@wayai/cli 0.3.102 → 0.3.104

package/dist/index.js

@@ -441,11 +441,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path28) {
+function addApiBreadcrumb(method, path30) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path28}`,
+    message: `${method} ${path30}`,
     level: "info"
   });
 }
@@ -503,13 +503,13 @@ var init_api_client = __esm({
     init_sentry();
     init_mask_secrets();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
-    delay = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
+    delay = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
     ApiError = class extends Error {
       status;
       body;
-      constructor(method, path28, status, body) {
+      constructor(method, path30, status, body) {
         const safeBody = maskSecretsInMessage(body);
-        super(`API request failed: ${method} ${path28} (${status}): ${safeBody}`);
+        super(`API request failed: ${method} ${path30} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
@@ -657,8 +657,8 @@ var init_api_client = __esm({
           ...organizationId && { organization_id: organizationId }
         });
       }
-      async lookup(path28, opts) {
-        const params = new URLSearchParams({ path: path28 });
+      async lookup(path30, opts) {
+        const params = new URLSearchParams({ path: path30 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -1058,9 +1058,9 @@ var init_api_client = __esm({
        * sandbox for this conversation, or the blob was purged).
        */
       async downloadArchiveSandboxFs(hubId, conversationId) {
-        const path28 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
-        addApiBreadcrumb("GET", path28);
-        const url = `${this.apiUrl}${path28}`;
+        const path30 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
+        addApiBreadcrumb("GET", path30);
+        const url = `${this.apiUrl}${path30}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -1074,7 +1074,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path28, response.status, await response.text());
+          throw new ApiError("GET", path30, response.status, await response.text());
         }
         return new Uint8Array(await response.arrayBuffer());
       }
@@ -1114,9 +1114,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path28, body) {
-        addApiBreadcrumb(method, path28);
-        const url = `${this.apiUrl}${path28}`;
+      async request(method, path30, body) {
+        addApiBreadcrumb(method, path30);
+        const url = `${this.apiUrl}${path30}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body);
@@ -1140,7 +1140,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path28, response.status, errorBody);
+          throw new ApiError(method, path30, response.status, errorBody);
         }
       }
       /** Issue a single authenticated request with the client's current token. */
@@ -1575,8 +1575,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path28, errorMaps, issueData } = params;
-      const fullPath = [...path28, ...issueData.path || []];
+      const { data, path: path30, errorMaps, issueData } = params;
+      const fullPath = [...path30, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1887,11 +1887,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path28, key) {
+      constructor(parent, value, path30, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path28;
+        this._path = path30;
         this._key = key;
       }
       get path() {
@@ -5375,12 +5375,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path28, errors, opts = {}) {
+function validateSchema(schema, path30, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path28 || "<root>",
+      path: path30 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -5388,7 +5388,7 @@ function validateSchema(schema, path28, errors, opts = {}) {
   }
   if (!isRecord(schema)) {
     errors.push({
-      path: path28,
+      path: path30,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -5396,14 +5396,14 @@ function validateSchema(schema, path28, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path28 ? `${path28}.type` : "type",
+        path: path30 ? `${path30}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path28}.type`,
+      path: `${path30}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -5412,25 +5412,25 @@ function validateSchema(schema, path28, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       errors.push({
-        path: `${path28}.enum`,
+        path: `${path30}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path28}.enum`,
+        path: `${path30}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path28}.enum`,
+        path: `${path30}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path28}.enum[${i}]`,
+            path: `${path30}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -5440,7 +5440,7 @@ function validateSchema(schema, path28, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path28}.${key}`,
+        path: `${path30}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -5449,45 +5449,45 @@ function validateSchema(schema, path28, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord(schema.properties)) {
       errors.push({
-        path: `${path28}.properties`,
+        path: `${path30}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path28}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path30}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path28}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path30}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path28}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path30}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord(schema[key])) {
-      validateSchema(schema[key], `${path28}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path30}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path28}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path30}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path28}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path30}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path28}.${k}`;
+    const fieldPath = `${path30}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -5562,15 +5562,17 @@ function describeRole(role) {
   return `a ${typeof role}`;
 }
 function asEvalInputRecord(input) {
-  const value = typeof input === "string" ? (() => {
-    try {
-      return JSON.parse(input);
-    } catch {
-      return null;
-    }
-  })() : input;
+  const value = parseMaybeJson(input);
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+function parseMaybeJson(value) {
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
 function evalInputRoleError(input) {
   const record = asEvalInputRecord(input);
   if (record === null) return null;
@@ -5581,6 +5583,32 @@ function evalInputRoleError(input) {
   }
   return `role must be ${EVAL_INPUT_ROLE_LIST} (received ${describeRole(role)}) \u2014 an eval trigger is what the responder answers, and an assistant or tool role gives it nothing to answer`;
 }
+function evalTurnAttachmentsError(turn) {
+  const record = asEvalInputRecord(turn);
+  if (record === null) return null;
+  const attachments = record.attachments;
+  if (attachments === void 0 || attachments === null) return null;
+  if (!Array.isArray(attachments)) return "attachments must be an array";
+  if (attachments.length === 0) return null;
+  if (attachments.length > MAX_ATTACHMENTS_PER_MESSAGE) {
