Remove cli tools packages from the ageGate

fix(ai) - add ai model preferences fallback (#20704 )
**Problem** AI_MODEL_PREFERENCES, JSON env var is not supported + IS_CONFIG_VARIABLES_IN_DB_ENABLED=false in twenty cloud server -> No option to set AI_MODEL_PREFERENCES **Solution** AI_MODEL_PREFERENCES supports three override sources beyond the hardcoded code defaults, in priority order: - DB (IS_CONFIG_VARIABLES_IN_DB_ENABLED=true), the only writable source; admin-panel mutations persist here - ENV not usable in Twenty Cloud, which does not handle JSON-format env vars - **Introduced in this PR** --> File (AI_MODEL_PREFERENCES_STORAGE_PATH), a read-only startup fallback, the only viable override in Cloud/self-managed deployments where DB config is disabled and JSON env vars are unsupported.
2026-05-19 16:10:47 +02:00 · 2026-05-19 13:19:24 +00:00 · 2026-05-19 13:12:47 +00:00 · 2026-05-19 15:17:23 +02:00 · 2026-05-19 15:15:56 +02:00 · 2026-05-19 15:09:49 +02:00
1318 changed files with 59870 additions and 23116 deletions
@@ -1,201 +0,0 @@
-name: CI Hello world App E2E
-
-on:
-  # Temporarily disabled — will be re-enabled when example apps are published.
-  # push:
-  #   branches:
-  #     - main
-  #
-  # pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-jobs:
-  changed-files-check:
-    uses: ./.github/workflows/changed-files.yaml
-    with:
-      files: |
-        packages/create-twenty-app/**
-        packages/twenty-sdk/**
-        packages/twenty-client-sdk/**
-        packages/twenty-shared/**
-        !packages/create-twenty-app/package.json
-        !packages/twenty-sdk/package.json
-        !packages/twenty-client-sdk/package.json
-        !packages/twenty-shared/package.json
-  create-app-e2e-hello-world:
-    needs: changed-files-check
-    if: needs.changed-files-check.outputs.any_changed == 'true'
-    timeout-minutes: 30
-    runs-on: ubuntu-latest-4-cores
-    services:
-      postgres:
-        image: postgres:18
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      redis:
-        image: redis
-        ports:
-          - 6379:6379
-    env:
-      PUBLISHABLE_PACKAGES: twenty-client-sdk twenty-sdk create-twenty-app
-      TWENTY_API_URL: http://localhost:3000
-      TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
-    steps:
-      - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-        with:
-          fetch-depth: 10
-
-      - name: Install dependencies
-        uses: ./.github/actions/yarn-install
-
-      - name: Set CI version and prepare packages for publish
-        run: |
-          CI_VERSION="0.0.0-ci.$(date +%s)"
-          echo "CI_VERSION=$CI_VERSION" >> $GITHUB_ENV
-          for pkg in $PUBLISHABLE_PACKAGES; do
-            npx nx run $pkg:set-local-version --releaseVersion=$CI_VERSION
-          done
-
-      - name: Build packages
-        run: |
-          for pkg in $PUBLISHABLE_PACKAGES; do
-            npx nx build $pkg
-          done
-
-      - name: Install and start Verdaccio
-        run: |
-          npx verdaccio --config .github/verdaccio-config.yaml &
-
-          for i in $(seq 1 30); do
-            if curl -s http://localhost:4873 > /dev/null 2>&1; then
-              echo "Verdaccio is ready"
-              break
-            fi
-            echo "Waiting for Verdaccio... ($i/30)"
-            sleep 1
-          done
-
-      - name: Publish packages to local registry
-        run: |
-          yarn config set npmRegistryServer http://localhost:4873
-          yarn config set unsafeHttpWhitelist --json '["localhost"]'
-          yarn config set npmAuthToken ci-auth-token
-
-          for pkg in $PUBLISHABLE_PACKAGES; do
-            cd packages/$pkg
-            yarn npm publish --tag ci
-            cd ../..
-          done
-
-      - name: Scaffold app using published create-twenty-app
-        run: |
-          npm install -g create-twenty-app@$CI_VERSION --registry http://localhost:4873
-          create-twenty-app --version
-          mkdir -p /tmp/e2e-test-workspace
-          cd /tmp/e2e-test-workspace
-          create-twenty-app test-app --example hello-world --display-name "Test hello-world app" --description "E2E test hello-world app" --skip-local-instance
-
-      - name: Install scaffolded app dependencies
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          echo 'npmRegistryServer: "http://localhost:4873"' >> .yarnrc.yml
-          echo 'unsafeHttpWhitelist: ["localhost"]' >> .yarnrc.yml
-          YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn install --no-immutable
-          echo "--- Installing last SDK versions ---"
-          YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn add twenty-sdk twenty-client-sdk
-
-      - name: Verify installed app versions
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          echo "--- Checking package.json references correct SDK version ---"
-          node -e "
-            const pkg = require('./package.json');
-            const sdkVersion = pkg.dependencies['twenty-sdk'];
-            if (!sdkVersion.startsWith('0.0.0-ci.')) {
-              console.error('Expected twenty-sdk version to start with 0.0.0-ci., got:', sdkVersion);
-              process.exit(1);
-            }
-            console.log('SDK version in scaffolded app:', sdkVersion);
-          "
-
-      - name: Verify SDK CLI is available
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          npx --no-install twenty --version
-
-      - name: Setup server environment
-        run: npx nx reset:env:e2e-testing-server twenty-server
-
-      - name: Create databases
-        run: |
-          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
-          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
-
-      - name: Setup database
-        run: npx nx run twenty-server:database:reset
-
-      - name: Start server
-        run: nohup npx nx start:ci twenty-server &
-
-      - name: Wait for server to be ready
-        run: npx wait-on http://localhost:3000/healthz --timeout 120000 --interval 1000
-
-      - name: Authenticate with twenty-server
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          npx --no-install twenty remote add --api-key ${{ env.TWENTY_API_KEY }} --api-url ${{ env.TWENTY_API_URL }}
-
-      - name: Deploy scaffolded app
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          npx --no-install twenty deploy
-
-      - name: Install scaffolded app
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          npx --no-install twenty install
-
-      - name: Execute hello-world logic function
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          EXEC_OUTPUT=$(npx --no-install twenty exec --functionName hello-world-logic-function)
-          echo "$EXEC_OUTPUT"
-          echo "$EXEC_OUTPUT" | grep -q "Hello, World!"
-
-      - name: Execute create-hello-world-company logic function
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          EXEC_OUTPUT=$(npx --no-install twenty exec --functionName create-hello-world-company)
-          echo "$EXEC_OUTPUT"
-          echo "$EXEC_OUTPUT" | grep -q 'Created company.*Hello World.*with id'
-
-      - name: Run scaffolded app integration test
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          yarn test
-
-  ci-create-app-e2e-hello-world-status-check:
-    if: always() && !cancelled()
-    timeout-minutes: 5
-    runs-on: ubuntu-latest
-    needs: [changed-files-check, create-app-e2e-hello-world]
-    steps:
-      - name: Fail job if any needs failed
-        if: contains(needs.*.result, 'failure')
-        run: exit 1
@@ -105,7 +105,7 @@ jobs:
          create-twenty-app --version
          mkdir -p /tmp/e2e-test-workspace
          cd /tmp/e2e-test-workspace
-          create-twenty-app test-app --display-name "Test scaffolded app" --description "E2E test scaffolded app" --skip-local-instance --yes
+          create-twenty-app test-app --display-name "Test scaffolded app" --description "E2E test scaffolded app" --workspace-url http://localhost:3000

      - name: Install scaffolded app dependencies
        run: |
@@ -1,199 +0,0 @@
-name: CI Postcard App E2E
-
-on:
-  # Temporarily disabled — will be re-enabled when example apps are published.
-  # push:
-  #   branches:
-  #     - main
-  #
-  # pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-jobs:
-  changed-files-check:
-    uses: ./.github/workflows/changed-files.yaml
-    with:
-      files: |
-        packages/create-twenty-app/**
-        packages/twenty-sdk/**
-        packages/twenty-client-sdk/**
-        packages/twenty-shared/**
-        !packages/create-twenty-app/package.json
-        !packages/twenty-sdk/package.json
-        !packages/twenty-client-sdk/package.json
-        !packages/twenty-shared/package.json
-  create-app-e2e-postcard:
-    needs: changed-files-check
-    if: needs.changed-files-check.outputs.any_changed == 'true'
-    timeout-minutes: 30
-    runs-on: ubuntu-latest-4-cores
-    services:
-      postgres:
-        image: postgres:18
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      redis:
-        image: redis
-        ports:
-          - 6379:6379
-    env:
-      PUBLISHABLE_PACKAGES: twenty-client-sdk twenty-sdk create-twenty-app
-      TWENTY_API_URL: http://localhost:3000
-      TWENTY_API_KEY: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ1c2VySWQiOiIyMDIwMjAyMC1lNmI1LTQ2ODAtOGEzMi1iODIwOTczNzE1NmIiLCJ3b3Jrc3BhY2VJZCI6IjIwMjAyMDIwLTFjMjUtNGQwMi1iZjI1LTZhZWNjZjdlYTQxOSIsIndvcmtzcGFjZU1lbWJlcklkIjoiMjAyMDIwMjAtNDYzZi00MzViLTgyOGMtMTA3ZTAwN2EyNzExIiwidXNlcldvcmtzcGFjZUlkIjoiMjAyMDIwMjAtMWU3Yy00M2Q5LWE1ZGItNjg1YjUwNjlkODE2IiwidHlwZSI6IkFDQ0VTUyIsImF1dGhQcm92aWRlciI6InBhc3N3b3JkIiwiaWF0IjoxNzUxMjgxNzA0LCJleHAiOjIwNjY4NTc3MDR9.HMGqCsVlOAPVUBhKSGlD1X86VoHKt4LIUtET3CGIdik
-    steps:
-      - name: Fetch custom Github Actions and base branch history
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-        with:
-          fetch-depth: 10
-
-      - name: Install dependencies
-        uses: ./.github/actions/yarn-install
-
-      - name: Set CI version and prepare packages for publish
-        run: |
-          CI_VERSION="0.0.0-ci.$(date +%s)"
-          echo "CI_VERSION=$CI_VERSION" >> $GITHUB_ENV
-          npx nx run-many -t set-local-version -p $PUBLISHABLE_PACKAGES --releaseVersion=$CI_VERSION
-
-      - name: Build packages
-        run: |
-          for pkg in $PUBLISHABLE_PACKAGES; do
-            npx nx build $pkg
-          done
-
-      - name: Install and start Verdaccio
-        run: |
-          npx verdaccio --config .github/verdaccio-config.yaml &
-
-          for i in $(seq 1 30); do
-            if curl -s http://localhost:4873 > /dev/null 2>&1; then
-              echo "Verdaccio is ready"
-              break
-            fi
-            echo "Waiting for Verdaccio... ($i/30)"
-            sleep 1
-          done
-
-      - name: Publish packages to local registry
-        run: |
-          yarn config set npmRegistryServer http://localhost:4873
-          yarn config set unsafeHttpWhitelist --json '["localhost"]'
-          yarn config set npmAuthToken ci-auth-token
-
-          for pkg in $PUBLISHABLE_PACKAGES; do
-            cd packages/$pkg
-            yarn npm publish --tag ci
-            cd ../..
-          done
-
-      - name: Scaffold app using published create-twenty-app
-        run: |
-          npm install -g create-twenty-app@$CI_VERSION --registry http://localhost:4873
-          create-twenty-app --version
-          mkdir -p /tmp/e2e-test-workspace
-          cd /tmp/e2e-test-workspace
-          create-twenty-app test-app --example postcard --display-name "Test postcard app" --description "E2E test postcard app" --skip-local-instance
-
-      - name: Install scaffolded app dependencies
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          echo 'npmRegistryServer: "http://localhost:4873"' >> .yarnrc.yml
-          echo 'unsafeHttpWhitelist: ["localhost"]' >> .yarnrc.yml
-          YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn install --no-immutable
-          echo "--- Installing last SDK versions ---"
-          YARN_ENABLE_IMMUTABLE_INSTALLS=false yarn add twenty-sdk twenty-client-sdk
-
-      - name: Verify installed app versions
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          echo "--- Checking package.json references correct SDK version ---"
-          node -e "
-            const pkg = require('./package.json');
-            const sdkVersion = pkg.dependencies['twenty-sdk'];
-            if (!sdkVersion.startsWith('0.0.0-ci.')) {
-              console.error('Expected twenty-sdk version to start with 0.0.0-ci., got:', sdkVersion);
-              process.exit(1);
-            }
-            console.log('SDK version in scaffolded app:', sdkVersion);
-          "
-
-      - name: Verify SDK CLI is available
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          npx --no-install twenty --version
-
-      - name: Setup server environment
-        run: npx nx reset:env:e2e-testing-server twenty-server
-
-      - name: Create databases
-        run: |
-          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
-          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
-
-      - name: Setup database
-        run: npx nx run twenty-server:database:reset
-
-      - name: Start server
-        run: nohup npx nx start:ci twenty-server &
-
-      - name: Wait for server to be ready
-        run: npx wait-on http://localhost:3000/healthz --timeout 120000 --interval 1000
-
-      - name: Authenticate with twenty-server
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          npx --no-install twenty remote add --api-key ${{ env.TWENTY_API_KEY }} --api-url ${{ env.TWENTY_API_URL }}
-
-      - name: Deploy scaffolded app
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          npx --no-install twenty deploy
-
-      - name: Install scaffolded app
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          npx --no-install twenty install
-
-      - name: Execute postcard logic function
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          EXEC_OUTPUT=$(npx --no-install twenty exec --functionName postcard-logic-function)
-          echo "$EXEC_OUTPUT"
-          echo "$EXEC_OUTPUT" | grep -q "Hello, World!"
-
-      - name: Execute create-postcard-company logic function
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          EXEC_OUTPUT=$(npx --no-install twenty exec --functionName create-postcard-company)
-          echo "$EXEC_OUTPUT"
-          echo "$EXEC_OUTPUT" | grep -q 'Created company.*Hello World.*with id'
-
-      - name: Run scaffolded app integration test
-        run: |
-          cd /tmp/e2e-test-workspace/test-app
-          yarn test
-
-  ci-create-app-e2e-postcard-status-check:
-    if: always() && !cancelled()
-    timeout-minutes: 5
-    runs-on: ubuntu-latest
-    needs: [changed-files-check, create-app-e2e-postcard]
-    steps:
-      - name: Fail job if any needs failed
-        if: contains(needs.*.result, 'failure')
-        run: exit 1
@@ -23,9 +23,11 @@ jobs:
        packages/twenty-sdk/**
        packages/twenty-client-sdk/**
        packages/twenty-shared/**
+        packages/twenty-server/**
        !packages/twenty-sdk/package.json
        !packages/twenty-client-sdk/package.json
        !packages/twenty-shared/package.json
+        !packages/twenty-server/package.json

  example-app-postcard:
    needs: changed-files-check
@@ -83,6 +85,31 @@ jobs:
        working-directory: packages/twenty-apps/examples/postcard
        run: npx vitest run

+      - name: Configure remote for SDK CLI
+        run: |
+          mkdir -p ~/.twenty
+          cat > ~/.twenty/config.json <<EOF
+          {
+            "version": 1,
+            "remotes": {
+              "target": {
+                "apiUrl": "${TWENTY_API_URL}",
+                "apiKey": "${TWENTY_API_KEY}",
+                "accessToken": "${TWENTY_API_KEY}"
+              }
+            },
+            "defaultRemote": "target"
+          }
+          EOF
+
+      - name: Deploy postcard app (registry install path)
+        working-directory: packages/twenty-apps/examples/postcard
+        run: node ${{ github.workspace }}/packages/twenty-sdk/dist/cli.cjs deploy --remote target
+
+      - name: Install postcard app (registry install path)
+        working-directory: packages/twenty-apps/examples/postcard
+        run: node ${{ github.workspace }}/packages/twenty-sdk/dist/cli.cjs install --remote target
+
  ci-example-app-postcard-status-check:
    if: always() && !cancelled()
    timeout-minutes: 5
@@ -51,6 +51,7 @@ jobs:
      contents: write
      pull-requests: write
      issues: write
+      id-token: write
    services:
      postgres:
        image: postgres:16
@@ -123,6 +124,7 @@ jobs:
      contents: write
      pull-requests: write
      issues: write
+      id-token: write
    services:
      postgres:
        image: postgres:16
@@ -43,6 +43,46 @@
    {
      "name": "packages/twenty-e2e-testing",
      "path": "../packages/twenty-e2e-testing"
+    },
+    {
+      "name": "packages/twenty-docs",
+      "path": "../packages/twenty-docs"
+    },
+    {
+      "name": "packages/create-twenty-app",
+      "path": "../packages/create-twenty-app"
+    },
+    {
+      "name": "packages/twenty-apps",
+      "path": "../packages/twenty-apps"
+    },
+    {
+      "name": "packages/twenty-claude-skills",
+      "path": "../packages/twenty-claude-skills"
+    },
+    {
+      "name": "packages/twenty-cli",
+      "path": "../packages/twenty-cli"
+    },
+    {
+      "name": "packages/twenty-client-sdk",
+      "path": "../packages/twenty-client-sdk"
+    },
+    {
+      "name": "packages/twenty-companion",
+      "path": "../packages/twenty-companion"
+    },
+    {
+      "name": "packages/twenty-front-component-renderer",
+      "path": "../packages/twenty-front-component-renderer"
+    },
+    {
+      "name": "packages/twenty-sdk",
+      "path": "../packages/twenty-sdk"
+    },
+    {
+      "name": "packages/twenty-website-new",
+      "path": "../packages/twenty-website-new"
    }
  ],
  "settings": {
@@ -4,8 +4,15 @@ enableHardenedMode: true

 enableInlineHunks: true

+enableScripts: false
+
 nodeLinker: node-modules

-npmMinimalAgeGate: "3d"
+npmMinimalAgeGate: 3d
+
+npmPreapprovedPackages:
+  - twenty-sdk
+  - twenty-client-sdk
+  - create-twenty-app

 yarnPath: .yarn/releases/yarn-4.13.0.cjs
@@ -25,26 +25,18 @@ yarn twenty dev
 The scaffolder will:

 1. Create a new project with TypeScript, linting, tests, and a preconfigured `twenty` CLI
-2. Optionally start a local Twenty server (Docker)
-3. Open the browser for OAuth authentication
+2. Start a local Twenty server via Docker (pulls the latest image automatically)
+3. Authenticate with the development API key

 ## Options

-| Flag                           | Description                             |
-| ------------------------------ | --------------------------------------- |
-| `--example <name>`             | Initialize from an example              |
-| `--name <name>`                | Set the app name (skips the prompt)     |
-| `--display-name <displayName>` | Set the display name (skips the prompt) |
-| `--description <description>`  | Set the description (skips the prompt)  |
-| `--skip-local-instance`        | Skip the local server setup prompt      |
-
-By default (no flags), a minimal app is generated with core files and an integration test. Use `--example` to start from a richer example:
-
-```bash
-npx create-twenty-app@latest my-twenty-app --example hello-world
-```
-
-Examples are sourced from [twentyhq/twenty/packages/twenty-apps/examples](https://github.com/twentyhq/twenty/tree/main/packages/twenty-apps/examples).
+| Flag                               | Description                                                           |
+| ---------------------------------- | --------------------------------------------------------------------- |
+| `--name <name>`                    | Set the app name                                                      |
+| `--display-name <displayName>`     | Set the display name                                                  |
+| `--description <description>`      | Set the description                                                   |
+| `--workspace-url <url>`            | Twenty workspace URL (default: `http://localhost:2020`)               |
+| `--authentication-method <method>` | `oauth` or `apiKey` (default: `apiKey` for local, `oauth` for remote) |

 ## Documentation

@@ -57,7 +49,7 @@ Full documentation is available at **[docs.twenty.com/developers/extend/apps](ht
 ## Troubleshooting

 - Server not starting: check Docker is running (`docker info`), then try `yarn twenty server logs`.
- Auth not working: make sure you are logged in to Twenty in the browser, then run `yarn twenty remote add`.
+- Auth not working: run `yarn twenty remote add --local` to re-authenticate.
 - Types not generated: ensure `yarn twenty dev` is running — it auto-generates the typed client.

 ## Contributing
@@ -1,6 +1,6 @@
 {
  "name": "create-twenty-app",
-  "version": "2.4.0",
+  "version": "2.5.1",
  "description": "Command-line interface to create Twenty application",
  "main": "dist/cli.cjs",
  "bin": "dist/cli.cjs",
@@ -32,7 +32,6 @@
    "chalk": "^5.3.0",
    "commander": "^12.0.0",
    "fs-extra": "^11.2.0",
-    "inquirer": "^10.0.0",
    "lodash.camelcase": "^4.3.0",
    "lodash.kebabcase": "^4.1.1",
    "lodash.startcase": "^4.4.0",
@@ -43,7 +42,6 @@
    "@swc/core": "^1.15.11",
    "@swc/jest": "^0.2.39",
    "@types/fs-extra": "^11.0.0",
-    "@types/inquirer": "^9.0.0",
    "@types/jest": "^30.0.0",
    "@types/lodash.camelcase": "^4.3.7",
    "@types/lodash.kebabcase": "^4.1.7",
@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import chalk from 'chalk';
 import { Command, CommanderError } from 'commander';
-import { CreateAppCommand } from '@/create-app.command';
+import {
+  type AuthenticationMethod,
+  CreateAppCommand,
+} from '@/create-app.command';
 import packageJson from '../package.json';

 const program = new Command(packageJson.name)
@@ -12,32 +15,29 @@ const program = new Command(packageJson.name)
    'Output the current version of create-twenty-app.',
  )
  .argument('[directory]')
-  .option('--example <name>', 'Initialize from an example')
-  .option('-n, --name <name>', 'Application name (skips prompt)')
+  .option('-n, --name <name>', 'Application name')
+  .option('-d, --display-name <displayName>', 'Application display name')
+  .option('--description <description>', 'Application description')
  .option(
-    '-d, --display-name <displayName>',
-    'Application display name (skips prompt)',
+    '--workspace-url <workspaceUrl>',
+    'Twenty workspace URL (default: http://localhost:2020)',
  )
+  .option('--api-url <apiUrl>', '[deprecated: use --workspace-url]')
  .option(
-    '--description <description>',
-    'Application description (skips prompt)',
+    '--authentication-method <method>',
+    'Authentication method: oauth or apiKey (default: apiKey for local, oauth for remote)',
  )
-  .option(
-    '--skip-local-instance',
-    'Skip the local Twenty instance setup prompt',
-  )
-  .option('-y, --yes', 'Auto-confirm prompts (e.g. start existing container)')
  .helpOption('-h, --help', 'Display this help message.')
  .action(
    async (
      directory?: string,
      options?: {
-        example?: string;
        name?: string;
        displayName?: string;
        description?: string;
-        skipLocalInstance?: boolean;
-        yes?: boolean;
+        workspaceUrl?: string;
+        apiUrl?: string;
+        authenticationMethod?: AuthenticationMethod;
      },
    ) => {
      if (directory && !/^[a-z0-9-]+$/.test(directory)) {
@@ -54,14 +54,33 @@ const program = new Command(packageJson.name)
        process.exit(1);
      }

+      if (
+        options?.authenticationMethod &&
+        !['oauth', 'apiKey'].includes(options.authenticationMethod)
+      ) {
+        console.error(
+          chalk.red(
+            'Error: --authentication-method must be "oauth" or "apiKey".',
+          ),
+        );
+        process.exit(1);
+      }
+
+      if (options?.apiUrl) {
+        console.warn(
+          chalk.yellow(
+            'Warning: --api-url is deprecated. Use --workspace-url instead.',
+          ),
+        );
+      }
+
      await new CreateAppCommand().execute({
        directory,
-        example: options?.example,
        name: options?.name,
        displayName: options?.displayName,
        description: options?.description,
-        skipLocalInstance: options?.skipLocalInstance,
-        yes: options?.yes,
+        workspaceUrl: options?.workspaceUrl ?? options?.apiUrl,
+        authenticationMethod: options?.authenticationMethod,
      });
    },
  );
@@ -2,8 +2,19 @@ This is a [Twenty](https://twenty.com) application bootstrapped with [`create-tw

 ## Getting Started

+This app was scaffolded with a local Twenty server running at [http://localhost:2020](http://localhost:2020).
+
+Login with the default development credentials: `tim@apple.dev` / `tim@apple.dev`.
+
 Run `yarn twenty help` to list all available commands.

+## Useful Commands
+
+- `yarn twenty dev` - Start the development server and sync your app
+- `yarn twenty server status` - Check the local Twenty server status
+- `yarn twenty server start` - Start the local Twenty server
+- `yarn test` - Run integration tests
+
 ## Learn More

 - [Twenty Apps documentation](https://docs.twenty.com/developers/extend/apps/getting-started/quick-start)
@@ -11,7 +11,7 @@ permissions:
  contents: read

 env:
-  TWENTY_DEPLOY_URL: http://localhost:3000
+  TWENTY_DEPLOY_URL: http://localhost:2020

 concurrency:
  group: cd-${{ github.ref }}
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80" fill="none">
+  <rect width="80" height="80" rx="16" fill="#141414"/>
+  <rect x="20" y="20" width="16" height="16" rx="4" fill="#FAFAFA"/>
+  <rect x="44" y="20" width="16" height="16" rx="4" fill="#FAFAFA" opacity="0.6"/>
+  <rect x="20" y="44" width="16" height="16" rx="4" fill="#FAFAFA" opacity="0.6"/>
+  <rect x="44" y="44" width="16" height="16" rx="4" fill="#FAFAFA" opacity="0.3"/>
+</svg>
@@ -2,3 +2,10 @@ export const APP_DISPLAY_NAME = 'DISPLAY-NAME-TO-BE-GENERATED';
 export const APP_DESCRIPTION = 'DESCRIPTION-TO-BE-GENERATED';
 export const APPLICATION_UNIVERSAL_IDENTIFIER = 'UUID-TO-BE-GENERATED';
 export const DEFAULT_ROLE_UNIVERSAL_IDENTIFIER = 'UUID-TO-BE-GENERATED';
+export const MAIN_PAGE_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER =
+  'UUID-TO-BE-GENERATED';
+export const MAIN_PAGE_LAYOUT_UNIVERSAL_IDENTIFIER = 'UUID-TO-BE-GENERATED';
+export const MAIN_PAGE_LAYOUT_TAB_UNIVERSAL_IDENTIFIER = 'UUID-TO-BE-GENERATED';
+export const MAIN_PAGE_WIDGET_UNIVERSAL_IDENTIFIER = 'UUID-TO-BE-GENERATED';
+export const MAIN_PAGE_NAVIGATION_MENU_ITEM_UNIVERSAL_IDENTIFIER =
+  'UUID-TO-BE-GENERATED';
@@ -0,0 +1,279 @@
+import { defineFrontComponent } from 'twenty-sdk/define';
+import { useState } from 'react';
+
+import {
+  APP_DISPLAY_NAME,
+  MAIN_PAGE_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
+} from 'src/constants/universal-identifiers';
+
+const DOCS_BASE_URL = 'https://docs.twenty.com/developers/extend/apps';
+
+const CATEGORIES = [
+  {
+    title: 'Data model',
+    color: '#73D08D',
+    items: [
+      { label: 'CUSTOM OBJECT', href: `${DOCS_BASE_URL}/data/objects` },
+      {
+        label: 'CUSTOM FIELDS',
+        href: `${DOCS_BASE_URL}/data/extending-objects`,
+      },
+    ],
+    rotation: '2.4deg',
+  },
+  {
+    title: 'Logic',
+    color: '#F4D345',
+    items: [
+      {
+        label: 'TOOLS',
+        href: `${DOCS_BASE_URL}/logic/logic-functions`,
+      },
+      {
+        label: 'SERVERLESS FUNCT.',
+        href: `${DOCS_BASE_URL}/logic/logic-functions`,
+      },
+      {
+        label: 'SKILLS',
+        href: `${DOCS_BASE_URL}/logic/skills-and-agents`,
+      },
+    ],
+    rotation: '0deg',
+  },
+  {
+    title: 'Layout',
+    color: '#C4A2E0',
+    items: [
+      { label: 'VIEWS', href: `${DOCS_BASE_URL}/layout/views` },
+      { label: 'WIDGETS', href: `${DOCS_BASE_URL}/layout/page-layouts` },
+      {
+        label: 'LAYOUT PAGES',
+        href: `${DOCS_BASE_URL}/layout/page-layouts`,
+      },
+      {
+        label: 'COMMANDS',
+        href: `${DOCS_BASE_URL}/layout/command-menu-items`,
+      },
+    ],
+    rotation: '-2.8deg',
+  },
+] as const;
+
+const ItemIcon = ({ color }: { color: string }) => (
+  <svg width="16" height="16" viewBox="0 0 16 16" fill="none">
+    <rect x="2" y="2" width="5" height="5" rx="1" fill={color} />
+    <rect x="9" y="2" width="5" height="5" rx="1" fill={color} opacity="0.6" />
+    <rect x="2" y="9" width="5" height="5" rx="1" fill={color} opacity="0.6" />
+    <rect x="9" y="9" width="5" height="5" rx="1" fill={color} opacity="0.3" />
+  </svg>
+);
+
+const ArrowUpRight = ({ color = '#999' }: { color?: string }) => (
+  <svg width="14" height="14" viewBox="0 0 14 14" fill="none">
+    <path
+      d="M4.5 3.5H10.5V9.5M10.5 3.5L3.5 10.5"
+      stroke={color}
+      strokeWidth="1.2"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+    />
+  </svg>
+);
+
+const CategoryCard = ({
+  title,
+  color,
+  items,
+  rotation,
+}: {
+  title: string;
+  color: string;
+  items: ReadonlyArray<{ label: string; href: string }>;
+  rotation: string;
+}) => {
+  const [hoveredItem, setHoveredItem] = useState<string | null>(null);
+
+  return (
+    <div
+      style={{
+        display: 'flex',
+        flexDirection: 'column',
+        border: `1px solid ${color}80`,
+        borderRadius: '12px',
+        overflow: 'hidden',
+        width: '240px',
+        background: '#FFFFFF',
+        transform: `rotate(${rotation})`,
+        boxShadow: '0 2px 8px rgba(0, 0, 0, 0.04)',
+      }}
+    >
+      <div
+        style={{
+          padding: '16px 20px',
+          background: `${color}22`,
+        }}
+      >
+        <span
+          style={{
+            fontSize: '16px',
+            fontWeight: 600,
+            color: color,
+          }}
+        >
+          {title}
+        </span>
+      </div>
+      <div
+        style={{
+          display: 'flex',
+          flexDirection: 'column',
+          padding: '8px',
+          gap: '4px',
+        }}
+      >
+        {items.map((item) => {
+          const isHovered = hoveredItem === item.label;
+
+          return (
+            <a
+              key={item.label}
+              href={item.href}
+              target="_blank"
+              rel="noopener noreferrer"
+              onMouseEnter={() => setHoveredItem(item.label)}
+              onMouseLeave={() => setHoveredItem(null)}
+              style={{
+                display: 'flex',
+                alignItems: 'center',
+                gap: '10px',
+                textDecoration: 'none',
+                cursor: 'pointer',
+                padding: '10px 12px',
+                borderRadius: '8px',
+                background: isHovered ? '#0000000A' : 'transparent',
+                transition: 'background 0.15s',
+              }}
+            >
+              <ItemIcon color={color} />
+              <span
+                style={{
+                  fontSize: '13px',
+                  fontWeight: 300,
+                  color: '#333',
+                  letterSpacing: '0.5px',
+                  flex: 1,
+                }}
+              >
+                {item.label}
+              </span>
+              {isHovered && <ArrowUpRight />}
+            </a>
+          );
+        })}
+      </div>
+    </div>
+  );
+};
+
+const MainPage = () => {
+  return (
+    <div
+      style={{
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        justifyContent: 'center',
+        height: '100%',
+        fontFamily:
+          'Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif',
+        gap: '8px',
+        padding: '40px',
+      }}
+    >
+      {/*<Avatar
+        avatarUrl={getPublicAssetUrl('logo.svg')}
+        placeholder={APP_DISPLAY_NAME}
+        placeholderColorSeed={APP_DISPLAY_NAME}
+        type="squared"
+        size="xl"
+      />*/}
+      <span
+        style={{
+          fontSize: '24px',
+          fontWeight: 600,
+          color: '#333',
+          marginTop: '8px',
+        }}
+      >
+        {APP_DISPLAY_NAME}
+      </span>
+      <span
+        style={{
+          fontSize: '13px',
+          color: '#888',
+          textAlign: 'center',
+          lineHeight: '1.5',
+        }}
+      >
+        Was installed successfully.
+        <br />
+        You can now add content to your app.
+      </span>
+      <a
+        href="/settings/applications"
+        style={{
+          display: 'inline-flex',
+          alignItems: 'center',
+          gap: '6px',
+          marginTop: '16px',
+          fontSize: '13px',
+          color: '#333',
+          textDecoration: 'none',
+          padding: '8px 16px',
+          borderRadius: '8px',
+          border: '1px solid #e0e0e0',
+          background: '#fafafa',
+          transition: 'background 0.15s, border-color 0.15s',
+        }}
+        onMouseEnter={(e) => {
+          e.currentTarget.style.background = '#f0f0f0';
+          e.currentTarget.style.borderColor = '#ccc';
+        }}
+        onMouseLeave={(e) => {
+          e.currentTarget.style.background = '#fafafa';
+          e.currentTarget.style.borderColor = '#e0e0e0';
+        }}
+      >
+        Open app settings
+        <ArrowUpRight color="#333" />
+      </a>
+      <div
+        style={{
+          display: 'flex',
+          gap: '16px',
+          marginTop: '32px',
+          flexWrap: 'wrap',
+          justifyContent: 'center',
+          alignItems: 'flex-start',
+        }}
+      >
+        {CATEGORIES.map((category) => (
+          <CategoryCard
+            key={category.title}
+            title={category.title}
+            color={category.color}
+            items={category.items}
+            rotation={category.rotation}
+          />
+        ))}
+      </div>
+    </div>
+  );
+};
+
+export default defineFrontComponent({
+  universalIdentifier: MAIN_PAGE_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
+  name: APP_DISPLAY_NAME,
+  description: `${APP_DISPLAY_NAME} front component displaying the app logo and name`,
+  component: MainPage,
+});
@@ -0,0 +1,19 @@
+import {
+  defineNavigationMenuItem,
+  NavigationMenuItemType,
+} from 'twenty-sdk/define';
+
+import {
+  APP_DISPLAY_NAME,
+  MAIN_PAGE_LAYOUT_UNIVERSAL_IDENTIFIER,
+  MAIN_PAGE_NAVIGATION_MENU_ITEM_UNIVERSAL_IDENTIFIER,
+} from 'src/constants/universal-identifiers';
+
+export default defineNavigationMenuItem({
+  universalIdentifier: MAIN_PAGE_NAVIGATION_MENU_ITEM_UNIVERSAL_IDENTIFIER,
+  name: APP_DISPLAY_NAME,
+  icon: 'IconFile',
+  position: -1,
+  type: NavigationMenuItemType.PAGE_LAYOUT,
+  pageLayoutUniversalIdentifier: MAIN_PAGE_LAYOUT_UNIVERSAL_IDENTIFIER,
+});
@@ -0,0 +1,37 @@
+import { definePageLayout, PageLayoutTabLayoutMode } from 'twenty-sdk/define';
+
+import {
+  APP_DISPLAY_NAME,
+  MAIN_PAGE_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
+  MAIN_PAGE_LAYOUT_TAB_UNIVERSAL_IDENTIFIER,
+  MAIN_PAGE_LAYOUT_UNIVERSAL_IDENTIFIER,
+  MAIN_PAGE_WIDGET_UNIVERSAL_IDENTIFIER,
+} from 'src/constants/universal-identifiers';
+
+export default definePageLayout({
+  universalIdentifier: MAIN_PAGE_LAYOUT_UNIVERSAL_IDENTIFIER,
+  name: APP_DISPLAY_NAME,
+  type: 'STANDALONE_PAGE',
+  tabs: [
+    {
+      universalIdentifier: MAIN_PAGE_LAYOUT_TAB_UNIVERSAL_IDENTIFIER,
+      title: 'Overview',
+      position: 0,
+      icon: 'IconApps',
+      layoutMode: PageLayoutTabLayoutMode.CANVAS,
+      widgets: [
+        {
+          universalIdentifier: MAIN_PAGE_WIDGET_UNIVERSAL_IDENTIFIER,
+          title: ' ',
+          type: 'FRONT_COMPONENT',
+          gridPosition: { row: 0, column: 0, rowSpan: 12, columnSpan: 12 },
+          configuration: {
+            configurationType: 'FRONT_COMPONENT',
+            frontComponentUniversalIdentifier:
+              MAIN_PAGE_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
+          },
+        },
+      ],
+    },
+  ],
+});
@@ -1,96 +1,109 @@
 import { copyBaseApplicationProject } from '@/utils/app-template';
-import { downloadExample } from '@/utils/download-example';
 import { convertToLabel } from '@/utils/convert-to-label';
 import { install } from '@/utils/install';
 import { tryGitInit } from '@/utils/try-git-init';
 import chalk from 'chalk';
 import * as fs from 'fs-extra';
-import inquirer from 'inquirer';
 import kebabCase from 'lodash.kebabcase';
 import * as path from 'path';
 import { basename } from 'path';
+import { spawn } from 'node:child_process';
 import {
+  authLogin,
  authLoginOAuth,
  checkDockerRunning,
  ConfigService,
-  containerExists,
-  detectLocalServer,
+  DEV_API_KEY,
+  DEV_API_URL,
  serverStart,
 } from 'twenty-sdk/cli';
 import { isDefined } from 'twenty-shared/utils';
+import {
+  getDockerInstallInstructions,
+  isDockerInstalled,
+} from '@/utils/docker-install';

 const CURRENT_EXECUTION_DIRECTORY = process.env.INIT_CWD || process.cwd();
+const IMAGE = 'twentycrm/twenty-app-dev:latest';
+
+export type AuthenticationMethod = 'oauth' | 'apiKey';

 type CreateAppOptions = {
  directory?: string;
-  example?: string;
  name?: string;
  displayName?: string;
  description?: string;
-  skipLocalInstance?: boolean;
-  yes?: boolean;
+  workspaceUrl?: string;
+  authenticationMethod?: AuthenticationMethod;
 };

 export class CreateAppCommand {
-  private static TOTAL_STEPS = 4;
+  private stepCounter = 0;
+  private totalSteps = 0;

  async execute(options: CreateAppOptions = {}): Promise<void> {
    const { appName, appDisplayName, appDirectory, appDescription } =
-      await this.getAppInfos(options);
+      this.getAppInfos(options);
+
+    const workspaceUrl = options.workspaceUrl ?? DEV_API_URL;
+
+    const skipLocalInstance = workspaceUrl !== DEV_API_URL;
+
+    if (!skipLocalInstance && !isDockerInstalled()) {
+      console.log(chalk.yellow('\n' + getDockerInstallInstructions() + '\n'));
+      process.exit(1);
+    }
+
+    if (skipLocalInstance && options.authenticationMethod === 'apiKey') {
+      console.log(
+        chalk.yellow(
+          'API key authentication is only supported on a local Docker instance. Ignoring and switching to OAuth authentication.',
+        ),
+      );
+    }
+
+    const authenticationMethod = skipLocalInstance
+      ? 'oauth'
+      : (options.authenticationMethod ?? 'apiKey');

    try {
      await this.validateDirectory(appDirectory);

