(mailPreviewRecipientSchema),
+      bcc: z8.array(mailPreviewRecipientSchema)
+    })
+  }).optional()
+});
+var workflowMailSenderFactSchema = z8.strictObject({
+  sender: z8.string().min(1),
+  title: z8.string().min(1),
+  icon: z8.string().min(1),
+  address: mailAddressSchema,
+  recipientDomains: z8.array(mailRecipientDomainSchema)
+});
+var mailSendContract = {
+  name: MAIL_SEND_OPERATION,
+  description: "Send one e-mail as a sender of the instance (system unless set). Recipients are addresses, people of the instance and workspaces; an address outside the instance's recipient domains is refused. The body is Markdown in the instance's frame. A test run previews the mail and sends nothing.",
+  inputSchema: mailSendInputSchema,
+  outputSchema: mailSendOutputSchema,
+  simulatedOutputSchema: mailSendSimulatedOutputSchema,
+  effect: "changing",
+  changeClass: "outward",
+  right: MAIL_SENDER_USE_ACTION,
+  resourceKind: MAIL_SENDER_RESOURCE_KIND,
+  events: { after: "mail.sent", refused: "mail.refused" },
+  errorCodes: MAIL_SEND_ERROR_CODES
+};
+
+// src/data-scope.ts
+import { z as z9 } from "zod";
+var dataScopeNameSchema = z9.string().regex(/^[a-z][a-z0-9_]{0,62}$/u);
+var dataScopesSchema = z9.record(
+  dataScopeNameSchema,
+  z9.strictObject({
+    label: z9.string().trim().min(1).max(120),
+    valueType: z9.literal("text")
+  })
+).refine(
+  (dimensions) => Object.keys(dimensions).length <= 1,
+  "One data scope dimension is supported"
+);
+var scopeAssignmentInputSchema = z9.strictObject({
+  dimension: dataScopeNameSchema,
+  holderKind: z9.enum(["user", "group", "service_principal"]),
+  holderId: z9.string().min(1).max(200).refine((value) => !value.includes("\0"), "NUL is not allowed"),
+  effect: z9.enum(GRANT_EFFECTS),
+  values: z9.union([
+    z9.literal("all"),
+    z9.array(
+      z9.string().min(1).max(200).refine((value) => !value.includes("\0"), "NUL is not allowed")
+    ).max(1e4)
+  ])
+});
+var identifier = z9.string().regex(/^[a-z_][a-z0-9_]{0,62}$/u);
+var scopedTablesSchema = z9.record(
+  identifier,
+  z9.strictObject({
+    scope: z9.record(dataScopeNameSchema, identifier).refine((scope) => Object.keys(scope).length === 1, "A scoped table names one dimension")
+  })
+);
+
+// src/feedback-values.ts
+var FEEDBACK_TEXT_MAX_LENGTH = 4e3;
+var FEEDBACK_SUMMARY_MAX_LENGTH = 1e3;
+var FEEDBACK_CATEGORY_MAX_LENGTH = 60;
+var FEEDBACK_NOTE_MAX_LENGTH = 2e3;
+var FEEDBACK_SUBJECT_KINDS = ["message"];
+var FEEDBACK_STATES = ["new", "handled"];
+
+// src/callable-operations.ts
+import { z as z10 } from "zod";
+var operationSourceSchema = z10.object({
+  kind: z10.enum(OPERATION_SOURCE_KINDS),