+    return `attachments must have at most ${MAX_ATTACHMENTS_PER_MESSAGE} items`;
+  }
+  if (!turnMayCarryAttachments({ role: String(record.role), attachments })) {
+    return ATTACHMENTS_USER_ONLY_MESSAGE;
+  }
+  for (let i = 0; i < attachments.length; i++) {
+    const parsed = evalAttachmentRef.safeParse(attachments[i]);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0];
+      return `attachments[${i}].${issue?.path.join(".") || "?"} is invalid: ${issue?.message ?? "malformed"}`;
+    }
+  }
+  return null;
+}
+function asEvalHistoryArray(history) {
+  const value = parseMaybeJson(history);
+  return Array.isArray(value) ? value : null;
+}
 function refineEvalMessageTextRole(value, ctx) {
   const error = evalInputRoleError(value.eval.message_text);
   if (error) {
@@ -5591,6 +5619,64 @@ function refineEvalMessageTextRole(value, ctx) {
     });
   }
 }
+function refineEvalAttachments(value, ctx) {
+  const triggerError = evalTurnAttachmentsError(value.eval.message_text);
+  if (triggerError) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["eval", "message_text", "attachments"],
+      message: triggerError
+    });
+  }
+  const history = asEvalHistoryArray(value.eval.message_history);
+  if (!history) return;
+  for (let i = 0; i < history.length; i++) {
+    const error = evalTurnAttachmentsError(history[i]);
+    if (error) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["eval", "message_history", i, "attachments"],
+        message: error
+      });
+    }
+  }
+}
+function collectTurnAttachmentHashes(turn) {
+  const atts = asEvalInputRecord(turn)?.attachments;
+  if (!Array.isArray(atts)) return [];
+  const hashes = [];
+  for (const a of atts) {
+    const parsed = evalAttachmentRef.safeParse(a);
+    if (parsed.success) hashes.push(parsed.data.hash);
+  }
+  return hashes;
+}
+function foldDiacritics(input) {
+  return input.normalize("NFKD").replace(/[̀-ͯ]/g, "");
+}
+function slugifyKebab(input, maxLength = 64) {
+  if (typeof input !== "string") return "";
+  return foldDiacritics(input).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").slice(0, maxLength).replace(/^-|-$/g, "");
+}
+function ensureUniqueSlug(slug, used) {
+  if (!used.has(slug)) {
+    used.add(slug);
+    return slug;
+  }
+  for (let i = 2; i < 1e6; i++) {
+    const suffix = `_${i}`;
+    const baseLen = Math.max(1, 50 - suffix.length);
+    const candidate = `${slug.slice(0, baseLen)}${suffix}`;
+    if (!used.has(candidate)) {
+      used.add(candidate);
+      return candidate;
+    }
+  }
+  throw new Error(`slug collision space exhausted for "${slug}"`);
+}
+function slugifySkillName(name) {
+  return slugifyKebab(name, 64);
+}
 function refineHubAsCodeCustomTools(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -5698,10 +5784,84 @@ function refineHubAsCodeEvals(config, ctx) {
     }
   }
 }
-function isSafeTemplatePath(path28) {
-  if (path28.length === 0 || path28.length > 300) return false;
-  if (path28.startsWith("/") || path28.includes("\\")) return false;
-  const segments = path28.split("/");
+function refineHubAsCodeEvalAttachments(config, ctx) {
+  const cfg = config;
+  const referencedHashes = /* @__PURE__ */ new Set();
+  const addTurnIssue = (path30, turn, name) => {
+    const error = evalTurnAttachmentsError(turn);
+    if (error) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path30, message: `${name}: ${error}` });
+      return;
+    }
+    for (const hash of collectTurnAttachmentHashes(turn)) referencedHashes.add(hash);
+  };
+  if (Array.isArray(cfg.evals)) {
+    cfg.evals.forEach((entry, e) => {
+      const ev = entry;
+      const name = `eval "${ev?.name ?? "<unnamed>"}"`;
+      addTurnIssue(["evals", e, "input"], ev?.input, name);
+      if (Array.isArray(ev?.history)) {
+        ev.history.forEach((turn, h) => addTurnIssue(["evals", e, "history", h], turn, name));
+      }
+    });
+  }
+  if (Array.isArray(cfg.journeys)) {
+    cfg.journeys.forEach((entry, j) => {
+      const jr = entry;
+      const name = `journey "${jr?.name ?? "<unnamed>"}"`;
+      if (Array.isArray(jr?.transcript)) {
+        jr.transcript.forEach((turn, t) => addTurnIssue(["journeys", j, "transcript", t], turn, name));
+      }
+    });
+  }
+  const carriedHashes = /* @__PURE__ */ new Set();
+  const files = cfg.eval_attachment_files;
+  if (Array.isArray(files)) {
+    if (files.length > MAX_EVAL_ATTACHMENT_CARRIERS) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["eval_attachment_files"],
+        message: `too many attachment carriers (${files.length}); the maximum is ${MAX_EVAL_ATTACHMENT_CARRIERS}`
+      });
+    }
+    let aggregateEncoded = 0;
+    files.forEach((f, i) => {
+      const h = f?.hash;
+      if (typeof h === "string") carriedHashes.add(h);
+      const b64 = f?.content_base64;
+      if (typeof b64 === "string") {
+        aggregateEncoded += b64.length;
+        if (b64.length > MAX_EVAL_ATTACHMENT_ENCODED_BYTES) {
+          ctx.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["eval_attachment_files", i, "content_base64"],
+            message: `attachment ${typeof h === "string" ? `${h.slice(0, 12)}\u2026 ` : ""}exceeds the ${(MAX_RESOURCE_FILE_SIZE / 1024 / 1024).toFixed(0)}MB size limit`
+          });
+        }
+      }
+    });
+    if (aggregateEncoded > MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["eval_attachment_files"],
+        message: `total attachment bytes exceed the ${(MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES / 1024 / 1024).toFixed(0)}MB per-push limit \u2014 split the push or reduce attachments`
+      });
+    }
+  }
+  for (const hash of referencedHashes) {
+    if (!carriedHashes.has(hash)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["eval_attachment_files"],
+        message: `attachment ${hash.slice(0, 12)}\u2026 is referenced by a turn but its bytes are missing from eval_attachment_files`
+      });
+    }
+  }
+}
+function isSafeTemplatePath(path30) {
+  if (path30.length === 0 || path30.length > 300) return false;
+  if (path30.startsWith("/") || path30.includes("\\")) return false;
+  const segments = path30.split("/");
   return segments.every(
     (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
   );
@@ -5711,32 +5871,6 @@ function identifyTokenType(token) {
   if (token.startsWith("eyJ")) return "jwt";
   return "unknown";
 }
-function foldDiacritics(input) {
-  return input.normalize("NFKD").replace(/[̀-ͯ]/g, "");
-}
-function slugifyKebab(input, maxLength = 64) {
-  if (typeof input !== "string") return "";
-  return foldDiacritics(input).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").slice(0, maxLength).replace(/^-|-$/g, "");
-}
-function ensureUniqueSlug(slug, used) {
-  if (!used.has(slug)) {
-    used.add(slug);
-    return slug;
-  }
-  for (let i = 2; i < 1e6; i++) {
-    const suffix = `_${i}`;
-    const baseLen = Math.max(1, 50 - suffix.length);
-    const candidate = `${slug.slice(0, baseLen)}${suffix}`;
-    if (!used.has(candidate)) {
-      used.add(candidate);
-      return candidate;
-    }
-  }
-  throw new Error(`slug collision space exhausted for "${slug}"`);
-}
-function slugifySkillName(name) {
-  return slugifyKebab(name, 64);
-}
 function findStepBoundaries(transcript) {
   const out = [];
   const n = transcript.length;
@@ -5771,7 +5905,7 @@ function findStepBoundaries(transcript) {
   }
   return out;
 }