-      const confirmed = await this.promptScaffoldConfirmation({
+      this.totalSteps = this.computeTotalSteps({
+        skipLocalInstance,
+      });
+
+      this.stepCounter = 0;
+
+      const dockerPullPromise =
+        !skipLocalInstance && checkDockerRunning()
+          ? this.pullImageInBackground()
+          : Promise.resolve(false);
+
+      this.logPlan({ appName, appDisplayName, appDescription, appDirectory });
+
+      this.logNextStep('Creating project directory');
+
+      await fs.ensureDir(appDirectory);
+
+      this.logDetail(appDirectory);
+
+      this.logNextStep('Scaffolding project files');
+
+      await copyBaseApplicationProject({
        appName,
        appDisplayName,
        appDescription,
        appDirectory,
-        autoConfirm: options.yes,
+        onProgress: (message) => this.logDetail(message),
      });

-      if (!confirmed) {
-        console.log(chalk.gray('\nScaffolding cancelled.'));
-        process.exit(0);
-      }
+      this.logNextStep('Installing dependencies');

-      console.log('');
-
-      this.logStep(1, 'Creating project directory');
-      await fs.ensureDir(appDirectory);
-      this.logDetail(appDirectory);
-
-      this.logStep(2, 'Scaffolding project files');
-
-      if (options.example) {
-        const exampleSucceeded = await this.tryDownloadExample(
-          options.example,
-          appDirectory,
-        );
-
-        if (!exampleSucceeded) {
-          await copyBaseApplicationProject({
-            appName,
-            appDisplayName,
-            appDescription,
-            appDirectory,
-            onProgress: (message) => this.logDetail(message),
-          });
-        }
-      } else {
-        await copyBaseApplicationProject({
-          appName,
-          appDisplayName,
-          appDescription,
-          appDirectory,
-          onProgress: (message) => this.logDetail(message),
-        });
-      }
-
-      this.logStep(3, 'Installing dependencies');
      await install(appDirectory, (message) => this.logDetail(message));

-      this.logStep(4, 'Initializing Git repository');
+      this.logNextStep('Initializing Git repository');
+
      const gitInitialized = await tryGitInit(appDirectory);

      if (gitInitialized) {
@@ -104,38 +117,58 @@ export class CreateAppCommand {

      console.log('');

-      let hasLocalServer = false;
      let authSucceeded = false;
+      let resolvedWorkspaceUrl = workspaceUrl;
+      let serverReady = skipLocalInstance;

-      if (!options.skipLocalInstance) {
-        const existingServerUrl = await detectLocalServer();
+      if (!skipLocalInstance) {
+        this.logNextStep('Starting Twenty server');
+        const serverResult = await this.ensureDockerServer(dockerPullPromise);

-        if (existingServerUrl) {
-          hasLocalServer = true;
-          authSucceeded = await this.promptConnectToLocal(existingServerUrl);
-        } else {
-          const shouldStart = await this.shouldStartServer(options.yes);
-
-          if (shouldStart) {
-            const startResult = await serverStart({
-              onProgress: (message: string) => console.log(chalk.gray(message)),
-            });
-
-            if (startResult.success) {
-              hasLocalServer = true;
-              authSucceeded = await this.promptConnectToLocal(
-                startResult.data.url,
-              );
-            } else {
-              console.log(chalk.yellow(`\n${startResult.error.message}`));
-            }
-          } else {
-            this.logServerSkipped();
-          }
+        if (isDefined(serverResult.url)) {
+          resolvedWorkspaceUrl = serverResult.url;
+          serverReady = true;
        }
      }

-      this.logSuccess(appDirectory, hasLocalServer, authSucceeded);
+      if (serverReady) {
+        this.logNextStep('Authenticating');
+
+        authSucceeded = await this.tryExistingAuth(resolvedWorkspaceUrl);
+
+        if (authSucceeded) {
+          this.logDetail('Reusing existing credentials');
+        } else if (authenticationMethod === 'oauth') {
+          this.logDetail('Starting OAuth flow');
+          authSucceeded =
+            await this.authenticateWithOAuth(resolvedWorkspaceUrl);
+        } else {
+          this.logDetail('Using development API key');
+          authSucceeded =
+            await this.authenticateWithDevKey(resolvedWorkspaceUrl);
+        }
+      }
+
+      this.logNextStep('Installing application');
+
+      let syncSucceeded = false;
+
+      if (serverReady && authSucceeded) {
+        syncSucceeded = await this.syncApplication(appDirectory);
+
+        if (!syncSucceeded) {
+          this.logDetail('Sync failed. Run `yarn twenty dev --once` manually.');
+          return;
+        }
+      } else {
+        this.logDetail('Skipped (server or authentication not available)');
+      }
+
+      if (syncSucceeded) {
+        await this.openMainPage(appDirectory, resolvedWorkspaceUrl);
+      }
+
+      this.logSuccess(appDirectory, resolvedWorkspaceUrl, authSucceeded);
    } catch (error) {
      console.error(
        chalk.red('\nCreate application failed:'),
@@ -145,66 +178,42 @@ export class CreateAppCommand {
    }
  }

-  private async getAppInfos(options: CreateAppOptions): Promise<{
+  private computeTotalSteps({
+    skipLocalInstance,
+  }: {
+    skipLocalInstance: boolean;
+  }): number {
+    let steps = 4; // directory, scaffold, install, git
+
+    if (!skipLocalInstance) {
+      steps += 1; // start server
+    }
+
+    steps += 1; // authenticate (oauth or apiKey)
+    steps += 1; // sync application
+
+    return steps;
+  }
+
+  private getAppInfos(options: CreateAppOptions): {
    appName: string;
    appDisplayName: string;
    appDescription: string;
    appDirectory: string;
-  }> {
-    const { directory } = options;
-
-    const hasName = isDefined(options.name) || isDefined(directory);
-    const hasDisplayName = isDefined(options.displayName);
-    const hasDescription = isDefined(options.description);
-    const hasExample = isDefined(options.example);
-
-    const { name, displayName, description } = await inquirer.prompt([
-      {
-        type: 'input',
-        name: 'name',
-        message: 'Application name:',
-        when: () => !hasName && !hasExample,
-        default: 'my-twenty-app',
-        validate: (input) => {
-          if (input.length === 0) return 'Application name is required';
-          return true;
-        },
-      },
-      {
-        type: 'input',
-        name: 'displayName',
-        message: 'Application display name:',
-        when: () => !hasDisplayName && !hasExample,
-        default: (answers: { name?: string }) => {
-          return convertToLabel(
-            answers?.name ?? options.name ?? directory ?? '',
-          );
-        },
-      },
-      {
-        type: 'input',
-        name: 'description',
-        message: 'Application description (optional):',
-        when: () => !hasDescription && !hasExample,
-        default: '',
-      },
-    ]);
-
+  } {
    const appName = (
      options.name ??
-      name ??
-      directory ??
-      options.example ??
+      options.directory ??
      'my-twenty-app'
    ).trim();

    const appDisplayName =
-      (options.displayName ?? displayName)?.trim() || convertToLabel(appName);
+      options.displayName?.trim() || convertToLabel(appName);

-    const appDescription = (options.description ?? description ?? '').trim();
+    const appDescription = (options.description ?? '').trim();

-    const appDirectory = directory
-      ? path.join(CURRENT_EXECUTION_DIRECTORY, directory)
+    const appDirectory = options.directory
+      ? path.join(CURRENT_EXECUTION_DIRECTORY, options.directory)
      : path.join(CURRENT_EXECUTION_DIRECTORY, kebabCase(appName));

    return { appName, appDisplayName, appDirectory, appDescription };
@@ -223,54 +232,17 @@ export class CreateAppCommand {
    }
  }

-  private async tryDownloadExample(
-    example: string,
-    appDirectory: string,
-  ): Promise<boolean> {
-    try {
-      await downloadExample(example, appDirectory);
-
-      return true;
-    } catch (error) {
-      console.error(
-        chalk.red(
-          `\n${error instanceof Error ? error.message : 'Failed to download example.'}`,
-        ),
-      );
-
-      const { useTemplate } = await inquirer.prompt([
-        {
-          type: 'confirm',
-          name: 'useTemplate',
-          message: 'Would you like to create a default template app instead?',
-          default: true,
-        },
-      ]);
-
-      if (!useTemplate) {
-        process.exit(1);
-      }
-
-      // Clean up any partial files from the failed download
-      await fs.emptyDir(appDirectory);
-
-      return false;
-    }
-  }
-
-  private async promptScaffoldConfirmation({
+  private logPlan({
    appName,
    appDisplayName,
    appDescription,
    appDirectory,
-    autoConfirm,
  }: {
    appName: string;
    appDisplayName: string;
    appDescription: string;
    appDirectory: string;
-    autoConfirm?: boolean;
-  }): Promise<boolean> {
+  }): void {
    console.log(chalk.blue('\nCreating Twenty Application\n'));
    console.log(chalk.white(`  Name:           ${appName}`));
    console.log(chalk.white(`  Display name:   ${appDisplayName}`));
@@ -280,43 +252,13 @@ export class CreateAppCommand {
    }

    console.log(chalk.white(`  Directory:      ${appDirectory}`));
-
-    console.log(chalk.white('\nThe following steps will be performed:\n'));
-    console.log(chalk.gray('  1. Create project directory'));
-    console.log(
-      chalk.gray(
-        '  2. Scaffold project files from base template\n' +
-          '     - Copy template files\n' +
-          '     - Configure dotfiles (.gitignore, .github)\n' +
-          '     - Generate unique application identifiers\n' +
-          '     - Update package.json with app name and SDK versions',
-      ),
-    );
-    console.log(chalk.gray('  3. Install dependencies (yarn)'));
-    console.log(
-      chalk.gray('  4. Initialize Git repository with initial commit'),
-    );
    console.log('');
-
-    if (autoConfirm) {
-      return true;
-    }
-
-    const { proceed } = await inquirer.prompt([
-      {
-        type: 'confirm',
-        name: 'proceed',
-        message: 'Proceed?',
-        default: true,
-      },
-    ]);
-
-    return proceed;
  }

-  private logStep(step: number, title: string): void {
+  private logNextStep(title: string): void {
+    this.stepCounter++;
    console.log(
-      chalk.blue(`\n[${step}/${CreateAppCommand.TOTAL_STEPS}]`) +
+      chalk.blue(`\n[${this.stepCounter}/${this.totalSteps}]`) +
        chalk.white(` ${title}...`),
    );
  }
@@ -325,100 +267,299 @@ export class CreateAppCommand {
    console.log(chalk.gray(`      → ${message}`));
  }

-  private async shouldStartServer(autoConfirm?: boolean): Promise<boolean> {
-    console.log(
-      chalk.white(
-        '\n  A local Twenty instance is required for app development.\n' +
-          '  It provides the API and schema your application connects to.\n',
-      ),
-    );
+  private pullImageInBackground(): Promise<boolean> {
+    return new Promise((resolve) => {
+      const child = spawn('docker', ['pull', IMAGE], { stdio: 'ignore' });

-    if (checkDockerRunning() && containerExists()) {
-      if (autoConfirm) {
-        return true;
-      }
-
-      const { startExisting } = await inquirer.prompt([
-        {
-          type: 'confirm',
-          name: 'startExisting',
-          message:
-            'An existing Twenty server container was found. Would you like to start it?',
-          default: true,
-        },
-      ]);
-
-      return startExisting;
-    }
-
-    if (autoConfirm) {
-      return true;
-    }
-
-    const { startDocker } = await inquirer.prompt([
-      {
-        type: 'confirm',
-        name: 'startDocker',
-        message:
-          'No running Twenty instance found. Would you like to start one using Docker?',
-        default: true,
-      },
-    ]);
-
-    return startDocker;
+      child.on('close', (code) => resolve(code === 0));
+      child.on('error', () => resolve(false));
+    });
  }

-  private logServerSkipped(): void {
-    console.log(
-      chalk.gray(
-        '\n  To start a Twenty instance later:\n' +
-          '     yarn twenty server start\n\n' +
-          '  To connect to a remote instance instead:\n' +
-          '     yarn twenty remote add\n',
-      ),
-    );
-  }
-
-  private async promptConnectToLocal(serverUrl: string): Promise<boolean> {
-    console.log(
-      chalk.white(
-        '\n  Authentication links your app to a Twenty instance so you can\n' +
-          '  sync custom objects, fields, and roles during development.\n' +
-          '  This will open a browser window to complete the OAuth flow.\n',
-      ),
-    );
-
-    const { shouldAuthenticate } = await inquirer.prompt([
-      {
-        type: 'confirm',
-        name: 'shouldAuthenticate',
-        message: `Authenticate to the local Twenty instance (${serverUrl})?`,
-        default: true,
-      },
-    ]);
-
-    if (!shouldAuthenticate) {
+  private async ensureDockerServer(
+    dockerPullPromise: Promise<boolean>,
+  ): Promise<{ url?: string }> {
+    if (!checkDockerRunning()) {
      console.log(
-        chalk.gray(
-          '\n  Authentication skipped. To authenticate later:\n' +
-            `     yarn twenty remote add --local\n`,
+        chalk.yellow(
+          '\n  Docker is installed but not running.\n' +
+            '  Please start Docker and run this command again.\n',
        ),
      );

-      return false;
+      return {};
    }

-    await inquirer.prompt([
-      {
-        type: 'input',
-        name: 'confirm',
-        message: 'Press Enter to open the browser for authentication...',
+    this.logDetail('Ensuring latest Twenty server image...');
+
+    const pullSucceeded = await dockerPullPromise;
+
+    if (!pullSucceeded) {
+      this.logDetail(
+        'Image pull failed, continuing with cached image if available...',
+      );
+    }
+
+    const startResult = await serverStart({
+      onProgress: (message: string) => this.logDetail(message),
+    });
+
+    if (startResult.success) {
+      return { url: startResult.data.url };
+    }
+
+    console.log(chalk.yellow(`\n  ${startResult.error.message}`));
+
+    return {};
+  }
+
+  private async openMainPage(
+    appDirectory: string,
+    workspaceUrl: string,
+  ): Promise<void> {
+    try {
+      const configService = new ConfigService();
+      const config = await configService.getConfig();
+      const token = config.twentyCLIAccessToken ?? config.apiKey;
+
+      if (!token) {
+        return;
+      }
+
+      const [universalIdentifier, frontUrl] = await Promise.all([
+        this.readMainPageLayoutUniversalIdentifier(appDirectory),
+        this.resolveWorkspaceFrontUrl(workspaceUrl, token),
+      ]);
+
+      if (!universalIdentifier || !frontUrl) {
+        return;
+      }
+
+      const pageLayoutId = await this.resolvePageLayoutId(
+        workspaceUrl,
+        universalIdentifier,
+        token,
+      );
+
+      if (!pageLayoutId) {
+        return;
+      }
+
+      const url = `${frontUrl}/page/${pageLayoutId}`;
+
+      this.logDetail(`Opening app welcome page: ${url}`);
+      this.openInBrowser(url);
+    } catch {
+      // Best-effort — don't fail the scaffold if browser open fails
+    }
+  }
+
+  private async resolveWorkspaceFrontUrl(
+    workspaceUrl: string,
+    token: string,
+  ): Promise<string | null> {
+    const query = `{ currentWorkspace { workspaceUrls { subdomainUrl customUrl } } }`;
+
+    const response = await fetch(`${workspaceUrl}/metadata`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${token}`,
      },
-    ]);
+      body: JSON.stringify({ query }),
+    });
+
+    if (!response.ok) {
+      return null;
+    }
+
+    const body = (await response.json()) as {
+      data?: {
+        currentWorkspace?: {
+          workspaceUrls?: { subdomainUrl?: string; customUrl?: string };
+        };
+      };
+    };
+
+    const urls = body.data?.currentWorkspace?.workspaceUrls;
+
+    if (!urls) {
+      return null;
+    }
+
+    const frontUrl = urls.customUrl ?? urls.subdomainUrl;
+
+    return frontUrl?.replace(/\/+$/, '') ?? null;
+  }
+
+  private async readMainPageLayoutUniversalIdentifier(
+    appDirectory: string,
+  ): Promise<string | null> {
+    const filePath = path.join(
+      appDirectory,
+      'src',
+      'constants',
+      'universal-identifiers.ts',
+    );
+    const content = await fs.readFile(filePath, 'utf-8');
+    const match = content.match(
+      /MAIN_PAGE_LAYOUT_UNIVERSAL_IDENTIFIER\s*=\s*'([^']+)'/,
+    );
+
+    return match?.[1] ?? null;
+  }
+
+  private async resolvePageLayoutId(
+    workspaceUrl: string,
+    universalIdentifier: string,
+    token: string,
+  ): Promise<string | null> {
+    const query = `{ getPageLayouts { id universalIdentifier } }`;
+
+    const response = await fetch(`${workspaceUrl}/metadata`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${token}`,
+      },
+      body: JSON.stringify({ query }),
+    });
+
+    if (!response.ok) {
+      return null;
+    }
+
+    const body = (await response.json()) as {
+      data?: {
+        getPageLayouts?: { id: string; universalIdentifier: string }[];
+      };
+    };
+
+    const matching = body.data?.getPageLayouts?.find(
+      (layout) => layout.universalIdentifier === universalIdentifier,
+    );
+
+    return matching?.id ?? null;
+  }
+
+  private sanitizeBrowserUrl(url: string): string | null {
+    if (/[^\u0020-\u007E]/.test(url)) {
+      return null;
+    }

    try {
-      const result = await authLoginOAuth({
-        apiUrl: serverUrl,
+      const parsed = new URL(url);
+
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return null;
+      }
+
+      return parsed.toString();
+    } catch {
+      return null;
+    }
+  }
+
+  private openInBrowser(url: string): void {
+    const safeUrl = this.sanitizeBrowserUrl(url);
+
+    if (!safeUrl) {
+      return;
+    }
+
+    const isWindows = process.platform === 'win32';
+    const command = isWindows
+      ? 'rundll32'
+      : process.platform === 'darwin'
+        ? 'open'
+        : 'xdg-open';
+    const args = isWindows
+      ? ['url.dll,FileProtocolHandler', safeUrl]
+      : [safeUrl];
+
+    const child = spawn(command, args, {
+      stdio: 'ignore',
+      detached: !isWindows,
+    });
+    child.on('error', () => undefined);
+    if (!isWindows) {
+      child.unref();
+    }
+  }
+
+  private async syncApplication(appDirectory: string): Promise<boolean> {
+    this.logDetail('Running `yarn twenty dev --once`...');
+    return new Promise((resolve) => {
+      const child = spawn('yarn', ['twenty', 'dev', '--once'], {
+        cwd: appDirectory,
+        stdio: ['inherit', 'pipe', 'pipe'],
+      });
+
+      child.stdout?.resume();
+      child.stderr?.resume();
+
+      child.on('close', (code) => resolve(code === 0));
+      child.on('error', () => resolve(false));
+    });
+  }
+
+  private async tryExistingAuth(workspaceUrl: string): Promise<boolean> {
+    try {
+      const configService = new ConfigService();
+      const remoteNames = await configService.getRemotes();
+
+      for (const remoteName of remoteNames) {
+        const remoteConfig = await configService.getConfigForRemote(remoteName);
+
+        if (remoteConfig.apiUrl !== workspaceUrl) {
+          continue;
+        }
+
+        const token = remoteConfig.twentyCLIAccessToken ?? remoteConfig.apiKey;
+
+        if (!token) {
+          continue;
+        }
+
+        const response = await fetch(`${workspaceUrl}/metadata`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${token}`,
+          },
+          body: JSON.stringify({
+            query: '{ currentWorkspace { id } }',
+          }),
+        });
+
+        if (!response.ok) {
+          continue;
+        }
+
+        const body = (await response.json()) as {
+          data?: { currentWorkspace?: { id: string } };
+          errors?: unknown[];
+        };
+
+        if (isDefined(body.data?.currentWorkspace) && !body.errors) {
+          ConfigService.setActiveRemote(remoteName);
+          await configService.setDefaultRemote(remoteName);
+
+          return true;
+        }
+      }
+
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  private async authenticateWithDevKey(workspaceUrl: string): Promise<boolean> {
+    try {
+      const result = await authLogin({
+        apiKey: DEV_API_KEY,
+        apiUrl: workspaceUrl,
        remote: 'local',
      });

@@ -426,21 +567,68 @@ export class CreateAppCommand {
        const configService = new ConfigService();

        await configService.setDefaultRemote('local');
+        this.logDetail('Authenticated as tim@apple.dev (development API key)');

        return true;
-      } else {
-        console.log(
-          chalk.yellow(
-            'Authentication failed. Run `yarn twenty remote add --local` manually.',
-          ),
-        );
-
-        return false;
      }
+
+      console.log(
+        chalk.yellow(
+          '  Authentication failed. Run `yarn twenty remote add --local` manually.',
+        ),
+      );
+
+      return false;
    } catch {
      console.log(
        chalk.yellow(
-          'Authentication failed. Run `yarn twenty remote add` manually.',
+          '  Authentication failed. Run `yarn twenty remote add --local` manually.',
+        ),
+      );
+
+      return false;
+    }
+  }
+
+  private deriveRemoteName(url: string): string {
+    try {
+      return new URL(url).hostname.replace(/\./g, '-');
+    } catch {
+      return 'remote';
+    }
+  }
+
+  private async authenticateWithOAuth(workspaceUrl: string): Promise<boolean> {
+    try {
+      const remoteName = this.deriveRemoteName(workspaceUrl);
+
+      ConfigService.setActiveRemote(remoteName);
+
+      this.logDetail('Opening browser for OAuth...');
+
+      const result = await authLoginOAuth({ apiUrl: workspaceUrl });
+
+      if (result.success) {
+        const configService = new ConfigService();
+
+        await configService.setDefaultRemote(remoteName);
+        this.logDetail(`Authenticated via OAuth to ${workspaceUrl}`);
+
+        return true;
+      }
+
+      console.log(
+        chalk.yellow(
+          `  OAuth failed: ${result.error.message}\n` +
+            `  Run \`yarn twenty remote add --api-url ${workspaceUrl}\` manually.`,
+        ),
+      );
+
+      return false;
+    } catch {
+      console.log(
+        chalk.yellow(
+          `  Authentication failed. Run \`yarn twenty remote add --api-url ${workspaceUrl}\` manually.`,
        ),
      );

@@ -450,12 +638,13 @@ export class CreateAppCommand {

  private logSuccess(
    appDirectory: string,
-    hasLocalServer: boolean,
+    workspaceUrl: string,
    authSucceeded: boolean,
  ): void {
    const dirName = basename(appDirectory);

    console.log(chalk.green('\n✔ Application created successfully!\n'));
+
    console.log(chalk.white('  Next steps:\n'));

    let stepNumber = 1;
@@ -465,17 +654,21 @@ export class CreateAppCommand {
    stepNumber++;

    if (!authSucceeded) {
-      const remoteCommand = hasLocalServer
-        ? 'yarn twenty remote add --local'
-        : 'yarn twenty remote add';
-
      console.log(chalk.white(`  ${stepNumber}. Connect to a Twenty instance`));
-      console.log(chalk.cyan(`     ${remoteCommand}\n`));
+      console.log(
+        chalk.cyan(
+          '     yarn twenty remote add --api-url <your-instance-url>\n',
+        ),
+      );
      stepNumber++;
    }

    console.log(chalk.white(`  ${stepNumber}. Start developing`));
    console.log(chalk.cyan('     yarn twenty dev\n'));
+    stepNumber++;
+
+    console.log(chalk.white(`  ${stepNumber}. Open your twenty instance`));
+    console.log(chalk.cyan(`     ${workspaceUrl}\n`));