+  title: z10.string().optional(),
+  /** The Connection's `service`, for its icon. */
+  service: z10.string().optional()
+});
+var jsonSchemaObject = z10.record(z10.string(), z10.unknown());
+var callableOperationSchema = z10.object({
+  /** What a step writes under `operation`. */
+  name: z10.string(),
+  effect: z10.enum(OPERATION_EFFECTS),
+  title: z10.string(),
+  /** The operation's own description, where its source gives one. */
+  description: z10.string().optional(),
+  source: operationSourceSchema,
+  /** False where a call cannot reach its source now, such as a Connection that is off. */
+  available: z10.boolean(),
+  inputSchema: jsonSchemaObject.optional(),
+  outputSchema: jsonSchemaObject.optional()
+});
+var callableOperationsPageSchema = z10.object({
+  operations: z10.array(callableOperationSchema),
+  /** Passed back as `cursor`, with the same filters, until it is absent. */
+  nextCursor: z10.string().optional(),
+  /** A source left operations out: a missing name proves no absence. */
+  truncated: z10.boolean()
+});
+export {
+  ACCESS_SOURCES,
+  ACTIONS,
+  ACTIVE_AGENT_RUN_STATUSES,
+  ADMINISTERED_USER_STATUSES,
+  AGENT_AVAILABILITY_MODES,
+  AGENT_EDITABLE_FIELDS,
+  AGENT_PREVIEW_SOURCES,
+  AGENT_RUN_FAILURE_CATEGORIES,
+  AGENT_RUN_STATUSES,
+  AGENT_STARTERS_MAX,
+  AGENT_USE_SETTINGS,
+  API_CREDENTIAL_SCOPES,
+  APPROVAL_CHECK_FAILURE_OUTCOMES,
+  APPROVAL_CHECK_STATUSES,
+  APPROVAL_EXECUTIONS,
+  APPROVAL_REQUEST_STATUSES,
+  APP_ACTION_CALL_STATUSES,
+  APP_AUDIENCES,
+  APP_ERROR_CODES,
+  APP_ERROR_STATUS_CODES,
+  APP_MODES,
+  ARTIFACT_PREVIEW_IMAGE_FORMATS,
+  ARTIFACT_PREVIEW_IMAGE_MIME_TYPES,
+  ARTIFACT_PREVIEW_STATUSES,
+  ASSET_ACCESS_VERBS,
+  ASSET_LIFECYCLES,
+  ASSET_NAME_REFUSAL_REASONS,
+  ASSET_OWNER_KINDS,
+  ASSET_REPO_BUNDLE_KINDS,
+  ASSET_REPRESENTATIONS,
+  ASSET_SYNC_CHANGE_TYPES,
+  ATTACHMENT_CREATE_OUTCOMES,
+  AUDIT_ACTOR_KINDS,
+  AUDIT_EVENT_STATUSES,
+  AUDIT_OUTCOMES,
+  AUDIT_TIERS,
+  AUTH_PRINCIPAL_KINDS,
+  AUTH_SCOPE_WILDCARD,
+  CATALOGUE_CATEGORIES,
+  CATALOGUE_PARTS,
+  CHAT_MESSAGE_ROLES,
+  CHAT_SESSION_AUTH_SCOPES,
+  COLLABORATION_WORKSPACE_KINDS,
+  CONFIG_ASSET_CHANGE_OPERATIONS,
+  CONFIG_ASSET_KINDS,
+  CONNECTION_BINDING_STATES,
+  CONNECTION_CREDENTIAL_MODES,
+  CONNECTION_EXPOSURES,
+  CONNECTION_HEALTH_STATES,
+  CONNECTION_NAME_MAX_LENGTH,
+  CONNECTION_NAME_PATTERN,
+  CONNECTION_NETWORKS,
+  CONNECTION_OAUTH_REGISTRATIONS,
+  CONNECTION_OPERATION_POLICIES,
+  CONNECTION_OPERATION_STATUSES,
+  CONNECTION_ORIGINS,
+  CONNECTION_PROPOSAL_BINDING_STATES,
+  CONNECTION_PROPOSAL_STATES,