-var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, appMessageBody, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminHubIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminSetOrgHarnessBody, adminSetHubHarnessBody, adminScopedTargetBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
+var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, appMessageBody, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, MAX_RESOURCE_FILE_SIZE, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminHubIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminSetOrgHarnessBody, adminSetHubHarnessBody, adminScopedTargetBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
@@ -7100,10 +7234,10 @@ var init_dist = __esm({
     ROLE_ECHO_MAX = 40;
     createEvalBody = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    }).superRefine(refineEvalMessageTextRole);
+    }).superRefine(refineEvalMessageTextRole).superRefine(refineEvalAttachments);
     updateEvalBody = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    }).superRefine(refineEvalMessageTextRole);
+    }).superRefine(refineEvalMessageTextRole).superRefine(refineEvalAttachments);
     getEvalsQuery = external_exports.object({
       hub_id: external_exports.string().uuid(),
       agent_id: external_exports.string().uuid().optional(),
@@ -7230,6 +7364,15 @@ var init_dist = __esm({
       journey_name: external_exports.string().min(1).max(200),
       evaluator_instructions: external_exports.string().max(4e3).optional()
     });
+    EVAL_ATTACHMENT_HASH_REGEX = /^[a-f0-9]{64}$/;
+    evalAttachmentRef = external_exports.object({
+      hash: external_exports.string().regex(EVAL_ATTACHMENT_HASH_REGEX),
+      file_name: external_exports.string().min(1).max(255),
+      mime_type: external_exports.string().min(1).max(255),
+      file_size: external_exports.number().int().positive().optional()
+    });
+    turnMayCarryAttachments = (turn) => !turn.attachments || turn.attachments.length === 0 || turn.role === "user";
+    ATTACHMENTS_USER_ONLY_MESSAGE = "attachments are only valid on user turns";
     journeyIdParam = external_exports.object({ id: external_exports.string().uuid() });
     journeyToolCallSchema = external_exports.object({
       id: external_exports.string(),
@@ -7241,7 +7384,10 @@ var init_dist = __esm({
       content: external_exports.string().nullable().optional(),
       tool_calls: external_exports.array(journeyToolCallSchema).optional(),
       tool_call_id: external_exports.string().optional(),
-      step_id: external_exports.string().optional()
+      step_id: external_exports.string().optional(),
+      attachments: external_exports.array(evalAttachmentRef).max(MAX_ATTACHMENTS_PER_MESSAGE).optional()
+    }).refine(turnMayCarryAttachments, {
+      message: ATTACHMENTS_USER_ONLY_MESSAGE
     });
     journeyStepOverrideSchema = external_exports.object({
       number_of_runs: external_exports.number().int().positive().max(100).optional(),
@@ -7746,6 +7892,10 @@ var init_dist = __esm({
       agent_id: external_exports.string().uuid().nullable().optional(),
       trigger_message: external_exports.string().nullable().optional()
     });
+    MAX_RESOURCE_FILE_SIZE = 10 * 1024 * 1024;
+    MAX_EVAL_ATTACHMENT_ENCODED_BYTES = Math.ceil(MAX_RESOURCE_FILE_SIZE / 3) * 4 + 16;
+    MAX_EVAL_ATTACHMENT_CARRIERS = 1e3;
+    MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES = 16 * 1024 * 1024;
     uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     ciUuidSchema = external_exports.string().regex(uuidPattern, "must be a valid UUID");
     hubAsCodeConfigSchema = external_exports.object({
@@ -7758,6 +7908,7 @@ var init_dist = __esm({
       refineHubAsCodeKanbanStatuses(config, ctx);
       refineHubAsCodeLanes(config, ctx);
       refineHubAsCodeEvals(config, ctx);
+      refineHubAsCodeEvalAttachments(config, ctx);
     });
     ciPullHubIdParam = external_exports.object({
       hub_id: ciUuidSchema
@@ -8589,7 +8740,6 @@ var init_dist = __esm({
       /** Subdir of `wsDir` holding org-as-code. */
       orgSubdir: "org"
     };
-    MAX_RESOURCE_FILE_SIZE = 10 * 1024 * 1024;
   }
 });
 
@@ -9145,24 +9295,24 @@ import * as path4 from "path";
 import * as readline from "readline";
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve4(answer.trim());
+      resolve6(answer.trim());
     });
   });
 }
 function confirm(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
-      resolve4(answer.trim().toLowerCase() === "y");
+      resolve6(answer.trim().toLowerCase() === "y");
     });
   });
 }
 function promptSecret(question) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const originalWrite = rl._writeToOutput;
     let firstWrite = true;
@@ -9178,18 +9328,18 @@ function promptSecret(question) {
       rl._writeToOutput = originalWrite;
       process.stdout.write("\n");
       rl.close();
-      resolve4(answer);
+      resolve6(answer);
     });
   });
 }
 function readStdin() {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
-    process.stdin.on("end", () => resolve4(data.trim()));
+    process.stdin.on("end", () => resolve6(data.trim()));
     process.stdin.on("error", reject);
   });
 }
@@ -9351,9 +9501,9 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path28 = getVersionCachePath(filename);
-    if (!existsSync4(path28)) return null;
-    const parsed = JSON.parse(readFileSync5(path28, "utf-8"));
+    const path30 = getVersionCachePath(filename);
+    if (!existsSync4(path30)) return null;
+    const parsed = JSON.parse(readFileSync5(path30, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -9373,10 +9523,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path28 = getVersionCachePath(filename);
-  const dir = dirname3(path28);
+  const path30 = getVersionCachePath(filename);
+  const dir = dirname3(path30);
   if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(path28, JSON.stringify(cache));
+  writeFileSync2(path30, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -9415,14 +9565,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path28 = join7(projectRoot, rel);
-    if (!existsSync5(path28)) continue;
+    const path30 = join7(projectRoot, rel);
+    if (!existsSync5(path30)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path28, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path30, "utf-8"));
     } catch {
     }
-    found.push({ path: path28, version });
+    found.push({ path: path30, version });
   }
   return found;
 }
@@ -9883,7 +10033,7 @@ async function validateToken(apiUrl, token) {
   }
 }
 function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
       if (url.pathname === "/callback") {
@@ -9909,7 +10059,7 @@ function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login successful!</h2><p>You can close this tab and return to your terminal.</p></body></html>");
           server.close();
-          resolve4({ code, port });
+          resolve6({ code, port });
         } else {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login failed</h2><p>No authorization code received</p></body></html>");
@@ -10119,10 +10269,10 @@ import * as readline2 from "readline";
 function prompt2(question, defaultValue) {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     rl.question(display, (answer) => {
       rl.close();
-      resolve4(answer.trim() || defaultValue || "");
+      resolve6(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -10240,8 +10390,8 @@ async function tryOpenBrowser(url) {
       cmd = "xdg-open";
       args2 = [url];
     }