    console.log(
      chalk.gray(
@@ -0,0 +1,33 @@
+import { execSync } from 'node:child_process';
+
+const DOCKER_DOWNLOAD_URLS: Record<string, string> = {
+  darwin: 'https://docs.docker.com/desktop/setup/install/mac-install/',
+  win32: 'https://docs.docker.com/desktop/setup/install/windows-install/',
+  linux: 'https://docs.docker.com/engine/install/',
+};
+
+export const isDockerInstalled = (): boolean => {
+  try {
+    execSync('docker --version', { stdio: 'ignore' });
+
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+export const getDockerInstallInstructions = (): string => {
+  const url =
+    DOCKER_DOWNLOAD_URLS[process.platform] ?? DOCKER_DOWNLOAD_URLS.linux;
+
+  return [
+    '  Docker is required but not installed.',
+    '',
+    `  Install Docker: ${url}`,
+    '',
+    '  Then run this command again.',
+    '',
+    '  Alternatively, connect to an existing Twenty instance:',
+    '  npx create-twenty-app@latest my-twenty-app --workspace-url <your-instance-url>',
+  ].join('\n');
+};
@@ -1,179 +0,0 @@
-import { execSync } from 'node:child_process';
-import * as fs from 'fs-extra';
-import { join } from 'path';
-import { tmpdir } from 'node:os';
-import chalk from 'chalk';
-
-const TWENTY_REPO_OWNER = 'twentyhq';
-const TWENTY_REPO_NAME = 'twenty';
-const TWENTY_FALLBACK_REF = 'main';
-const TWENTY_EXAMPLES_PATH = 'packages/twenty-apps/examples';
-const TWENTY_EXAMPLES_URL = `https://github.com/${TWENTY_REPO_OWNER}/${TWENTY_REPO_NAME}/tree/${TWENTY_FALLBACK_REF}/${TWENTY_EXAMPLES_PATH}`;
-
-// Fetches the latest release tag from the repo, or falls back to main
-const resolveRef = async (): Promise<string> => {
-  const response = await fetch(
-    `https://api.github.com/repos/${TWENTY_REPO_OWNER}/${TWENTY_REPO_NAME}/releases/latest`,
-    { headers: { Accept: 'application/vnd.github.v3+json' } },
-  );
-
-  if (response.ok) {
-    const release = (await response.json()) as { tag_name: string };
-
-    return release.tag_name;
-  }
-
-  return TWENTY_FALLBACK_REF;
-};
-
-// Uses the GitHub Contents API to list directories — fast and doesn't download the repo
-const fetchGitHubDirectoryContents = async (
-  path: string,
-  ref: string,
-): Promise<{ name: string; type: string }[] | null> => {
-  const apiUrl = `https://api.github.com/repos/${TWENTY_REPO_OWNER}/${TWENTY_REPO_NAME}/contents/${path}?ref=${ref}`;
-
-  const response = await fetch(apiUrl, {
-    headers: { Accept: 'application/vnd.github.v3+json' },
-  });
-
-  if (!response.ok) {
-    return null;
-  }
-
-  const data = await response.json();
-
-  if (!Array.isArray(data)) {
-    return null;
-  }
-
-  return data as { name: string; type: string }[];
-};
-
-const listAvailableExamples = async (ref: string): Promise<string[]> => {
-  const contents = await fetchGitHubDirectoryContents(
-    TWENTY_EXAMPLES_PATH,
-    ref,
-  );
-
-  if (!contents) {
-    return [];
-  }
-
-  return contents
-    .filter((entry) => entry.type === 'dir')
-    .map((entry) => entry.name);
-};
-
-const validateExampleExists = async (
-  exampleName: string,
-  ref: string,
-): Promise<void> => {
-  const examplePath = `${TWENTY_EXAMPLES_PATH}/${exampleName}`;
-
-  const contents = await fetchGitHubDirectoryContents(examplePath, ref);
-
-  if (contents !== null) {
-    return;
-  }
-
-  const availableExamples = await listAvailableExamples(ref);
-
-  throw new Error(
-    `Example "${exampleName}" not found.\n\n` +
-      (availableExamples.length > 0
-        ? `Available examples:\n${availableExamples.map((name) => `  - ${name}`).join('\n')}\n\n`
-        : '') +
-      `Browse all examples: ${TWENTY_EXAMPLES_URL}`,
-  );
-};
-
-export const downloadExample = async (
-  exampleName: string,
-  targetDirectory: string,
-): Promise<void> => {
-  if (
-    exampleName.includes('/') ||
-    exampleName.includes('\\') ||
-    exampleName.includes('..')
-  ) {
-    throw new Error(
-      `Invalid example name: "${exampleName}". Example names must be simple directory names (e.g., "hello-world").`,
-    );
-  }
-
-  const ref = await resolveRef();
-  const examplePath = `${TWENTY_EXAMPLES_PATH}/${exampleName}`;
-
-  console.log(chalk.gray(`Resolving examples from ref '${ref}'...`));
-
-  await validateExampleExists(exampleName, ref);
-
-  console.log(chalk.gray(`Example '${examplePath}' validated successfully.`));
-
-  const tarballUrl = `https://codeload.github.com/${TWENTY_REPO_OWNER}/${TWENTY_REPO_NAME}/tar.gz/${ref}`;
-
-  const tempDir = join(
-    tmpdir(),
-    `create-twenty-app-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-  );
-
-  try {
-    await fs.ensureDir(tempDir);
-
-    console.log(chalk.gray(`Downloading tarball from ${tarballUrl}...`));
-
-    const response = await fetch(tarballUrl);
-
-    if (!response.ok) {
-      if (response.status === 404) {
-        throw new Error(
-          `Could not find repository: ${TWENTY_REPO_OWNER}/${TWENTY_REPO_NAME} (ref: ${ref})`,
-        );
-      }
-      throw new Error(
-        `Failed to download from GitHub: ${response.status} ${response.statusText}`,
-      );
-    }
-
-    console.log(chalk.gray('Tarball downloaded. Writing to disk...'));
-
-    const tarballPath = join(tempDir, 'archive.tar.gz');
-
-    const buffer = Buffer.from(await response.arrayBuffer());
-
-    await fs.writeFile(tarballPath, buffer);
-
-    console.log(
-      chalk.gray(
-        `Tarball saved (${(buffer.length / 1024 / 1024).toFixed(1)} MB). Extracting...`,
-      ),
-    );
-
-    execSync(`tar xzf "${tarballPath}" -C "${tempDir}"`, {
-      stdio: 'pipe',
-    });
-
-    // GitHub tarballs extract to a directory named {repo}-{ref}/
-    const extractedEntries = await fs.readdir(tempDir);
-    const extractedDir = extractedEntries.find(
-      (entry) => entry !== 'archive.tar.gz',
-    );
-
-    if (!extractedDir) {
-      throw new Error('Failed to extract archive: no directory found');
-    }
-
-    const sourcePath = join(tempDir, extractedDir, examplePath);
-
-    if (!(await fs.pathExists(sourcePath))) {
-      throw new Error(
-        `Example directory not found in archive: "${examplePath}"`,
-      );
-    }
-
-    await fs.copy(sourcePath, targetDirectory);
-  } finally {
-    await fs.remove(tempDir);
-  }
-};
@@ -28,12 +28,6 @@ yarn install
 yarn twenty dev
 ```

-Or use it as a template via create-twenty-app:
-
-```bash
-npx create-twenty-app@latest my-app --example postcard
-```
-
 ## Learn more

 - [Getting Started](https://docs.twenty.com/developers/extend/apps/getting-started)
@@ -0,0 +1,18 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript"],
+  "categories": {
+    "correctness": "off"
+  },
+  "ignorePatterns": ["node_modules", "dist"],
+  "rules": {
+    "no-unused-vars": "off",
+    "typescript/no-unused-vars": [
+      "warn",
+      {
+        "argsIgnorePattern": "^_"
+      }
+    ],
+    "typescript/no-explicit-any": "off"
+  }
+}
@@ -0,0 +1,173 @@
+# Discord for Twenty
+
+Connect Discord to your Twenty workflows. Post messages, edit them, react,
+delete, and browse channels — all from the workflow builder or the AI chat.
+
+## What you can do
+
+Once installed and the admin has provided the bot token, five tools become
+available in workflows and the AI chat:
+
+- **Send Discord message** — *"post 'New deal closed 🎉' to #general"*. As a
+  workflow step: provide `channelId` + `messageText`. Optional
+  `replyToMessageId` turns it into a reply to a previous message.
+- **Update Discord message** — edit a message the bot already sent. Useful
+  for status messages that change as a workflow progresses.
+- **Delete Discord message** — remove a bot message (for example after a
+  mistake or when a workflow is cancelled).
+- **Add Discord reaction** — react with a unicode emoji (`👍`, `✅`, `🎉`)
+  or a custom server emoji (`partyparrot:643452342342342342`). Great for
+  signalling status at a glance.
+- **List Discord channels** — discovers the text-postable channels in a
+  Discord server, useful as the first step in a workflow that picks a
+  channel dynamically. **Leave `guildId` blank if your bot is in only one
+  server — it auto-picks.** If the bot is in multiple servers, the error
+  response lists each server's name and ID so you can copy the right one.
+
+## Installing
+
+1. Open **Settings → Applications** in your Twenty workspace.
+2. Find **Discord** in the available apps and click **Install**.
+3. Use any of the tools above in a workflow step or via the AI chat.
+
+> **Heads up:** if you see *"Discord is not configured"* on the first run,
+> your Twenty admin needs to follow the [Self-hosting setup](#self-hosting-setup-admin-only)
+> section below — they need to create a Discord application and provide the
+> bot token before the tools work.
+
+## Finding channel and message IDs
+
+Discord IDs are long numeric strings (e.g. `1234567890123456789`). To copy
+them from the Discord client:
+
+1. **Enable Developer Mode** once: **User Settings → Advanced → Developer
+   Mode** (toggle on). Discord then shows extra "Copy ID" options on
+   right-click.
+2. **Channel ID** — right-click any channel → *Copy Channel ID*.
+3. **Message ID** — right-click any message → *Copy Message ID*.
+4. **Server (guild) ID** — right-click the server icon → *Copy Server ID*.
+   Only needed for `discord-list-channels` when your bot is in multiple
+   servers (otherwise leave it blank for auto-pick).
+
+> **Tip:** when chaining steps, pass `messageId` from a previous *Send
+> Discord message* step directly into a follow-up *Update / Delete / Add
+> Reaction* step. No copy/paste needed.
+
+## Limitations
+
+What this connector intentionally does **not** support in v1:
+
+- **Direct messages to users.** Discord's DM API needs a different identity
+  flow.
+- **Threads.** Replying inside a thread or starting a new one isn't exposed.
+- **Webhooks.** Uses the bot REST API only.
+- **Slash commands / interactions.** The bot doesn't register or respond to
+  `/commands`.
+- **Per-workspace identity.** All Twenty workspaces in the same Twenty
+  deployment share the same Discord bot — see
+  [Why bot token instead of OAuth?](#why-bot-token-instead-of-oauth) below.
+- **2000-character message limit.** Discord rejects longer payloads with
+  HTTP 400.
+
+## Troubleshooting
+
+| Symptom | Likely cause | Fix |
+|---|---|---|
+| `Discord is not configured` | `DISCORD_BOT_TOKEN` not set | Admin: paste the bot token in Settings → Applications → Discord → **Settings tab** |
+| `401 Unauthorized` | Token wrong, copied with whitespace, or rotated | Reset the token in the Discord Developer Portal and re-paste |
+| `Missing Access (50001)` | Bot wasn't invited to that server | Re-run the OAuth invite URL for that server (see admin setup) |
+| `Missing Permissions (50013)` | Bot is in the server but lacks Send / Manage / React permissions | In Discord: server settings → roles → grant the bot's role the missing permission |
+| `Unknown Channel (10003)` | `channelId` is wrong, or bot can't see that channel | Verify the ID; check the bot has *View Channel* permission |
+| `Unknown Message (10008)` | `messageId` is wrong, or message was deleted | Verify the ID is from a still-existing message |
+| `Cannot edit a message authored by another user (50005)` | Trying to update / delete a message the bot didn't send | The bot can only edit its own messages; it can delete others' messages only with the *Manage Messages* permission |
+| `Bot is in N Discord servers — please specify which one` (from list-channels) | Bot is in multiple servers and `guildId` was left blank | Copy the server ID from the error message and paste it into the `guildId` field |
+| `Discord API responded with 429` | Hit Discord's rate limit | Reduce workflow concurrency; this connector doesn't yet auto-retry |
+
+---
+
+## Self-hosting setup (admin-only)
+
+This section is for Twenty server admins. If you're on Twenty Cloud, skip
+this — the bot credentials are already configured.
+
+### 1. Create a Discord application
+
+1. Visit https://discord.com/developers/applications and click
+   **New Application**.
+2. Name it (e.g. *"Twenty Bot"*) and create. Use a dedicated app — don't
+   reuse one configured for other bots.
+3. Sidebar → **Bot** tab → **Reset Token** → copy the token immediately
+   (it's only shown once; if you lose it, reset again).
+4. *Recommended:* toggle **Public Bot** OFF so randoms can't invite the
+   bot to their servers.
+
+### 2. Generate the invite URL and add the bot to your server(s)
+
+1. In the Discord Developer Portal: sidebar → **OAuth2** → **URL Generator**.
+2. **Scopes**: tick `bot`.
+3. **Bot Permissions**: tick `Send Messages`, `Manage Messages`,
+   `Add Reactions`, `Read Message History`.
+4. Copy the generated URL.
+5. Open the URL in your browser, pick the Discord server, authorize.
+   Repeat for each server you want workflows to post in.
+
+### 3. Wire the bot token into Twenty
+
+1. In Twenty: **Settings → Applications → Discord → Settings tab**
+   (gear icon).
+2. Paste the bot token into the `DISCORD_BOT_TOKEN` row. Saves on blur.
+
+Workspace users can now use the Discord workflow tools immediately — no
+further per-user configuration needed (which is unique vs Linear / Slack
+where each user connects their own account).
+
+---
+
+## Why bot token instead of OAuth?
+
+Slack and Linear use OAuth-per-workspace
+(`defineConnectionProvider({ type: 'oauth' })`) so each Twenty workspace
+stores its own access token. Discord works differently:
+
+- Discord's `bot` scope **does** have an OAuth flow, but the `access_token`
+  it returns is a *user* bearer token — useless for bot actions like posting
+  messages. To actually send messages as the bot you need the static
+  **bot token** from the Developer Portal.
+- That bot token is global to the Discord application (and therefore to
+  the Twenty deployment). Discord deprecated per-install bot tokens years
+  ago.
+- Webhooks are a separate auth model but only support posting — no edit,
+  delete, or reactions — so they don't cover Slack/Linear parity.
+
+The result: this connector skips `defineConnectionProvider` entirely and
+reads `DISCORD_BOT_TOKEN` from an `applicationVariable` set once at
+deployment scope. See
+[Discord's OAuth2 docs](https://discord.com/developers/docs/topics/oauth2#bot-users)
+for the underlying reason bot users authenticate via static tokens.
+
+---
+
+## Developers only
+
+If you're working on this app rather than installing the published version:
+
+```bash
+cd packages/twenty-apps/internal/twenty-discord
+
+# Day-to-day development (publish + install + watch in one):
+yarn twenty dev
+
+# Run unit tests:
+yarn test
+
+# Lint:
+yarn lint
+```
+
+`twenty dev` is recommended for iteration — it publishes to your local
+Twenty server, installs the app, and watches for changes in one command.
+
+The Discord REST API (v10) is called directly via `fetch` — no `discord.js`
+or other SDK dependency. See
+`src/logic-functions/utils/discord-api-request.ts` for the auth and
+error-handling wrapper that all handlers go through.
@@ -0,0 +1,31 @@
+{
+  "name": "twenty-discord",
+  "version": "0.1.0",
+  "description": "Discord workflow connector for Twenty",
+  "license": "MIT",
+  "engines": {
+    "node": "^24.5.0",
+    "npm": "please-use-yarn",
+    "yarn": ">=4.0.2"
+  },
+  "keywords": [
+    "twenty-app"
+  ],
+  "packageManager": "yarn@4.9.2",
+  "scripts": {
+    "twenty": "twenty",
+    "lint": "oxlint -c .oxlintrc.json .",
+    "lint:fix": "oxlint --fix -c .oxlintrc.json .",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "twenty-sdk": "2.4.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.7.2",
+    "oxlint": "^0.16.0",
+    "typescript": "^5.9.3",
+    "vitest": "^3.1.1"
+  }
+}
@@ -0,0 +1,14 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="64"
+  height="64"
+  viewBox="0 0 127 127"
+  fill="none"
+  role="img"
+>
+  <title>Discord</title>
+  <path
+    fill="#5865F2"
+    d="M107.7 26.4A104.6 104.6 0 0 0 81.6 18a0.4 0.4 0 0 0-0.4 0.2 73 73 0 0 0-3.2 6.6 96.6 96.6 0 0 0-29 0A66.8 66.8 0 0 0 45.6 18.2a0.4 0.4 0 0 0-0.4-0.2 104.2 104.2 0 0 0-26.1 8.4 0.4 0.4 0 0 0-0.2 0.2C2.3 51.4-2.2 75.7 0 99.7a0.4 0.4 0 0 0 0.2 0.3 105.2 105.2 0 0 0 31.6 16 0.4 0.4 0 0 0 0.5-0.1 75.6 75.6 0 0 0 6.5-10.6 0.4 0.4 0 0 0-0.2-0.5 69.4 69.4 0 0 1-9.9-4.7 0.4 0.4 0 0 1 0-0.7 54.6 54.6 0 0 0 2-1.6 0.4 0.4 0 0 1 0.4-0.1 75 75 0 0 0 63.9 0 0.4 0.4 0 0 1 0.4 0.1c0.6 0.6 1.3 1.1 2 1.6a0.4 0.4 0 0 1 0 0.7 65.2 65.2 0 0 1-9.9 4.7 0.4 0.4 0 0 0-0.2 0.5 84.8 84.8 0 0 0 6.5 10.6 0.4 0.4 0 0 0 0.5 0.1 104.8 104.8 0 0 0 31.6-16 0.4 0.4 0 0 0 0.2-0.3c2.7-27.8-4.5-51.9-18.9-73.1a0.4 0.4 0 0 0-0.2-0.2zM42.5 85a12.3 12.3 0 0 1-11.5-12.9c0-7.1 5-12.9 11.5-12.9 6.6 0 11.7 5.8 11.6 12.9 0 7-5.1 12.9-11.6 12.9zm42.8 0a12.3 12.3 0 0 1-11.5-12.9c0-7.1 5-12.9 11.5-12.9 6.6 0 11.6 5.8 11.5 12.9 0 7-5 12.9-11.5 12.9z"
+  />
+</svg>
@@ -0,0 +1,30 @@
+import { defineApplication } from 'twenty-sdk/define';
+
+import {
+  APPLICATION_UNIVERSAL_IDENTIFIER,
+  DISCORD_BOT_TOKEN_VARIABLE_UNIVERSAL_IDENTIFIER,
+} from 'src/constants/universal-identifiers';
+
+export default defineApplication({
+  universalIdentifier: APPLICATION_UNIVERSAL_IDENTIFIER,
+  displayName: 'Twenty Discord',
+  description:
+    'Connect Discord to Twenty. Workflow steps post, update, and delete bot messages and add reactions using a Discord bot token shared across the deployment.',
+  logoUrl: 'public/twenty-discord.svg',
+  author: 'Twenty',
+  category: 'Communication',
+  aboutDescription:
+    'Official Discord connector for Twenty CRM. Create a Discord application at https://discord.com/developers/applications, copy its bot token into the DISCORD_BOT_TOKEN application variable, then invite the bot to each server you want workflows to post in. Use workflow actions to post, update, or delete bot messages and add reactions.',
+  websiteUrl: 'https://docs.twenty.com/developers/extend/apps/getting-started',
+  termsUrl: 'https://www.twenty.com/terms',
+  emailSupport: 'contact@twenty.com',
+  issueReportUrl: 'https://github.com/twentyhq/twenty/issues',
+  applicationVariables: {
+    DISCORD_BOT_TOKEN: {
+      universalIdentifier: DISCORD_BOT_TOKEN_VARIABLE_UNIVERSAL_IDENTIFIER,
+      description:
+        'Bot token from your Discord application (Developer Portal → Bot tab → Reset Token). Used with the `Bot` auth prefix to call the Discord REST API. The same token authenticates the bot across every guild it has been invited to.',
+      isSecret: true,
+    },
+  },
+});
@@ -0,0 +1,17 @@
+import { defineCommandMenuItem } from 'twenty-sdk/define';
+
+import {
+  SEND_DISCORD_MESSAGE_COMMAND_UNIVERSAL_IDENTIFIER,
+  SEND_MESSAGE_FORM_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
+} from 'src/constants/universal-identifiers';
+
+export default defineCommandMenuItem({
+  universalIdentifier: SEND_DISCORD_MESSAGE_COMMAND_UNIVERSAL_IDENTIFIER,
+  label: 'Send Discord message',
+  shortLabel: 'Discord message',
+  icon: 'IconBrandDiscord',
+  isPinned: false,
+  availabilityType: 'GLOBAL',
+  frontComponentUniversalIdentifier:
+    SEND_MESSAGE_FORM_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
+});
@@ -0,0 +1,670 @@
+import { useCallback, useEffect, useState } from 'react';
+import { defineFrontComponent } from 'twenty-sdk/define';
+import {
+  closeSidePanel,
+  enqueueSnackbar,
+  unmountFrontComponent,
+} from 'twenty-sdk/front-component';
+
+import { SEND_MESSAGE_FORM_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+
+type DiscordGuild = {
+  id: string;
+  name: string;
+};
+
+type DiscordChannel = {
+  id: string;
+  name: string;
+  type: number;
+  parentId: string | null;
+  position: number;
+};
+
+const DISCORD_MESSAGE_MAX_LENGTH = 2000;
+
+// The front component sandbox dispatches events with a non-standard shape.
+// Values may live on e.detail.value, e.value, or e.target.value.
+const readSerializedValue = (
+  e: React.SyntheticEvent<HTMLElement>,
+): string | undefined => {
+  const obj = e as {
+    detail?: { value?: string };
+    value?: string;
+    target?: { value?: string };
+  };
+
+  if (typeof obj.detail?.value === 'string') return obj.detail.value;
+  if (typeof obj.value === 'string') return obj.value;
+  if (typeof obj.target?.value === 'string') return obj.target.value;
+
+  return undefined;
+};
+
+const onValueChange =
+  (fn: (value: string) => void) => (e: React.SyntheticEvent<HTMLElement>) => {
+    const v = readSerializedValue(e);
+
+    if (typeof v === 'string') fn(v);
+  };
+
+const callAppRoute = async (
+  path: string,
+  method: 'GET' | 'POST',
+  body?: Record<string, unknown>,
+) => {
+  const apiBaseUrl = process.env.TWENTY_API_URL;
+  const token =
+    process.env.TWENTY_APP_ACCESS_TOKEN ?? process.env.TWENTY_API_KEY;
+
+  if (!apiBaseUrl || !token) {
+    throw new Error('API configuration missing');
+  }
+
+  const response = await fetch(`${apiBaseUrl}/s${path}`, {
+    method,
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    ...(body ? { body: JSON.stringify(body) } : {}),
+  });
+
+  if (!response.ok) {
+    const text = await response.text().catch(() => '');
+
+    throw new Error(
+      `Request failed (${response.status}): ${text.slice(0, 200)}`,
+    );
+  }
+
+  return response.json();
+};
+
+const COLOR = {
+  bg: '#f1f1f1',
+  card: '#ffffff',
+  surface: '#fcfcfc',
+  border: '#ebebeb',
+  borderStrong: '#d6d6d6',
+  text: '#333333',
+  textSecondary: '#666666',
+  textTertiary: '#999999',
+  placeholder: '#cccccc',
+  accent: '#5865f2',
+  error: '#e05252',
+};
+
+const INLINE_SELECT: React.CSSProperties = {
+  appearance: 'none',
+  WebkitAppearance: 'none' as const,
+  border: 'none',
+  background: 'transparent',
+  color: 'inherit',
+  font: 'inherit',
+  cursor: 'pointer',
+  outline: 'none',
+  padding: 0,
+};
+
+const STYLES = {
+  outer: {
+    fontFamily: 'Inter, system-ui, -apple-system, sans-serif',
+    fontSize: '13px',
+    backgroundColor: COLOR.bg,
+    padding: '12px',
+    height: '100%',
+    boxSizing: 'border-box' as const,
+  },
+  container: {
+    backgroundColor: COLOR.card,
+    borderRadius: '8px',
+    border: `1px solid ${COLOR.border}`,
+    display: 'flex',
+    flexDirection: 'column' as const,
+    height: '100%',
+    boxSizing: 'border-box' as const,
+    color: COLOR.text,
+  },
+  topBar: {
+    display: 'flex',
+    alignItems: 'center',
+    padding: '8px 12px',
+    borderBottom: `1px solid ${COLOR.border}`,
+    flexShrink: 0,
+  },
+  guildSelect: {
+    appearance: 'none' as const,
+    WebkitAppearance: 'none' as const,
+    background: COLOR.surface,
+    border: `1px solid ${COLOR.border}`,
+    borderRadius: '6px',
+    padding: '3px 8px',
+    color: COLOR.text,
+    fontSize: '12px',
+    fontFamily: 'inherit',
+    cursor: 'pointer',
+    outline: 'none',
+  },
+  channelPicker: {
+    flexShrink: 0,
+    padding: '12px',
+    display: 'flex',
+    alignItems: 'center',
+    gap: '6px',
+    borderBottom: `1px solid ${COLOR.border}`,
+  },
+  channelChip: {
+    appearance: 'none' as const,
+    WebkitAppearance: 'none' as const,
+    background: 'transparent',
+    border: `1px solid ${COLOR.border}`,
+    borderRadius: '20px',
+    padding: '3px 9px',
+    color: COLOR.textSecondary,
+    fontSize: '12px',
+    fontFamily: 'inherit',
+    cursor: 'pointer',
+    outline: 'none',
+    display: 'inline-flex' as const,
+    alignItems: 'center',
+    gap: '4px',
+    whiteSpace: 'nowrap' as const,
+    lineHeight: '16px',
+  },
+  chipIcon: {
+    fontSize: '12px',
+    lineHeight: 1,
+    flexShrink: 0,
+    color: COLOR.textTertiary,
+  },
+  optionsLoadingIndicator: {
+    marginLeft: 'auto',
+    display: 'flex',
+    alignItems: 'center',
+  },
+  spinner: {
+    width: '14px',
+    height: '14px',
+    border: `2px solid ${COLOR.border}`,
+    borderTopColor: COLOR.textSecondary,
+    borderRadius: '50%',
+    animation: 'spin 0.6s linear infinite',
+  },
+  body: {
+    flex: 1,
+    display: 'flex',
+    flexDirection: 'column' as const,
+    padding: '24px',
+    overflow: 'auto',
+    minHeight: 0,
+    gap: '6px',
+  },
+  messageInput: {
+    background: 'transparent',
+    border: 'none',
+    outline: 'none',
+    color: COLOR.text,
+    fontSize: '14px',
+    fontFamily: 'inherit',
+    width: '100%',
+    padding: 0,
+    resize: 'none' as const,
+    flex: 1,
+    minHeight: '120px',
+  },
+  charCount: {
+    fontSize: '11px',
+    textAlign: 'right' as const,
+    color: COLOR.textTertiary,
+    flexShrink: 0,
+  },
+  charCountOverLimit: {
+    color: COLOR.error,
+  },
+  actionBar: {
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'flex-end',
+    gap: '6px',
+    padding: '6px 12px',
+    borderTop: `1px solid ${COLOR.border}`,
+    flexShrink: 0,
+  },
+  cancelButton: {
+    background: 'transparent',
+    border: 'none',
+    color: COLOR.textSecondary,
+    fontSize: '12px',
+    fontFamily: 'inherit',
+    cursor: 'pointer',
+    padding: '5px 10px',
+    borderRadius: '6px',
+  },
+  sendButton: {
+    background: COLOR.accent,
+    border: 'none',
+    color: '#ffffff',
+    fontSize: '12px',
+    fontWeight: 500,
+    fontFamily: 'inherit',
+    cursor: 'pointer',
+    padding: '5px 14px',
+    borderRadius: '6px',
+  },
+  sendButtonDisabled: {
+    background: COLOR.borderStrong,
+    color: COLOR.textTertiary,
+    cursor: 'not-allowed',
+  },
+  successOuter: {
+    fontFamily: 'Inter, system-ui, -apple-system, sans-serif',
+    backgroundColor: COLOR.bg,
+    padding: '12px',
+    height: '100%',
+    boxSizing: 'border-box' as const,
+  },
+  successContainer: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: '10px',
+    padding: '10px 14px',
+    boxSizing: 'border-box' as const,
+    backgroundColor: COLOR.card,
+    borderRadius: '8px',
+    border: `1px solid ${COLOR.border}`,
+    color: COLOR.text,
+  },
+  successCheck: {
+    width: '20px',
+    height: '20px',
+    borderRadius: '50%',
+    backgroundColor: '#2ea043',
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'center',
+    fontSize: '11px',
+    color: '#fff',
+    flexShrink: 0,
+  },
+  successText: {
+    color: COLOR.text,
+    fontWeight: 500,
+    fontSize: '13px',
+    flex: 1,
+    overflow: 'hidden' as const,
+    textOverflow: 'ellipsis' as const,
+    whiteSpace: 'nowrap' as const,
+  },
+  closeButton: {
+    background: 'transparent',
+    border: `1px solid ${COLOR.border}`,
+    color: COLOR.textSecondary,
+    fontSize: '12px',
+    fontFamily: 'inherit',
+    cursor: 'pointer',
+    padding: '5px 14px',
+    borderRadius: '6px',
+    flexShrink: 0,
+  },
+  loadingOuter: {
+    fontFamily: 'Inter, system-ui, -apple-system, sans-serif',
+    backgroundColor: COLOR.bg,
+    padding: '12px',
+    height: '100%',
+    boxSizing: 'border-box' as const,
+  },
+  loadingContainer: {
+    color: COLOR.textSecondary,
+    fontSize: '13px',
+    textAlign: 'center' as const,
+    backgroundColor: COLOR.card,
+    borderRadius: '8px',
+    border: `1px solid ${COLOR.border}`,
+    padding: '24px',
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'center',
+  },
+  errorOuter: {
+    fontFamily: 'Inter, system-ui, -apple-system, sans-serif',
+    backgroundColor: COLOR.bg,
+    padding: '12px',
+    height: '100%',
+    boxSizing: 'border-box' as const,
+  },
+  errorContainer: {
+    backgroundColor: COLOR.card,
+    borderRadius: '8px',
+    border: `1px solid ${COLOR.border}`,
+    padding: '24px',
+    display: 'flex',
+    flexDirection: 'column' as const,
+    alignItems: 'center',
+    justifyContent: 'center',
+    gap: '10px',
+  },
+  errorText: {
+    color: COLOR.error,
+    fontSize: '12px',
+    textAlign: 'center' as const,
+  },
+  retryButton: {
+    background: COLOR.surface,
+    border: `1px solid ${COLOR.border}`,
+    color: COLOR.text,
+    fontSize: '12px',
+    fontFamily: 'inherit',
+    cursor: 'pointer',
+    padding: '5px 12px',
+    borderRadius: '6px',
+  },
+};
+
+const SendMessageForm = () => {
+  const [guilds, setGuilds] = useState<DiscordGuild[]>([]);
+  const [guildsLoading, setGuildsLoading] = useState(true);
+  const [guildsError, setGuildsError] = useState<string | null>(null);
+
+  const [channels, setChannels] = useState<DiscordChannel[]>([]);
+  const [channelsLoading, setChannelsLoading] = useState(false);
+
+  const [selectedGuildId, setSelectedGuildId] = useState('');
+  const [selectedChannelId, setSelectedChannelId] = useState('');
+  const [messageText, setMessageText] = useState('');
+
+  const [sending, setSending] = useState(false);
+  const [sentChannelName, setSentChannelName] = useState<string | null>(null);
+  const [closing, setClosing] = useState(false);
+
+  const fetchChannels = useCallback(async (guildId: string) => {
+    if (!guildId) {
+      setChannels([]);
+      setSelectedChannelId('');
+
+      return;
+    }
+
+    setChannelsLoading(true);
+
+    try {
+      const result = await callAppRoute(
+        `/discord/channels?guildId=${encodeURIComponent(guildId)}`,
+        'GET',
+      );
+
+      if (!result.success) {
+        setChannels([]);
+        await enqueueSnackbar({
+          message: result.error ?? 'Failed to load channels',
+          variant: 'error',
+        });
+
+        return;
+      }
+
+      setChannels(result.channels ?? []);
+    } catch (error) {
+      setChannels([]);
+      await enqueueSnackbar({
+        message:
+          error instanceof Error ? error.message : 'Failed to load channels',
+        variant: 'error',
+      });
+    } finally {
+      setChannelsLoading(false);
+    }
+  }, []);
+
+  const handleGuildChange = useCallback(
+    (newGuildId: string) => {
+      setSelectedGuildId(newGuildId);
+      setSelectedChannelId('');
+      fetchChannels(newGuildId);
+    },
+    [fetchChannels],
+  );
+
+  const fetchGuilds = useCallback(async () => {
+    try {
+      setGuildsError(null);
+      const result = await callAppRoute('/discord/guilds', 'GET');
+
+      if (!result.success) {
+        setGuildsError(result.error ?? 'Failed to load Discord servers');
+
+        return;
+      }
+
+      const fetchedGuilds: DiscordGuild[] = result.guilds ?? [];
+
+      setGuilds(fetchedGuilds);
+
+      // Auto-select when the bot is in exactly one server to skip a needless step.
+      if (fetchedGuilds.length === 1) {
+        setSelectedGuildId(fetchedGuilds[0].id);
+        fetchChannels(fetchedGuilds[0].id);
+      }
+    } catch (error) {
+      setGuildsError(
+        error instanceof Error
+          ? error.message
+          : 'Failed to load Discord servers',
+      );
+    } finally {
+      setGuildsLoading(false);
+    }
+  }, [fetchChannels]);
+
+  useEffect(() => {
+    fetchGuilds();
+  }, [fetchGuilds]);
+
+  const handleSubmit = async () => {
+    const trimmedMessage = (messageText ?? '').trim();
+
+    if (
+      !selectedGuildId ||
+      !selectedChannelId ||
+      trimmedMessage.length === 0 ||
+      trimmedMessage.length > DISCORD_MESSAGE_MAX_LENGTH
+    ) {
+      return;
+    }
+
+    setSending(true);
+
+    try {
+      const result = await callAppRoute('/discord/messages', 'POST', {
+        channelId: selectedChannelId,
+        messageText: trimmedMessage,
+      });
+
+      if (!result.success) {
+        await enqueueSnackbar({
+          message: result.error ?? 'Failed to send message',
+          variant: 'error',
+        });
+        setSending(false);
+
+        return;
+      }
+
+      const channelName =
+        channels.find((channel) => channel.id === selectedChannelId)?.name ??
+        'channel';
+
+      setSentChannelName(channelName);
+      await enqueueSnackbar({
+        message: `Message sent to #${channelName}`,
+        variant: 'success',
+      });
+    } catch (error) {
+      await enqueueSnackbar({
+        message:
+          error instanceof Error ? error.message : 'Failed to send message',
+        variant: 'error',
+      });
+      setSending(false);
+    }
+  };
+
+  const handleCancel = () => {
+    setClosing(true);
+    unmountFrontComponent();
+    closeSidePanel();
+  };
+
+  if (closing) {
+    return null;
+  }
+
+  if (sentChannelName) {
+    return (
+      <div style={STYLES.successOuter}>
+        <div style={STYLES.successContainer}>
+          <div style={STYLES.successCheck}>{'✓'}</div>
+          <span style={STYLES.successText}>
+            Message sent to #{sentChannelName}
+          </span>
+          <button
+            type="button"
+            style={STYLES.closeButton}
+            onClick={handleCancel}
+          >
+            Close
+          </button>
+        </div>
+      </div>
+    );
+  }
+
+  if (guildsLoading) {
+    return (
+      <div style={STYLES.loadingOuter}>
+        <div style={STYLES.loadingContainer}>Loading...</div>
+      </div>
+    );
+  }
+
+  if (guildsError) {
+    return (
+      <div style={STYLES.errorOuter}>
+        <div style={STYLES.errorContainer}>
+          <p style={STYLES.errorText}>{guildsError}</p>
+          <button
+            type="button"
+            style={STYLES.retryButton}
+            onClick={fetchGuilds}
+          >
+            Retry
+          </button>
+        </div>
+      </div>
+    );
+  }
+
+  const trimmedLength = (messageText ?? '').trim().length;
+  const isOverLimit = (messageText ?? '').length > DISCORD_MESSAGE_MAX_LENGTH;
+  const canSubmit =
+    !!selectedGuildId &&
+    !!selectedChannelId &&
+    trimmedLength > 0 &&
+    !isOverLimit &&
+    !sending;
+
+  return (
+    <div style={STYLES.outer}>
+      <style>{'@keyframes spin{to{transform:rotate(360deg)}}'}</style>
+      <div style={STYLES.container}>
+        <div style={STYLES.topBar}>
+          <select
+            value={selectedGuildId}
+            onChange={onValueChange(handleGuildChange)}
+            style={STYLES.guildSelect}
+          >
+            <option value="">Select server...</option>
+            {guilds.map((guild) => (
+              <option key={guild.id} value={guild.id}>
+                {guild.name}
+              </option>
+            ))}
+          </select>
+          {channelsLoading && (
+            <div style={STYLES.optionsLoadingIndicator}>
+              <div style={STYLES.spinner} />
+            </div>
+          )}
+        </div>
+
+        <div style={STYLES.channelPicker}>
+          <label style={STYLES.channelChip}>
+            <span style={STYLES.chipIcon}>{'#'}</span>
+            <select
+              value={selectedChannelId}
+              onChange={onValueChange(setSelectedChannelId)}
+              style={INLINE_SELECT}
+              disabled={!selectedGuildId || channelsLoading}
+            >
+              <option value="">
+                {channels.length === 0 ? 'No channels' : 'Select channel'}
+              </option>
+              {channels.map((channel) => (
+                <option key={channel.id} value={channel.id}>
+                  {channel.name}
+                </option>
+              ))}
+            </select>
+          </label>
+        </div>
+
+        <div style={STYLES.body}>
+          <textarea
+            value={messageText}
+            onInput={onValueChange(setMessageText)}
+            onChange={onValueChange(setMessageText)}
+            style={STYLES.messageInput}
+            placeholder="Type a message..."
+          />
+          <div
+            style={{
+              ...STYLES.charCount,
+              ...(isOverLimit ? STYLES.charCountOverLimit : {}),
+            }}
+          >
+            {(messageText ?? '').length} / {DISCORD_MESSAGE_MAX_LENGTH}
+          </div>
+        </div>
+
+        <div style={STYLES.actionBar}>
+          <button
+            type="button"
+            style={STYLES.cancelButton}
+            onClick={handleCancel}
+          >
+            Cancel
+          </button>
+          <button
+            type="button"
+            style={{
+              ...STYLES.sendButton,
+              ...(!canSubmit ? STYLES.sendButtonDisabled : {}),
+            }}
+            disabled={!canSubmit}
+            onClick={handleSubmit}
+          >
+            {sending ? 'Sending...' : 'Send'}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+};
+
+export default defineFrontComponent({
+  universalIdentifier: SEND_MESSAGE_FORM_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER,
+  name: 'send-discord-message-form',
+  description:
+    'Form to send a message to a Discord channel: pick the server, pick the channel, type the message, send.',
+  component: SendMessageForm,
+});
@@ -0,0 +1,41 @@
+export const APPLICATION_UNIVERSAL_IDENTIFIER =
+  '9b1b7628-ac98-4e44-8e1e-91b401378a5f';
+
+export const DEFAULT_ROLE_UNIVERSAL_IDENTIFIER =
+  '6aa50eb2-e8c2-470f-8c4d-09debbf6e051';
+
+export const DISCORD_BOT_TOKEN_VARIABLE_UNIVERSAL_IDENTIFIER =
+  'ac986a3b-19a5-4cee-a87a-2f8d3885ad84';
+
+export const DISCORD_POST_MESSAGE_UNIVERSAL_IDENTIFIER =
+  '6c03d456-c1fa-4acc-9928-d97ced0925fe';
+
+export const DISCORD_UPDATE_MESSAGE_UNIVERSAL_IDENTIFIER =
+  'b37285d9-cb11-4fe5-963d-0434780122ba';
+
+export const DISCORD_DELETE_MESSAGE_UNIVERSAL_IDENTIFIER =
+  'a2efc27c-eae0-4713-b327-bdb1aaeff95f';
+
+export const DISCORD_ADD_REACTION_UNIVERSAL_IDENTIFIER =
+  '32c77c8a-ebd0-4308-aa1b-d21bb94422ac';
+
+export const DISCORD_LIST_CHANNELS_UNIVERSAL_IDENTIFIER =
+  'ef2296f6-1b48-4edd-81ac-cafa4fe73f99';
+
+export const DISCORD_LIST_CHANNELS_ROUTE_UNIVERSAL_IDENTIFIER =
+  '550cd993-af6e-46ae-b697-f838f34cfe39';
+
+export const DISCORD_LIST_GUILDS_UNIVERSAL_IDENTIFIER =
+  '0aaaca4f-3156-4b7c-a9f5-ee6a2e17cbf1';
+
+export const DISCORD_LIST_GUILDS_ROUTE_UNIVERSAL_IDENTIFIER =
+  '3cfa36d9-3c04-495c-bc09-f8019ad85dce';
+
+export const DISCORD_POST_MESSAGE_ROUTE_UNIVERSAL_IDENTIFIER =
+  'eda60c95-450b-4a86-b5a0-6b85f488ae81';
+
+export const SEND_MESSAGE_FORM_FRONT_COMPONENT_UNIVERSAL_IDENTIFIER =
+  'ee8d8efa-2f9d-4d2c-b759-bb3cafc7797d';
+
+export const SEND_DISCORD_MESSAGE_COMMAND_UNIVERSAL_IDENTIFIER =
+  '8c80b9d8-2f18-4b6c-8933-30d170790685';
@@ -0,0 +1,35 @@
+import { defineLogicFunction } from 'twenty-sdk/define';
+import { jsonSchemaToInputSchema } from 'twenty-shared/logic-function';
+
+import { DISCORD_ADD_REACTION_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordAddReactionHandler } from 'src/logic-functions/handlers/discord-add-reaction-handler';
+import { discordAddReactionInputSchema } from './schemas/discord-add-reaction-input.schema';
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_ADD_REACTION_UNIVERSAL_IDENTIFIER,
+  name: 'discord-add-reaction',
+  description:
+    'Add an emoji reaction to a Discord message (for example a checkmark ✅) so the channel can see status at a glance.',
+  timeoutSeconds: 30,
+  toolTriggerSettings: {
+    inputSchema: discordAddReactionInputSchema,
+  },
+  workflowActionTriggerSettings: {
+    label: 'Add Discord Reaction',
+    icon: 'IconBrandDiscord',
+    inputSchema: jsonSchemaToInputSchema(discordAddReactionInputSchema),
+    outputSchema: [
+      {
+        type: 'object',
+        properties: {
+          success: { type: 'boolean' },
+          message: { type: 'string' },
+          error: { type: 'string' },
+          messageId: { type: 'string' },
+          channelId: { type: 'string' },
+        },
+      },
+    ],
+  },
+  handler: discordAddReactionHandler,
+});
@@ -0,0 +1,35 @@
+import { defineLogicFunction } from 'twenty-sdk/define';
+import { jsonSchemaToInputSchema } from 'twenty-shared/logic-function';
+
+import { DISCORD_DELETE_MESSAGE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordDeleteMessageHandler } from 'src/logic-functions/handlers/discord-delete-message-handler';
+import { discordDeleteMessageInputSchema } from './schemas/discord-delete-message-input.schema';
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_DELETE_MESSAGE_UNIVERSAL_IDENTIFIER,
+  name: 'discord-delete-message',
+  description:
+    'Remove a Discord message this bot sent (for example after a mistake or when a workflow is cancelled).',
+  timeoutSeconds: 30,
+  toolTriggerSettings: {
+    inputSchema: discordDeleteMessageInputSchema,
+  },
+  workflowActionTriggerSettings: {
+    label: 'Delete Discord Message',
+    icon: 'IconBrandDiscord',
+    inputSchema: jsonSchemaToInputSchema(discordDeleteMessageInputSchema),
+    outputSchema: [
+      {
+        type: 'object',
+        properties: {
+          success: { type: 'boolean' },
+          message: { type: 'string' },
+          error: { type: 'string' },
+          messageId: { type: 'string' },
+          channelId: { type: 'string' },
+        },
+      },
+    ],
+  },
+  handler: discordDeleteMessageHandler,
+});
@@ -0,0 +1,27 @@
+import type { RoutePayload } from 'twenty-sdk/define';
+import { defineLogicFunction } from 'twenty-sdk/define';
+
+import { DISCORD_LIST_CHANNELS_ROUTE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordListChannelsHandler } from 'src/logic-functions/handlers/discord-list-channels-handler';
+
+const handler = async (event: RoutePayload) => {
+  const params = event.queryStringParameters ?? {};
+  const guildId =
+    typeof params.guildId === 'string' && params.guildId.length > 0
+      ? params.guildId
+      : undefined;
+
+  return discordListChannelsHandler({ guildId });
+};
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_LIST_CHANNELS_ROUTE_UNIVERSAL_IDENTIFIER,
+  name: 'discord-list-channels-route',
+  timeoutSeconds: 30,
+  handler,
+  httpRouteTriggerSettings: {
+    path: '/discord/channels',
+    httpMethod: 'GET',
+    isAuthRequired: true,
+  },
+});
@@ -0,0 +1,46 @@
+import { defineLogicFunction } from 'twenty-sdk/define';
+import { jsonSchemaToInputSchema } from 'twenty-shared/logic-function';
+
+import { DISCORD_LIST_CHANNELS_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordListChannelsHandler } from 'src/logic-functions/handlers/discord-list-channels-handler';
+import { discordListChannelsInputSchema } from './schemas/discord-list-channels-input.schema';
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_LIST_CHANNELS_UNIVERSAL_IDENTIFIER,
+  name: 'discord-list-channels',
+  description:
+    'List the text-postable channels (types `GUILD_TEXT` and `GUILD_ANNOUNCEMENT`) in a Discord server, sorted by Discord position. Each entry exposes `id`, `name`, `type`, `parentId` (category), and `position`. Pass the server (guild) ID to scope the listing; if omitted and the bot is in exactly one server, that server is auto-selected. If the bot is in multiple servers, the error response lists each server name and ID for explicit selection. Voice channels, threads, forums, and categories are excluded.',
+  timeoutSeconds: 30,
+  toolTriggerSettings: {
+    inputSchema: discordListChannelsInputSchema,
+  },
+  workflowActionTriggerSettings: {
+    label: 'List Discord Channels',
+    icon: 'IconBrandDiscord',
+    inputSchema: jsonSchemaToInputSchema(discordListChannelsInputSchema),
+    outputSchema: [
+      {
+        type: 'object',
+        properties: {
+          success: { type: 'boolean' },
+          channels: {
+            type: 'array',
+            items: {
+              type: 'object',
+              properties: {
+                id: { type: 'string' },
+                name: { type: 'string' },
+                type: { type: 'number' },
+                parentId: { type: 'string' },
+                position: { type: 'number' },
+              },
+            },
+          },
+          count: { type: 'number' },
+          error: { type: 'string' },
+        },
+      },
+    ],
+  },
+  handler: discordListChannelsHandler,
+});
@@ -0,0 +1,21 @@
+import { defineLogicFunction } from 'twenty-sdk/define';
+import type { RoutePayload } from 'twenty-sdk/define';
+
+import { DISCORD_LIST_GUILDS_ROUTE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordListGuildsHandler } from 'src/logic-functions/handlers/discord-list-guilds-handler';
+
+const handler = async (_event: RoutePayload) => {
+  return discordListGuildsHandler();
+};
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_LIST_GUILDS_ROUTE_UNIVERSAL_IDENTIFIER,
+  name: 'discord-list-guilds-route',
+  timeoutSeconds: 30,
+  handler,
+  httpRouteTriggerSettings: {
+    path: '/discord/guilds',
+    httpMethod: 'GET',
+    isAuthRequired: true,
+  },
+});
@@ -0,0 +1,43 @@
+import { defineLogicFunction } from 'twenty-sdk/define';
+import { jsonSchemaToInputSchema } from 'twenty-shared/logic-function';
+
+import { DISCORD_LIST_GUILDS_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordListGuildsHandler } from 'src/logic-functions/handlers/discord-list-guilds-handler';
+import { discordListGuildsInputSchema } from './schemas/discord-list-guilds-input.schema';
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_LIST_GUILDS_UNIVERSAL_IDENTIFIER,
+  name: 'discord-list-guilds',
+  description:
+    'List the Discord servers (guilds) the bot has been invited to. Each entry exposes `id` and `name`. Use this to discover which servers the bot can post in, then pass the chosen server ID to `discord-list-channels` or other server-scoped actions.',
+  timeoutSeconds: 30,
+  toolTriggerSettings: {
+    inputSchema: discordListGuildsInputSchema,
+  },
+  workflowActionTriggerSettings: {
+    label: 'List Discord Servers',
+    icon: 'IconBrandDiscord',
+    inputSchema: jsonSchemaToInputSchema(discordListGuildsInputSchema),
+    outputSchema: [
+      {
+        type: 'object',
+        properties: {
+          success: { type: 'boolean' },
+          guilds: {
+            type: 'array',
+            items: {
+              type: 'object',
+              properties: {
+                id: { type: 'string' },
+                name: { type: 'string' },
+              },
+            },
+          },
+          count: { type: 'number' },
+          error: { type: 'string' },
+        },
+      },
+    ],
+  },
+  handler: discordListGuildsHandler,
+});
@@ -0,0 +1,45 @@
+import { isNonEmptyString } from '@sniptt/guards';
+import type { RoutePayload } from 'twenty-sdk/define';
+import { defineLogicFunction } from 'twenty-sdk/define';
+
+import { DISCORD_POST_MESSAGE_ROUTE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordPostMessageHandler } from 'src/logic-functions/handlers/discord-post-message-handler';
+
+const handler = async (event: RoutePayload) => {
+  const body = event.body as Record<string, unknown> | null;
+  const rawChannelId = body?.channelId;
+  const rawMessageText = body?.messageText;
+
+  if (typeof rawChannelId !== 'string' || typeof rawMessageText !== 'string') {
+    return {
+      success: false,
+      message: 'Failed to post Discord message',
+      error: '`channelId` and `messageText` must be strings.',
+    };
+  }
+
+  const channelId = rawChannelId.trim();
+  const messageText = rawMessageText.trim();
+
+  if (!isNonEmptyString(channelId) || !isNonEmptyString(messageText)) {
+    return {
+      success: false,
+      message: 'Failed to post Discord message',
+      error: '`channelId` and `messageText` are required.',
+    };
+  }
+
+  return discordPostMessageHandler({ channelId, messageText });
+};
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_POST_MESSAGE_ROUTE_UNIVERSAL_IDENTIFIER,
+  name: 'discord-post-message-route',
+  timeoutSeconds: 30,
+  handler,
+  httpRouteTriggerSettings: {
+    path: '/discord/messages',
+    httpMethod: 'POST',
+    isAuthRequired: true,
+  },
+});
@@ -0,0 +1,35 @@
+import { defineLogicFunction } from 'twenty-sdk/define';
+import { jsonSchemaToInputSchema } from 'twenty-shared/logic-function';
+
+import { DISCORD_POST_MESSAGE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordPostMessageHandler } from 'src/logic-functions/handlers/discord-post-message-handler';
+import { discordPostMessageInputSchema } from './schemas/discord-post-message-input.schema';
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_POST_MESSAGE_UNIVERSAL_IDENTIFIER,
+  name: 'discord-post-message',
+  description:
+    'Send a message to a Discord channel as the bot. Optionally reply to an existing message using its message ID from a previous step.',
+  timeoutSeconds: 30,
+  toolTriggerSettings: {
+    inputSchema: discordPostMessageInputSchema,
+  },
+  workflowActionTriggerSettings: {
+    label: 'Send Discord Message',
+    icon: 'IconBrandDiscord',
+    inputSchema: jsonSchemaToInputSchema(discordPostMessageInputSchema),
+    outputSchema: [
+      {
+        type: 'object',
+        properties: {
+          success: { type: 'boolean' },
+          message: { type: 'string' },
+          error: { type: 'string' },
+          messageId: { type: 'string' },
+          channelId: { type: 'string' },
+        },
+      },
+    ],
+  },
+  handler: discordPostMessageHandler,
+});
@@ -0,0 +1,35 @@
+import { defineLogicFunction } from 'twenty-sdk/define';
+import { jsonSchemaToInputSchema } from 'twenty-shared/logic-function';
+
+import { DISCORD_UPDATE_MESSAGE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+import { discordUpdateMessageHandler } from 'src/logic-functions/handlers/discord-update-message-handler';
+import { discordUpdateMessageInputSchema } from './schemas/discord-update-message-input.schema';
+
+export default defineLogicFunction({
+  universalIdentifier: DISCORD_UPDATE_MESSAGE_UNIVERSAL_IDENTIFIER,
+  name: 'discord-update-message',
+  description:
+    'Change the text of a Discord message this bot already sent. You need the channel ID and the message ID from when it was posted.',
+  timeoutSeconds: 30,
+  toolTriggerSettings: {
+    inputSchema: discordUpdateMessageInputSchema,
+  },
+  workflowActionTriggerSettings: {
+    label: 'Update Discord Message',
+    icon: 'IconBrandDiscord',
+    inputSchema: jsonSchemaToInputSchema(discordUpdateMessageInputSchema),
+    outputSchema: [
+      {
+        type: 'object',
+        properties: {
+          success: { type: 'boolean' },
+          message: { type: 'string' },
+          error: { type: 'string' },
+          messageId: { type: 'string' },
+          channelId: { type: 'string' },
+        },
+      },
+    ],
+  },
+  handler: discordUpdateMessageHandler,
+});
@@ -0,0 +1,52 @@
+import { type DiscordAddReactionInput } from 'src/logic-functions/types/discord-add-reaction-input.type';
+import { type DiscordToolResult } from 'src/logic-functions/types/discord-tool-result.type';
+import { buildDiscordFailureResult } from 'src/logic-functions/utils/build-discord-failure-result';
+import { discordApiRequest } from 'src/logic-functions/utils/discord-api-request';
+import { getDiscordBotToken } from 'src/logic-functions/utils/get-discord-bot-token';
+
+export const discordAddReactionHandler = async (
+  parameters: DiscordAddReactionInput,
+): Promise<DiscordToolResult> => {
+  const tokenResult = getDiscordBotToken();
+
+  if (!tokenResult.success) {
+    return {
+      success: false,
+      message: 'Discord is not configured',
+      error: tokenResult.error,
+    };
+  }
+
+  const channelId = parameters.channelId.trim();
+  const messageId = parameters.messageId.trim();
+  const emoji = parameters.emoji.trim();
+
+  const encodedChannelId = encodeURIComponent(channelId);
+  const encodedMessageId = encodeURIComponent(messageId);
+  const encodedEmoji = encodeURIComponent(emoji);
+
+  try {
+    const result = await discordApiRequest({
+      botToken: tokenResult.botToken,
+      method: 'PUT',
+      path: `/channels/${encodedChannelId}/messages/${encodedMessageId}/reactions/${encodedEmoji}/@me`,
+    });
+
+    if (!result.ok) {
+      return {
+        success: false,
+        message: 'Failed to add Discord reaction',
+        error: result.errorMessage,
+      };
+    }
+
+    return {
+      success: true,
+      message: `Reaction "${emoji}" added to the message.`,
+      messageId,
+      channelId,
+    };
+  } catch (error) {
+    return buildDiscordFailureResult('Failed to add Discord reaction', error);
+  }
+};
@@ -0,0 +1,46 @@
+import { type DiscordDeleteMessageInput } from 'src/logic-functions/types/discord-delete-message-input.type';
+import { type DiscordToolResult } from 'src/logic-functions/types/discord-tool-result.type';
+import { buildDiscordFailureResult } from 'src/logic-functions/utils/build-discord-failure-result';
+import { discordApiRequest } from 'src/logic-functions/utils/discord-api-request';
+import { getDiscordBotToken } from 'src/logic-functions/utils/get-discord-bot-token';
+
+export const discordDeleteMessageHandler = async (
+  parameters: DiscordDeleteMessageInput,
+): Promise<DiscordToolResult> => {
+  const tokenResult = getDiscordBotToken();
+
+  if (!tokenResult.success) {
+    return {
+      success: false,
+      message: 'Discord is not configured',
+      error: tokenResult.error,
+    };
+  }
+
+  try {
+    const result = await discordApiRequest({
+      botToken: tokenResult.botToken,
+      method: 'DELETE',
+      path: `/channels/${encodeURIComponent(
+        parameters.channelId,
+      )}/messages/${encodeURIComponent(parameters.messageId)}`,
+    });
+
+    if (!result.ok) {
+      return {
+        success: false,
+        message: 'Failed to delete Discord message',
+        error: result.errorMessage,
+      };
+    }
+
+    return {
+      success: true,
+      message: 'Discord message deleted.',
+      messageId: parameters.messageId,
+      channelId: parameters.channelId,
+    };
+  } catch (error) {
+    return buildDiscordFailureResult('Failed to delete Discord message', error);
+  }
+};
@@ -0,0 +1,125 @@
+import { isDefined } from 'twenty-shared/utils';
+
+import { type DiscordListChannelsInput } from 'src/logic-functions/types/discord-list-channels-input.type';
+import {
+  type DiscordListChannelsResult,
+  type DiscordListChannelsResultChannel,
+} from 'src/logic-functions/types/discord-list-channels-output.type';
+import { discordApiRequest } from 'src/logic-functions/utils/discord-api-request';
+import { fetchDiscordGuilds } from 'src/logic-functions/utils/fetch-discord-guilds';
+import { getDiscordBotToken } from 'src/logic-functions/utils/get-discord-bot-token';
+
+const GUILD_TEXT_CHANNEL_TYPE = 0;
+const GUILD_ANNOUNCEMENT_CHANNEL_TYPE = 5;
+
+const POSTABLE_CHANNEL_TYPES = new Set<number>([
+  GUILD_TEXT_CHANNEL_TYPE,
+  GUILD_ANNOUNCEMENT_CHANNEL_TYPE,
+]);
+
+type DiscordChannelResponse = {
+  id: string;
+  name: string | null;
+  type: number;
+  parent_id: string | null;
+  position: number;
+};
+
+const buildFailureResult = (error: string): DiscordListChannelsResult => ({
+  success: false,
+  channels: [],
+  count: 0,
+  error,
+});
+
+const resolveGuildId = async ({
+  botToken,
+  providedGuildId,
+}: {
+  botToken: string;
+  providedGuildId: string | undefined;
+}): Promise<{ ok: true; guildId: string } | { ok: false; error: string }> => {
+  const trimmed = providedGuildId?.trim();
+
+  if (isDefined(trimmed) && trimmed.length > 0) {
+    return { ok: true, guildId: trimmed };
+  }
+
+  const guildsResult = await fetchDiscordGuilds(botToken);
+
+  if (!guildsResult.ok) {
+    return { ok: false, error: guildsResult.errorMessage };
+  }
+
+  const guilds = guildsResult.data;
+
+  if (guilds.length === 0) {
+    return {
+      ok: false,
+      error:
+        'Bot has not been invited to any Discord server yet. Use the OAuth2 → URL Generator in the Discord Developer Portal (scope `bot`) to invite it to a server, then retry.',
+    };
+  }
+
+  if (guilds.length > 1) {
+    const guildList = guilds
+      .map((guild) => `"${guild.name}" (${guild.id})`)
+      .join(', ');
+
+    return {
+      ok: false,
+      error: `Bot is in ${guilds.length} Discord servers — please specify which one via the guildId input. Available: ${guildList}.`,
+    };
+  }
+
+  return { ok: true, guildId: guilds[0].id };
+};
+
+export const discordListChannelsHandler = async (
+  parameters: DiscordListChannelsInput,
+): Promise<DiscordListChannelsResult> => {
+  const tokenResult = getDiscordBotToken();
+
+  if (!tokenResult.success) {
+    return buildFailureResult(tokenResult.error);
+  }
+
+  const guildIdResult = await resolveGuildId({
+    botToken: tokenResult.botToken,
+    providedGuildId: parameters.guildId,
+  });
+
+  if (!guildIdResult.ok) {
+    return buildFailureResult(guildIdResult.error);
+  }
+
+  const result = await discordApiRequest<DiscordChannelResponse[]>({
+    botToken: tokenResult.botToken,
+    method: 'GET',
+    path: `/guilds/${encodeURIComponent(guildIdResult.guildId)}/channels`,
+  });
+
+  if (!result.ok) {
+    return buildFailureResult(result.errorMessage);
+  }
+
+  const channels: DiscordListChannelsResultChannel[] = result.data
+    .filter(
+      (channel) =>
+        POSTABLE_CHANNEL_TYPES.has(channel.type) && isDefined(channel.name),
+    )
+    .map((channel) => ({
+      id: channel.id,
+      name: channel.name as string,
+      type: channel.type,
+      parentId: channel.parent_id,
+      position: channel.position,
+    }))
+    .sort((a, b) => a.position - b.position);
+
+  return {
+    success: true,
+    channels,
+    count: channels.length,
+  };
+};
@@ -0,0 +1,36 @@
+import { type DiscordListGuildsResult } from 'src/logic-functions/types/discord-list-guilds-output.type';
+import { fetchDiscordGuilds } from 'src/logic-functions/utils/fetch-discord-guilds';
+import { getDiscordBotToken } from 'src/logic-functions/utils/get-discord-bot-token';
+
+const buildFailureResult = (error: string): DiscordListGuildsResult => ({
+  success: false,
+  guilds: [],
+  count: 0,
+  error,
+});
+
+export const discordListGuildsHandler =
+  async (): Promise<DiscordListGuildsResult> => {
+    const tokenResult = getDiscordBotToken();
+
+    if (!tokenResult.success) {
+      return buildFailureResult(tokenResult.error);
+    }
+
+    const result = await fetchDiscordGuilds(tokenResult.botToken);
+
+    if (!result.ok) {
+      return buildFailureResult(result.errorMessage);
+    }
+
+    const guilds = result.data.map((guild) => ({
+      id: guild.id,
+      name: guild.name,
+    }));
+
+    return {
+      success: true,
+      guilds,
+      count: guilds.length,
+    };
+  };
@@ -0,0 +1,61 @@
+import { isDefined } from 'twenty-shared/utils';
+
+import { type DiscordPostMessageInput } from 'src/logic-functions/types/discord-post-message-input.type';
+import { type DiscordToolResult } from 'src/logic-functions/types/discord-tool-result.type';
+import { buildDiscordFailureResult } from 'src/logic-functions/utils/build-discord-failure-result';
+import { discordApiRequest } from 'src/logic-functions/utils/discord-api-request';
+import { getDiscordBotToken } from 'src/logic-functions/utils/get-discord-bot-token';
+
+type DiscordMessageResponse = {
+  id: string;
+  channel_id: string;
+};
+
+export const discordPostMessageHandler = async (
+  parameters: DiscordPostMessageInput,
+): Promise<DiscordToolResult> => {
+  const tokenResult = getDiscordBotToken();
+
+  if (!tokenResult.success) {
+    return {
+      success: false,
+      message: 'Discord is not configured',
+      error: tokenResult.error,
+    };
+  }
+
+  const replyToMessageId = parameters.replyToMessageId?.trim();
+  const body: Record<string, unknown> = {
+    content: parameters.messageText,
+  };
+
+  if (isDefined(replyToMessageId) && replyToMessageId.length > 0) {
+    body.message_reference = { message_id: replyToMessageId };
+  }
+
+  try {
+    const result = await discordApiRequest<DiscordMessageResponse>({
+      botToken: tokenResult.botToken,
+      method: 'POST',
+      path: `/channels/${encodeURIComponent(parameters.channelId)}/messages`,
+      body,
+    });
+
+    if (!result.ok) {
+      return {
+        success: false,
+        message: 'Failed to post Discord message',
+        error: result.errorMessage,
+      };
+    }
+
+    return {
+      success: true,
+      message: `Message posted to Discord (id=${result.data.id}).`,
+      messageId: result.data.id,
+      channelId: result.data.channel_id,
+    };
+  } catch (error) {
+    return buildDiscordFailureResult('Failed to post Discord message', error);
+  }
+};
@@ -0,0 +1,52 @@
+import { type DiscordToolResult } from 'src/logic-functions/types/discord-tool-result.type';
+import { type DiscordUpdateMessageInput } from 'src/logic-functions/types/discord-update-message-input.type';
+import { buildDiscordFailureResult } from 'src/logic-functions/utils/build-discord-failure-result';
+import { discordApiRequest } from 'src/logic-functions/utils/discord-api-request';
+import { getDiscordBotToken } from 'src/logic-functions/utils/get-discord-bot-token';
+
+type DiscordMessageResponse = {
+  id: string;
+  channel_id: string;
+};
+
+export const discordUpdateMessageHandler = async (
+  parameters: DiscordUpdateMessageInput,
+): Promise<DiscordToolResult> => {
+  const tokenResult = getDiscordBotToken();
+
+  if (!tokenResult.success) {
+    return {
+      success: false,
+      message: 'Discord is not configured',
+      error: tokenResult.error,
+    };
+  }
+
+  try {
+    const result = await discordApiRequest<DiscordMessageResponse>({
+      botToken: tokenResult.botToken,
+      method: 'PATCH',
+      path: `/channels/${encodeURIComponent(
+        parameters.channelId,
+      )}/messages/${encodeURIComponent(parameters.messageId)}`,
+      body: { content: parameters.newMessageText },
+    });
+
+    if (!result.ok) {
+      return {
+        success: false,
+        message: 'Failed to update Discord message',
+        error: result.errorMessage,
+      };
+    }
+
+    return {
+      success: true,
+      message: 'Discord message updated.',
+      messageId: result.data.id,
+      channelId: result.data.channel_id,
+    };
+  } catch (error) {
+    return buildDiscordFailureResult('Failed to update Discord message', error);
+  }
+};
@@ -0,0 +1,26 @@
+import { type InputJsonSchema } from 'twenty-sdk/logic-function';
+
+export const discordAddReactionInputSchema: InputJsonSchema = {
+  type: 'object',
+  properties: {
+    channelId: {
+      type: 'string',
+      label: 'Discord channel ID',
+      description: 'Channel where the message lives (Discord channel ID).',
+    },
+    messageId: {
+      type: 'string',
+      label: 'Message ID',
+      description:
+        'The message to react to: its **message ID** (same value as `messageId` returned when the bot posted it, or right-click the message → "Copy Message ID").',
+    },
+    emoji: {
+      type: 'string',
+      label: 'Emoji',
+      description:
+        'Emoji to add. For a standard unicode emoji, paste the emoji directly (e.g. `👍`, `✅`, `🎉`). For a custom server emoji, use the format `name:id` (e.g. `partyparrot:643452342342342342`). The bot must have **Add Reactions** permission in the channel.',
+    },
+  },
+  required: ['channelId', 'messageId', 'emoji'],
+  additionalProperties: false,
+};
@@ -0,0 +1,20 @@
+import { type InputJsonSchema } from 'twenty-sdk/logic-function';
+
+export const discordDeleteMessageInputSchema: InputJsonSchema = {
+  type: 'object',
+  properties: {
+    channelId: {
+      type: 'string',
+      label: 'Discord channel ID',
+      description: 'Channel that contains the message (Discord channel ID).',
+    },
+    messageId: {
+      type: 'string',
+      label: 'Message ID',
+      description:
+        'Which message to remove: its **message ID** (same value as `messageId` returned when the bot posted it). The bot can delete its own messages without extra permissions; deleting others\' messages requires the **Manage Messages** permission.',
+    },
+  },
+  required: ['channelId', 'messageId'],
+  additionalProperties: false,
+};
@@ -0,0 +1,15 @@
+import { type InputJsonSchema } from 'twenty-sdk/logic-function';
+
+export const discordListChannelsInputSchema: InputJsonSchema = {
+  type: 'object',
+  properties: {
+    guildId: {
+      type: 'string',
+      label: 'Discord server (guild) ID',
+      description:
+        'Optional. The Discord server ID to list channels for (a long number like `1234567890123456789`). In Discord with Developer Mode on: right-click the server icon → "Copy Server ID". If omitted and the bot is in exactly one server, that server is used automatically; if the bot is in multiple servers, the error response lists each server name and ID so you can pick one.',
+    },
+  },
+  required: [],
+  additionalProperties: false,
+};
@@ -0,0 +1,8 @@
+import { type InputJsonSchema } from 'twenty-sdk/logic-function';
+
+export const discordListGuildsInputSchema: InputJsonSchema = {
+  type: 'object',
+  properties: {},
+  required: [],
+  additionalProperties: false,
+};
@@ -0,0 +1,28 @@
+import { type InputJsonSchema } from 'twenty-sdk/logic-function';
+
+export const discordPostMessageInputSchema: InputJsonSchema = {
+  type: 'object',
+  properties: {
+    channelId: {
+      type: 'string',
+      label: 'Discord channel ID',
+      description:
+        'Where to post: the Discord channel ID (a long number like `1234567890123456789`). In Discord with Developer Mode on: right-click the channel → "Copy Channel ID". The bot must be a member of the server and have permission to send messages in this channel.',
+    },
+    messageText: {
+      type: 'string',
+      label: 'Message',
+      multiline: true,
+      description:
+        'The message text. Supports Discord-flavoured markdown (**bold**, *italics*, ```code blocks```, lists, links). Max 2000 characters — Discord rejects longer payloads.',
+    },
+    replyToMessageId: {
+      type: 'string',
+      label: 'Reply to message ID',
+      description:
+        'Optional. To reply to an existing message, paste its ID (from a previous step\'s `messageId` output, or right-click the message → "Copy Message ID"). Leave empty for a normal new message.',
+    },
+  },
+  required: ['channelId', 'messageText'],
+  additionalProperties: false,
+};
@@ -0,0 +1,27 @@
+import { type InputJsonSchema } from 'twenty-sdk/logic-function';
+
+export const discordUpdateMessageInputSchema: InputJsonSchema = {
+  type: 'object',
+  properties: {
+    channelId: {
+      type: 'string',
+      label: 'Discord channel ID',
+      description: 'Channel that contains the message (Discord channel ID).',
+    },
+    messageId: {
+      type: 'string',
+      label: 'Message ID',
+      description:
+        'Which message to edit: its **message ID** (same value as `messageId` returned when the bot posted the message). You can only edit messages this bot sent.',
+    },
+    newMessageText: {
+      type: 'string',
+      label: 'New message',
+      multiline: true,
+      description:
+        'Replacement text shown in Discord instead of the old content. Supports Discord-flavoured markdown. Max 2000 characters.',
+    },
+  },
+  required: ['channelId', 'messageId', 'newMessageText'],
+  additionalProperties: false,
+};
@@ -0,0 +1,5 @@
+export type DiscordAddReactionInput = {
+  channelId: string;
+  messageId: string;
+  emoji: string;
+};
@@ -0,0 +1,4 @@
+export type DiscordDeleteMessageInput = {
+  channelId: string;
+  messageId: string;
+};
@@ -0,0 +1,3 @@
+export type DiscordListChannelsInput = {
+  guildId?: string;
+};
@@ -0,0 +1,14 @@
+export type DiscordListChannelsResultChannel = {
+  id: string;
+  name: string;
+  type: number;
+  parentId: string | null;
+  position: number;
+};
+
+export type DiscordListChannelsResult = {
+  success: boolean;
+  channels: DiscordListChannelsResultChannel[];
+  count: number;
+  error?: string;
+};
@@ -0,0 +1,11 @@
+export type DiscordListGuildsResultGuild = {
+  id: string;
+  name: string;
+};
+
+export type DiscordListGuildsResult = {
+  success: boolean;
+  guilds: DiscordListGuildsResultGuild[];
+  count: number;
+  error?: string;
+};
@@ -0,0 +1,5 @@
+export type DiscordPostMessageInput = {
+  channelId: string;
+  messageText: string;
+  replyToMessageId?: string;
+};
@@ -0,0 +1,7 @@
+export type DiscordToolResult = {
+  success: boolean;
+  message: string;
+  error?: string;
+  messageId?: string;
+  channelId?: string;
+};
@@ -0,0 +1,5 @@
+export type DiscordUpdateMessageInput = {
+  channelId: string;
+  messageId: string;
+  newMessageText: string;
+};
@@ -0,0 +1,10 @@
+import { type DiscordToolResult } from 'src/logic-functions/types/discord-tool-result.type';
+
+export const buildDiscordFailureResult = (
+  message: string,
+  error: unknown,
+): DiscordToolResult => ({
+  success: false,
+  message,
+  error: error instanceof Error ? error.message : 'Discord request failed',
+});
@@ -0,0 +1,108 @@
+import { isDefined } from 'twenty-shared/utils';
+
+const DISCORD_API_BASE_URL = 'https://discord.com/api/v10';
+
+type DiscordApiSuccess<TData> = {
+  ok: true;
+  status: number;
+  data: TData;
+};
+
+type DiscordApiFailure = {
+  ok: false;
+  status: number;
+  errorMessage: string;
+};
+
+export type DiscordApiResult<TData> =
+  | DiscordApiSuccess<TData>
+  | DiscordApiFailure;
+
+type DiscordErrorBody = {
+  code?: number;
+  message?: string;
+};
+
+type DiscordApiRequestParams = {
+  botToken: string;
+  path: string;
+  method: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+  body?: unknown;
+};
+
+export const discordApiRequest = async <TData = unknown>({
+  botToken,
+  path,
+  method,
+  body,
+}: DiscordApiRequestParams): Promise<DiscordApiResult<TData>> => {
+  const url = `${DISCORD_API_BASE_URL}${path}`;
+  const hasBody = isDefined(body);
+
+  let response: Response;
+
+  try {
+    response = await fetch(url, {
+      method,
+      headers: {
+        Authorization: `Bot ${botToken}`,
+        ...(hasBody ? { 'Content-Type': 'application/json' } : {}),
+      },
+      ...(hasBody ? { body: JSON.stringify(body) } : {}),
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      status: 0,
+      errorMessage: `Discord API request failed: ${(error as Error).message}`,
+    };
+  }
+
+  if (response.status === 204) {
+    return { ok: true, status: 204, data: undefined as TData };
+  }
+
+  if (!response.ok) {
+    const errorMessage = await extractDiscordErrorMessage(response);
+
+    return {
+      ok: false,
+      status: response.status,
+      errorMessage,
+    };
+  }
+
+  try {
+    const data = (await response.json()) as TData;
+
+    return { ok: true, status: response.status, data };
+  } catch (error) {
+    return {
+      ok: false,
+      status: response.status,
+      errorMessage: `Discord API returned a non-JSON response: ${
+        (error as Error).message
+      }`,
+    };
+  }
+};
+
+const extractDiscordErrorMessage = async (
+  response: Response,
+): Promise<string> => {
+  const fallback = `Discord API responded with ${response.status}`;
+
+  try {
+    const errorBody = (await response.json()) as DiscordErrorBody;
+
+    if (isDefined(errorBody.message)) {
+      return isDefined(errorBody.code)
+        ? `${errorBody.message} (Discord error code ${errorBody.code})`
+        : errorBody.message;
+    }
+
+    return fallback;
+  } catch {
+    return fallback;
+  }
+};
@@ -0,0 +1,18 @@
+import {
+  discordApiRequest,
+  type DiscordApiResult,
+} from 'src/logic-functions/utils/discord-api-request';
+
+export type DiscordGuildResponse = {
+  id: string;
+  name: string;
+};
+
+export const fetchDiscordGuilds = (
+  botToken: string,
+): Promise<DiscordApiResult<DiscordGuildResponse[]>> =>
+  discordApiRequest<DiscordGuildResponse[]>({
+    botToken,
+    method: 'GET',
+    path: '/users/@me/guilds',
+  });
@@ -0,0 +1,19 @@
+import { isDefined } from 'twenty-shared/utils';
+
+export const DISCORD_BOT_TOKEN_ENV_VAR = 'DISCORD_BOT_TOKEN';
+
+export const getDiscordBotToken = ():
+  | { success: true; botToken: string }
+  | { success: false; error: string } => {
+  const botToken = process.env[DISCORD_BOT_TOKEN_ENV_VAR];
+
+  if (!isDefined(botToken) || botToken.length === 0) {
+    return {
+      success: false,
+      error:
+        'Discord is not configured. Open the Twenty Discord app settings and set the DISCORD_BOT_TOKEN application variable (Developer Portal → Bot tab → Reset Token).',
+    };
+  }
+
+  return { success: true, botToken };
+};
@@ -0,0 +1,21 @@
+import { defineApplicationRole } from 'twenty-sdk/define';
+
+import { DEFAULT_ROLE_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
+
+export default defineApplicationRole({
+  universalIdentifier: DEFAULT_ROLE_UNIVERSAL_IDENTIFIER,
+  label: 'Twenty Discord tools role',
+  description:
+    'No CRM data access — tools only forward requests to Discord using the configured bot token.',
+  canReadAllObjectRecords: false,
+  canUpdateAllObjectRecords: false,
+  canSoftDeleteAllObjectRecords: false,
+  canDestroyAllObjectRecords: false,
+  canUpdateAllSettings: false,
+  canBeAssignedToAgents: false,
+  canBeAssignedToUsers: false,
+  canBeAssignedToApiKeys: false,
+  objectPermissions: [],
+  fieldPermissions: [],
+  permissionFlags: [],
+});
@@ -0,0 +1,31 @@
+{
+  "compileOnSave": false,
+  "compilerOptions": {
+    "sourceMap": true,
+    "declaration": true,
+    "outDir": "./dist",
+    "rootDir": ".",
+    "jsx": "react-jsx",
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true,
+    "emitDecoratorMetadata": true,
+    "experimentalDecorators": true,
+    "importHelpers": true,
+    "allowUnreachableCode": false,
+    "strict": true,
+    "alwaysStrict": true,
+    "noImplicitAny": true,
+    "strictBindCallApply": false,
+    "target": "es2020",
+    "module": "esnext",
+    "lib": ["es2020", "dom"],
+    "skipLibCheck": true,
+    "skipDefaultLibCheck": true,
+    "resolveJsonModule": true,
+    "paths": {
+      "src/*": ["./src/*"],
+      "~/*": ["./*"]
+    }
+  },
+  "exclude": ["node_modules", "dist", "**/*.test.ts", "**/*.spec.ts"]
+}
@@ -0,0 +1,7 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['src/**/*.test.ts'],
+  },
+});
@@ -1,6 +1,6 @@
 {
  "name": "twenty-client-sdk",
-  "version": "2.4.0",
+  "version": "2.5.1",
  "sideEffects": false,
  "license": "AGPL-3.0",
  "scripts": {
@@ -244,7 +244,7 @@ type FieldPermission {
  canUpdateFieldValue: Boolean
 }

-type PermissionFlag {
+type RolePermissionFlag {
  id: UUID!
  roleId: UUID!
  flag: PermissionFlagType!
@@ -276,7 +276,7 @@ type Role {
  canUpdateAllObjectRecords: Boolean!
  canSoftDeleteAllObjectRecords: Boolean!
  canDestroyAllObjectRecords: Boolean!
-  permissionFlags: [PermissionFlag!]
+  permissionFlags: [RolePermissionFlag!]
  objectPermissions: [ObjectPermission!]
  fieldPermissions: [FieldPermission!]
  rowLevelPermissionPredicates: [RowLevelPermissionPredicate!]
@@ -323,6 +323,7 @@ type FrontComponent {
  isHeadless: Boolean!
  usesSdkClient: Boolean!
  applicationTokenPair: ApplicationTokenPair
+  applicationVariables: JSON
 }

 type CommandMenuItem {
@@ -770,6 +771,7 @@ type ViewFilter {
  viewFilterGroupId: UUID
  positionInViewFilterGroup: Float
  subFieldName: String
+  relationTargetFieldMetadataId: UUID
  viewId: UUID!
  workspaceId: UUID!
  createdAt: DateTime!
@@ -812,6 +814,7 @@ type ViewSort {
  id: UUID!
  fieldMetadataId: UUID!
  direction: ViewSortDirection!
+  subFieldName: String
  viewId: UUID!
  workspaceId: UUID!
  createdAt: DateTime!
@@ -1392,6 +1395,7 @@ type PageLayout {
  objectMetadataId: UUID
  tabs: [PageLayoutTab!]
  defaultTabToFocusOnMobileAndSidePanelId: UUID
+  universalIdentifier: UUID!
  createdAt: DateTime!
  updatedAt: DateTime!
  deletedAt: DateTime
@@ -1418,6 +1422,22 @@ type ApplicationConnectionProvider {
  oauth: ApplicationConnectionProviderOAuthConfig
 }

+type EnterpriseLicenseInfoDTO {
+  isValid: Boolean!
+  licensee: String
+  expiresAt: DateTime
+  subscriptionId: String
+}
+
+type EnterpriseSubscriptionStatusDTO {
+  status: String!
+  licensee: String
+  expiresAt: DateTime
+  cancelAt: DateTime
+  currentPeriodEnd: DateTime
+  isCancellationScheduled: Boolean!
+}
+
 type Analytics {
  """Boolean that confirms query was dispatched"""
  success: Boolean!
@@ -1438,22 +1458,6 @@ type FileWithSignedUrl {
  url: String!
 }

-type EnterpriseLicenseInfoDTO {
-  isValid: Boolean!
-  licensee: String
-  expiresAt: DateTime
-  subscriptionId: String
-}
-
-type EnterpriseSubscriptionStatusDTO {
-  status: String!
-  licensee: String
-  expiresAt: DateTime
-  cancelAt: DateTime
-  currentPeriodEnd: DateTime
-  isCancellationScheduled: Boolean!
-}
-
 type BillingSubscriptionSchedulePhaseItem {
  price: String!
  quantity: Float
@@ -1486,7 +1490,6 @@ enum BillingUsageType {
 enum BillingProductKey {
  BASE_PRODUCT
  RESOURCE_CREDIT
-  WORKFLOW_NODE_EXECUTION
 }

 type BillingPriceLicensed {
@@ -1580,7 +1583,7 @@ type BillingEndTrialPeriod {
  billingPortalUrl: String
 }

-type BillingMeteredProductUsage {
+type BillingResourceCreditUsage {
  productKey: BillingProductKey!
  periodStart: DateTime!
  periodEnd: DateTime!
@@ -1749,13 +1752,11 @@ enum FeatureFlagKey {
  IS_UNIQUE_INDEXES_ENABLED
  IS_JSON_FILTER_ENABLED
  IS_MARKETPLACE_SETTING_TAB_VISIBLE
-  IS_RECORD_PAGE_LAYOUT_EDITING_ENABLED
  IS_PUBLIC_DOMAIN_ENABLED
  IS_EMAILING_DOMAIN_ENABLED
  IS_EMAIL_GROUP_ENABLED
  IS_JUNCTION_RELATIONS_ENABLED
-  IS_RECORD_PAGE_LAYOUT_GLOBAL_EDITION_ENABLED
-  IS_BILLING_V2_ENABLED
+  IS_REST_METADATA_API_NEW_FORMAT_DIRECT
 }

 type WorkspaceUrls {
@@ -2417,18 +2418,49 @@ type PlaceDetailsResult {
  location: Location
 }

-type ConnectionParametersOutput {
+type PublicConnectionParametersOutput {
  host: String!
  port: Float!
  username: String
-  password: String!
  secure: Boolean
 }

-type ImapSmtpCaldavConnectionParameters {
-  IMAP: ConnectionParametersOutput
-  SMTP: ConnectionParametersOutput
-  CALDAV: ConnectionParametersOutput
+type PublicImapSmtpCaldavConnectionParameters {
+  IMAP: PublicConnectionParametersOutput
+  SMTP: PublicConnectionParametersOutput
+  CALDAV: PublicConnectionParametersOutput
+}
+
+type ConnectedAccountPublicDTO {
+  id: UUID!
+  handle: String!
+  provider: String!
+  lastCredentialsRefreshedAt: DateTime
+  authFailedAt: DateTime
+  handleAliases: [String!]
+  scopes: [String!]
+  lastSignedInAt: DateTime
+  userWorkspaceId: UUID!
+  connectionProviderId: UUID
+  applicationId: UUID
+  name: String
+  visibility: String!
+  createdAt: DateTime!
+  updatedAt: DateTime!
+  connectionParameters: PublicImapSmtpCaldavConnectionParameters
+}
+
+type ImapSmtpCaldavPublicConnectionParams {
+  host: String!
+  port: Float!
+  username: String
+  secure: Boolean
+}
+
+type ImapSmtpCaldavPublicConnectionParameters {
+  IMAP: ImapSmtpCaldavPublicConnectionParams
+  SMTP: ImapSmtpCaldavPublicConnectionParams
+  CALDAV: ImapSmtpCaldavPublicConnectionParams
 }

 type ConnectedImapSmtpCaldavAccount {
@@ -2436,7 +2468,7 @@ type ConnectedImapSmtpCaldavAccount {
  handle: String!
  provider: String!
  userWorkspaceId: UUID!
-  connectionParameters: ImapSmtpCaldavConnectionParameters
+  connectionParameters: ImapSmtpCaldavPublicConnectionParameters
 }

 type ImapSmtpCaldavConnectionSuccess {
@@ -2444,13 +2476,6 @@ type ImapSmtpCaldavConnectionSuccess {
  connectedAccountId: String!
 }

-type PostgresCredentials {
-  id: UUID!
-  user: String!
-  password: String!
-  workspaceId: UUID!
-}
-
 type ToolIndexEntry {
  name: String!
  description: String!
@@ -2558,57 +2583,6 @@ type DuplicatedDashboard {
  updatedAt: String!
 }

-type ConnectedAccountDTO {
-  id: UUID!
-  handle: String!
-  provider: String!
-  lastCredentialsRefreshedAt: DateTime
-  authFailedAt: DateTime
-  handleAliases: [String!]
-  scopes: [String!]
-  connectionParameters: ImapSmtpCaldavConnectionParameters
-  lastSignedInAt: DateTime
-  userWorkspaceId: UUID!
-  connectionProviderId: UUID
-  applicationId: UUID
-  name: String
-  visibility: String!
-  createdAt: DateTime!
-  updatedAt: DateTime!
-}
-
-type PublicConnectionParametersOutput {
-  host: String!
-  port: Float!
-  username: String
-  secure: Boolean
-}
-
-type PublicImapSmtpCaldavConnectionParameters {
-  IMAP: PublicConnectionParametersOutput
-  SMTP: PublicConnectionParametersOutput
-  CALDAV: PublicConnectionParametersOutput
-}
-
-type ConnectedAccountPublicDTO {
-  id: UUID!
-  handle: String!
-  provider: String!
-  lastCredentialsRefreshedAt: DateTime
-  authFailedAt: DateTime
-  handleAliases: [String!]
-  scopes: [String!]
-  lastSignedInAt: DateTime
-  userWorkspaceId: UUID!
-  connectionProviderId: UUID
-  applicationId: UUID
-  name: String
-  visibility: String!
-  createdAt: DateTime!
-  updatedAt: DateTime!
-  connectionParameters: PublicImapSmtpCaldavConnectionParameters
-}
-
 type SendEmailOutput {
  success: Boolean!
  error: String
@@ -2891,6 +2865,7 @@ enum AllMetadataName {
  pageLayoutTab
  commandMenuItem
  navigationMenuItem
+  rolePermissionFlag
  permissionFlag
  objectPermission
  fieldPermission
@@ -2942,6 +2917,9 @@ type Webhook {
 type Query {
  navigationMenuItems: [NavigationMenuItem!]!
  navigationMenuItem(id: UUID!): NavigationMenuItem
+  enterprisePortalSession(returnUrlPath: String): String
+  enterpriseCheckoutSession(billingInterval: String): String
+  enterpriseSubscriptionStatus: EnterpriseSubscriptionStatusDTO
  getViewFilterGroups(viewId: String): [ViewFilterGroup!]!
  getViewFilterGroup(id: String!): ViewFilterGroup
  getViewFilters(viewId: String): [ViewFilter!]!
@@ -2956,12 +2934,9 @@ type Query {
  getViewFieldGroup(id: String!): ViewFieldGroup
  apiKeys: [ApiKey!]!
  apiKey(input: GetApiKeyInput!): ApiKey
-  enterprisePortalSession(returnUrlPath: String): String
-  enterpriseCheckoutSession(billingInterval: String): String
-  enterpriseSubscriptionStatus: EnterpriseSubscriptionStatusDTO
  billingPortalSession(returnUrlPath: String): BillingSession!
  listPlans: [BillingPlan!]!
-  getMeteredProductsUsage: [BillingMeteredProductUsage!]!
+  getResourceCreditUsage: [BillingResourceCreditUsage!]!
  findWorkspaceInvitations: [WorkspaceInvitation!]!
  getApprovedAccessDomains: [ApprovedAccessDomain!]!
  getPageLayoutTabs(pageLayoutId: String!): [PageLayoutTab!]!
@@ -3022,9 +2997,9 @@ type Query {
  getViewGroup(id: String!): ViewGroup
  myMessageFolders(messageChannelId: UUID): [MessageFolder!]!
  myMessageChannels(connectedAccountId: UUID): [MessageChannel!]!
-  myConnectedAccounts: [ConnectedAccountDTO!]!
+  myConnectedAccounts: [ConnectedAccountPublicDTO!]!
  connectedAccountById(id: UUID!): ConnectedAccountPublicDTO
-  connectedAccounts: [ConnectedAccountDTO!]!
+  connectedAccounts: [ConnectedAccountPublicDTO!]!
  myCalendarChannels(connectedAccountId: UUID): [CalendarChannel!]!
  webhooks: [Webhook!]!
  webhook(id: UUID!): Webhook
@@ -3063,7 +3038,6 @@ type Query {
  getAutoCompleteAddress(address: String!, token: String!, country: String, isFieldCity: Boolean): [AutocompleteResult!]!
  getAddressDetails(placeId: String!, token: String!): PlaceDetailsResult!
  getUsageAnalytics(input: UsageAnalyticsInput): UsageAnalytics!
-  getPostgresCredentials: PostgresCredentials
  findManyPublicDomains: [PublicDomain!]!
  getEmailingDomains: [EmailingDomain!]!
  findManyMarketplaceApps: [MarketplaceApp!]!
@@ -3152,6 +3126,8 @@ type Mutation {
  deleteManyNavigationMenuItems(ids: [UUID!]!): [NavigationMenuItem!]!
  deleteNavigationMenuItem(id: UUID!): NavigationMenuItem!
  uploadEmailAttachmentFile(file: Upload!): FileWithSignedUrl!
+  refreshEnterpriseValidityToken: Boolean!
+  setEnterpriseKey(enterpriseKey: String!): EnterpriseLicenseInfoDTO!
  uploadAiChatFile(file: Upload!): FileWithSignedUrl!
  uploadWorkflowFile(file: Upload!): FileWithSignedUrl!
  uploadWorkspaceLogo(file: Upload!): FileWithSignedUrl!
@@ -3192,8 +3168,6 @@ type Mutation {
  assignRoleToApiKey(apiKeyId: UUID!, roleId: UUID!): Boolean!
  createObjectEvent(event: String!, recordId: UUID!, objectMetadataId: UUID!, properties: JSON): Analytics!
  trackAnalytics(type: AnalyticsType!, name: String, event: String, properties: JSON): Analytics!
-  refreshEnterpriseValidityToken: Boolean!
-  setEnterpriseKey(enterpriseKey: String!): EnterpriseLicenseInfoDTO!
  skipSyncEmailOnboardingStep: OnboardingStepSuccess!
  skipBookOnboardingStep: OnboardingStepSuccess!
  checkoutSession(recurringInterval: SubscriptionInterval!, plan: BillingPlanKey! = PRO, requirePaymentMethod: Boolean! = true, successUrlPath: String): BillingSession!
@@ -3201,9 +3175,9 @@ type Mutation {
  switchBillingPlan: BillingUpdate!
  cancelSwitchBillingPlan: BillingUpdate!
  cancelSwitchBillingInterval: BillingUpdate!
-  setMeteredSubscriptionPrice(priceId: String!): BillingUpdate!
+  setResourceCreditSubscriptionPrice(priceId: String!): BillingUpdate!
  endSubscriptionTrialPeriod: BillingEndTrialPeriod!
-  cancelSwitchMeteredPrice: BillingUpdate!
+  cancelSwitchResourceCreditPrice: BillingUpdate!
  deleteWorkspaceInvitation(appTokenId: String!): String!
  resendWorkspaceInvitation(appTokenId: String!): SendInvitations!
  sendInvitations(emails: [String!]!, roleId: UUID): SendInvitations!
@@ -3245,7 +3219,7 @@ type Mutation {
  updateOneRole(updateRoleInput: UpdateRoleInput!): Role!
  deleteOneRole(roleId: UUID!): String!
  upsertObjectPermissions(upsertObjectPermissionsInput: UpsertObjectPermissionsInput!): [ObjectPermission!]!
-  upsertPermissionFlags(upsertPermissionFlagsInput: UpsertPermissionFlagsInput!): [PermissionFlag!]!
+  upsertPermissionFlags(upsertPermissionFlagsInput: UpsertPermissionFlagsInput!): [RolePermissionFlag!]!
  upsertFieldPermissions(upsertFieldPermissionsInput: UpsertFieldPermissionsInput!): [FieldPermission!]!
  upsertRowLevelPermissionPredicates(input: UpsertRowLevelPermissionPredicatesInput!): UpsertRowLevelPermissionPredicatesResult!
  assignRoleToAgent(agentId: UUID!, roleId: UUID!): Boolean!
@@ -3264,13 +3238,13 @@ type Mutation {
  updateMessageChannel(input: UpdateMessageChannelInput!): MessageChannel!
  createEmailGroupChannel(input: CreateEmailGroupChannelInput!): CreateEmailGroupChannelOutput!
  deleteEmailGroupChannel(id: UUID!): MessageChannel!
-  deleteConnectedAccount(id: UUID!): ConnectedAccountDTO!
+  deleteConnectedAccount(id: UUID!): ConnectedAccountPublicDTO!
  updateCalendarChannel(input: UpdateCalendarChannelInput!): CalendarChannel!
  createWebhook(input: CreateWebhookInput!): Webhook!
  updateWebhook(input: UpdateWebhookInput!): Webhook!
  deleteWebhook(id: UUID!): Webhook!
  createChatThread: AgentChatThread!
-  sendChatMessage(threadId: UUID!, text: String!, messageId: UUID!, browsingContext: JSON, modelId: String, fileIds: [UUID!]): SendChatMessageResult!
+  sendChatMessage(threadId: UUID!, text: String!, messageId: UUID!, browsingContext: JSON, modelId: String, fileAttachments: [FileAttachmentInput!]): SendChatMessageResult!
  stopAgentChatStream(threadId: UUID!): Boolean!
  renameChatThread(id: UUID!, title: String!): AgentChatThread!
  archiveChatThread(id: UUID!): AgentChatThread!
@@ -3333,10 +3307,8 @@ type Mutation {
  impersonate(userId: UUID!, workspaceId: UUID!): Impersonate!
  sendEmail(input: SendEmailInput!): SendEmailOutput!
  startChannelSync(connectedAccountId: UUID!): ChannelSyncSuccess!
-  saveImapSmtpCaldavAccount(accountOwnerId: UUID!, handle: String!, connectionParameters: EmailAccountConnectionParameters!, id: UUID): ImapSmtpCaldavConnectionSuccess!
+  saveImapSmtpCaldavAccount(handle: String!, connectionParameters: EmailAccountConnectionParameters!, id: UUID): ImapSmtpCaldavConnectionSuccess!
  updateLabPublicFeatureFlag(input: UpdateLabPublicFeatureFlagInput!): FeatureFlag!
-  enablePostgresProxy: PostgresCredentials!
-  disablePostgresProxy: PostgresCredentials!
  createPublicDomain(domain: String!, applicationId: String): PublicDomain!
  updatePublicDomain(domain: String!, applicationId: String): PublicDomain!
  deletePublicDomain(domain: String!): Boolean!
@@ -3427,6 +3399,7 @@ input CreateViewFilterInput {
  viewFilterGroupId: UUID
  positionInViewFilterGroup: Float
  subFieldName: String
+  relationTargetFieldMetadataId: UUID
  viewId: UUID!
 }

@@ -3445,6 +3418,7 @@ input UpdateViewFilterInputUpdates {
  viewFilterGroupId: UUID
  positionInViewFilterGroup: Float
  subFieldName: String
+  relationTargetFieldMetadataId: UUID
 }

 input DeleteViewFilterInput {
@@ -3533,6 +3507,7 @@ input UpsertViewWidgetViewFilterInput {
  viewFilterGroupId: UUID
  positionInViewFilterGroup: Float
  subFieldName: String
+  relationTargetFieldMetadataId: UUID
 }

 input UpsertViewWidgetViewFilterGroupInput {
@@ -3552,6 +3527,7 @@ input CreateViewSortInput {
  id: UUID
  fieldMetadataId: UUID!
  direction: ViewSortDirection = ASC
+  subFieldName: String
  viewId: UUID!
 }

@@ -3565,6 +3541,7 @@ input UpdateViewSortInput {

 input UpdateViewSortInputUpdates {
  direction: ViewSortDirection
+  subFieldName: String
 }

 input DeleteViewSortInput {
@@ -4232,6 +4209,11 @@ input UpdateWebhookInputUpdates {
  secret: String
 }

+input FileAttachmentInput {
+  id: UUID!
+  filename: String!
+}
+
 input CreateSkillInput {
  id: UUID
  name: String!
@@ -4388,16 +4370,16 @@ input SendEmailAttachmentInput {
 }

 input EmailAccountConnectionParameters {
-  IMAP: ConnectionParameters
-  SMTP: ConnectionParameters
-  CALDAV: ConnectionParameters
+  IMAP: ConnectionParametersInput
+  SMTP: ConnectionParametersInput
+  CALDAV: ConnectionParametersInput
 }

-input ConnectionParameters {
+input ConnectionParametersInput {
  host: String!
  port: Float!
  username: String
-  password: String!
+  password: String
  secure: Boolean
 }

@@ -190,11 +190,11 @@ export interface FieldPermission {
    __typename: 'FieldPermission'
 }

-export interface PermissionFlag {
+export interface RolePermissionFlag {
    id: Scalars['UUID']
    roleId: Scalars['UUID']
    flag: PermissionFlagType
-    __typename: 'PermissionFlag'
+    __typename: 'RolePermissionFlag'
 }

 export interface ApiKeyForRole {
@@ -224,7 +224,7 @@ export interface Role {
    canUpdateAllObjectRecords: Scalars['Boolean']
    canSoftDeleteAllObjectRecords: Scalars['Boolean']
    canDestroyAllObjectRecords: Scalars['Boolean']
-    permissionFlags?: PermissionFlag[]
+    permissionFlags?: RolePermissionFlag[]
    objectPermissions?: ObjectPermission[]
    fieldPermissions?: FieldPermission[]
    rowLevelPermissionPredicates?: RowLevelPermissionPredicate[]
@@ -276,6 +276,7 @@ export interface FrontComponent {
    isHeadless: Scalars['Boolean']
    usesSdkClient: Scalars['Boolean']
    applicationTokenPair?: ApplicationTokenPair
+    applicationVariables?: Scalars['JSON']
    __typename: 'FrontComponent'
 }

@@ -522,6 +523,7 @@ export interface ViewFilter {
    viewFilterGroupId?: Scalars['UUID']
    positionInViewFilterGroup?: Scalars['Float']
    subFieldName?: Scalars['String']
+    relationTargetFieldMetadataId?: Scalars['UUID']
    viewId: Scalars['UUID']
    workspaceId: Scalars['UUID']
    createdAt: Scalars['DateTime']
@@ -549,6 +551,7 @@ export interface ViewSort {
    id: Scalars['UUID']
    fieldMetadataId: Scalars['UUID']
    direction: ViewSortDirection
+    subFieldName?: Scalars['String']
    viewId: Scalars['UUID']
    workspaceId: Scalars['UUID']
    createdAt: Scalars['DateTime']
@@ -1053,6 +1056,7 @@ export interface PageLayout {
    objectMetadataId?: Scalars['UUID']
    tabs?: PageLayoutTab[]
    defaultTabToFocusOnMobileAndSidePanelId?: Scalars['UUID']
+    universalIdentifier: Scalars['UUID']
    createdAt: Scalars['DateTime']
    updatedAt: Scalars['DateTime']
    deletedAt?: Scalars['DateTime']
@@ -1077,6 +1081,24 @@ export interface ApplicationConnectionProvider {
    __typename: 'ApplicationConnectionProvider'
 }

+export interface EnterpriseLicenseInfoDTO {
+    isValid: Scalars['Boolean']
+    licensee?: Scalars['String']
+    expiresAt?: Scalars['DateTime']
+    subscriptionId?: Scalars['String']
+    __typename: 'EnterpriseLicenseInfoDTO'
+}
+
+export interface EnterpriseSubscriptionStatusDTO {
+    status: Scalars['String']
+    licensee?: Scalars['String']
+    expiresAt?: Scalars['DateTime']
+    cancelAt?: Scalars['DateTime']
+    currentPeriodEnd?: Scalars['DateTime']
+    isCancellationScheduled: Scalars['Boolean']
+    __typename: 'EnterpriseSubscriptionStatusDTO'
+}
+
 export interface Analytics {
    /** Boolean that confirms query was dispatched */
    success: Scalars['Boolean']
@@ -1100,24 +1122,6 @@ export interface FileWithSignedUrl {
    __typename: 'FileWithSignedUrl'
 }

-export interface EnterpriseLicenseInfoDTO {
-    isValid: Scalars['Boolean']
-    licensee?: Scalars['String']
-    expiresAt?: Scalars['DateTime']
-    subscriptionId?: Scalars['String']
-    __typename: 'EnterpriseLicenseInfoDTO'
-}
-
-export interface EnterpriseSubscriptionStatusDTO {
-    status: Scalars['String']
-    licensee?: Scalars['String']
-    expiresAt?: Scalars['DateTime']
-    cancelAt?: Scalars['DateTime']
-    currentPeriodEnd?: Scalars['DateTime']
-    isCancellationScheduled: Scalars['Boolean']
-    __typename: 'EnterpriseSubscriptionStatusDTO'
-}
-
 export interface BillingSubscriptionSchedulePhaseItem {
    price: Scalars['String']
    quantity?: Scalars['Float']
@@ -1146,7 +1150,7 @@ export type BillingUsageType = 'METERED' | 'LICENSED'


 /** The different billing products available */
-export type BillingProductKey = 'BASE_PRODUCT' | 'RESOURCE_CREDIT' | 'WORKFLOW_NODE_EXECUTION'
+export type BillingProductKey = 'BASE_PRODUCT' | 'RESOURCE_CREDIT'

 export interface BillingPriceLicensed {
    recurringInterval: SubscriptionInterval
@@ -1232,7 +1236,7 @@ export interface BillingEndTrialPeriod {
    __typename: 'BillingEndTrialPeriod'
 }

-export interface BillingMeteredProductUsage {
+export interface BillingResourceCreditUsage {
    productKey: BillingProductKey
    periodStart: Scalars['DateTime']
    periodEnd: Scalars['DateTime']
@@ -1241,7 +1245,7 @@ export interface BillingMeteredProductUsage {
    rolloverCredits: Scalars['Float']
    totalGrantedCredits: Scalars['Float']
    unitPriceCents: Scalars['Float']
-    __typename: 'BillingMeteredProductUsage'
+    __typename: 'BillingResourceCreditUsage'
 }

 export interface BillingPlan {
@@ -1389,7 +1393,7 @@ export interface FeatureFlag {
    __typename: 'FeatureFlag'
 }

-export type FeatureFlagKey = 'IS_UNIQUE_INDEXES_ENABLED' | 'IS_JSON_FILTER_ENABLED' | 'IS_MARKETPLACE_SETTING_TAB_VISIBLE' | 'IS_RECORD_PAGE_LAYOUT_EDITING_ENABLED' | 'IS_PUBLIC_DOMAIN_ENABLED' | 'IS_EMAILING_DOMAIN_ENABLED' | 'IS_EMAIL_GROUP_ENABLED' | 'IS_JUNCTION_RELATIONS_ENABLED' | 'IS_RECORD_PAGE_LAYOUT_GLOBAL_EDITION_ENABLED' | 'IS_BILLING_V2_ENABLED'
+export type FeatureFlagKey = 'IS_UNIQUE_INDEXES_ENABLED' | 'IS_JSON_FILTER_ENABLED' | 'IS_MARKETPLACE_SETTING_TAB_VISIBLE' | 'IS_PUBLIC_DOMAIN_ENABLED' | 'IS_EMAILING_DOMAIN_ENABLED' | 'IS_EMAIL_GROUP_ENABLED' | 'IS_JUNCTION_RELATIONS_ENABLED' | 'IS_REST_METADATA_API_NEW_FORMAT_DIRECT'

 export interface WorkspaceUrls {
    customUrl?: Scalars['String']
@@ -2091,20 +2095,54 @@ export interface PlaceDetailsResult {
    __typename: 'PlaceDetailsResult'
 }

-export interface ConnectionParametersOutput {
+export interface PublicConnectionParametersOutput {
    host: Scalars['String']
    port: Scalars['Float']
    username?: Scalars['String']
-    password: Scalars['String']
    secure?: Scalars['Boolean']
-    __typename: 'ConnectionParametersOutput'
+    __typename: 'PublicConnectionParametersOutput'
 }

-export interface ImapSmtpCaldavConnectionParameters {
-    IMAP?: ConnectionParametersOutput
-    SMTP?: ConnectionParametersOutput
-    CALDAV?: ConnectionParametersOutput
-    __typename: 'ImapSmtpCaldavConnectionParameters'
+export interface PublicImapSmtpCaldavConnectionParameters {
+    IMAP?: PublicConnectionParametersOutput
+    SMTP?: PublicConnectionParametersOutput
+    CALDAV?: PublicConnectionParametersOutput
+    __typename: 'PublicImapSmtpCaldavConnectionParameters'
+}
+
+export interface ConnectedAccountPublicDTO {
+    id: Scalars['UUID']
+    handle: Scalars['String']
+    provider: Scalars['String']
+    lastCredentialsRefreshedAt?: Scalars['DateTime']
+    authFailedAt?: Scalars['DateTime']
+    handleAliases?: Scalars['String'][]
+    scopes?: Scalars['String'][]
+    lastSignedInAt?: Scalars['DateTime']
+    userWorkspaceId: Scalars['UUID']
+    connectionProviderId?: Scalars['UUID']
+    applicationId?: Scalars['UUID']
+    name?: Scalars['String']
+    visibility: Scalars['String']
+    createdAt: Scalars['DateTime']
+    updatedAt: Scalars['DateTime']
+    connectionParameters?: PublicImapSmtpCaldavConnectionParameters
+    __typename: 'ConnectedAccountPublicDTO'
+}
+
+export interface ImapSmtpCaldavPublicConnectionParams {
+    host: Scalars['String']
+    port: Scalars['Float']
+    username?: Scalars['String']
+    secure?: Scalars['Boolean']
+    __typename: 'ImapSmtpCaldavPublicConnectionParams'
+}
+
+export interface ImapSmtpCaldavPublicConnectionParameters {
+    IMAP?: ImapSmtpCaldavPublicConnectionParams
+    SMTP?: ImapSmtpCaldavPublicConnectionParams
+    CALDAV?: ImapSmtpCaldavPublicConnectionParams
+    __typename: 'ImapSmtpCaldavPublicConnectionParameters'
 }

 export interface ConnectedImapSmtpCaldavAccount {
@@ -2112,7 +2150,7 @@ export interface ConnectedImapSmtpCaldavAccount {
    handle: Scalars['String']
    provider: Scalars['String']
    userWorkspaceId: Scalars['UUID']
-    connectionParameters?: ImapSmtpCaldavConnectionParameters
+    connectionParameters?: ImapSmtpCaldavPublicConnectionParameters
    __typename: 'ConnectedImapSmtpCaldavAccount'
 }

@@ -2122,14 +2160,6 @@ export interface ImapSmtpCaldavConnectionSuccess {
    __typename: 'ImapSmtpCaldavConnectionSuccess'
 }

-export interface PostgresCredentials {
-    id: Scalars['UUID']
-    user: Scalars['String']
-    password: Scalars['String']
-    workspaceId: Scalars['UUID']
-    __typename: 'PostgresCredentials'
-}
-
 export interface ToolIndexEntry {
    name: Scalars['String']
    description: Scalars['String']
@@ -2248,61 +2278,6 @@ export interface DuplicatedDashboard {
    __typename: 'DuplicatedDashboard'
 }

-export interface ConnectedAccountDTO {
-    id: Scalars['UUID']
-    handle: Scalars['String']
-    provider: Scalars['String']
-    lastCredentialsRefreshedAt?: Scalars['DateTime']
-    authFailedAt?: Scalars['DateTime']
-    handleAliases?: Scalars['String'][]
-    scopes?: Scalars['String'][]
-    connectionParameters?: ImapSmtpCaldavConnectionParameters
-    lastSignedInAt?: Scalars['DateTime']
-    userWorkspaceId: Scalars['UUID']
-    connectionProviderId?: Scalars['UUID']
-    applicationId?: Scalars['UUID']
-    name?: Scalars['String']
-    visibility: Scalars['String']
-    createdAt: Scalars['DateTime']
-    updatedAt: Scalars['DateTime']
-    __typename: 'ConnectedAccountDTO'
-}
-
-export interface PublicConnectionParametersOutput {
-    host: Scalars['String']
-    port: Scalars['Float']
-    username?: Scalars['String']
-    secure?: Scalars['Boolean']
-    __typename: 'PublicConnectionParametersOutput'
-}
-
-export interface PublicImapSmtpCaldavConnectionParameters {
-    IMAP?: PublicConnectionParametersOutput
-    SMTP?: PublicConnectionParametersOutput
-    CALDAV?: PublicConnectionParametersOutput