+  CONNECTION_PROVIDER_REVOCATIONS,
+  CONNECTION_SECRET_STATES,
+  CONNECTION_SIGN_IN_NEEDS,
+  CONNECTOR_TEST_STATUSES,
+  CONVERSATION_ATTACHMENT_STATUSES,
+  CONVERSATION_KINDS,
+  CONVERSATION_VISIBILITIES,
+  DATABASE_RELATION_TYPES,
+  DATA_STORE_CONDITIONS,
+  DATA_STORE_INSERT_CONFLICT_MODES,
+  DATA_STORE_LOAD_CONFLICT_MODES,
+  DATA_STORE_MIGRATION_OUTCOMES,
+  DATA_STORE_SCALAR_TYPES,
+  DATA_STORE_STATUSES,
+  DECIDED_APPROVAL_REQUEST_STATUSES,
+  DELETION_STATES,
+  ENDED_AGENT_RUN_STATUSES,
+  ENDED_APPROVAL_EXECUTIONS,
+  FAILED_JOB_STATUSES,
+  FEEDBACK_CATEGORY_MAX_LENGTH,
+  FEEDBACK_NOTE_MAX_LENGTH,
+  FEEDBACK_STATES,
+  FEEDBACK_SUBJECT_KINDS,
+  FEEDBACK_SUMMARY_MAX_LENGTH,
+  FEEDBACK_TEXT_MAX_LENGTH,
+  FIRST_PARTY_AUTH_SCOPES,
+  FOLLOW_UP_MODES,
+  FOLLOW_UP_STATUSES,
+  GRANT_EFFECTS,
+  GRANT_HOLDER_KINDS,
+  GRANT_SCOPE_KINDS,
+  GUARDRAIL_HIT_OUTCOMES,
+  GUARDRAIL_NAME_MAX_LENGTH,
+  GUARDRAIL_NAME_PATTERN,
+  GUARDRAIL_OUTCOMES,
+  IDEMPOTENCY_KEY_MAX_LENGTH,
+  INFRASTRUCTURE_SECRET_STATES,
+  INFRASTRUCTURE_WITHHELD_FIELDS,
+  JOB_STATUSES,
+  KNOWLEDGE_BASE_STATUSES,
+  KNOWLEDGE_CHECK_STATUSES,
+  KNOWLEDGE_DOCUMENT_FAILURE_CODES,
+  KNOWLEDGE_DOCUMENT_STATES,
+  KNOWLEDGE_DOCUMENT_WAIT_CODES,
+  KNOWLEDGE_EMBEDDING_STATES,
+  KNOWLEDGE_FILE_MAX_BYTES,
+  KNOWLEDGE_SEARCH_SIGNALS,
+  KNOWLEDGE_SOURCE_FAILURE_CODES,
+  KNOWLEDGE_SOURCE_ITEM_FAILURE_CODES,
+  KNOWLEDGE_SOURCE_ITEM_SHOWN_STATES,
+  KNOWLEDGE_SOURCE_ITEM_STATES,
+  KNOWLEDGE_SYNC_COUNTS,
+  KNOWLEDGE_SYNC_MODES,
+  KNOWLEDGE_SYNC_RUN_STATES,
+  LISTED_DATA_STORE_STATUSES,
+  LIVE_JOB_STATUSES,
+  MAIL_ADDRESS_MAX_LENGTH,
+  MAIL_ATTACHMENTS_MAX_BYTES,
+  MAIL_ATTACHMENTS_MAX_FILES,
+  MAIL_AUDIT_MAX_DOMAINS,
+  MAIL_BODY_MAX_BYTES,
+  MAIL_OUTBOUND_DEFAULT_LIMITS,
+  MAIL_OUTBOUND_FOOTER_MAX_LENGTH,
+  MAIL_RECIPIENT_DOMAINS_ANY,
+  MAIL_RECIPIENT_DOMAIN_PATTERN,
+  MAIL_RECIPIENT_ID_PATTERN,
+  MAIL_SENDER_CONNECTION_PREFIX,
+  MAIL_SENDER_NAME_MAX_LENGTH,
+  MAIL_SENDER_RESOURCE_KIND,
+  MAIL_SENDER_SYSTEM,
+  MAIL_SENDER_SYSTEM_ICON,
+  MAIL_SENDER_USE_ACTION,
+  MAIL_SEND_ERROR_CODES,
+  MAIL_SEND_MAX_ADDRESSES,
+  MAIL_SEND_OPERATION,
+  MAIL_SEND_REFUSAL_REASONS,
+  MAIL_SUBJECT_MAX_LENGTH,
+  MAIL_WORKFLOW_MESSAGE_TEMPLATE,
+  MANAGED_FILE_STATUSES,
+  MESSAGE_FINISH_STATUSES,
+  MODEL_PROVIDER_AUTH_MODES,
+  MODEL_USAGE_EVENT_STATUSES,
+  MODEL_USAGE_LIMIT_METRICS,
+  MODEL_USAGE_LIMIT_PERIODS,
+  MODEL_USAGE_LIMIT_SCOPES,
+  MODEL_USAGE_SOURCES,
+  MODEL_USAGE_TIERS,
+  NOTIFY_CHANNELS,
+  OPENAI_COMPATIBLE_APIS,
+  OPERATIONS_AUDIENCES,
+  OPERATION_CHANGE_CLASSES,
+  OPERATION_CONFIRMATION_DECISIONS,