-    return new Promise((resolve4) => {
-      execFile(cmd, args2, (err) => resolve4(!err));
+    return new Promise((resolve6) => {
+      execFile(cmd, args2, (err) => resolve6(!err));
     });
   } catch {
     return false;
@@ -10881,9 +11031,86 @@ var init_init = __esm({
   }
 });
 
-// src/lib/resource-files.ts
+// src/lib/fs-safety.ts
 import * as fs9 from "fs";
 import * as path11 from "path";
+function realpathContained(root, abs) {
+  let realRoot;
+  let realAbs;
+  try {
+    realRoot = fs9.realpathSync(root);
+    realAbs = fs9.realpathSync(abs);
+  } catch {
+    return false;
+  }
+  return realAbs === realRoot || realAbs.startsWith(realRoot + path11.sep);
+}
+function mkdirTolerateRace(dir) {
+  try {
+    fs9.mkdirSync(dir);
+    return true;
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+    let st;
+    try {
+      st = fs9.lstatSync(dir);
+    } catch {
+      st = void 0;
+    }
+    return !!st?.isDirectory();
+  }
+}
+function ensureRealSubdirNoSymlink(root, target, create) {
+  const rootResolved = path11.resolve(root);
+  const targetResolved = path11.resolve(target);
+  if (targetResolved !== rootResolved && !targetResolved.startsWith(rootResolved + path11.sep)) return false;
+  try {
+    if (!fs9.lstatSync(rootResolved).isDirectory()) return false;
+  } catch {
+    return false;
+  }
+  const rel = path11.relative(rootResolved, targetResolved);
+  if (rel === "") return true;
+  let cur = rootResolved;
+  for (const segment of rel.split(path11.sep)) {
+    cur = path11.join(cur, segment);
+    let st;
+    try {
+      st = fs9.lstatSync(cur);
+    } catch {
+      st = void 0;
+    }
+    if (st) {
+      if (!st.isDirectory()) return false;
+    } else if (create) {
+      if (!mkdirTolerateRace(cur)) return false;
+    } else {
+      return true;
+    }
+  }
+  return true;
+}
+function writeFileNoFollow(root, abs, data) {
+  const parent = path11.dirname(abs);
+  if (!ensureRealSubdirNoSymlink(root, parent, true)) return false;
+  let st;
+  try {
+    st = fs9.lstatSync(abs);
+  } catch {
+  }
+  if (st?.isSymbolicLink()) fs9.rmSync(abs);
+  fs9.writeFileSync(abs, data);
+  return true;
+}
+var init_fs_safety = __esm({
+  "src/lib/fs-safety.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/resource-files.ts
+import * as fs10 from "fs";
+import * as path12 from "path";
 import * as crypto3 from "crypto";
 function isBinaryFile(filename) {
   const ext = filename.split(".").pop()?.toLowerCase() || "";
@@ -10929,14 +11156,14 @@ function computeHash(data) {
 }
 function scanResourceFiles(dir, prefix = "") {
   const files = [];
-  const entries = fs9.readdirSync(dir, { withFileTypes: true });
+  const entries = fs10.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
     if (entry.isDirectory()) {
-      files.push(...scanResourceFiles(path11.join(dir, entry.name), relPath));
+      files.push(...scanResourceFiles(path12.join(dir, entry.name), relPath));
     } else if (entry.isFile()) {
-      const fullPath = path11.join(dir, entry.name);
-      const stat = fs9.statSync(fullPath);
+      const fullPath = path12.join(dir, entry.name);
+      const stat = fs10.statSync(fullPath);
       if (stat.size > MAX_RESOURCE_FILE_SIZE2) {
         console.warn(`  Warning: skipping ${relPath} (${(stat.size / 1024 / 1024).toFixed(1)}MB exceeds 10MB limit)`);
         continue;
@@ -10946,7 +11173,7 @@ function scanResourceFiles(dir, prefix = "") {
         mime_type: guessMimeType(entry.name),
         file_size: stat.size
       };
-      const data = fs9.readFileSync(fullPath);
+      const data = fs10.readFileSync(fullPath);
       fileEntry.hash = computeHash(data);
       if (isBinaryFile(entry.name)) {
         fileEntry.content_base64 = data.toString("base64");
@@ -10958,49 +11185,61 @@ function scanResourceFiles(dir, prefix = "") {
   }
   return files;
 }
-function writeResourceFileTree(resDir, files) {
+function writeResourceFileTree(resDir, files, root) {
+  if (!ensureRealSubdirNoSymlink(root, resDir, files.length > 0)) {
+    console.warn(`  Warning: skipping resource dir (not reachable inside the workspace without a symlink)`);
+    return;
+  }
   if (files.length === 0) {
-    if (fs9.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set());
+    if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set());
     return;
   }
   const writtenPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const filePath = path11.join(resDir, file.path);
-    if (!filePath.startsWith(resDir + path11.sep) && filePath !== resDir) {
+    const filePath = path12.join(resDir, file.path);
+    if (!filePath.startsWith(resDir + path12.sep) && filePath !== resDir) {
       console.warn(`  Warning: skipping ${file.path} (path traversal detected)`);
       continue;
     }
-    const fileDir = path11.dirname(filePath);
-    if (!fs9.existsSync(fileDir)) fs9.mkdirSync(fileDir, { recursive: true });
     writtenPaths.add(file.path);
     if (file.content !== void 0) {
-      fs9.writeFileSync(filePath, file.content, "utf-8");
+      if (!writeFileNoFollow(resDir, filePath, Buffer.from(file.content, "utf-8"))) {
+        console.warn(`  Warning: skipping ${file.path} (destination escapes the resource folder via a symlink)`);
+        writtenPaths.delete(file.path);
+      }
     } else if (file.content_base64) {
-      fs9.writeFileSync(filePath, Buffer.from(file.content_base64, "base64"));
+      if (!writeFileNoFollow(resDir, filePath, Buffer.from(file.content_base64, "base64"))) {
+        console.warn(`  Warning: skipping ${file.path} (destination escapes the resource folder via a symlink)`);
+        writtenPaths.delete(file.path);
+      }
     }
   }
-  if (fs9.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths);
+  if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths);
 }
 function cleanOrphanFiles(dir, prefix, writtenPaths) {
-  const entries = fs9.readdirSync(dir, { withFileTypes: true });
+  const entries = fs10.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
-    const fullPath = path11.join(dir, entry.name);
+    const fullPath = path12.join(dir, entry.name);
     if (entry.isDirectory()) {
       cleanOrphanFiles(fullPath, relPath, writtenPaths);
-      if (fs9.readdirSync(fullPath).length === 0) fs9.rmdirSync(fullPath);
+      if (fs10.readdirSync(fullPath).length === 0) fs10.rmdirSync(fullPath);
     } else if (!writtenPaths.has(relPath)) {
-      fs9.unlinkSync(fullPath);
+      fs10.unlinkSync(fullPath);
     }
   }
 }
-async function downloadBinaryFiles(resDir, files) {
+async function downloadBinaryFiles(resDir, files, root) {
+  if (!ensureRealSubdirNoSymlink(root, resDir, true)) {
+    console.warn(`  Warning: skipping resource downloads (dir not reachable inside the workspace without a symlink)`);
+    return 0;
+  }
   let count = 0;
   for (const file of files) {
     if (!file.download_url || file.content !== void 0) continue;
     try {
-      const filePath = path11.join(resDir, file.path);
-      if (!filePath.startsWith(resDir + path11.sep) && filePath !== resDir) {
+      const filePath = path12.join(resDir, file.path);
+      if (!filePath.startsWith(resDir + path12.sep) && filePath !== resDir) {
         console.warn(`  Warning: skipping ${file.path} (path traversal detected)`);
         continue;
       }
@@ -11010,10 +11249,8 @@ async function downloadBinaryFiles(resDir, files) {
         continue;
       }
       const buffer = Buffer.from(await response.arrayBuffer());