-    __typename: 'PublicImapSmtpCaldavConnectionParameters'
-}
-
-export interface ConnectedAccountPublicDTO {
-    id: Scalars['UUID']
-    handle: Scalars['String']
-    provider: Scalars['String']
-    lastCredentialsRefreshedAt?: Scalars['DateTime']
-    authFailedAt?: Scalars['DateTime']
-    handleAliases?: Scalars['String'][]
-    scopes?: Scalars['String'][]
-    lastSignedInAt?: Scalars['DateTime']
-    userWorkspaceId: Scalars['UUID']
-    connectionProviderId?: Scalars['UUID']
-    applicationId?: Scalars['UUID']
-    name?: Scalars['String']
-    visibility: Scalars['String']
-    createdAt: Scalars['DateTime']
-    updatedAt: Scalars['DateTime']
-    connectionParameters?: PublicImapSmtpCaldavConnectionParameters
-    __typename: 'ConnectedAccountPublicDTO'
-}
-
 export interface SendEmailOutput {
    success: Scalars['Boolean']
    error?: Scalars['String']
@@ -2521,7 +2496,7 @@ export interface CollectionHash {
    __typename: 'CollectionHash'
 }

-export type AllMetadataName = 'fieldMetadata' | 'objectMetadata' | 'view' | 'viewField' | 'viewFieldGroup' | 'viewGroup' | 'viewSort' | 'rowLevelPermissionPredicate' | 'rowLevelPermissionPredicateGroup' | 'viewFilterGroup' | 'index' | 'logicFunction' | 'viewFilter' | 'role' | 'roleTarget' | 'agent' | 'skill' | 'pageLayout' | 'pageLayoutWidget' | 'pageLayoutTab' | 'commandMenuItem' | 'navigationMenuItem' | 'permissionFlag' | 'objectPermission' | 'fieldPermission' | 'frontComponent' | 'webhook' | 'applicationVariable' | 'connectionProvider'
+export type AllMetadataName = 'fieldMetadata' | 'objectMetadata' | 'view' | 'viewField' | 'viewFieldGroup' | 'viewGroup' | 'viewSort' | 'rowLevelPermissionPredicate' | 'rowLevelPermissionPredicateGroup' | 'viewFilterGroup' | 'index' | 'logicFunction' | 'viewFilter' | 'role' | 'roleTarget' | 'agent' | 'skill' | 'pageLayout' | 'pageLayoutWidget' | 'pageLayoutTab' | 'commandMenuItem' | 'navigationMenuItem' | 'rolePermissionFlag' | 'permissionFlag' | 'objectPermission' | 'fieldPermission' | 'frontComponent' | 'webhook' | 'applicationVariable' | 'connectionProvider'

 export interface MinimalObjectMetadata {
    id: Scalars['UUID']
@@ -2569,6 +2544,9 @@ export interface Webhook {
 export interface Query {
    navigationMenuItems: NavigationMenuItem[]
    navigationMenuItem?: NavigationMenuItem
+    enterprisePortalSession?: Scalars['String']
+    enterpriseCheckoutSession?: Scalars['String']
+    enterpriseSubscriptionStatus?: EnterpriseSubscriptionStatusDTO
    getViewFilterGroups: ViewFilterGroup[]
    getViewFilterGroup?: ViewFilterGroup
    getViewFilters: ViewFilter[]
@@ -2583,12 +2561,9 @@ export interface Query {
    getViewFieldGroup?: ViewFieldGroup
    apiKeys: ApiKey[]
    apiKey?: ApiKey
-    enterprisePortalSession?: Scalars['String']
-    enterpriseCheckoutSession?: Scalars['String']
-    enterpriseSubscriptionStatus?: EnterpriseSubscriptionStatusDTO
    billingPortalSession: BillingSession
    listPlans: BillingPlan[]
-    getMeteredProductsUsage: BillingMeteredProductUsage[]
+    getResourceCreditUsage: BillingResourceCreditUsage[]
    findWorkspaceInvitations: WorkspaceInvitation[]
    getApprovedAccessDomains: ApprovedAccessDomain[]
    getPageLayoutTabs: PageLayoutTab[]
@@ -2622,9 +2597,9 @@ export interface Query {
    getViewGroup?: ViewGroup
    myMessageFolders: MessageFolder[]
    myMessageChannels: MessageChannel[]
-    myConnectedAccounts: ConnectedAccountDTO[]
+    myConnectedAccounts: ConnectedAccountPublicDTO[]
    connectedAccountById?: ConnectedAccountPublicDTO
-    connectedAccounts: ConnectedAccountDTO[]
+    connectedAccounts: ConnectedAccountPublicDTO[]
    myCalendarChannels: CalendarChannel[]
    webhooks: Webhook[]
    webhook?: Webhook
@@ -2663,7 +2638,6 @@ export interface Query {
    getAutoCompleteAddress: AutocompleteResult[]
    getAddressDetails: PlaceDetailsResult
    getUsageAnalytics: UsageAnalytics
-    getPostgresCredentials?: PostgresCredentials
    findManyPublicDomains: PublicDomain[]
    getEmailingDomains: EmailingDomain[]
    findManyMarketplaceApps: MarketplaceApp[]
@@ -2685,6 +2659,8 @@ export interface Mutation {
    deleteManyNavigationMenuItems: NavigationMenuItem[]
    deleteNavigationMenuItem: NavigationMenuItem
    uploadEmailAttachmentFile: FileWithSignedUrl
+    refreshEnterpriseValidityToken: Scalars['Boolean']
+    setEnterpriseKey: EnterpriseLicenseInfoDTO
    uploadAiChatFile: FileWithSignedUrl
    uploadWorkflowFile: FileWithSignedUrl
    uploadWorkspaceLogo: FileWithSignedUrl
@@ -2725,8 +2701,6 @@ export interface Mutation {
    assignRoleToApiKey: Scalars['Boolean']
    createObjectEvent: Analytics
    trackAnalytics: Analytics
-    refreshEnterpriseValidityToken: Scalars['Boolean']
-    setEnterpriseKey: EnterpriseLicenseInfoDTO
    skipSyncEmailOnboardingStep: OnboardingStepSuccess
    skipBookOnboardingStep: OnboardingStepSuccess
    checkoutSession: BillingSession
@@ -2734,9 +2708,9 @@ export interface Mutation {
    switchBillingPlan: BillingUpdate
    cancelSwitchBillingPlan: BillingUpdate
    cancelSwitchBillingInterval: BillingUpdate
-    setMeteredSubscriptionPrice: BillingUpdate
+    setResourceCreditSubscriptionPrice: BillingUpdate
    endSubscriptionTrialPeriod: BillingEndTrialPeriod
-    cancelSwitchMeteredPrice: BillingUpdate
+    cancelSwitchResourceCreditPrice: BillingUpdate
    deleteWorkspaceInvitation: Scalars['String']
    resendWorkspaceInvitation: SendInvitations
    sendInvitations: SendInvitations
@@ -2778,7 +2752,7 @@ export interface Mutation {
    updateOneRole: Role
    deleteOneRole: Scalars['String']
    upsertObjectPermissions: ObjectPermission[]
-    upsertPermissionFlags: PermissionFlag[]
+    upsertPermissionFlags: RolePermissionFlag[]
    upsertFieldPermissions: FieldPermission[]
    upsertRowLevelPermissionPredicates: UpsertRowLevelPermissionPredicatesResult
    assignRoleToAgent: Scalars['Boolean']
@@ -2797,7 +2771,7 @@ export interface Mutation {
    updateMessageChannel: MessageChannel
    createEmailGroupChannel: CreateEmailGroupChannelOutput
    deleteEmailGroupChannel: MessageChannel
-    deleteConnectedAccount: ConnectedAccountDTO
+    deleteConnectedAccount: ConnectedAccountPublicDTO
    updateCalendarChannel: CalendarChannel
    createWebhook: Webhook
    updateWebhook: Webhook
@@ -2868,8 +2842,6 @@ export interface Mutation {
    startChannelSync: ChannelSyncSuccess
    saveImapSmtpCaldavAccount: ImapSmtpCaldavConnectionSuccess
    updateLabPublicFeatureFlag: FeatureFlag
-    enablePostgresProxy: PostgresCredentials
-    disablePostgresProxy: PostgresCredentials
    createPublicDomain: PublicDomain
    updatePublicDomain: PublicDomain
    deletePublicDomain: Scalars['Boolean']
@@ -3080,7 +3052,7 @@ export interface FieldPermissionGenqlSelection{
    __scalar?: boolean | number
 }

-export interface PermissionFlagGenqlSelection{
+export interface RolePermissionFlagGenqlSelection{
    id?: boolean | number
    roleId?: boolean | number
    flag?: boolean | number
@@ -3116,7 +3088,7 @@ export interface RoleGenqlSelection{
    canUpdateAllObjectRecords?: boolean | number
    canSoftDeleteAllObjectRecords?: boolean | number
    canDestroyAllObjectRecords?: boolean | number
-    permissionFlags?: PermissionFlagGenqlSelection
+    permissionFlags?: RolePermissionFlagGenqlSelection
    objectPermissions?: ObjectPermissionGenqlSelection
    fieldPermissions?: FieldPermissionGenqlSelection
    rowLevelPermissionPredicates?: RowLevelPermissionPredicateGenqlSelection
@@ -3173,6 +3145,7 @@ export interface FrontComponentGenqlSelection{
    isHeadless?: boolean | number
    usesSdkClient?: boolean | number
    applicationTokenPair?: ApplicationTokenPairGenqlSelection
+    applicationVariables?: boolean | number
    __typename?: boolean | number
    __scalar?: boolean | number
 }
@@ -3459,6 +3432,7 @@ export interface ViewFilterGenqlSelection{
    viewFilterGroupId?: boolean | number
    positionInViewFilterGroup?: boolean | number
    subFieldName?: boolean | number
+    relationTargetFieldMetadataId?: boolean | number
    viewId?: boolean | number
    workspaceId?: boolean | number
    createdAt?: boolean | number
@@ -3486,6 +3460,7 @@ export interface ViewSortGenqlSelection{
    id?: boolean | number
    fieldMetadataId?: boolean | number
    direction?: boolean | number
+    subFieldName?: boolean | number
    viewId?: boolean | number
    workspaceId?: boolean | number
    createdAt?: boolean | number
@@ -4009,6 +3984,7 @@ export interface PageLayoutGenqlSelection{
    objectMetadataId?: boolean | number
    tabs?: PageLayoutTabGenqlSelection
    defaultTabToFocusOnMobileAndSidePanelId?: boolean | number
+    universalIdentifier?: boolean | number
    createdAt?: boolean | number
    updatedAt?: boolean | number
    deletedAt?: boolean | number
@@ -4034,6 +4010,26 @@ export interface ApplicationConnectionProviderGenqlSelection{
    __scalar?: boolean | number
 }

+export interface EnterpriseLicenseInfoDTOGenqlSelection{
+    isValid?: boolean | number
+    licensee?: boolean | number
+    expiresAt?: boolean | number
+    subscriptionId?: boolean | number
+    __typename?: boolean | number
+    __scalar?: boolean | number
+}
+
+export interface EnterpriseSubscriptionStatusDTOGenqlSelection{
+    status?: boolean | number
+    licensee?: boolean | number
+    expiresAt?: boolean | number
+    cancelAt?: boolean | number
+    currentPeriodEnd?: boolean | number
+    isCancellationScheduled?: boolean | number
+    __typename?: boolean | number
+    __scalar?: boolean | number
+}
+
 export interface AnalyticsGenqlSelection{
    /** Boolean that confirms query was dispatched */
    success?: boolean | number
@@ -4060,26 +4056,6 @@ export interface FileWithSignedUrlGenqlSelection{
    __scalar?: boolean | number
 }

-export interface EnterpriseLicenseInfoDTOGenqlSelection{
-    isValid?: boolean | number
-    licensee?: boolean | number
-    expiresAt?: boolean | number
-    subscriptionId?: boolean | number
-    __typename?: boolean | number
-    __scalar?: boolean | number
-}
-
-export interface EnterpriseSubscriptionStatusDTOGenqlSelection{
-    status?: boolean | number
-    licensee?: boolean | number
-    expiresAt?: boolean | number
-    cancelAt?: boolean | number
-    currentPeriodEnd?: boolean | number
-    isCancellationScheduled?: boolean | number
-    __typename?: boolean | number
-    __scalar?: boolean | number
-}
-
 export interface BillingSubscriptionSchedulePhaseItemGenqlSelection{
    price?: boolean | number
    quantity?: boolean | number
@@ -4192,7 +4168,7 @@ export interface BillingEndTrialPeriodGenqlSelection{
    __scalar?: boolean | number
 }

-export interface BillingMeteredProductUsageGenqlSelection{
+export interface BillingResourceCreditUsageGenqlSelection{
    productKey?: boolean | number
    periodStart?: boolean | number
    periodEnd?: boolean | number
@@ -5119,20 +5095,57 @@ export interface PlaceDetailsResultGenqlSelection{
    __scalar?: boolean | number
 }

-export interface ConnectionParametersOutputGenqlSelection{
+export interface PublicConnectionParametersOutputGenqlSelection{
    host?: boolean | number
    port?: boolean | number
    username?: boolean | number
-    password?: boolean | number
    secure?: boolean | number
    __typename?: boolean | number
    __scalar?: boolean | number
 }

-export interface ImapSmtpCaldavConnectionParametersGenqlSelection{
-    IMAP?: ConnectionParametersOutputGenqlSelection
-    SMTP?: ConnectionParametersOutputGenqlSelection
-    CALDAV?: ConnectionParametersOutputGenqlSelection
+export interface PublicImapSmtpCaldavConnectionParametersGenqlSelection{
+    IMAP?: PublicConnectionParametersOutputGenqlSelection
+    SMTP?: PublicConnectionParametersOutputGenqlSelection
+    CALDAV?: PublicConnectionParametersOutputGenqlSelection
+    __typename?: boolean | number
+    __scalar?: boolean | number
+}
+
+export interface ConnectedAccountPublicDTOGenqlSelection{
+    id?: boolean | number
+    handle?: boolean | number
+    provider?: boolean | number
+    lastCredentialsRefreshedAt?: boolean | number
+    authFailedAt?: boolean | number
+    handleAliases?: boolean | number
+    scopes?: boolean | number
+    lastSignedInAt?: boolean | number
+    userWorkspaceId?: boolean | number
+    connectionProviderId?: boolean | number
+    applicationId?: boolean | number
+    name?: boolean | number
+    visibility?: boolean | number
+    createdAt?: boolean | number
+    updatedAt?: boolean | number
+    connectionParameters?: PublicImapSmtpCaldavConnectionParametersGenqlSelection
+    __typename?: boolean | number
+    __scalar?: boolean | number
+}
+
+export interface ImapSmtpCaldavPublicConnectionParamsGenqlSelection{
+    host?: boolean | number
+    port?: boolean | number
+    username?: boolean | number
+    secure?: boolean | number
+    __typename?: boolean | number
+    __scalar?: boolean | number
+}
+
+export interface ImapSmtpCaldavPublicConnectionParametersGenqlSelection{
+    IMAP?: ImapSmtpCaldavPublicConnectionParamsGenqlSelection
+    SMTP?: ImapSmtpCaldavPublicConnectionParamsGenqlSelection
+    CALDAV?: ImapSmtpCaldavPublicConnectionParamsGenqlSelection
    __typename?: boolean | number
    __scalar?: boolean | number
 }
@@ -5142,7 +5155,7 @@ export interface ConnectedImapSmtpCaldavAccountGenqlSelection{
    handle?: boolean | number
    provider?: boolean | number
    userWorkspaceId?: boolean | number
-    connectionParameters?: ImapSmtpCaldavConnectionParametersGenqlSelection
+    connectionParameters?: ImapSmtpCaldavPublicConnectionParametersGenqlSelection
    __typename?: boolean | number
    __scalar?: boolean | number
 }
@@ -5154,15 +5167,6 @@ export interface ImapSmtpCaldavConnectionSuccessGenqlSelection{
    __scalar?: boolean | number
 }

-export interface PostgresCredentialsGenqlSelection{
-    id?: boolean | number
-    user?: boolean | number
-    password?: boolean | number
-    workspaceId?: boolean | number
-    __typename?: boolean | number
-    __scalar?: boolean | number
-}
-
 export interface ToolIndexEntryGenqlSelection{
    name?: boolean | number
    description?: boolean | number
@@ -5292,65 +5296,6 @@ export interface DuplicatedDashboardGenqlSelection{
    __scalar?: boolean | number
 }

-export interface ConnectedAccountDTOGenqlSelection{
-    id?: boolean | number
-    handle?: boolean | number
-    provider?: boolean | number
-    lastCredentialsRefreshedAt?: boolean | number
-    authFailedAt?: boolean | number
-    handleAliases?: boolean | number
-    scopes?: boolean | number
-    connectionParameters?: ImapSmtpCaldavConnectionParametersGenqlSelection
-    lastSignedInAt?: boolean | number
-    userWorkspaceId?: boolean | number
-    connectionProviderId?: boolean | number
-    applicationId?: boolean | number
-    name?: boolean | number
-    visibility?: boolean | number
-    createdAt?: boolean | number
-    updatedAt?: boolean | number
-    __typename?: boolean | number
-    __scalar?: boolean | number
-}
-
-export interface PublicConnectionParametersOutputGenqlSelection{
-    host?: boolean | number
-    port?: boolean | number
-    username?: boolean | number
-    secure?: boolean | number
-    __typename?: boolean | number
-    __scalar?: boolean | number
-}
-
-export interface PublicImapSmtpCaldavConnectionParametersGenqlSelection{
-    IMAP?: PublicConnectionParametersOutputGenqlSelection
-    SMTP?: PublicConnectionParametersOutputGenqlSelection
-    CALDAV?: PublicConnectionParametersOutputGenqlSelection
-    __typename?: boolean | number
-    __scalar?: boolean | number
-}
-
-export interface ConnectedAccountPublicDTOGenqlSelection{
-    id?: boolean | number
-    handle?: boolean | number
-    provider?: boolean | number
-    lastCredentialsRefreshedAt?: boolean | number
-    authFailedAt?: boolean | number
-    handleAliases?: boolean | number
-    scopes?: boolean | number
-    lastSignedInAt?: boolean | number
-    userWorkspaceId?: boolean | number
-    connectionProviderId?: boolean | number
-    applicationId?: boolean | number
-    name?: boolean | number
-    visibility?: boolean | number
-    createdAt?: boolean | number
-    updatedAt?: boolean | number
-    connectionParameters?: PublicImapSmtpCaldavConnectionParametersGenqlSelection
-    __typename?: boolean | number
-    __scalar?: boolean | number
-}
-
 export interface SendEmailOutputGenqlSelection{
    success?: boolean | number
    error?: boolean | number
@@ -5614,6 +5559,9 @@ export interface WebhookGenqlSelection{
 export interface QueryGenqlSelection{
    navigationMenuItems?: NavigationMenuItemGenqlSelection
    navigationMenuItem?: (NavigationMenuItemGenqlSelection & { __args: {id: Scalars['UUID']} })
+    enterprisePortalSession?: { __args: {returnUrlPath?: (Scalars['String'] | null)} } | boolean | number
+    enterpriseCheckoutSession?: { __args: {billingInterval?: (Scalars['String'] | null)} } | boolean | number
+    enterpriseSubscriptionStatus?: EnterpriseSubscriptionStatusDTOGenqlSelection
    getViewFilterGroups?: (ViewFilterGroupGenqlSelection & { __args?: {viewId?: (Scalars['String'] | null)} })
    getViewFilterGroup?: (ViewFilterGroupGenqlSelection & { __args: {id: Scalars['String']} })
    getViewFilters?: (ViewFilterGenqlSelection & { __args?: {viewId?: (Scalars['String'] | null)} })
@@ -5628,12 +5576,9 @@ export interface QueryGenqlSelection{
    getViewFieldGroup?: (ViewFieldGroupGenqlSelection & { __args: {id: Scalars['String']} })
    apiKeys?: ApiKeyGenqlSelection
    apiKey?: (ApiKeyGenqlSelection & { __args: {input: GetApiKeyInput} })
-    enterprisePortalSession?: { __args: {returnUrlPath?: (Scalars['String'] | null)} } | boolean | number
-    enterpriseCheckoutSession?: { __args: {billingInterval?: (Scalars['String'] | null)} } | boolean | number
-    enterpriseSubscriptionStatus?: EnterpriseSubscriptionStatusDTOGenqlSelection
    billingPortalSession?: (BillingSessionGenqlSelection & { __args?: {returnUrlPath?: (Scalars['String'] | null)} })
    listPlans?: BillingPlanGenqlSelection
-    getMeteredProductsUsage?: BillingMeteredProductUsageGenqlSelection
+    getResourceCreditUsage?: BillingResourceCreditUsageGenqlSelection
    findWorkspaceInvitations?: WorkspaceInvitationGenqlSelection
    getApprovedAccessDomains?: ApprovedAccessDomainGenqlSelection
    getPageLayoutTabs?: (PageLayoutTabGenqlSelection & { __args: {pageLayoutId: Scalars['String']} })
@@ -5685,9 +5630,9 @@ export interface QueryGenqlSelection{
    getViewGroup?: (ViewGroupGenqlSelection & { __args: {id: Scalars['String']} })
    myMessageFolders?: (MessageFolderGenqlSelection & { __args?: {messageChannelId?: (Scalars['UUID'] | null)} })
    myMessageChannels?: (MessageChannelGenqlSelection & { __args?: {connectedAccountId?: (Scalars['UUID'] | null)} })
-    myConnectedAccounts?: ConnectedAccountDTOGenqlSelection
+    myConnectedAccounts?: ConnectedAccountPublicDTOGenqlSelection
    connectedAccountById?: (ConnectedAccountPublicDTOGenqlSelection & { __args: {id: Scalars['UUID']} })
-    connectedAccounts?: ConnectedAccountDTOGenqlSelection
+    connectedAccounts?: ConnectedAccountPublicDTOGenqlSelection
    myCalendarChannels?: (CalendarChannelGenqlSelection & { __args?: {connectedAccountId?: (Scalars['UUID'] | null)} })
    webhooks?: WebhookGenqlSelection
    webhook?: (WebhookGenqlSelection & { __args: {id: Scalars['UUID']} })
@@ -5726,7 +5671,6 @@ export interface QueryGenqlSelection{
    getAutoCompleteAddress?: (AutocompleteResultGenqlSelection & { __args: {address: Scalars['String'], token: Scalars['String'], country?: (Scalars['String'] | null), isFieldCity?: (Scalars['Boolean'] | null)} })
    getAddressDetails?: (PlaceDetailsResultGenqlSelection & { __args: {placeId: Scalars['String'], token: Scalars['String']} })
    getUsageAnalytics?: (UsageAnalyticsGenqlSelection & { __args?: {input?: (UsageAnalyticsInput | null)} })
-    getPostgresCredentials?: PostgresCredentialsGenqlSelection
    findManyPublicDomains?: PublicDomainGenqlSelection
    getEmailingDomains?: EmailingDomainGenqlSelection
    findManyMarketplaceApps?: MarketplaceAppGenqlSelection
@@ -5769,6 +5713,8 @@ export interface MutationGenqlSelection{
    deleteManyNavigationMenuItems?: (NavigationMenuItemGenqlSelection & { __args: {ids: Scalars['UUID'][]} })
    deleteNavigationMenuItem?: (NavigationMenuItemGenqlSelection & { __args: {id: Scalars['UUID']} })
    uploadEmailAttachmentFile?: (FileWithSignedUrlGenqlSelection & { __args: {file: Scalars['Upload']} })
+    refreshEnterpriseValidityToken?: boolean | number
+    setEnterpriseKey?: (EnterpriseLicenseInfoDTOGenqlSelection & { __args: {enterpriseKey: Scalars['String']} })
    uploadAiChatFile?: (FileWithSignedUrlGenqlSelection & { __args: {file: Scalars['Upload']} })
    uploadWorkflowFile?: (FileWithSignedUrlGenqlSelection & { __args: {file: Scalars['Upload']} })
    uploadWorkspaceLogo?: (FileWithSignedUrlGenqlSelection & { __args: {file: Scalars['Upload']} })
@@ -5809,8 +5755,6 @@ export interface MutationGenqlSelection{
    assignRoleToApiKey?: { __args: {apiKeyId: Scalars['UUID'], roleId: Scalars['UUID']} }
    createObjectEvent?: (AnalyticsGenqlSelection & { __args: {event: Scalars['String'], recordId: Scalars['UUID'], objectMetadataId: Scalars['UUID'], properties?: (Scalars['JSON'] | null)} })
    trackAnalytics?: (AnalyticsGenqlSelection & { __args: {type: AnalyticsType, name?: (Scalars['String'] | null), event?: (Scalars['String'] | null), properties?: (Scalars['JSON'] | null)} })
-    refreshEnterpriseValidityToken?: boolean | number
-    setEnterpriseKey?: (EnterpriseLicenseInfoDTOGenqlSelection & { __args: {enterpriseKey: Scalars['String']} })
    skipSyncEmailOnboardingStep?: OnboardingStepSuccessGenqlSelection
    skipBookOnboardingStep?: OnboardingStepSuccessGenqlSelection
    checkoutSession?: (BillingSessionGenqlSelection & { __args: {recurringInterval: SubscriptionInterval, plan: BillingPlanKey, requirePaymentMethod: Scalars['Boolean'], successUrlPath?: (Scalars['String'] | null)} })
@@ -5818,9 +5762,9 @@ export interface MutationGenqlSelection{
    switchBillingPlan?: BillingUpdateGenqlSelection
    cancelSwitchBillingPlan?: BillingUpdateGenqlSelection
    cancelSwitchBillingInterval?: BillingUpdateGenqlSelection
-    setMeteredSubscriptionPrice?: (BillingUpdateGenqlSelection & { __args: {priceId: Scalars['String']} })
+    setResourceCreditSubscriptionPrice?: (BillingUpdateGenqlSelection & { __args: {priceId: Scalars['String']} })
    endSubscriptionTrialPeriod?: BillingEndTrialPeriodGenqlSelection
-    cancelSwitchMeteredPrice?: BillingUpdateGenqlSelection
+    cancelSwitchResourceCreditPrice?: BillingUpdateGenqlSelection
    deleteWorkspaceInvitation?: { __args: {appTokenId: Scalars['String']} }
    resendWorkspaceInvitation?: (SendInvitationsGenqlSelection & { __args: {appTokenId: Scalars['String']} })
    sendInvitations?: (SendInvitationsGenqlSelection & { __args: {emails: Scalars['String'][], roleId?: (Scalars['UUID'] | null)} })
@@ -5862,7 +5806,7 @@ export interface MutationGenqlSelection{
    updateOneRole?: (RoleGenqlSelection & { __args: {updateRoleInput: UpdateRoleInput} })
    deleteOneRole?: { __args: {roleId: Scalars['UUID']} }
    upsertObjectPermissions?: (ObjectPermissionGenqlSelection & { __args: {upsertObjectPermissionsInput: UpsertObjectPermissionsInput} })
-    upsertPermissionFlags?: (PermissionFlagGenqlSelection & { __args: {upsertPermissionFlagsInput: UpsertPermissionFlagsInput} })
+    upsertPermissionFlags?: (RolePermissionFlagGenqlSelection & { __args: {upsertPermissionFlagsInput: UpsertPermissionFlagsInput} })
    upsertFieldPermissions?: (FieldPermissionGenqlSelection & { __args: {upsertFieldPermissionsInput: UpsertFieldPermissionsInput} })
    upsertRowLevelPermissionPredicates?: (UpsertRowLevelPermissionPredicatesResultGenqlSelection & { __args: {input: UpsertRowLevelPermissionPredicatesInput} })
    assignRoleToAgent?: { __args: {agentId: Scalars['UUID'], roleId: Scalars['UUID']} }
@@ -5881,13 +5825,13 @@ export interface MutationGenqlSelection{
    updateMessageChannel?: (MessageChannelGenqlSelection & { __args: {input: UpdateMessageChannelInput} })
    createEmailGroupChannel?: (CreateEmailGroupChannelOutputGenqlSelection & { __args: {input: CreateEmailGroupChannelInput} })
    deleteEmailGroupChannel?: (MessageChannelGenqlSelection & { __args: {id: Scalars['UUID']} })
-    deleteConnectedAccount?: (ConnectedAccountDTOGenqlSelection & { __args: {id: Scalars['UUID']} })
+    deleteConnectedAccount?: (ConnectedAccountPublicDTOGenqlSelection & { __args: {id: Scalars['UUID']} })
    updateCalendarChannel?: (CalendarChannelGenqlSelection & { __args: {input: UpdateCalendarChannelInput} })
    createWebhook?: (WebhookGenqlSelection & { __args: {input: CreateWebhookInput} })
    updateWebhook?: (WebhookGenqlSelection & { __args: {input: UpdateWebhookInput} })
    deleteWebhook?: (WebhookGenqlSelection & { __args: {id: Scalars['UUID']} })
    createChatThread?: AgentChatThreadGenqlSelection
-    sendChatMessage?: (SendChatMessageResultGenqlSelection & { __args: {threadId: Scalars['UUID'], text: Scalars['String'], messageId: Scalars['UUID'], browsingContext?: (Scalars['JSON'] | null), modelId?: (Scalars['String'] | null), fileIds?: (Scalars['UUID'][] | null)} })
+    sendChatMessage?: (SendChatMessageResultGenqlSelection & { __args: {threadId: Scalars['UUID'], text: Scalars['String'], messageId: Scalars['UUID'], browsingContext?: (Scalars['JSON'] | null), modelId?: (Scalars['String'] | null), fileAttachments?: (FileAttachmentInput[] | null)} })
    stopAgentChatStream?: { __args: {threadId: Scalars['UUID']} }
    renameChatThread?: (AgentChatThreadGenqlSelection & { __args: {id: Scalars['UUID'], title: Scalars['String']} })
    archiveChatThread?: (AgentChatThreadGenqlSelection & { __args: {id: Scalars['UUID']} })
@@ -5950,10 +5894,8 @@ export interface MutationGenqlSelection{
    impersonate?: (ImpersonateGenqlSelection & { __args: {userId: Scalars['UUID'], workspaceId: Scalars['UUID']} })
    sendEmail?: (SendEmailOutputGenqlSelection & { __args: {input: SendEmailInput} })
    startChannelSync?: (ChannelSyncSuccessGenqlSelection & { __args: {connectedAccountId: Scalars['UUID']} })
-    saveImapSmtpCaldavAccount?: (ImapSmtpCaldavConnectionSuccessGenqlSelection & { __args: {accountOwnerId: Scalars['UUID'], handle: Scalars['String'], connectionParameters: EmailAccountConnectionParameters, id?: (Scalars['UUID'] | null)} })
+    saveImapSmtpCaldavAccount?: (ImapSmtpCaldavConnectionSuccessGenqlSelection & { __args: {handle: Scalars['String'], connectionParameters: EmailAccountConnectionParameters, id?: (Scalars['UUID'] | null)} })
    updateLabPublicFeatureFlag?: (FeatureFlagGenqlSelection & { __args: {input: UpdateLabPublicFeatureFlagInput} })
-    enablePostgresProxy?: PostgresCredentialsGenqlSelection
-    disablePostgresProxy?: PostgresCredentialsGenqlSelection
    createPublicDomain?: (PublicDomainGenqlSelection & { __args: {domain: Scalars['String'], applicationId?: (Scalars['String'] | null)} })
    updatePublicDomain?: (PublicDomainGenqlSelection & { __args: {domain: Scalars['String'], applicationId?: (Scalars['String'] | null)} })
    deletePublicDomain?: { __args: {domain: Scalars['String']} }
@@ -5992,7 +5934,7 @@ export interface CreateViewFilterGroupInput {id?: (Scalars['UUID'] | null),paren

 export interface UpdateViewFilterGroupInput {id?: (Scalars['UUID'] | null),parentViewFilterGroupId?: (Scalars['UUID'] | null),logicalOperator?: (ViewFilterGroupLogicalOperator | null),positionInViewFilterGroup?: (Scalars['Float'] | null),viewId?: (Scalars['UUID'] | null)}

-export interface CreateViewFilterInput {id?: (Scalars['UUID'] | null),fieldMetadataId: Scalars['UUID'],operand?: (ViewFilterOperand | null),value: Scalars['JSON'],viewFilterGroupId?: (Scalars['UUID'] | null),positionInViewFilterGroup?: (Scalars['Float'] | null),subFieldName?: (Scalars['String'] | null),viewId: Scalars['UUID']}
+export interface CreateViewFilterInput {id?: (Scalars['UUID'] | null),fieldMetadataId: Scalars['UUID'],operand?: (ViewFilterOperand | null),value: Scalars['JSON'],viewFilterGroupId?: (Scalars['UUID'] | null),positionInViewFilterGroup?: (Scalars['Float'] | null),subFieldName?: (Scalars['String'] | null),relationTargetFieldMetadataId?: (Scalars['UUID'] | null),viewId: Scalars['UUID']}

 export interface UpdateViewFilterInput {
 /** The id of the view filter to update */
@@ -6000,7 +5942,7 @@ id: Scalars['UUID'],
 /** The view filter to update */
 update: UpdateViewFilterInputUpdates}

-export interface UpdateViewFilterInputUpdates {fieldMetadataId?: (Scalars['UUID'] | null),operand?: (ViewFilterOperand | null),value?: (Scalars['JSON'] | null),viewFilterGroupId?: (Scalars['UUID'] | null),positionInViewFilterGroup?: (Scalars['Float'] | null),subFieldName?: (Scalars['String'] | null)}
+export interface UpdateViewFilterInputUpdates {fieldMetadataId?: (Scalars['UUID'] | null),operand?: (ViewFilterOperand | null),value?: (Scalars['JSON'] | null),viewFilterGroupId?: (Scalars['UUID'] | null),positionInViewFilterGroup?: (Scalars['Float'] | null),subFieldName?: (Scalars['String'] | null),relationTargetFieldMetadataId?: (Scalars['UUID'] | null)}

 export interface DeleteViewFilterInput {
 /** The id of the view filter to delete. */
@@ -6032,13 +5974,13 @@ viewFieldId?: (Scalars['UUID'] | null),
 /** The field metadata id. Used to create a new view field when viewFieldId is not provided. */
 fieldMetadataId?: (Scalars['UUID'] | null),isVisible: Scalars['Boolean'],position: Scalars['Float'],size?: (Scalars['Float'] | null)}

-export interface UpsertViewWidgetViewFilterInput {id?: (Scalars['UUID'] | null),fieldMetadataId: Scalars['UUID'],operand?: (ViewFilterOperand | null),value: Scalars['JSON'],viewFilterGroupId?: (Scalars['UUID'] | null),positionInViewFilterGroup?: (Scalars['Float'] | null),subFieldName?: (Scalars['String'] | null)}
+export interface UpsertViewWidgetViewFilterInput {id?: (Scalars['UUID'] | null),fieldMetadataId: Scalars['UUID'],operand?: (ViewFilterOperand | null),value: Scalars['JSON'],viewFilterGroupId?: (Scalars['UUID'] | null),positionInViewFilterGroup?: (Scalars['Float'] | null),subFieldName?: (Scalars['String'] | null),relationTargetFieldMetadataId?: (Scalars['UUID'] | null)}

 export interface UpsertViewWidgetViewFilterGroupInput {id?: (Scalars['UUID'] | null),parentViewFilterGroupId?: (Scalars['UUID'] | null),logicalOperator?: (ViewFilterGroupLogicalOperator | null),positionInViewFilterGroup?: (Scalars['Float'] | null)}

 export interface UpsertViewWidgetViewSortInput {id?: (Scalars['UUID'] | null),fieldMetadataId: Scalars['UUID'],direction?: (ViewSortDirection | null)}

-export interface CreateViewSortInput {id?: (Scalars['UUID'] | null),fieldMetadataId: Scalars['UUID'],direction?: (ViewSortDirection | null),viewId: Scalars['UUID']}
+export interface CreateViewSortInput {id?: (Scalars['UUID'] | null),fieldMetadataId: Scalars['UUID'],direction?: (ViewSortDirection | null),subFieldName?: (Scalars['String'] | null),viewId: Scalars['UUID']}

 export interface UpdateViewSortInput {
 /** The id of the view sort to update */
@@ -6046,7 +5988,7 @@ id: Scalars['UUID'],
 /** The view sort to update */
 update: UpdateViewSortInputUpdates}

-export interface UpdateViewSortInputUpdates {direction?: (ViewSortDirection | null)}
+export interface UpdateViewSortInputUpdates {direction?: (ViewSortDirection | null),subFieldName?: (Scalars['String'] | null)}

 export interface DeleteViewSortInput {
 /** The id of the view sort to delete. */
@@ -6276,6 +6218,8 @@ update: UpdateWebhookInputUpdates}

 export interface UpdateWebhookInputUpdates {targetUrl?: (Scalars['String'] | null),operations?: (Scalars['String'][] | null),description?: (Scalars['String'] | null),secret?: (Scalars['String'] | null)}

+export interface FileAttachmentInput {id: Scalars['UUID'],filename: Scalars['String']}
+
 export interface CreateSkillInput {id?: (Scalars['UUID'] | null),name: Scalars['String'],label: Scalars['String'],icon?: (Scalars['String'] | null),description?: (Scalars['String'] | null),content: Scalars['String']}

 export interface UpdateSkillInput {id: Scalars['UUID'],name?: (Scalars['String'] | null),label?: (Scalars['String'] | null),icon?: (Scalars['String'] | null),description?: (Scalars['String'] | null),content?: (Scalars['String'] | null),isActive?: (Scalars['Boolean'] | null)}
@@ -6316,9 +6260,9 @@ export interface SendEmailInput {connectedAccountId: Scalars['String'],to: Scala

 export interface SendEmailAttachmentInput {id: Scalars['String'],name: Scalars['String']}

-export interface EmailAccountConnectionParameters {IMAP?: (ConnectionParameters | null),SMTP?: (ConnectionParameters | null),CALDAV?: (ConnectionParameters | null)}
+export interface EmailAccountConnectionParameters {IMAP?: (ConnectionParametersInput | null),SMTP?: (ConnectionParametersInput | null),CALDAV?: (ConnectionParametersInput | null)}

-export interface ConnectionParameters {host: Scalars['String'],port: Scalars['Float'],username?: (Scalars['String'] | null),password: Scalars['String'],secure?: (Scalars['Boolean'] | null)}
+export interface ConnectionParametersInput {host: Scalars['String'],port: Scalars['Float'],username?: (Scalars['String'] | null),password?: (Scalars['String'] | null),secure?: (Scalars['Boolean'] | null)}

 export interface UpdateLabPublicFeatureFlagInput {publicFeatureFlag: Scalars['String'],value: Scalars['Boolean']}

@@ -6443,10 +6387,10 @@ export interface LogicFunctionLogsInput {applicationId?: (Scalars['UUID'] | null
    


-    const PermissionFlag_possibleTypes: string[] = ['PermissionFlag']
-    export const isPermissionFlag = (obj?: { __typename?: any } | null): obj is PermissionFlag => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isPermissionFlag"')
-      return PermissionFlag_possibleTypes.includes(obj.__typename)
+    const RolePermissionFlag_possibleTypes: string[] = ['RolePermissionFlag']
+    export const isRolePermissionFlag = (obj?: { __typename?: any } | null): obj is RolePermissionFlag => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isRolePermissionFlag"')
+      return RolePermissionFlag_possibleTypes.includes(obj.__typename)
    }
    

@@ -6971,6 +6915,22 @@ export interface LogicFunctionLogsInput {applicationId?: (Scalars['UUID'] | null
    


+    const EnterpriseLicenseInfoDTO_possibleTypes: string[] = ['EnterpriseLicenseInfoDTO']
+    export const isEnterpriseLicenseInfoDTO = (obj?: { __typename?: any } | null): obj is EnterpriseLicenseInfoDTO => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isEnterpriseLicenseInfoDTO"')
+      return EnterpriseLicenseInfoDTO_possibleTypes.includes(obj.__typename)
+    }
+    
+
+
+    const EnterpriseSubscriptionStatusDTO_possibleTypes: string[] = ['EnterpriseSubscriptionStatusDTO']
+    export const isEnterpriseSubscriptionStatusDTO = (obj?: { __typename?: any } | null): obj is EnterpriseSubscriptionStatusDTO => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isEnterpriseSubscriptionStatusDTO"')
+      return EnterpriseSubscriptionStatusDTO_possibleTypes.includes(obj.__typename)
+    }
+    
+
+
    const Analytics_possibleTypes: string[] = ['Analytics']
    export const isAnalytics = (obj?: { __typename?: any } | null): obj is Analytics => {
      if (!obj?.__typename) throw new Error('__typename is missing in "isAnalytics"')
@@ -6995,22 +6955,6 @@ export interface LogicFunctionLogsInput {applicationId?: (Scalars['UUID'] | null
    


-    const EnterpriseLicenseInfoDTO_possibleTypes: string[] = ['EnterpriseLicenseInfoDTO']
-    export const isEnterpriseLicenseInfoDTO = (obj?: { __typename?: any } | null): obj is EnterpriseLicenseInfoDTO => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isEnterpriseLicenseInfoDTO"')
-      return EnterpriseLicenseInfoDTO_possibleTypes.includes(obj.__typename)
-    }
-    
-
-
-    const EnterpriseSubscriptionStatusDTO_possibleTypes: string[] = ['EnterpriseSubscriptionStatusDTO']
-    export const isEnterpriseSubscriptionStatusDTO = (obj?: { __typename?: any } | null): obj is EnterpriseSubscriptionStatusDTO => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isEnterpriseSubscriptionStatusDTO"')
-      return EnterpriseSubscriptionStatusDTO_possibleTypes.includes(obj.__typename)
-    }
-    
-
-
    const BillingSubscriptionSchedulePhaseItem_possibleTypes: string[] = ['BillingSubscriptionSchedulePhaseItem']
    export const isBillingSubscriptionSchedulePhaseItem = (obj?: { __typename?: any } | null): obj is BillingSubscriptionSchedulePhaseItem => {
      if (!obj?.__typename) throw new Error('__typename is missing in "isBillingSubscriptionSchedulePhaseItem"')
@@ -7107,10 +7051,10 @@ export interface LogicFunctionLogsInput {applicationId?: (Scalars['UUID'] | null
    


-    const BillingMeteredProductUsage_possibleTypes: string[] = ['BillingMeteredProductUsage']
-    export const isBillingMeteredProductUsage = (obj?: { __typename?: any } | null): obj is BillingMeteredProductUsage => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isBillingMeteredProductUsage"')
-      return BillingMeteredProductUsage_possibleTypes.includes(obj.__typename)
+    const BillingResourceCreditUsage_possibleTypes: string[] = ['BillingResourceCreditUsage']
+    export const isBillingResourceCreditUsage = (obj?: { __typename?: any } | null): obj is BillingResourceCreditUsage => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isBillingResourceCreditUsage"')
+      return BillingResourceCreditUsage_possibleTypes.includes(obj.__typename)
    }
    

@@ -7939,18 +7883,42 @@ export interface LogicFunctionLogsInput {applicationId?: (Scalars['UUID'] | null
    


-    const ConnectionParametersOutput_possibleTypes: string[] = ['ConnectionParametersOutput']
-    export const isConnectionParametersOutput = (obj?: { __typename?: any } | null): obj is ConnectionParametersOutput => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isConnectionParametersOutput"')
-      return ConnectionParametersOutput_possibleTypes.includes(obj.__typename)
+    const PublicConnectionParametersOutput_possibleTypes: string[] = ['PublicConnectionParametersOutput']
+    export const isPublicConnectionParametersOutput = (obj?: { __typename?: any } | null): obj is PublicConnectionParametersOutput => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isPublicConnectionParametersOutput"')
+      return PublicConnectionParametersOutput_possibleTypes.includes(obj.__typename)
    }
    


-    const ImapSmtpCaldavConnectionParameters_possibleTypes: string[] = ['ImapSmtpCaldavConnectionParameters']
-    export const isImapSmtpCaldavConnectionParameters = (obj?: { __typename?: any } | null): obj is ImapSmtpCaldavConnectionParameters => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isImapSmtpCaldavConnectionParameters"')
-      return ImapSmtpCaldavConnectionParameters_possibleTypes.includes(obj.__typename)
+    const PublicImapSmtpCaldavConnectionParameters_possibleTypes: string[] = ['PublicImapSmtpCaldavConnectionParameters']
+    export const isPublicImapSmtpCaldavConnectionParameters = (obj?: { __typename?: any } | null): obj is PublicImapSmtpCaldavConnectionParameters => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isPublicImapSmtpCaldavConnectionParameters"')
+      return PublicImapSmtpCaldavConnectionParameters_possibleTypes.includes(obj.__typename)
+    }
+    
+
+
+    const ConnectedAccountPublicDTO_possibleTypes: string[] = ['ConnectedAccountPublicDTO']
+    export const isConnectedAccountPublicDTO = (obj?: { __typename?: any } | null): obj is ConnectedAccountPublicDTO => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isConnectedAccountPublicDTO"')
+      return ConnectedAccountPublicDTO_possibleTypes.includes(obj.__typename)
+    }
+    
+
+
+    const ImapSmtpCaldavPublicConnectionParams_possibleTypes: string[] = ['ImapSmtpCaldavPublicConnectionParams']
+    export const isImapSmtpCaldavPublicConnectionParams = (obj?: { __typename?: any } | null): obj is ImapSmtpCaldavPublicConnectionParams => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isImapSmtpCaldavPublicConnectionParams"')
+      return ImapSmtpCaldavPublicConnectionParams_possibleTypes.includes(obj.__typename)
+    }
+    
+
+
+    const ImapSmtpCaldavPublicConnectionParameters_possibleTypes: string[] = ['ImapSmtpCaldavPublicConnectionParameters']
+    export const isImapSmtpCaldavPublicConnectionParameters = (obj?: { __typename?: any } | null): obj is ImapSmtpCaldavPublicConnectionParameters => {
+      if (!obj?.__typename) throw new Error('__typename is missing in "isImapSmtpCaldavPublicConnectionParameters"')
+      return ImapSmtpCaldavPublicConnectionParameters_possibleTypes.includes(obj.__typename)
    }
    

@@ -7971,14 +7939,6 @@ export interface LogicFunctionLogsInput {applicationId?: (Scalars['UUID'] | null
    


-    const PostgresCredentials_possibleTypes: string[] = ['PostgresCredentials']
-    export const isPostgresCredentials = (obj?: { __typename?: any } | null): obj is PostgresCredentials => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isPostgresCredentials"')
-      return PostgresCredentials_possibleTypes.includes(obj.__typename)
-    }
-    
-
-
    const ToolIndexEntry_possibleTypes: string[] = ['ToolIndexEntry']
    export const isToolIndexEntry = (obj?: { __typename?: any } | null): obj is ToolIndexEntry => {
      if (!obj?.__typename) throw new Error('__typename is missing in "isToolIndexEntry"')
@@ -8067,38 +8027,6 @@ export interface LogicFunctionLogsInput {applicationId?: (Scalars['UUID'] | null
    


-    const ConnectedAccountDTO_possibleTypes: string[] = ['ConnectedAccountDTO']
-    export const isConnectedAccountDTO = (obj?: { __typename?: any } | null): obj is ConnectedAccountDTO => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isConnectedAccountDTO"')
-      return ConnectedAccountDTO_possibleTypes.includes(obj.__typename)
-    }
-    
-
-
-    const PublicConnectionParametersOutput_possibleTypes: string[] = ['PublicConnectionParametersOutput']
-    export const isPublicConnectionParametersOutput = (obj?: { __typename?: any } | null): obj is PublicConnectionParametersOutput => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isPublicConnectionParametersOutput"')
-      return PublicConnectionParametersOutput_possibleTypes.includes(obj.__typename)
-    }
-    
-
-
-    const PublicImapSmtpCaldavConnectionParameters_possibleTypes: string[] = ['PublicImapSmtpCaldavConnectionParameters']
-    export const isPublicImapSmtpCaldavConnectionParameters = (obj?: { __typename?: any } | null): obj is PublicImapSmtpCaldavConnectionParameters => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isPublicImapSmtpCaldavConnectionParameters"')
-      return PublicImapSmtpCaldavConnectionParameters_possibleTypes.includes(obj.__typename)
-    }
-    
-
-
-    const ConnectedAccountPublicDTO_possibleTypes: string[] = ['ConnectedAccountPublicDTO']
-    export const isConnectedAccountPublicDTO = (obj?: { __typename?: any } | null): obj is ConnectedAccountPublicDTO => {
-      if (!obj?.__typename) throw new Error('__typename is missing in "isConnectedAccountPublicDTO"')
-      return ConnectedAccountPublicDTO_possibleTypes.includes(obj.__typename)
-    }
-    
-
-
    const SendEmailOutput_possibleTypes: string[] = ['SendEmailOutput']
    export const isSendEmailOutput = (obj?: { __typename?: any } | null): obj is SendEmailOutput => {
      if (!obj?.__typename) throw new Error('__typename is missing in "isSendEmailOutput"')
@@ -8705,8 +8633,7 @@ export const enumBillingUsageType = {

 export const enumBillingProductKey = {
   BASE_PRODUCT: 'BASE_PRODUCT' as const,
-   RESOURCE_CREDIT: 'RESOURCE_CREDIT' as const,
-   WORKFLOW_NODE_EXECUTION: 'WORKFLOW_NODE_EXECUTION' as const
+   RESOURCE_CREDIT: 'RESOURCE_CREDIT' as const
 }

 export const enumSubscriptionInterval = {
@@ -8759,13 +8686,11 @@ export const enumFeatureFlagKey = {
   IS_UNIQUE_INDEXES_ENABLED: 'IS_UNIQUE_INDEXES_ENABLED' as const,
   IS_JSON_FILTER_ENABLED: 'IS_JSON_FILTER_ENABLED' as const,
   IS_MARKETPLACE_SETTING_TAB_VISIBLE: 'IS_MARKETPLACE_SETTING_TAB_VISIBLE' as const,
-   IS_RECORD_PAGE_LAYOUT_EDITING_ENABLED: 'IS_RECORD_PAGE_LAYOUT_EDITING_ENABLED' as const,
   IS_PUBLIC_DOMAIN_ENABLED: 'IS_PUBLIC_DOMAIN_ENABLED' as const,
   IS_EMAILING_DOMAIN_ENABLED: 'IS_EMAILING_DOMAIN_ENABLED' as const,
   IS_EMAIL_GROUP_ENABLED: 'IS_EMAIL_GROUP_ENABLED' as const,
   IS_JUNCTION_RELATIONS_ENABLED: 'IS_JUNCTION_RELATIONS_ENABLED' as const,
-   IS_RECORD_PAGE_LAYOUT_GLOBAL_EDITION_ENABLED: 'IS_RECORD_PAGE_LAYOUT_GLOBAL_EDITION_ENABLED' as const,
-   IS_BILLING_V2_ENABLED: 'IS_BILLING_V2_ENABLED' as const
+   IS_REST_METADATA_API_NEW_FORMAT_DIRECT: 'IS_REST_METADATA_API_NEW_FORMAT_DIRECT' as const
 }

 export const enumIdentityProviderType = {
@@ -8927,6 +8852,7 @@ export const enumAllMetadataName = {
   pageLayoutTab: 'pageLayoutTab' as const,
   commandMenuItem: 'commandMenuItem' as const,
   navigationMenuItem: 'navigationMenuItem' as const,
+   rolePermissionFlag: 'rolePermissionFlag' as const,
   permissionFlag: 'permissionFlag' as const,
   objectPermission: 'objectPermission' as const,
   fieldPermission: 'fieldPermission' as const,
@@ -9,7 +9,9 @@ TAG=latest
 SERVER_URL=http://localhost:3000

 # Use openssl rand -base64 32 for each secret
-# APP_SECRET=replace_me_with_a_random_string
+# ENCRYPTION_KEY=replace_me_with_a_random_string
+# FALLBACK_ENCRYPTION_KEY= # set to the previous ENCRYPTION_KEY during a rotation
+# APP_SECRET= # legacy: only required for instances that pre-date ENCRYPTION_KEY

 STORAGE_TYPE=local

@@ -20,7 +20,9 @@ services:
      STORAGE_S3_NAME: ${STORAGE_S3_NAME}
      STORAGE_S3_ENDPOINT: ${STORAGE_S3_ENDPOINT}

-      APP_SECRET: ${APP_SECRET:-replace_me_with_a_random_string}
+      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
+      FALLBACK_ENCRYPTION_KEY: ${FALLBACK_ENCRYPTION_KEY}
+      APP_SECRET: ${APP_SECRET:-}
      # MESSAGING_PROVIDER_GMAIL_ENABLED: ${MESSAGING_PROVIDER_GMAIL_ENABLED}
      # CALENDAR_PROVIDER_GOOGLE_ENABLED: ${CALENDAR_PROVIDER_GOOGLE_ENABLED}
      # AUTH_GOOGLE_CLIENT_ID: ${AUTH_GOOGLE_CLIENT_ID}
@@ -73,7 +75,9 @@ services:
      STORAGE_S3_NAME: ${STORAGE_S3_NAME}
      STORAGE_S3_ENDPOINT: ${STORAGE_S3_ENDPOINT}

-      APP_SECRET: ${APP_SECRET:-replace_me_with_a_random_string}
+      ENCRYPTION_KEY: ${ENCRYPTION_KEY}
+      FALLBACK_ENCRYPTION_KEY: ${FALLBACK_ENCRYPTION_KEY}
+      APP_SECRET: ${APP_SECRET:-}
      # MESSAGING_PROVIDER_GMAIL_ENABLED: ${MESSAGING_PROVIDER_GMAIL_ENABLED}
      # CALENDAR_PROVIDER_GOOGLE_ENABLED: ${CALENDAR_PROVIDER_GOOGLE_ENABLED}
      # AUTH_GOOGLE_CLIENT_ID: ${AUTH_GOOGLE_CLIENT_ID}
@@ -91,7 +91,7 @@ fi

 # Generate random strings for secrets
 echo "# === Randomly generated secret ===" >> .env
-echo "APP_SECRET=$(openssl rand -base64 32)" >> .env
+echo "ENCRYPTION_KEY=$(openssl rand -base64 32)" >> .env

 echo "" >> .env
 echo "PG_DATABASE_PASSWORD=$(openssl rand -hex 32)" >> .env
@@ -1,4 +1,4 @@
-FROM node:24-alpine AS twenty-website-new-build
+FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-website-new-build


 WORKDIR /app
@@ -20,7 +20,7 @@ COPY ./packages/twenty-shared /app/packages/twenty-shared
 COPY ./packages/twenty-website-new /app/packages/twenty-website-new
 RUN npx nx build twenty-website-new

-FROM node:24-alpine AS twenty-website-new
+FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-website-new

 WORKDIR /app/packages/twenty-website-new

@@ -2,7 +2,7 @@
 # Dependency stages
 # ===========================================================================

-FROM node:24-alpine AS front-deps
+FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS front-deps

 WORKDIR /app

@@ -20,7 +20,7 @@ COPY ./packages/twenty-client-sdk/package.json /app/packages/twenty-client-sdk/
 RUN yarn workspaces focus twenty twenty-front twenty-front-component-renderer twenty-ui twenty-shared twenty-sdk twenty-client-sdk && yarn cache clean && npx nx reset


-FROM node:24-alpine AS server-deps
+FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS server-deps

 WORKDIR /app

@@ -84,7 +84,7 @@ RUN if [ -d /app/packages/twenty-front/build ]; then \
 #   docker build --target twenty-server -f packages/twenty-docker/twenty/Dockerfile .
 # ===========================================================================

-FROM node:24-alpine AS twenty-server
+FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-server

 RUN apk add --no-cache curl jq postgresql-client

@@ -187,7 +187,7 @@ RUN S6_ARCH=$(cat /tmp/s6arch) && \
    echo "$NOARCH_SUM  s6-overlay-noarch.tar.xz" | sha256sum -c - && \
    echo "$ARCH_SUM  s6-overlay-arch.tar.xz" | sha256sum -c -

-FROM node:24-alpine AS twenty-app-dev
+FROM node:24.15.0-alpine3.23@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f AS twenty-app-dev

 # s6-overlay
 COPY --from=s6-fetch /tmp/s6-overlay-noarch.tar.xz /tmp/
@@ -197,7 +197,7 @@ RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz \
 && rm /tmp/s6-overlay-*.tar.xz

 RUN apk add --no-cache \
-    postgresql16 postgresql16-contrib \
+    postgresql18 postgresql18-contrib \
    redis \
    curl jq su-exec

@@ -72,11 +72,11 @@ Your content here...
 - `package.json` - Package dependencies and scripts (`docs:generate`, `docs:generate-navigation-template`, …).
 - `project.json` - Nx workspace configuration

-## 📦 Building
+## 📦 Validation