+  OPERATION_DENIAL_REASONS,
+  OPERATION_EFFECTS,
+  OPERATION_ORIGIN_KINDS,
+  OPERATION_RUN_DECISION_MODES,
+  OPERATION_RUN_DECISION_REASONS,
+  OPERATION_RUN_STATUSES,
+  OPERATION_SOURCE_KINDS,
+  OPERATION_TARGETS,
+  PERSONAL_WORKSPACES_KEY,
+  PERSON_POLICY_SETTINGS,
+  POLICY_VALUES,
+  PRINCIPAL_HOLDER_KINDS,
+  PROVIDER_CHECK_ERROR_CLASSES,
+  PROVIDER_PORTS,
+  PROVIDER_REGIONS,
+  PUBLISHED_DATA_CONSUMER_KINDS,
+  READING_POLICY_VALUES,
+  REASONING_EFFORTS,
+  RECORDS_FLAGGED_MAX_ITEMS_PER_PAGE,
+  RECORDS_PROPOSE_MAX_FIELDS_PER_ITEM,
+  RECORDS_PROPOSE_MAX_ITEMS_PER_CALL,
+  RECORD_FIELD_FAILURE_CODES,
+  RECORD_FIELD_STATES,
+  RECORD_FLAG_REASONS,
+  ROLE_GRANT_SCOPE_KINDS,
+  ROLE_PENDING_CHANGES,
+  ROLE_PENDING_DECISIONS,
+  SCHEDULED_START_STATES,
+  SERVICE_PRINCIPAL_PERMISSIONS,
+  SERVICE_PRINCIPAL_STATUSES,
+  SKILL_CHANGE_TYPES,
+  SKILL_FRONTMATTER_FIELDS,
+  SKILL_FRONTMATTER_MAX_BYTES,
+  SKILL_FRONTMATTER_MAX_DEPTH,
+  SKILL_NAME_PATTERN,
+  SKILL_NAME_RULE,
+  SKILL_ORIGINS,
+  SKILL_PORTABLE_DESCRIPTION_MAX_CHARS,
+  SKILL_PORTABLE_NAME_MAX_CHARS,
+  SKILL_RESOURCE_MEDIA_TYPES,
+  SKILL_STARTERS_MAX,
+  SKILL_STARTER_LINE_MAX_LENGTH,
+  SKILL_SUMMARY_MAX_LENGTH,
+  STRUCTURED_DATA_REVIEW_REASONS,
+  SUPPORTED_IMAGE_MIME_TYPES,
+  SkillMarkdownError,
+  THEME_MODES,
+  THEME_MODE_PREFERENCES,
+  TOOL_CALL_STATES,
+  TOOL_DECISION_MODES,
+  TOOL_DECISION_OUTCOMES,
+  TOOL_DISPLAY_MODES,
+  TOOL_GROUPS,
+  TOOL_INPUT_PARSE_ERROR_CODES,
+  USAGE_BREAKDOWN_DIMENSIONS,
+  USAGE_COST_STATUSES,
+  USAGE_ORIGINS,
+  USAGE_SPEND_LIMIT_LEVELS,
+  USER_STATUSES,
+  WAITING_OPERATION_RUN_STATUSES,
+  WEB_SOURCE_PROVIDERS,
+  WORKFLOW_DATASET_DOWNLOAD_FORMATS,
+  WORKFLOW_DATASET_STATES,
+  WORKFLOW_ENDED_STATUSES,
+  WORKFLOW_EXECUTED_STEP_TYPES,
+  WORKFLOW_KINDS,
+  WORKFLOW_MARKDOWN_MAX_COLUMNS,
+  WORKFLOW_MARKDOWN_MAX_ROWS,
+  WORKFLOW_NAME_PATTERN,
+  WORKFLOW_NAME_RULE,
+  WORKFLOW_RESERVED_STEP_TYPES,
+  WORKFLOW_RIGHTS_REVISIONS,
+  WORKFLOW_RIGHT_NEEDED_FOR,
+  WORKFLOW_RIGHT_REFUSALS,
+  WORKFLOW_RUN_ACCOUNT_STATUSES,
+  WORKFLOW_RUN_MODES,
+  WORKFLOW_RUN_STATUSES,
+  WORKFLOW_STEP_RUN_STATUSES,
+  WORKFLOW_STEP_SOURCE_KINDS,
+  WORKFLOW_STEP_TYPES,
+  WORKFLOW_TEST_REVISIONS,
+  WORKFLOW_TEXT_FORMAT_MARKDOWN,
+  WORKFLOW_TEXT_MAX_PARTS,
+  WORKFLOW_TRIGGER_KINDS,
+  WORKSPACE_ACCENT_COLORS,
+  WORKSPACE_ACCESS_STATES,
+  WORKSPACE_COMMAND_STATUSES,
+  WORKSPACE_FILE_KINDS,
+  WORKSPACE_MEMBERSHIP_ROLES,
+  WORKSPACE_SECTIONS,
+  WORKSPACE_USE_ASSET_KINDS,
+  WORKSPACE_VISIBILITIES,
+  YAML_DATA_MAX_VALUES,
+  YamlDataError,
+  agentConfigSchema,
+  callableOperationSchema,