-      const fileDir = path11.dirname(filePath);
-      if (!fs9.existsSync(fileDir)) fs9.mkdirSync(fileDir, { recursive: true });
-      fs9.writeFileSync(filePath, buffer);
-      count++;
+      if (writeFileNoFollow(resDir, filePath, buffer)) count++;
+      else console.warn(`  Warning: skipping ${file.path} (destination escapes the resource folder via a symlink)`);
     } catch (err) {
       console.warn(`  Warning: failed to download ${file.path} (${err instanceof Error ? err.message : String(err)})`);
     }
@@ -11024,6 +11261,7 @@ var BINARY_EXTENSIONS, MAX_RESOURCE_FILE_SIZE2;
 var init_resource_files = __esm({
   "src/lib/resource-files.ts"() {
     "use strict";
+    init_fs_safety();
     BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
       "pdf",
       "png",
@@ -11049,8 +11287,8 @@ var init_resource_files = __esm({
 });
 
 // src/lib/yaml-writer.ts
-import * as fs10 from "fs";
-import * as path12 from "path";
+import * as fs11 from "fs";
+import * as path13 from "path";
 import * as yaml4 from "js-yaml";
 function buildEvalYamlObject(evalEntry, slug) {
   const out = {};
@@ -11084,42 +11322,42 @@ function buildEvalYamlObject(evalEntry, slug) {
   return out;
 }
 function writeHubFolder(hubFolder, payload, options = {}) {
-  const agentsDir = path12.join(hubFolder, "agents");
-  if (!fs10.existsSync(hubFolder)) {
-    fs10.mkdirSync(hubFolder, { recursive: true });
+  const agentsDir = path13.join(hubFolder, "agents");
+  if (!fs11.existsSync(hubFolder)) {
+    fs11.mkdirSync(hubFolder, { recursive: true });
   }
-  if (!fs10.existsSync(agentsDir)) {
-    fs10.mkdirSync(agentsDir, { recursive: true });
+  if (!fs11.existsSync(agentsDir)) {
+    fs11.mkdirSync(agentsDir, { recursive: true });
   }
   const yamlPayload = buildYamlPayload(payload);
   const agentFiles = extractAgentFiles(payload);
   const yamlContent = yaml4.dump(yamlPayload, YAML_DUMP_OPTIONS);
-  fs10.writeFileSync(path12.join(hubFolder, "hub.yaml"), yamlContent, "utf-8");
+  fs11.writeFileSync(path13.join(hubFolder, "hub.yaml"), yamlContent, "utf-8");
   if (options.seedAgentContext ?? true) {
-    writeIfAbsent(path12.join(hubFolder, "AGENTS.md"), perHubAgentsMd(path12.basename(hubFolder)));
-    writeIfAbsent(path12.join(hubFolder, "CLAUDE.md"), CLAUDE_MD_SHIM);
+    writeIfAbsent(path13.join(hubFolder, "AGENTS.md"), perHubAgentsMd(path13.basename(hubFolder)));
+    writeIfAbsent(path13.join(hubFolder, "CLAUDE.md"), CLAUDE_MD_SHIM);
   }
-  const oldYamlPath = path12.join(hubFolder, "wayai.yaml");
-  if (fs10.existsSync(oldYamlPath)) {
-    fs10.unlinkSync(oldYamlPath);
+  const oldYamlPath = path13.join(hubFolder, "wayai.yaml");
+  if (fs11.existsSync(oldYamlPath)) {
+    fs11.unlinkSync(oldYamlPath);
   }
   const yamlSlugs = writeAgentYamlFiles(agentsDir, payload.agents || []);
   const mdSlugs = /* @__PURE__ */ new Set();
   for (const { slug, content } of agentFiles) {
     mdSlugs.add(slug);
-    fs10.writeFileSync(path12.join(agentsDir, `${slug}.md`), content, "utf-8");
+    fs11.writeFileSync(path13.join(agentsDir, `${slug}.md`), content, "utf-8");
   }
-  const existingFiles = fs10.readdirSync(agentsDir);
+  const existingFiles = fs11.readdirSync(agentsDir);
   for (const file of existingFiles) {
     if (file.endsWith(".yaml")) {
       const slug = file.slice(0, -5);
       if (!yamlSlugs.has(slug)) {
-        fs10.unlinkSync(path12.join(agentsDir, file));
+        fs11.unlinkSync(path13.join(agentsDir, file));
       }
     } else if (file.endsWith(".md")) {
       const slug = file.slice(0, -3);
       if (!mdSlugs.has(slug)) {
-        fs10.unlinkSync(path12.join(agentsDir, file));
+        fs11.unlinkSync(path13.join(agentsDir, file));
       }
     }
   }
@@ -11130,10 +11368,10 @@ function writeHubFolder(hubFolder, payload, options = {}) {
 function setPreviewLabelInHubYaml(hubFolder, label) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) return;
-  const obj = yaml4.load(fs10.readFileSync(yamlPath, "utf-8")) ?? {};
+  const obj = yaml4.load(fs11.readFileSync(yamlPath, "utf-8")) ?? {};
   if (label) obj.preview_label = label;
   else delete obj.preview_label;
-  fs10.writeFileSync(yamlPath, yaml4.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
+  fs11.writeFileSync(yamlPath, yaml4.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
 }
 function buildYamlPayload(payload) {
   const result = {
@@ -11179,7 +11417,7 @@ function writeAgentYamlFiles(agentsDir, agents) {
     const entry = { ...agent };
     delete entry.instructions;
     const yamlContent = yaml4.dump(entry, YAML_DUMP_OPTIONS);
-    fs10.writeFileSync(path12.join(agentsDir, `${slug}.yaml`), yamlContent, "utf-8");
+    fs11.writeFileSync(path13.join(agentsDir, `${slug}.yaml`), yamlContent, "utf-8");
   }
   return slugs;
 }
@@ -11196,65 +11434,65 @@ function extractAgentFiles(payload) {
   return files;
 }
 function writeEvalYamlFiles(hubFolder, evals) {
-  const evalsDir = path12.join(hubFolder, "evals");
+  const evalsDir = path13.join(hubFolder, "evals");
   if (evals.length === 0) {
-    if (fs10.existsSync(evalsDir)) {
+    if (fs11.existsSync(evalsDir)) {
       cleanEvalOrphans(evalsDir, /* @__PURE__ */ new Set());
       try {
-        if (fs10.readdirSync(evalsDir).length === 0) fs10.rmdirSync(evalsDir);
+        if (fs11.readdirSync(evalsDir).length === 0) fs11.rmdirSync(evalsDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs10.existsSync(evalsDir)) {
-    fs10.mkdirSync(evalsDir, { recursive: true });
+  if (!fs11.existsSync(evalsDir)) {
+    fs11.mkdirSync(evalsDir, { recursive: true });
   }
   const writtenRelPaths = /* @__PURE__ */ new Set();
   for (const evalEntry of evals) {
     const slug = slugify(evalEntry.name);
     const setName = evalEntry.path && evalEntry.path.trim().length > 0 ? evalEntry.path : null;
     const relPath = setName ? `${setName}/${slug}.yaml` : `${slug}.yaml`;
-    const targetPath = path12.join(evalsDir, relPath);
-    if (!targetPath.startsWith(evalsDir + path12.sep)) {
+    const targetPath = path13.join(evalsDir, relPath);
+    if (!targetPath.startsWith(evalsDir + path13.sep)) {
       console.warn(`  Warning: skipping eval "${evalEntry.name}" (scenario set "${setName}" escapes evals/ \u2014 possible bad backend data)`);
       continue;
     }
     if (setName) {
-      const setDir = path12.join(evalsDir, setName);
-      if (!fs10.existsSync(setDir)) {
-        fs10.mkdirSync(setDir, { recursive: true });
+      const setDir = path13.join(evalsDir, setName);
+      if (!fs11.existsSync(setDir)) {
+        fs11.mkdirSync(setDir, { recursive: true });
       }
     }
     const yamlContent = yaml4.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
-    fs10.writeFileSync(targetPath, yamlContent, "utf-8");
+    fs11.writeFileSync(targetPath, yamlContent, "utf-8");
     writtenRelPaths.add(relPath);
   }
   cleanEvalOrphans(evalsDir, writtenRelPaths);
 }
 function cleanEvalOrphans(evalsDir, writtenRelPaths) {
-  const entries = fs10.readdirSync(evalsDir, { withFileTypes: true });
+  const entries = fs11.readdirSync(evalsDir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path12.join(evalsDir, entry.name);
+    const fullPath = path13.join(evalsDir, entry.name);
     if (entry.isFile()) {
       if (entry.name.endsWith(".yaml") && !writtenRelPaths.has(entry.name)) {
-        fs10.unlinkSync(fullPath);
+        fs11.unlinkSync(fullPath);
       }
       continue;
     }
     if (entry.isDirectory()) {