 ```bash
-# Build the documentation
-npx nx run twenty-docs:build
+# Validate the documentation build
+npx nx run twenty-docs:validate
 ```

 ## 🔗 Links
@@ -97,4 +97,3 @@ To contribute to the documentation:
 ## 📄 License

 This documentation is part of the Twenty project and is licensed under [AGPL-3.0](../../LICENSE).
-
@@ -31,7 +31,7 @@ export default defineApplication({

 Notes:
 - `universalIdentifier` fields are deterministic IDs you own. Generate them once and keep them stable across syncs.
- `applicationVariables` become environment variables for your functions and front components (e.g., `DEFAULT_RECIPIENT_NAME` is available as `process.env.DEFAULT_RECIPIENT_NAME`).
+- `applicationVariables` become environment variables for your functions and front components. In logic functions (server-side), they are available as `process.env.VARIABLE_NAME`. In front components, use `getApplicationVariable('VARIABLE_NAME')` from `twenty-sdk/front-component`. Variables marked with `isSecret: true` are only injected into logic functions. Front components receive only non-secret variables.
 - The default role is detected automatically from the role file marked with [`defineApplicationRole()`](/developers/extend/apps/config/roles) — you do not need to reference it from `defineApplication()`.
 - Pre-install and post-install functions are detected automatically during the manifest build — you do not need to reference them in `defineApplication()`.
 - Passing `defaultRoleUniversalIdentifier` explicitly is still supported for backward compatibility, but is deprecated in favor of `defineApplicationRole()`.
@@ -22,7 +22,8 @@ Use the `getPublicAssetUrl` helper from `twenty-sdk` to get the full URL of a fi
 **In a logic function:**

