fix: approximated not verifying domain, change request type for /agents

route

packages/utils/src/constants/agent.ts

@@ -0,0 +1,11 @@
+/**
+ * Custom request `Content-Type` for `/agent/*` write endpoints.
+ *
+ * Render fronts every service with Cloudflare, which runs OWASP Managed Rules
+ * on bodies whose content-type substring-matches `application/json` and rejects
+ * AI chat payloads that contain SQL-injection-shaped strings (e.g. user
+ * messages discussing `SELECT … WHERE … OR 1=1`). A vendor-specific type
+ * falls through inspection. A small server middleware rewrites it back to
+ * `application/json` so `zValidator` parses the body unchanged.
+ */
+export const AGENT_CONTENT_TYPE = 'application/x-cio-agent';

packages/utils/src/constants/index.ts

@@ -3,3 +3,4 @@ export * from './org';
 export * from './content';
 export * from './domains';
 export * from './error-codes';
+export * from './agent';