       const setName = entry.name;
-      const subEntries = fs10.readdirSync(fullPath, { withFileTypes: true });
+      const subEntries = fs11.readdirSync(fullPath, { withFileTypes: true });
       for (const sub of subEntries) {
         if (sub.isFile() && sub.name.endsWith(".yaml")) {
           const relPath = `${setName}/${sub.name}`;
           if (!writtenRelPaths.has(relPath)) {
-            fs10.unlinkSync(path12.join(fullPath, sub.name));
+            fs11.unlinkSync(path13.join(fullPath, sub.name));
           }
         }
       }
       try {
-        if (fs10.readdirSync(fullPath).length === 0) fs10.rmdirSync(fullPath);
+        if (fs11.readdirSync(fullPath).length === 0) fs11.rmdirSync(fullPath);
       } catch {
       }
     }
@@ -11290,19 +11528,19 @@ function buildJourneyYamlObject(journeyEntry, slug) {
   return out;
 }
 function writeJourneyYamlFiles(hubFolder, journeys) {
-  const journeysDir = path12.join(hubFolder, "journeys");
+  const journeysDir = path13.join(hubFolder, "journeys");
   if (journeys.length === 0) {
-    if (fs10.existsSync(journeysDir)) {
+    if (fs11.existsSync(journeysDir)) {
       cleanJourneyOrphans(journeysDir, /* @__PURE__ */ new Set());
       try {
-        if (fs10.readdirSync(journeysDir).length === 0) fs10.rmdirSync(journeysDir);
+        if (fs11.readdirSync(journeysDir).length === 0) fs11.rmdirSync(journeysDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs10.existsSync(journeysDir)) {
-    fs10.mkdirSync(journeysDir, { recursive: true });
+  if (!fs11.existsSync(journeysDir)) {
+    fs11.mkdirSync(journeysDir, { recursive: true });
   }
   const writtenFiles = /* @__PURE__ */ new Set();
   const usedSlugs = /* @__PURE__ */ new Set();
@@ -11310,33 +11548,33 @@ function writeJourneyYamlFiles(hubFolder, journeys) {
     const slug = ensureUniqueSlug(slugify(journeyEntry.name), usedSlugs);
     const fileName = `${slug}.yaml`;
     const yamlContent = yaml4.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
-    fs10.writeFileSync(path12.join(journeysDir, fileName), yamlContent, "utf-8");
+    fs11.writeFileSync(path13.join(journeysDir, fileName), yamlContent, "utf-8");
     writtenFiles.add(fileName);
   }
   cleanJourneyOrphans(journeysDir, writtenFiles);
 }
 function cleanJourneyOrphans(journeysDir, writtenFiles) {
-  const entries = fs10.readdirSync(journeysDir, { withFileTypes: true });
+  const entries = fs11.readdirSync(journeysDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && entry.name.endsWith(".yaml") && !writtenFiles.has(entry.name)) {
-      fs10.unlinkSync(path12.join(journeysDir, entry.name));
+      fs11.unlinkSync(path13.join(journeysDir, entry.name));
     }
   }
 }
 function writeResourceFiles(hubFolder, resources) {
-  const resourcesDir = path12.join(hubFolder, "resources");
+  const resourcesDir = path13.join(hubFolder, "resources");
   const currentSlugs = /* @__PURE__ */ new Set();
   for (const resource of resources) {
     const resSlug = slugify(resource.name);
     currentSlugs.add(resSlug);
-    const resDir = path12.join(resourcesDir, resSlug);
-    writeResourceFileTree(resDir, resource.files || []);
+    const resDir = path13.join(resourcesDir, resSlug);
+    writeResourceFileTree(resDir, resource.files || [], hubFolder);
   }
-  if (fs10.existsSync(resourcesDir)) {
-    const existingDirs = fs10.readdirSync(resourcesDir, { withFileTypes: true });
+  if (fs11.existsSync(resourcesDir)) {
+    const existingDirs = fs11.readdirSync(resourcesDir, { withFileTypes: true });
     for (const entry of existingDirs) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
-        fs10.rmSync(path12.join(resourcesDir, entry.name), { recursive: true, force: true });
+        fs11.rmSync(path13.join(resourcesDir, entry.name), { recursive: true, force: true });
       }
     }
   }
@@ -11361,9 +11599,187 @@ var init_yaml_writer = __esm({
   }
 });
 
+// src/lib/eval-attachments.ts
+import * as fs12 from "fs";
+import * as path14 from "path";
+function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
+  const raw = turn.attachments;
+  if (raw === void 0 || raw === null) return void 0;
+  if (!Array.isArray(raw) || raw.length === 0) {
+    if (Array.isArray(raw)) return void 0;
+    throw expected(`${label}: "attachments" must be a list of file paths.`);
+  }
+  if (turn.role !== "user") {
+    throw expected(`${label}: attachments are only allowed on user turns (this turn is "${String(turn.role)}").`);
+  }
+  const refs = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string" || !entry.trim()) {
+      throw expected(`${label}: each attachment must be a hub-relative file path string.`);
+    }
+    const abs = path14.resolve(hubFolder, entry);
+    const root = path14.resolve(hubFolder);
+    if (abs !== root && !abs.startsWith(root + path14.sep)) {
+      throw expected(`${label}: attachment "${entry}" escapes the hub folder.`);
+    }
+    let stat;
+    try {
+      stat = fs12.statSync(abs);
+    } catch {
+    }
+    if (!stat?.isFile()) {
+      throw expected(`${label}: attachment "${entry}" not found.`);
+    }
+    if (!realpathContained(root, abs)) {
+      throw expected(`${label}: attachment "${entry}" resolves outside the hub folder (symlinks are not allowed).`);
+    }
+    if (stat.size > MAX_RESOURCE_FILE_SIZE2) {
+      throw expected(
+        `${label}: attachment "${entry}" is ${(stat.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
+      );
+    }
+    const data = fs12.readFileSync(abs);
+    const hash = computeHash(data);
+    const fileName = path14.basename(abs);
+    const mimeType = guessMimeType(fileName) ?? "application/octet-stream";
+    refs.push({ hash, file_name: fileName, mime_type: mimeType, file_size: stat.size });
+    if (!bytesByHash.has(hash)) {
+      bytesByHash.set(hash, {
+        hash,
+        content_base64: data.toString("base64"),
+        file_name: fileName,
+        mime_type: mimeType,
+        file_size: stat.size
+      });
+    }
+  }
+  return refs;
+}
+function applyTurnAttachments(hubFolder, turn, label, bytesByHash) {
+  const refs = resolveTurnAttachments(hubFolder, turn, label, bytesByHash);
+  if (refs) turn.attachments = refs;
+  else delete turn.attachments;
+}
+function forEachAttachableTurn(payload, fn) {
+  for (const ev of payload.evals ?? []) {
+    if (ev.input) fn(ev.input);
+    for (const t of ev.history ?? []) fn(t);
+  }
+  for (const jr of payload.journeys ?? []) {
+    for (const t of jr.transcript ?? []) fn(t);
+  }
+}
+function rewriteEvalAttachmentsToLocalPaths(payload) {
+  const urlByHash = new Map((payload.eval_attachment_files ?? []).map((f) => [f.hash, f.download_url]));
+  const safeName = (ref) => {
+    const base = path14.basename(ref.file_name);
+    return base === "" || base === "." || base === ".." ? ref.hash.slice(0, 16) : base;
+  };
+  const hashesByName = /* @__PURE__ */ new Map();
+  const collect = (turn) => {
+    if (!Array.isArray(turn.attachments)) return;
+    for (const ref of turn.attachments) {
+      if (!ref?.hash || !ref.file_name) continue;
+      const name = safeName(ref);
+      let set = hashesByName.get(name);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        hashesByName.set(name, set);
+      }
+      set.add(ref.hash);
+    }
+  };
+  forEachAttachableTurn(payload, collect);
+  const pathByKey = /* @__PURE__ */ new Map();
+  const usedLower = /* @__PURE__ */ new Set();
+  const localPathFor = (ref) => {
+    const name = safeName(ref);