 ```ts src/logic-functions/send-invoice.ts
-import { defineLogicFunction, getPublicAssetUrl } from 'twenty-sdk/define';
+import { defineLogicFunction } from 'twenty-sdk/define';
+import { getPublicAssetUrl } from 'twenty-sdk/utils';

 const handler = async (): Promise<any> => {
  const logoUrl = getPublicAssetUrl('logo.png');
@@ -47,12 +48,19 @@ export default defineLogicFunction({
 **In a front component:**

 ```tsx src/front-components/company-card.tsx
-import { defineFrontComponent, getPublicAssetUrl } from 'twenty-sdk/define';
+import { defineFrontComponent } from 'twenty-sdk/define';
+import { getPublicAssetUrl } from 'twenty-sdk/utils';

-export default defineFrontComponent(() => {
+const CompanyCard = () => {
  const logoUrl = getPublicAssetUrl('logo.png');

  return <img src={logoUrl} alt="App logo" />;
+};
+
+export default defineFrontComponent({
+  universalIdentifier: '...',
+  name: 'company-card',
+  component: CompanyCard,
 });
 ```

@@ -1,7 +1,7 @@
 ---
 title: Roles & Permissions
 description: Declare what objects and fields your app's logic functions and front components can read and write.
-icon: "shield-halved"
+icon: 'shield-halved'
 ---

 A **role** is a permission set: which objects an app can read or write, which fields it can see, and which platform-level capabilities it can use. Every app's logic functions and front components inherit the permissions of the role marked with `defineApplicationRole()` (see [The default function role](#the-default-function-role) below).
@@ -40,7 +40,8 @@ export default defineRole({
      objectUniversalIdentifier:
        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
      fieldUniversalIdentifier:
-        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.fields.name.universalIdentifier,
+        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.fields.name
+          .universalIdentifier,
      canReadFieldValue: false,
      canUpdateFieldValue: false,
    },
@@ -80,6 +81,7 @@ export default defineApplicationRole({
 `defineApplicationRole()` is a thin wrapper around `defineRole()` that flags **the** role used as your application's default at install time. Validation is identical to `defineRole`, but the build pipeline auto-wires its `universalIdentifier` into the application manifest's `defaultRoleUniversalIdentifier` — so you do not need to reference it from [`defineApplication`](/developers/extend/apps/config/application) yourself.

 Notes:
+
 - Exactly **one** `defineApplicationRole(...)` is allowed per app — the manifest build will fail if it finds more than one.
 - Use `defineRole()` (not `defineApplicationRole()`) for any **additional** roles your app ships.
 - Setting `defaultRoleUniversalIdentifier` explicitly on `defineApplication()` is still supported for backward compatibility, but is deprecated in favor of `defineApplicationRole()`.
@@ -87,7 +87,7 @@ cd my-twenty-app
 yarn twenty dev
 ```

-This watches `src/`, rebuilds on every change, and syncs the result to the server. Edit a file, save, and within a second the server reflects the change. You'll see a live status panel in your terminal.
+This watches `src/`, rebuilds on every change, and syncs the result to the server. Edit a file, save, and within a few seconds the server reflects the change. You'll see a live status panel in your terminal.

 For more detailed output (build logs, sync requests, error traces), add `--verbose`.

@@ -128,25 +128,15 @@ yarn twenty dev --once
 | `yarn twenty dev` | Watches and re-syncs on every change. Runs until you stop it. | Interactive local development. |
 | `yarn twenty dev --once` | Single build + sync, exits `0` on success, `1` on failure. | CI, pre-commit hooks, AI agents, scripted workflows. |

-Both modes need a server in development mode and an authenticated remote.
+Both modes need an authenticated remote.

-<Warning>
-Dev mode is only available on Twenty instances running in development (`NODE_ENV=development`). Production instances reject dev sync requests — use `yarn twenty deploy` to deploy to production servers. See [Publishing](/developers/extend/apps/operations/publishing).
-</Warning>
+### Dev mode options

---
-
-## Starting from an example
-
-Use `--example` to start with a more complete project (custom objects, fields, logic functions, front components):
-
-```bash filename="Terminal"
-npx create-twenty-app@latest my-twenty-app --example postcard
-```
-
-Examples live in [twenty-apps/examples](https://github.com/twentyhq/twenty/tree/main/packages/twenty-apps/examples). You can also scaffold individual entities into an existing project with `yarn twenty add` — see [Scaffolding](/developers/extend/apps/getting-started/scaffolding).
-
---
+| Flag | Description |
+|------|-------------|
+| `--once` | Build and sync once, then exit. |
+| `--debounceMs <ms>` | Set the file-change debounce delay in milliseconds (default: `2000`). |
+| `--verbose` / `--debug` | Show detailed build logs, sync requests, and error traces. |

 ## What you can build

@@ -239,6 +239,38 @@ Available hooks:
 | `useFrontComponentId()` | `string` | This component instance's ID |
 | `useFrontComponentExecutionContext(selector)` | varies | Access the full execution context with a selector function |

+## Application variables
+
+Application variables defined in [`defineApplication()`](/developers/extend/apps/config/application) with `isSecret: false` are available inside front components via the `getApplicationVariable` utility:
+
+```tsx src/front-components/greeting.tsx
+import { defineFrontComponent } from 'twenty-sdk/define';
+import { getApplicationVariable } from 'twenty-sdk/front-component';
+
+const Greeting = () => {
+  const recipientName = getApplicationVariable('DEFAULT_RECIPIENT_NAME') ?? 'World';
+
+  return <p>Hello, {recipientName}!</p>;
+};
+
+export default defineFrontComponent({
+  universalIdentifier: '...',
+  name: 'greeting',
+  component: Greeting,
+});
+```
+
+<Warning>
+Secret variables (`isSecret: true`) are **not** exposed to front components. They are only available in [logic functions](/developers/extend/apps/logic/logic-functions), which run server-side. This prevents sensitive values like API keys from being sent to the browser.
+</Warning>
+
+The following system variables are always available via `process.env`:
+
+| Variable | Description |
+|----------|-------------|
+| `TWENTY_API_URL` | Base URL of the Twenty API |
+| `TWENTY_APP_ACCESS_TOKEN` | Short-lived token scoped to your app's role |
+
 ## Host communication API

 Front components can trigger navigation, modals, and notifications using functions from `twenty-sdk`:
@@ -358,7 +390,8 @@ export default defineFrontComponent({
 Front components can access files from the app's `public/` directory using `getPublicAssetUrl`:

 ```tsx
-import { defineFrontComponent, getPublicAssetUrl } from 'twenty-sdk/define';
+import { defineFrontComponent } from 'twenty-sdk/define';
+import { getPublicAssetUrl } from 'twenty-sdk/utils';

 const Logo = () => <img src={getPublicAssetUrl('logo.png')} alt="Logo" />;

@@ -47,22 +47,25 @@ Follow these steps for a manual setup.
    curl -o .env https://raw.githubusercontent.com/twentyhq/twenty/refs/heads/main/packages/twenty-docker/.env.example
    ```

-2. **Generate Secret Tokens**
+2. **Generate an Encryption Key**

    Run the following command to generate a unique random string:
+
    ```bash
    openssl rand -base64 32
    ```
-    **Important:** Keep this value secret / do not share it.
+    **Important:** Keep this value secret / do not share it. Losing `ENCRYPTION_KEY` means losing access to every secret stored in the database (OAuth tokens, application variables, TOTP secrets, etc.).

 3. **Update the `.env`**

    Replace the placeholder value in your .env file with the generated token:

    ```ini
-    APP_SECRET=first_random_string
+    ENCRYPTION_KEY=random_string
    ```

+    See the [Key rotation guide](/developers/self-host/capabilities/key-rotation) for instructions on rotating it without downtime.
+
 4. **Set the Postgres Password**

    Update the `PG_DATABASE_PASSWORD` value in the .env file with a strong password without special characters.
@@ -0,0 +1,57 @@
+---
+title: Key rotation
+icon: "rotate"
+---
+
+Twenty has two independent key families:
+
+- **JWT signing keys** — asymmetric ES256 keypairs (`kid`-tagged) stored in `core."signingKey"`, used to sign and verify access / refresh tokens.
+- **At-rest encryption key** — `ENCRYPTION_KEY`, used to encrypt OAuth tokens, application variables, signing-key private keys, sensitive config values and TOTP secrets inside an `enc:v2:` envelope.
+
+`APP_SECRET` is a legacy secret kept for backward compatibility: when `ENCRYPTION_KEY` is unset it acts as the at-rest encryption / session cookie fallback, and it still verifies pre-existing HS256 access tokens. It will be deprecated.
+
+## JWT signing keys
+
+Each key carries a `publicKey` (kept indefinitely so it can verify previously issued tokens), an encrypted `privateKey` (used only while the key is current), an `isCurrent` flag (exactly one row at a time) and an optional `revokedAt`.
+
+### Rotate the current key
+
+- **Manual** — **Settings → Admin Panel → Signing keys → Revoke** on the current row. Revoking wipes its encrypted private material and demotes it; the next sign call automatically mints a fresh ES256 keypair as the new current. Tokens signed under any other (non-revoked) `kid` keep verifying until they expire.
+- **Enterprise (automatic)** — a daily cron (`'15 3 * * *'` UTC) issues a new current key once the existing one has been current for `SIGNING_KEY_ROTATION_DAYS` (default `90`). The previous key is *not* revoked, so tokens signed under it keep verifying. Register it once with `yarn command:prod cron:register:all`.
+
+  <Note>The Enterprise cron and `SIGNING_KEY_ROTATION_DAYS` ship in v2.6+.</Note>
+
+### Revoke a key (leak / emergency only)
+
+**Settings → Admin Panel → Signing keys → Revoke** on a non-current row. Wipes the encrypted private material, sets `revokedAt`, and rejects every existing token signed under that `kid`.
+
+## Rotate `ENCRYPTION_KEY`
+
+<Note>The `secret-encryption:rotate` command described below ships in v2.6+.</Note>
+
+Every encrypted value is wrapped as `enc:v2:<keyId>:<payload>`, where `<keyId>` is an 8-hex prefix derived from the raw key. Rotation is online and resumable.
+
+1. **Generate a new key**: `openssl rand -base64 32`.
+2. **Configure both keys side-by-side** in `.env`, then restart:
+   ```ini
+   ENCRYPTION_KEY=NEW_VALUE
+   FALLBACK_ENCRYPTION_KEY=OLD_VALUE
+   ```
+   New writes use the new key, existing rows still decrypt via the fallback.
+3. **Re-encrypt existing rows**:
+   ```bash
+   docker exec -it {server_container} yarn command:prod secret-encryption:rotate
+   ```
+   The command walks six sites (`connected-account-tokens`, `application-variable`, `application-registration-variable`, `signing-key-private-keys`, `sensitive-config-storage`, `totp-secrets`). A SQL filter skips rows already on the new `<keyId>`, so the command is idempotent: interrupt and re-run as needed. Exits non-zero if any row fails — re-run to retry.
+
+   | Flag | Description |
+   | --- | --- |
+   | `-s, --site <site>` | Limit to a single site. |
+   | `-b, --batch-size <n>` | Rows per batch (default `200`, max `5000`). |
+   | `-d, --dry-run` | Decrypt + re-encrypt in memory, skip the `UPDATE`. |
+
+4. **Drop the fallback** once `--dry-run` shows zero remaining rows: remove `FALLBACK_ENCRYPTION_KEY` and restart.
+
+## Legacy `APP_SECRET` support
+
+Older instances that never set `ENCRYPTION_KEY` use `APP_SECRET` as the at-rest encryption key (and as the session-cookie secret, derived from it). This path is preserved for backward compatibility but is **deprecated** — set a dedicated `ENCRYPTION_KEY` and follow the rotation procedure above to migrate off it. `APP_SECRET` itself stays in use to verify legacy HS256 access tokens.
@@ -42,11 +42,26 @@ IS_CONFIG_VARIABLES_IN_DB_ENABLED=true  # default

 <Warning>
 Each variable is documented with descriptions in your admin panel at **Settings → Admin Panel → Configuration Variables**.
-Some infrastructure settings like database connections (`PG_DATABASE_URL`), server URLs (`SERVER_URL`), and app secrets (`APP_SECRET`) can only be configured via `.env` file.
+Some infrastructure settings like database connections (`PG_DATABASE_URL`), server URLs (`SERVER_URL`), and secrets (`ENCRYPTION_KEY`, `FALLBACK_ENCRYPTION_KEY`) can only be configured via `.env` file.

 [Complete technical reference →](https://github.com/twentyhq/twenty/blob/main/packages/twenty-server/src/engine/core-modules/twenty-config/config-variables.ts)
 </Warning>

+## Encryption keys
+
+Twenty uses two env-only encryption keys:
+
+| Variable | Purpose | Required |
+| --- | --- | --- |
+| `ENCRYPTION_KEY` | Primary key used to encrypt secrets at rest (OAuth tokens, application variables, signing-key private keys, TOTP secrets, sensitive config values). | Yes for new installs (legacy installs may instead rely on `APP_SECRET` — see below) |
+| `FALLBACK_ENCRYPTION_KEY` | Verification-only key. Set during a rotation to the *previous* `ENCRYPTION_KEY` so existing rows remain decryptable. | Only during rotation |
+
+For backward compatibility, if `ENCRYPTION_KEY` is unset, Twenty falls back to `APP_SECRET` for at-rest encryption — matching the legacy behaviour for older deployments. New installs should always set a dedicated `ENCRYPTION_KEY`.
+
+Generate values with `openssl rand -base64 32` and store them somewhere safe (a secrets manager, sealed config, etc.). Losing `ENCRYPTION_KEY` means losing access to every secret stored in the database.
+
+To rotate `ENCRYPTION_KEY` without downtime, see the [Key rotation guide](/developers/self-host/capabilities/key-rotation).
+
 ## 2. Environment-Only Configuration

 ```bash
@@ -31,6 +31,18 @@ Starting from **v1.22**, Twenty supports cross-version upgrades. You can jump di

 For example, upgrading from v1.22 straight to v2.0 is fully supported.