+  callableOperationsPageSchema,
+  checkStorableTexts,
+  dataScopeNameSchema,
+  dataScopesSchema,
+  dataStoreRecordFieldSchema,
+  dataStoreRecordProposalItemSchema,
+  dataStoreRecordsContracts,
+  dataStoreRecordsDecideInputSchema,
+  dataStoreRecordsDecideOutputSchema,
+  dataStoreRecordsFlaggedInputSchema,
+  dataStoreRecordsFlaggedOutputSchema,
+  dataStoreRecordsProposeInputSchema,
+  dataStoreRecordsRuleSchema,
+  deriveSkillTitle,
+  formatSkillMarkdown,
+  isStorableText,
+  knowledgeExtractFieldsInputSchema,
+  knowledgeExtractFieldsOutputSchema,
+  knowledgeFieldValueSchema,
+  knowledgeFirstPassConfirmationSchema,
+  knowledgeIngestFetchSchema,
+  knowledgeIngestInputSchema,
+  knowledgeIngestItemSchema,
+  knowledgeIngestOutputSchema,
+  knowledgeLocateInputSchema,
+  knowledgeLocateOutputSchema,
+  knowledgePendingInputSchema,
+  knowledgePendingOutputSchema,
+  knowledgePendingRowSchema,
+  knowledgeProcessorOutputSchema,
+  knowledgePutProcessedInputSchema,
+  knowledgeRecordsRefusalSchema,
+  knowledgeRetryInputSchema,
+  knowledgeRetryOutputSchema,
+  knowledgeSourceItemsInputSchema,
+  knowledgeSourceItemsOutputSchema,
+  knowledgeSourcesOutputSchema,
+  knowledgeSyncInputSchema,
+  knowledgeSyncResultSchema,
+  knowledgeWithdrawInputSchema,
+  knowledgeWithdrawOutputSchema,
+  knowledgeWorkflowSourceSchema,
+  knowledgeWorkflowSourcesOutputSchema,
+  knowledgeWriteContracts,
+  loadYamlData,
+  localeCodes,
+  localizedStringSchema,
+  mailAddressSchema,
+  mailBodySchema,
+  mailCopyRecipientListSchema,
+  mailPreviewRecipientSchema,
+  mailRecipientDomainSchema,
+  mailRecipientListSchema,
+  mailRecipientSchema,
+  mailReplyToSchema,
+  mailSendContract,
+  mailSendInputSchema,
+  mailSendOutputSchema,
+  mailSendPreviewSchema,
+  mailSendRefusalDetailsSchema,
+  mailSendSimulatedOutputSchema,
+  mailSenderIdSchema,
+  mailSenderNameSchema,
+  mailSubjectSchema,
+  operationBatchFailureSchema,
+  operationBatchResultSchema,
+  operationPagingSchema,
+  operationSourceSchema,
+  parseSkillMarkdown,
+  providerRegionSchema,
+  readYamlData,
+  recordColumnTakes,
+  recordEvidenceResultSchema,
+  scopeAssignmentInputSchema,
+  scopedTablesSchema,
+  skillConfigSchema,
+  skillFileEntrySchema,
+  skillFileFrontmatterSchema,
+  skillNameSchema,
+  skillPortabilityIssues,
+  skillResourceConfigSchema,
+  skillResourceMediaTypeForPath,
+  skillResourcePathSchema,
+  skillStarterSchema,
+  workflowConfigSchema,
+  workflowDataFlowsSchema,
+  workflowDatasetReferenceSchema,
+  workflowMailSenderFactSchema,
+  workflowMessageMailParamsSchema,
+  yamlValueIssue,
+  yamlValueIssueSentence
+};