+    const key = `${ref.hash} ${name}`;
+    const existing = pathByKey.get(key);
+    if (existing) return existing;
+    const ext = path14.extname(name);
+    const stem = path14.basename(name, ext);
+    const collides = (hashesByName.get(name)?.size ?? 0) > 1;
+    let rel = collides ? `${ATTACHMENTS_DIR}/${stem}-${ref.hash.slice(0, 8)}${ext}` : `${ATTACHMENTS_DIR}/${name}`;
+    if (usedLower.has(rel.toLowerCase())) {
+      let n = 12;
+      while (usedLower.has(rel.toLowerCase()) && n <= ref.hash.length) {
+        rel = `${ATTACHMENTS_DIR}/${stem}-${ref.hash.slice(0, n)}${ext}`;
+        n += 4;
+      }
+      for (let extra = 2; usedLower.has(rel.toLowerCase()); extra++) {
+        rel = `${ATTACHMENTS_DIR}/${stem}-${ref.hash}-${extra}${ext}`;
+      }
+    }
+    usedLower.add(rel.toLowerCase());
+    pathByKey.set(key, rel);
+    return rel;
+  };
+  const downloads = /* @__PURE__ */ new Map();
+  forEachAttachableTurn(payload, (turn) => {
+    if (!Array.isArray(turn.attachments)) return;
+    turn.attachments = turn.attachments.map((ref) => {
+      const rel = localPathFor(ref);
+      const url = urlByHash.get(ref.hash);
+      if (url && !downloads.has(rel)) downloads.set(rel, { relPath: rel, url, hash: ref.hash });
+      return rel;
+    });
+  });
+  delete payload.eval_attachment_files;
+  return [...downloads.values()];
+}
+async function downloadEvalAttachments(hubFolder, downloads) {
+  const attachDir = path14.resolve(hubFolder, ATTACHMENTS_DIR);
+  let written = 0;
+  if (!ensureRealSubdirNoSymlink(hubFolder, attachDir, downloads.length > 0)) {
+    console.warn(`  Warning: ${ATTACHMENTS_DIR}/ is not reachable inside the hub folder without a symlink; skipping attachment sync.`);
+    return written;
+  }
+  if (!fs12.existsSync(attachDir)) return written;
+  for (const dl of downloads) {
+    const abs = path14.resolve(hubFolder, dl.relPath);
+    if (abs !== attachDir && !abs.startsWith(attachDir + path14.sep)) continue;
+    let existing;
+    try {
+      existing = fs12.lstatSync(abs);
+    } catch {
+    }
+    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs12.readFileSync(abs)) === dl.hash) {
+      continue;
+    }
+    try {
+      const res = await fetch(dl.url);
+      if (!res.ok) {
+        console.warn(`  Warning: failed to download ${dl.relPath} (HTTP ${res.status})`);
+        continue;
+      }
+      if (writeFileNoFollow(hubFolder, abs, Buffer.from(await res.arrayBuffer()))) written++;
+    } catch (err) {
+      console.warn(`  Warning: failed to download ${dl.relPath}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const keep = new Set(downloads.map((d) => path14.resolve(hubFolder, d.relPath)));
+  for (const name of fs12.readdirSync(attachDir)) {
+    const abs = path14.join(attachDir, name);
+    const st = fs12.lstatSync(abs);
+    if ((st.isFile() || st.isSymbolicLink()) && !keep.has(abs)) fs12.rmSync(abs);
+  }
+  return written;
+}
+var ATTACHMENTS_DIR;
+var init_eval_attachments = __esm({
+  "src/lib/eval-attachments.ts"() {
+    "use strict";
+    init_resource_files();
+    init_fs_safety();
+    init_parser();
+    ATTACHMENTS_DIR = "attachments";
+  }
+});
+
 // src/lib/parser.ts
-import * as fs11 from "fs";
-import * as path13 from "path";
+import * as fs13 from "fs";
+import * as path15 from "path";
 import * as yaml5 from "js-yaml";
 function expected(message) {
   const err = new Error(message);
@@ -11377,7 +11793,7 @@ function parseHubFolder(hubFolder, opts) {
     err.isExpected = true;
     throw err;
   }
-  const yamlContent = fs11.readFileSync(yamlPath, "utf-8");
+  const yamlContent = fs13.readFileSync(yamlPath, "utf-8");
   let config;
   try {
     config = yaml5.load(yamlContent);
@@ -11412,9 +11828,9 @@ function parseHubFolder(hubFolder, opts) {
     const resolved = { ...agent };
     if (typeof resolved.instructions === "string" && resolved.instructions.endsWith(".md")) {
       const instrValue = resolved.instructions;
-      const instructionsPath = instrValue.startsWith("agents/") ? path13.join(hubFolder, instrValue) : path13.join(hubFolder, "agents", instrValue);
-      if (fs11.existsSync(instructionsPath)) {
-        resolved.instructions = fs11.readFileSync(instructionsPath, "utf-8");
+      const instructionsPath = instrValue.startsWith("agents/") ? path15.join(hubFolder, instrValue) : path15.join(hubFolder, "agents", instrValue);
+      if (fs13.existsSync(instructionsPath)) {
+        resolved.instructions = fs13.readFileSync(instructionsPath, "utf-8");
       } else {
         const err = new Error(
           `Agent instructions file not found: ${instructionsPath} (referenced by agent "${agent.name}")`
@@ -11423,9 +11839,9 @@ function parseHubFolder(hubFolder, opts) {
         throw err;
       }
     } else if (resolved.instructions === void 0 && typeof agent.name === "string") {
-      const conventionPath = path13.join(hubFolder, "agents", `${slugify(agent.name)}.md`);
-      if (fs11.existsSync(conventionPath)) {
-        resolved.instructions = fs11.readFileSync(conventionPath, "utf-8");
+      const conventionPath = path15.join(hubFolder, "agents", `${slugify(agent.name)}.md`);
+      if (fs13.existsSync(conventionPath)) {
+        resolved.instructions = fs13.readFileSync(conventionPath, "utf-8");
       }
     }
     return resolved;
@@ -11464,58 +11880,62 @@ function parseHubFolder(hubFolder, opts) {
   if (config.outbound_schedules && config.outbound_schedules.length > 0) {
     payload.outbound_schedules = config.outbound_schedules;
   }
-  const evals = scanEvalYamlFiles(hubFolder);
+  const bytesByHash = /* @__PURE__ */ new Map();
+  const evals = scanEvalYamlFiles(hubFolder, bytesByHash);
   if (evals.length > 0) {
     payload.evals = evals;
   }
-  const journeys = scanJourneyYamlFiles(hubFolder);
+  const journeys = scanJourneyYamlFiles(hubFolder, bytesByHash);
   if (journeys.length > 0) {
     payload.journeys = journeys;
   }
+  if (bytesByHash.size > 0) {
+    payload.eval_attachment_files = [...bytesByHash.values()];
+  }
   return payload;
 }
-function scanEvalYamlFiles(hubFolder) {
-  const evalsDir = path13.join(hubFolder, "evals");
-  if (!fs11.existsSync(evalsDir)) return [];
+function scanEvalYamlFiles(hubFolder, bytesByHash) {
+  const evalsDir = path15.join(hubFolder, "evals");
+  if (!fs13.existsSync(evalsDir)) return [];
   const evals = [];
   const seen = /* @__PURE__ */ new Set();
-  const topEntries = fs11.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const topEntries = fs13.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of topEntries) {
     if (entry.isFile() && entry.name.endsWith(".yaml")) {
-      collectEval(evals, seen, path13.join(evalsDir, entry.name), `evals/${entry.name}`, null);
+      collectEval(evals, seen, path15.join(evalsDir, entry.name), `evals/${entry.name}`, null, hubFolder, bytesByHash);
     } else if (entry.isDirectory()) {
       const setName = entry.name;
-      const setDir = path13.join(evalsDir, setName);
-      const setEntries = fs11.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      const setDir = path15.join(evalsDir, setName);
+      const setEntries = fs13.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
       for (const sub of setEntries) {
         if (sub.isDirectory()) {
           throw expected(
-            `Nested scenario sets are not supported: ${path13.relative(hubFolder, path13.join(setDir, sub.name))}. Move scenarios up to evals/${setName}/.`