+## Upgrading to v2.5+ — at-rest encryption envelope
+
+Starting in **v2.5**, Twenty stores at-rest secrets (OAuth tokens, application variables, signing-key private keys, sensitive config values, TOTP secrets) inside a versioned `enc:v2:` envelope encrypted with `ENCRYPTION_KEY` (or `APP_SECRET` if `ENCRYPTION_KEY` is unset).
+
+The first boot on v2.5 runs slow upgrade commands that **backfill** existing rows into the new envelope. They are idempotent — interrupting and restarting the server resumes from where it left off — but they can take a while on large databases. You can monitor progress with `upgrade:status`.
+
+You should set a dedicated `ENCRYPTION_KEY` **before** the v2.5 upgrade so the backfill writes rows under it from the start. Switching keys after the backfill requires a [rotation](/developers/self-host/capabilities/key-rotation).
+
+## Rotating secrets and signing keys
+
+For day-to-day operational tasks like rotating `ENCRYPTION_KEY`, rotating the JWT signing key, or revoking a leaked signing key, see the dedicated [Key rotation guide](/developers/self-host/capabilities/key-rotation).
+
 ## Checking upgrade status

 The `upgrade:status` command lets you inspect the current state of your instance and workspace migrations. It is useful for debugging upgrade issues or when filing a support request.
@@ -32,7 +32,7 @@ export default defineApplication({
 Notizen:

 * `universalIdentifier`-Felder sind deterministische IDs, die Ihnen gehören. Erzeugen Sie sie einmal und halten Sie sie über Synchronisierungen hinweg stabil.
-* `applicationVariables` werden zu Umgebungsvariablen für Ihre Funktionen und Frontend-Komponenten (z. B. ist `DEFAULT_RECIPIENT_NAME` als `process.env.DEFAULT_RECIPIENT_NAME` verfügbar).
+* `applicationVariables` werden zu Umgebungsvariablen für Ihre Funktionen und Frontend-Komponenten. In Logikfunktionen (serverseitig) sind sie als `process.env.VARIABLE_NAME` verfügbar. In Frontend-Komponenten verwenden Sie `getApplicationVariable('VARIABLE_NAME')` aus `twenty-sdk/front-component`. Variablen, die mit `isSecret: true` gekennzeichnet sind, werden nur in Logikfunktionen injiziert. Frontend-Komponenten erhalten nur nicht-geheime Variablen.
 * Die Standardrolle wird automatisch aus der Rollen-Datei erkannt, die mit [`defineApplicationRole()`](/l/de/developers/extend/apps/config/roles) markiert ist – Sie müssen sie nicht aus `defineApplication()` referenzieren.
 * Pre- und Post-Installationsfunktionen werden während des Manifest-Builds automatisch erkannt — Sie müssen sie in `defineApplication()` nicht referenzieren.
 * Die explizite Übergabe von `defaultRoleUniversalIdentifier` wird für die Abwärtskompatibilität weiterhin unterstützt, ist jedoch zugunsten von `defineApplicationRole()` veraltet.
@@ -40,7 +40,8 @@ export default defineRole({
      objectUniversalIdentifier:
        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
      fieldUniversalIdentifier:
-        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.fields.name.universalIdentifier,
+        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.fields.name
+          .universalIdentifier,
      canReadFieldValue: false,
      canUpdateFieldValue: false,
    },
@@ -87,7 +87,7 @@ cd my-twenty-app
 yarn twenty dev
 ```

-Dies überwacht `src/`, baut bei jeder Änderung neu und synchronisiert das Ergebnis mit dem Server. Bearbeiten Sie eine Datei, speichern Sie, und innerhalb einer Sekunde spiegelt der Server die Änderung wider. Sie sehen eine Live-Statusanzeige in Ihrem Terminal.
+Dies überwacht `src/`, baut bei jeder Änderung neu und synchronisiert das Ergebnis mit dem Server. Bearbeiten Sie eine Datei, speichern Sie, und innerhalb weniger Sekunden spiegelt der Server die Änderung wider. Sie sehen eine Live-Statusanzeige in Ihrem Terminal.

 Für ausführlichere Ausgaben (Build-Protokolle, Sync-Anfragen, Fehlerspuren) fügen Sie `--verbose` hinzu.

@@ -128,11 +128,15 @@ yarn twenty dev --once
 | `yarn twenty dev`        | Überwacht und synchronisiert bei jeder Änderung erneut. Läuft, bis Sie es stoppen. | Interaktive lokale Entwicklung.                               |
 | `yarn twenty dev --once` | Einmaliger Build + Sync, beendet sich mit `0` bei Erfolg, mit `1` bei Fehler.      | CI, Pre-Commit-Hooks, KI-Agenten, skriptgesteuerte Workflows. |

-Beide Modi benötigen einen Server im Entwicklungsmodus und eine authentifizierte Remote-Verbindung.
+Beide Modi benötigen ein authentifiziertes Remote-Repository.

-<Warning>
-Der Dev-Modus ist nur auf Twenty-Instanzen verfügbar, die im Entwicklungsmodus laufen (`NODE_ENV=development`). Produktionsinstanzen lehnen Dev-Sync-Anfragen ab — verwenden Sie `yarn twenty deploy`, um auf Produktionsserver bereitzustellen. Siehe [Apps veröffentlichen](/l/de/developers/extend/apps/operations/publishing).
-</Warning>
+### Dev-Modus-Optionen
+
+| Flag                                  | Beschreibung                                                                        |
+| ------------------------------------- | ----------------------------------------------------------------------------------- |
+| `--once`                              | Einmal erstellen und synchronisieren, dann beenden.                                 |
+| `--debounceMs \<ms>` | Legt die Entprellzeit für Dateiänderungen in Millisekunden fest (Standard: `2000`). |
+| `--verbose` / `--debug`               | Zeigt ausführliche Build-Protokolle, Sync-Anfragen und Fehler-Traces an.            |

 ---

@@ -239,6 +239,38 @@ Verfügbare Hooks:
 | `useFrontComponentId()`                       | `string`             | Die ID dieser Komponenteninstanz                                            |
 | `useFrontComponentExecutionContext(selector)` | variiert             | Zugriff auf den vollständigen Ausführungskontext mit einer Selektorfunktion |

+## Anwendungsvariablen
+
+In [`defineApplication()`](/l/de/developers/extend/apps/config/application) mit `isSecret: false` definierte Anwendungsvariablen sind in Front-Komponenten über das Hilfsprogramm `getApplicationVariable` verfügbar:
+
+```tsx src/front-components/greeting.tsx
+import { defineFrontComponent } from 'twenty-sdk/define';
+import { getApplicationVariable } from 'twenty-sdk/front-component';
+
+const Greeting = () => {
+  const recipientName = getApplicationVariable('DEFAULT_RECIPIENT_NAME') ?? 'World';
+
+  return <p>Hello, {recipientName}!</p>;
+};
+
+export default defineFrontComponent({
+  universalIdentifier: '...',
+  name: 'greeting',
+  component: Greeting,
+});
+```
+
+<Warning>
+Geheime Variablen (`isSecret: true`) werden **nicht** in Front-Komponenten offengelegt. Sie sind nur in [Logikfunktionen](/l/de/developers/extend/apps/logic/logic-functions) verfügbar, die serverseitig ausgeführt werden. Dadurch wird verhindert, dass sensible Werte wie API-Schlüssel an den Browser gesendet werden.
+</Warning>
+
+Die folgenden Systemvariablen sind immer über `process.env` verfügbar:
+
+| Variable                  | Beschreibung                                                  |
+| ------------------------- | ------------------------------------------------------------- |
+| `TWENTY_API_URL`          | Basis-URL der Twenty API                                      |
+| `TWENTY_APP_ACCESS_TOKEN` | Kurzlebiges Token mit dem Geltungsbereich der Rolle Ihrer App |
+
 ## Host-Kommunikations-API

 Front-Komponenten können Navigation, Modals und Benachrichtigungen mittels Funktionen aus `twenty-sdk` auslösen:
@@ -51,7 +51,7 @@ Befolgen Sie diese Schritte für eine manuelle Einrichtung.
   curl -o .env https://raw.githubusercontent.com/twentyhq/twenty/refs/heads/main/packages/twenty-docker/.env.example
   ```

-2. **Erstellen Sie geheime Tokens**
+2. **Einen Verschlüsselungsschlüssel generieren**

   Führen Sie den folgenden Befehl aus, um eine eindeutige Zufallszeichenfolge zu generieren:

@@ -59,16 +59,18 @@ Befolgen Sie diese Schritte für eine manuelle Einrichtung.
   openssl rand -base64 32
   ```

-   **Wichtig:** Bewahren Sie diesen Wert geheim auf / teilen Sie ihn nicht.
+   **Wichtig:** Bewahren Sie diesen Wert geheim auf / teilen Sie ihn nicht. Der Verlust von `ENCRYPTION_KEY` bedeutet den Verlust des Zugriffs auf alle in der Datenbank gespeicherten Secrets (OAuth-Tokens, Anwendungsvariablen, TOTP-Secrets usw.).

 3. **Aktualisieren Sie die `.env`**

   Ersetzen Sie den Platzhalterwert in Ihrer .env-Datei durch das generierte Token:

   ```ini
-   APP_SECRET=erster_zufälliger_string
+   ENCRYPTION_KEY=random_string
   ```

+   Weitere Informationen findest du im [Leitfaden zur Schlüsselrotation](/l/de/developers/self-host/capabilities/key-rotation) mit Anweisungen zur Rotation ohne Ausfallzeit.
+
 4. **Setzen Sie das Postgres-Passwort**

   Aktualisieren Sie den Wert `PG_DATABASE_PASSWORD` in der .env-Datei mit einem starken Passwort ohne Sonderzeichen.
@@ -0,0 +1,61 @@
+---
+title: Schlüsselrotation
+icon: rotate
+---
+
+Twenty hat zwei unabhängige Schlüsselfamilien:
+
+* **JWT-Signaturschlüssel** — asymmetrische ES256-Schlüsselpaare (`kid`-markiert), die in `core."signingKey"` gespeichert sind und zum Signieren und Verifizieren von Access-/Refresh-Tokens verwendet werden.
+* **Verschlüsselungsschlüssel im Ruhezustand** — `ENCRYPTION_KEY`, wird verwendet, um OAuth-Tokens, Anwendungsvariablen, die privaten Schlüssel der Signierschlüssel, sensible Konfigurationswerte und TOTP-Geheimnisse innerhalb eines `enc:v2:`-Umschlags zu verschlüsseln.
+
+`APP_SECRET` ist ein veraltetes Secret, das aus Gründen der Abwärtskompatibilität beibehalten wird: Wenn `ENCRYPTION_KEY` nicht gesetzt ist, fungiert es als Fallback für At-Rest-Verschlüsselung / Session-Cookie und verifiziert weiterhin bereits bestehende HS256-Access-Tokens. Es wird als veraltet markiert werden.
+
+## JWT-Signierschlüssel
+
+Jeder Schlüssel enthält einen `publicKey` (unbefristet aufbewahrt, damit er zuvor ausgestellte Tokens verifizieren kann), einen verschlüsselten `privateKey` (nur verwendet, solange der Schlüssel aktuell ist), ein `isCurrent`-Flag (zu jedem Zeitpunkt genau eine Zeile) und ein optionales `revokedAt`.
+
+### Aktuellen Schlüssel rotieren
+
+* **Manuell** — **Settings → Admin Panel → Signing keys → Revoke** in der aktuellen Zeile. Das Widerrufen löscht das verschlüsselte private Material und stuft es herab; der nächste Signieraufruf erstellt automatisch ein neues ES256-Schlüsselpaar als neuen aktuellen Schlüssel. Tokens, die unter einem anderen (nicht widerrufenen) `kid` signiert wurden, werden weiterhin verifiziert, bis sie ablaufen.
+* **Enterprise (automatisch)** — ein täglicher Cron-Job (`'15 3 * * *'` UTC) erstellt einen neuen aktuellen Schlüssel, sobald der vorhandene Schlüssel seit `SIGNING_KEY_ROTATION_DAYS` (Standard `90`) aktuell ist. Der vorherige Schlüssel wird *nicht* widerrufen, daher werden Tokens, die darunter signiert wurden, weiterhin verifiziert. Registriere ihn einmalig mit `yarn command:prod cron:register:all`.
+
+  <Note>Der Enterprise-Cron-Job und `SIGNING_KEY_ROTATION_DAYS` sind ab v2.6+ enthalten.</Note>
+
+### Einen Schlüssel widerrufen (nur bei Leak / Notfall)
+
+**Settings → Admin Panel → Signing keys → Revoke** in einer nicht aktuellen Zeile. Löscht das verschlüsselte private Material, setzt `revokedAt` und weist jedes vorhandene Token zurück, das unter diesem `kid` signiert wurde.
+
+## `ENCRYPTION_KEY` rotieren
+
+<Note>Der unten beschriebene Befehl `secret-encryption:rotate` ist ab v2.6+ enthalten.</Note>
+
+Jeder verschlüsselte Wert wird als `enc:v2:\<keyId>:\<payload>` verpackt, wobei `\<keyId>` ein 8-stelliges Hex-Präfix ist, das aus dem Rohschlüssel abgeleitet wird. Die Rotation erfolgt online und ist fortsetzbar.
+
+1. **Einen neuen Schlüssel generieren**: `openssl rand -base64 32`.
+
+2. **Beide Schlüssel nebeneinander konfigurieren** in `.env` und dann neu starten:
+   ```ini
+   ENCRYPTION_KEY=NEW_VALUE
+   FALLBACK_ENCRYPTION_KEY=OLD_VALUE
+   ```
+   Neue Schreibvorgänge verwenden den neuen Schlüssel, vorhandene Zeilen werden weiterhin über den Fallback entschlüsselt.
+
+3. **Vorhandene Zeilen erneut verschlüsseln**:
+
+   ```bash
+   docker exec -it {server_container} yarn command:prod secret-encryption:rotate
+   ```
+
+   Der Befehl durchläuft sechs Sites (`connected-account-tokens`, `application-variable`, `application-registration-variable`, `signing-key-private-keys`, `sensitive-config-storage`, `totp-secrets`). Ein SQL-Filter überspringt Zeilen, die bereits auf dem neuen `\<keyId>` sind, sodass der Befehl idempotent ist: Unterbrechen und bei Bedarf erneut ausführen. Beendet sich mit einem von Null verschiedenen Exit-Code, wenn irgendeine Zeile fehlschlägt — zum Wiederholen erneut ausführen.
+
+   | Flag                                     | Beschreibung                                                                 |
+   | ---------------------------------------- | ---------------------------------------------------------------------------- |
+   | `-s, --site \<site>`    | Auf eine einzelne Site beschränken.                                          |
+   | `-b, --batch-size \<n>` | Zeilen pro Batch (Standard `200`, Maximum `5000`).                           |
+   | `-d, --dry-run`                          | Entschlüsseln + erneut im Speicher verschlüsseln, das `UPDATE` überspringen. |
+
+4. **Den Fallback entfernen**, sobald `--dry-run` null verbleibende Zeilen anzeigt: `FALLBACK_ENCRYPTION_KEY` entfernen und neu starten.
+
+## Legacy-Unterstützung für `APP_SECRET`
+
+Ältere Instanzen, die niemals `ENCRYPTION_KEY` gesetzt haben, verwenden `APP_SECRET` als At-Rest-Verschlüsselungsschlüssel (und als Session-Cookie-Secret, das daraus abgeleitet wird). Dieser Pfad wird aus Gründen der Abwärtskompatibilität beibehalten, ist aber **veraltet** — setze einen dedizierten `ENCRYPTION_KEY` und folge dem oben beschriebenen Rotationsverfahren, um davon zu migrieren. `APP_SECRET` selbst bleibt in Verwendung, um Legacy-HS256-Access-Tokens zu verifizieren.
@@ -43,11 +43,26 @@ IS_CONFIG_VARIABLES_IN_DB_ENABLED=true  # Standard

 <Warning>
 Jede Variable ist mit Beschreibungen in Ihrem Admin-Panel dokumentiert unter **Einstellungen → Admin-Panel → Konfigurationsvariablen**.
-Einige Infrastruktureinstellungen wie Datenbankverbindungen (`PG_DATABASE_URL`), Server-URLs (`SERVER_URL`) und Anwendungsgeheimnisse (`APP_SECRET`) können nur über die `.env`-Datei konfiguriert werden.
+Einige Infrastruktureinstellungen wie Datenbankverbindungen (`PG_DATABASE_URL`), Server-URLs (`SERVER_URL`) und Secrets (`ENCRYPTION_KEY`, `FALLBACK_ENCRYPTION_KEY`) können nur über die `.env`-Datei konfiguriert werden.

 [Vollständige technische Referenz →](https://github.com/twentyhq/twenty/blob/main/packages/twenty-server/src/engine/core-modules/twenty-config/config-variables.ts)
 </Warning>

+## Verschlüsselungsschlüssel
+
+Twenty verwendet zwei ausschließlich über Umgebungsvariablen konfigurierbare Verschlüsselungsschlüssel:
+
+| Variable                  | Zweck                                                                                                                                                                                                               | Erforderlich                                                                                                         |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| `ENCRYPTION_KEY`          | Primärer Schlüssel, der für die Verschlüsselung von Secrets im Ruhezustand verwendet wird (OAuth-Tokens, Anwendungsvariablen, private Schlüssel von Signierschlüsseln, TOTP-Secrets, sensible Konfigurationswerte). | Ja, für neue Installationen (Legacy-Installationen können stattdessen auf `APP_SECRET` zurückgreifen – siehe unten). |
+| `FALLBACK_ENCRYPTION_KEY` | Nur zur Verifizierung verwendeter Schlüssel. Während einer Rotation auf den *vorherigen* `ENCRYPTION_KEY` gesetzt, damit vorhandene Zeilen weiterhin entschlüsselt werden können.                                   | Nur während der Rotation                                                                                             |
+
+Aus Gründen der Abwärtskompatibilität greift Twenty, falls `ENCRYPTION_KEY` nicht gesetzt ist, für die Verschlüsselung im Ruhezustand auf `APP_SECRET` zurück – entsprechend dem Legacy-Verhalten älterer Deployments. Neue Installationen sollten immer einen eigenen `ENCRYPTION_KEY` setzen.
+
+Werte mit `openssl rand -base64 32` generieren und sie an einem sicheren Ort aufbewahren (einen Secrets-Manager, eine versiegelte Konfiguration usw.). Der Verlust des `ENCRYPTION_KEY` bedeutet den Verlust des Zugriffs auf jedes in der Datenbank gespeicherte Secret.
+
+Um `ENCRYPTION_KEY` ohne Downtime zu rotieren, siehe die [Anleitung zur Schlüsselrotation](/l/de/developers/self-host/capabilities/key-rotation).
+
 ## 2. Nur-Umgebungs-Konfiguration

 ```bash
@@ -31,6 +31,18 @@ Ab **v1.22** unterstützt Twenty versionsübergreifende Upgrades. Sie können di

 Zum Beispiel wird ein Upgrade direkt von v1.22 auf v2.0 vollständig unterstützt.

+## Upgrade auf v2.5+ – Verschlüsselungsumschlag für ruhende Daten
+
+Ab **v2.5** speichert Twenty Secrets im Ruhezustand (OAuth-Tokens, Anwendungsvariablen, private Signaturschlüssel, sensible Konfigurationswerte, TOTP-Secrets) in einem versionierten Umschlag `enc:v2:`, der mit `ENCRYPTION_KEY` (oder `APP_SECRET`, falls `ENCRYPTION_KEY` nicht gesetzt ist) verschlüsselt wird.
+
+Beim ersten Start mit v2.5 werden langsame Upgrade-Befehle ausgeführt, die den neuen Umschlag mit bestehenden Zeilen befüllen. Sie sind idempotent – ein Unterbrechen und Neustarten des Servers setzt an der Stelle fort, an der er aufgehört hat –, aber sie können bei großen Datenbanken eine Weile dauern. Sie können den Fortschritt mit `upgrade:status` überwachen.
+
+Sie sollten **vor** dem Upgrade auf v2.5 einen dedizierten `ENCRYPTION_KEY` setzen, damit beim Nachbefüllen die Zeilen von Anfang an unter diesem Schlüssel geschrieben werden. Ein Schlüsselwechsel nach der Nachbefüllung erfordert eine [Rotation](/l/de/developers/self-host/capabilities/key-rotation).
+
+## Rotation von Secrets und Signaturschlüsseln
+
+Für alltägliche operative Aufgaben wie das Rotieren von `ENCRYPTION_KEY`, das Rotieren des JWT-Signaturschlüssels oder das Widerrufen eines kompromittierten Signaturschlüssels siehe den dedizierten [Leitfaden zur Schlüsselrotation](/l/de/developers/self-host/capabilities/key-rotation).
+
 ## Upgrade-Status prüfen

 Mit dem Befehl `upgrade:status` können Sie den aktuellen Status Ihrer Instanz und der Workspace-Migrationen prüfen. Er ist nützlich zum Debuggen von Upgrade-Problemen oder beim Erstellen einer Support-Anfrage.
@@ -32,7 +32,7 @@ export default defineApplication({
 Notas:

 * Os campos `universalIdentifier` são IDs determinísticos que você controla. Gere-os uma vez e mantenha-os estáveis entre sincronizações.
-* `applicationVariables` tornam-se variáveis de ambiente para suas funções e componentes de front-end (por exemplo, `DEFAULT_RECIPIENT_NAME` fica disponível como `process.env.DEFAULT_RECIPIENT_NAME`).
+* `applicationVariables` tornam-se variáveis de ambiente para suas funções e componentes de front-end. Em funções lógicas (no lado do servidor), elas ficam disponíveis como `process.env.VARIABLE_NAME`. Em componentes de front-end, use `getApplicationVariable('VARIABLE_NAME')` de `twenty-sdk/front-component`. Variáveis marcadas com `isSecret: true` são injetadas apenas em funções lógicas. Componentes de front-end recebem apenas variáveis não secretas.
 * O papel padrão é detectado automaticamente a partir do arquivo de definição de papel marcado com [`defineApplicationRole()`](/l/pt/developers/extend/apps/config/roles) — você não precisa referenciá-lo em `defineApplication()`.
 * As funções de pré-instalação e pós-instalação são detectadas automaticamente durante a construção do manifesto — você não precisa referenciá-las em `defineApplication()`.
 * Passar `defaultRoleUniversalIdentifier` explicitamente ainda é compatível para retrocompatibilidade, mas foi preterido em favor de `defineApplicationRole()`.
@@ -40,7 +40,8 @@ export default defineRole({
      objectUniversalIdentifier:
        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
      fieldUniversalIdentifier:
-        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.fields.name.universalIdentifier,
+        STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.fields.name
+          .universalIdentifier,
      canReadFieldValue: false,
      canUpdateFieldValue: false,
    },
@@ -87,7 +87,7 @@ cd my-twenty-app
 yarn twenty dev
 ```

-Isso monitora `src/`, recompila a cada alteração e sincroniza o resultado com o servidor. Edite um arquivo, salve e, em um segundo, o servidor refletirá a alteração. Você verá um painel de status em tempo real no seu terminal.
+Isso monitora `src/`, recompila a cada alteração e sincroniza o resultado com o servidor. Edite um arquivo, salve e, em alguns segundos, o servidor refletirá a alteração. Você verá um painel de status em tempo real no seu terminal.

 Para uma saída mais detalhada (logs de build, solicitações de sincronização, rastros de erro), adicione `--verbose`.

@@ -128,11 +128,15 @@ yarn twenty dev --once
 | `yarn twenty dev`        | Monitora e ressincroniza a cada alteração. Fica em execução até você interrompê-lo.                                              | Desenvolvimento local interativo.                                                |
 | `yarn twenty dev --once` | Executa uma única compilação + sincronização e, em seguida, encerra com o código `0` em caso de sucesso ou `1` em caso de falha. | Scripts, CI, hooks de pre-commit, agentes de IA e fluxos de trabalho com script. |

-Ambos os modos precisam de um servidor em modo de desenvolvimento e de um remoto autenticado.
+Ambos os modos precisam de um remoto autenticado.

-<Warning>
-O modo de desenvolvimento só está disponível em instâncias do Twenty em modo de desenvolvimento (`NODE_ENV=development`). Instâncias de produção rejeitam solicitações de sincronização de desenvolvimento — use `yarn twenty deploy` para implantar em servidores de produção. Veja [Publicação](/l/pt/developers/extend/apps/operations/publishing).
-</Warning>
+### Opções do modo de desenvolvimento
+
+| Opção                                 | Descrição                                                                                         |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------- |
+| `--once`                              | Compila e sincroniza uma vez e, em seguida, sai.                                                  |
+| `--debounceMs \<ms>` | Define o atraso de debounce para alterações de arquivo em milissegundos (padrão: `2000`).         |
+| `--verbose` / `--debug`               | Mostra registros detalhados de compilação, solicitações de sincronização e rastreamentos de erro. |

 ---

@@ -239,6 +239,38 @@ Hooks disponíveis:
 | `useFrontComponentId()`                       | `string`           | O ID desta instância do componente                                                  |
 | `useFrontComponentExecutionContext(selector)` | varia              | Acesse o contexto de execução completo com uma função seletora                      |

+## Variáveis de aplicação
+
+Variáveis de aplicação definidas em [`defineApplication()`](/l/pt/developers/extend/apps/config/application) com `isSecret: false` estão disponíveis nos componentes de front por meio do utilitário `getApplicationVariable`:
+
+```tsx src/front-components/greeting.tsx
+import { defineFrontComponent } from 'twenty-sdk/define';
+import { getApplicationVariable } from 'twenty-sdk/front-component';
+
+const Greeting = () => {
+  const recipientName = getApplicationVariable('DEFAULT_RECIPIENT_NAME') ?? 'World';
+
+  return <p>Hello, {recipientName}!</p>;
+};
+
+export default defineFrontComponent({
+  universalIdentifier: '...',
+  name: 'greeting',
+  component: Greeting,
+});
+```
+
+<Warning>
+Variáveis secretas (`isSecret: true`) **não** são expostas aos componentes de front. Elas estão disponíveis apenas em [funções de lógica](/l/pt/developers/extend/apps/logic/logic-functions), que são executadas no lado do servidor. Isso impede que valores sigilosos, como chaves de API, sejam enviados para o navegador.
+</Warning>
+
+As seguintes variáveis de sistema estão sempre disponíveis via `process.env`:
+
+| Variável                  | Descrição                                                     |
+| ------------------------- | ------------------------------------------------------------- |
+| `TWENTY_API_URL`          | URL base da API da Twenty                                     |
+| `TWENTY_APP_ACCESS_TOKEN` | Token de curta duração limitado ao escopo do papel do seu app |
+
 ## API de comunicação do host

 Componentes de front-end podem acionar navegação, modais e notificações usando funções de `twenty-sdk`:
@@ -51,7 +51,7 @@ Siga estas etapas para uma configuração manual.
   curl -o .env https://raw.githubusercontent.com/twentyhq/twenty/refs/heads/main/packages/twenty-docker/.env.example
   ```

-2. **Gere Tokens Secretos**
+2. **Gerar uma chave de criptografia**

   Execute o seguinte comando para gerar uma string aleatória única:

@@ -59,16 +59,18 @@ Siga estas etapas para uma configuração manual.
   openssl rand -base64 32
   ```

-   **Importante:** Mantenha este valor em segredo / não o compartilhe.
+   **Importante:** Mantenha este valor em segredo / não o compartilhe. Perder `ENCRYPTION_KEY` significa perder o acesso a todos os segredos armazenados no banco de dados (tokens OAuth, variáveis de aplicação, segredos TOTP, etc.).

 3. **Atualize o `.env`**

   Substitua o valor do espaço reservado no seu arquivo .env pelo token gerado:

   ```ini
-   APP_SECRET=first_random_string
+   ENCRYPTION_KEY=random_string
   ```

+   Consulte o [guia de rotação de chaves](/l/pt/developers/self-host/capabilities/key-rotation) para obter instruções sobre como fazer a rotação sem tempo de inatividade.
+
 4. **Defina a Senha do Postgres**

   Atualize o valor `PG_DATABASE_PASSWORD` no arquivo .env com uma senha forte sem caracteres especiais.
@@ -0,0 +1,61 @@
+---
+title: Rotação de chaves
+icon: rotate
+---
+
+Twenty possui duas famílias de chaves independentes:
+
+* **Chaves de assinatura JWT** — pares de chaves assimétricas ES256 (com `kid`) armazenados em `core."signingKey"`, usados para assinar e verificar tokens de acesso/atualização.
+* **Chave de criptografia em repouso** — `ENCRYPTION_KEY`, usada para criptografar tokens OAuth, variáveis de aplicação, chaves privadas de chaves de assinatura, valores confidenciais de configuração e segredos TOTP dentro de um envelope `enc:v2:`.
+
+`APP_SECRET` é um segredo legado mantido para compatibilidade retroativa: quando `ENCRYPTION_KEY` não está definido, ele funciona como fallback de criptografia em repouso / cookie de sessão e ainda verifica tokens de acesso HS256 já existentes. Ele será descontinuado.
+
+## Chaves de assinatura JWT
+
+Cada chave carrega uma `publicKey` (mantida indefinidamente para que possa verificar tokens emitidos anteriormente), uma `privateKey` criptografada (usada apenas enquanto a chave é atual), um sinalizador `isCurrent` (exatamente uma linha por vez) e um `revokedAt` opcional.
+
+### Rotacionar a chave atual
+
+* **Manual** — **Settings → Admin Panel → Signing keys → Revoke** na linha atual. A revogação apaga o material privado criptografado e o rebaixa; a próxima chamada de assinatura gera automaticamente um novo par de chaves ES256 como o novo atual. Tokens assinados sob qualquer outro `kid` (não revogado) continuam sendo verificados até expirarem.
+* **Enterprise (automático)** — um cron diário (`'15 3 * * *'` UTC) emite uma nova chave atual assim que a existente tiver sido atual por `SIGNING_KEY_ROTATION_DAYS` (padrão `90`). A chave anterior *não* é revogada, então tokens assinados sob ela continuam sendo verificados. Registre-o uma vez com `yarn command:prod cron:register:all`.
+
+  <Note>O cron do Enterprise e `SIGNING_KEY_ROTATION_DAYS` são disponibilizados a partir da v2.6+.</Note>
+
+### Revogar uma chave (apenas vazamento / emergência)
+
+**Settings → Admin Panel → Signing keys → Revoke** em uma linha que não seja a atual. Apaga o material privado criptografado, define `revokedAt` e rejeita todos os tokens existentes assinados sob aquele `kid`.
+
+## Rotacionar `ENCRYPTION_KEY`
+
+<Note>O comando `secret-encryption:rotate` descrito abaixo é disponibilizado a partir da v2.6+.</Note>
+
+Cada valor criptografado é encapsulado como `enc:v2:\<keyId>:\<payload>`, em que `\<keyId>` é um prefixo hexadecimal de 8 caracteres derivado da chave bruta. A rotação é online e retomável.
+
+1. **Gerar uma nova chave**: `openssl rand -base64 32`.
+
+2. **Configurar ambas as chaves lado a lado** em `.env`, depois reinicie:
+   ```ini
+   ENCRYPTION_KEY=NEW_VALUE
+   FALLBACK_ENCRYPTION_KEY=OLD_VALUE
+   ```
+   Novas gravações usam a nova chave; linhas existentes ainda são descriptografadas por meio do fallback.
+
+3. **Recriptografar linhas existentes**:
+
+   ```bash
+   docker exec -it {server_container} yarn command:prod secret-encryption:rotate
+   ```
+
+   O comando percorre seis sites (`connected-account-tokens`, `application-variable`, `application-registration-variable`, `signing-key-private-keys`, `sensitive-config-storage`, `totp-secrets`). Um filtro SQL ignora as linhas que já estão no novo `\<keyId>`, portanto o comando é idempotente: interrompa e execute novamente conforme necessário. Sai com código diferente de zero se alguma linha falhar — execute novamente para tentar de novo.
+
+   | Opção                                    | Descrição                                                      |
+   | ---------------------------------------- | -------------------------------------------------------------- |
+   | `-s, --site \<site>`    | Limitar a um único site.                                       |
+   | `-b, --batch-size \<n>` | Linhas por lote (padrão `200`, máximo `5000`).                 |
+   | `-d, --dry-run`                          | Descriptografar + recriptografar em memória, pular o `UPDATE`. |
+
+4. **Remova o fallback** assim que `--dry-run` mostrar zero linhas restantes: remova `FALLBACK_ENCRYPTION_KEY` e reinicie.
+
+## Suporte legado a `APP_SECRET`
+
+Instâncias antigas que nunca definiram `ENCRYPTION_KEY` usam `APP_SECRET` como chave de criptografia em repouso (e como segredo de cookie de sessão, derivado dela). Esse caminho é mantido para compatibilidade retroativa, mas está **descontinuado** — defina uma `ENCRYPTION_KEY` dedicada e siga o procedimento de rotação acima para migrar para fora dele. O próprio `APP_SECRET` continua em uso para verificar tokens de acesso HS256 legados.
@@ -43,11 +43,26 @@ IS_CONFIG_VARIABLES_IN_DB_ENABLED=true  # default

 <Warning>
 Cada variável é documentada com descrições no seu painel de administração em **Configurações → Painel de Administração → Variáveis de Configuração**.
-Algumas configurações de infraestrutura como conexões de banco de dados (`PG_DATABASE_URL`), URLs de servidor (`SERVER_URL`) e segredos do app (`APP_SECRET`) só podem ser configuradas via arquivo `.env`.
+Algumas configurações de infraestrutura como conexões de banco de dados (`PG_DATABASE_URL`), URLs de servidor (`SERVER_URL`) e segredos (`ENCRYPTION_KEY`, `FALLBACK_ENCRYPTION_KEY`) só podem ser configuradas via arquivo `.env`.

 [Referência técnica completa →](https://github.com/twentyhq/twenty/blob/main/packages/twenty-server/src/engine/core-modules/twenty-config/config-variables.ts)
 </Warning>

+## Chaves de criptografia
+
+A Twenty usa duas chaves de criptografia definidas apenas por variáveis de ambiente:
+
+| Variável                  | Finalidade                                                                                                                                                                           | Obrigatório                                                                                                  |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ |
+| `ENCRYPTION_KEY`          | Chave primária usada para criptografar segredos em repouso (tokens OAuth, variáveis do aplicativo, chaves privadas de assinatura, segredos TOTP, valores de configuração sensíveis). | Sim para novas instalações (instalações legadas podem, em vez disso, depender de `APP_SECRET` — veja abaixo) |
+| `FALLBACK_ENCRYPTION_KEY` | Chave somente para verificação. Definida durante uma rotação para a *chave `ENCRYPTION_KEY` anterior* para que as linhas existentes permaneçam descriptografáveis.                   | Apenas durante a rotação                                                                                     |
+
+Para compatibilidade retroativa, se `ENCRYPTION_KEY` não estiver definida, Twenty recorre a `APP_SECRET` para criptografia em repouso — correspondendo ao comportamento legado de implantações mais antigas. Novas instalações devem sempre definir uma `ENCRYPTION_KEY` dedicada.
+
+Gere valores com `openssl rand -base64 32` e armazene-os em um local seguro (um gerenciador de segredos, configuração selada, etc.). Perder a `ENCRYPTION_KEY` significa perder o acesso a todos os segredos armazenados no banco de dados.
+
+Para rotacionar a `ENCRYPTION_KEY` sem tempo de inatividade, consulte o [guia de rotação de chaves](/l/pt/developers/self-host/capabilities/key-rotation).
+
 ## 2. Configuração Somente por Ambiente

 ```bash
--- a/Show More
+++ b/Show More