+            `Nested scenario sets are not supported: ${path15.relative(hubFolder, path15.join(setDir, sub.name))}. Move scenarios up to evals/${setName}/.`
           );
         }
         if (sub.isFile() && sub.name.endsWith(".yaml")) {
-          collectEval(evals, seen, path13.join(setDir, sub.name), `evals/${setName}/${sub.name}`, setName);
+          collectEval(evals, seen, path15.join(setDir, sub.name), `evals/${setName}/${sub.name}`, setName, hubFolder, bytesByHash);
         }
       }
     }
   }
   return evals;
 }
-function collectEval(evals, seen, filePath, relPath, setName) {
-  const evalEntry = parseEvalYaml(filePath, relPath, setName);
+function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesByHash) {
+  const evalEntry = parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash);
   if (!evalEntry) return;
   const key = `${evalEntry.name}|${setName ?? ""}`;
   if (seen.has(key)) {
     const where = setName ? `scenario set "${setName}"` : "root";
     throw expected(
-      `Duplicate eval at ${where}: "${evalEntry.name}" (in ${path13.basename(filePath)}). Each (name, scenario set) pair must be unique.`
+      `Duplicate eval at ${where}: "${evalEntry.name}" (in ${path15.basename(filePath)}). Each (name, scenario set) pair must be unique.`
     );
   }
   seen.add(key);
   evals.push(evalEntry);
 }
-function parseEvalYaml(filePath, relPath, setName) {
-  const content = fs11.readFileSync(filePath, "utf-8");
+function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
+  const content = fs13.readFileSync(filePath, "utf-8");
   let raw;
   try {
     raw = yaml5.load(content);
@@ -11530,7 +11950,7 @@ function parseEvalYaml(filePath, relPath, setName) {
     return null;
   }
   const data = raw;
-  const fileSlug = path13.basename(filePath, ".yaml");
+  const fileSlug = path15.basename(filePath, ".yaml");
   const evalName = typeof data.name === "string" && data.name.trim().length > 0 ? data.name : fileSlug;
   if (typeof data.agent !== "string" || data.agent.trim().length === 0) {
     throw expected(`Eval "${evalName}" in ${relPath}: missing required field "agent" (string).`);
@@ -11541,11 +11961,13 @@ function parseEvalYaml(filePath, relPath, setName) {
   if (!data.expected || typeof data.expected !== "object" || Array.isArray(data.expected)) {
     throw expected(`Eval "${evalName}" in ${relPath}: missing required field "expected" (object).`);
   }
+  const input = { ...data.input };
+  applyTurnAttachments(hubFolder, input, `Eval "${evalName}" input`, bytesByHash);
   const evalEntry = {
     name: evalName,
     agent: data.agent,
     path: setName,
-    input: data.input,
+    input,
     expected: data.expected
   };
   if (typeof data.id === "string") evalEntry.id = data.id;
@@ -11553,7 +11975,11 @@ function parseEvalYaml(filePath, relPath, setName) {
   if (typeof data.runs === "number") evalEntry.runs = data.runs;
   if (data.enabled === false) evalEntry.enabled = false;
   if (Array.isArray(data.history)) {
-    evalEntry.history = data.history;
+    evalEntry.history = data.history.map((turn, i) => {
+      const t = { ...turn };
+      applyTurnAttachments(hubFolder, t, `Eval "${evalName}" history[${i}]`, bytesByHash);
+      return t;
+    });
   }
   if (typeof data.evaluator_instructions === "string") {
     evalEntry.evaluator_instructions = data.evaluator_instructions;
@@ -11583,20 +12009,20 @@ function parseFixtureField(raw, label, key) {
   const trimmed = raw.trim();
   return trimmed.length > 0 ? trimmed : void 0;
 }
-function scanJourneyYamlFiles(hubFolder) {
-  const journeysDir = path13.join(hubFolder, "journeys");
-  if (!fs11.existsSync(journeysDir)) return [];
+function scanJourneyYamlFiles(hubFolder, bytesByHash) {
+  const journeysDir = path15.join(hubFolder, "journeys");
+  if (!fs13.existsSync(journeysDir)) return [];
   const journeys = [];
   const seen = /* @__PURE__ */ new Set();
-  const entries = fs11.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
       throw expected(
-        `Subfolders are not supported under journeys/: ${path13.relative(hubFolder, path13.join(journeysDir, entry.name))}. A journey owns its own managed scenario set \u2014 put each journey in a single journeys/<slug>.yaml file.`
+        `Subfolders are not supported under journeys/: ${path15.relative(hubFolder, path15.join(journeysDir, entry.name))}. A journey owns its own managed scenario set \u2014 put each journey in a single journeys/<slug>.yaml file.`
       );
     }
     if (!entry.isFile() || !entry.name.endsWith(".yaml")) continue;
-    const journeyEntry = parseJourneyYaml(path13.join(journeysDir, entry.name), `journeys/${entry.name}`);
+    const journeyEntry = parseJourneyYaml(path15.join(journeysDir, entry.name), `journeys/${entry.name}`, hubFolder, bytesByHash);
     if (!journeyEntry) continue;
     if (seen.has(journeyEntry.name)) {
       throw expected(
@@ -11608,8 +12034,8 @@ function scanJourneyYamlFiles(hubFolder) {
   }
   return journeys;
 }
-function parseJourneyYaml(filePath, relPath) {
-  const content = fs11.readFileSync(filePath, "utf-8");
+function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
+  const content = fs13.readFileSync(filePath, "utf-8");
   let raw;
   try {
     raw = yaml5.load(content);
@@ -11624,7 +12050,7 @@ function parseJourneyYaml(filePath, relPath) {
     return null;
   }
   const data = raw;
-  const fileSlug = path13.basename(filePath, ".yaml");
+  const fileSlug = path15.basename(filePath, ".yaml");
   const journeyName = typeof data.name === "string" && data.name.trim().length > 0 ? data.name : fileSlug;
   if (typeof data.agent !== "string" || data.agent.trim().length === 0) {
     throw expected(`Journey "${journeyName}" in ${relPath}: missing required field "agent" (string).`);
@@ -11646,7 +12072,11 @@ function parseJourneyYaml(filePath, relPath) {
     journeyEntry.evaluator_instructions = data.evaluator_instructions;
   }
   if (Array.isArray(data.transcript)) {
-    journeyEntry.transcript = data.transcript;
+    journeyEntry.transcript = data.transcript.map((turn, i) => {
+      const t = { ...turn };
+      applyTurnAttachments(hubFolder, t, `Journey "${journeyName}" transcript[${i}]`, bytesByHash);
+      return t;
+    });
   }
   if (data.step_config && typeof data.step_config === "object" && !Array.isArray(data.step_config)) {
     journeyEntry.step_config = data.step_config;
@@ -11660,14 +12090,14 @@ function parseJourneyYaml(filePath, relPath) {
   return journeyEntry;
 }
 function scanAgentYamlFiles(hubFolder) {
-  const agentsDir = path13.join(hubFolder, "agents");
-  if (!fs11.existsSync(agentsDir)) return [];
-  const yamlFiles = fs11.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
+  const agentsDir = path15.join(hubFolder, "agents");
+  if (!fs13.existsSync(agentsDir)) return [];
+  const yamlFiles = fs13.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
   if (yamlFiles.length === 0) return [];
   const agents = [];
   for (const file of yamlFiles) {
-    const filePath = path13.join(agentsDir, file);
-    const content = fs11.readFileSync(filePath, "utf-8");
+    const filePath = path15.join(agentsDir, file);
+    const content = fs13.readFileSync(filePath, "utf-8");
     let agent;
     try {
       agent = yaml5.load(content);
@@ -11689,7 +12119,7 @@ function scanAgentYamlFiles(hubFolder) {
   return agents;
 }
 function parseResources(hubFolder, configResources) {
-  const resourcesDir = path13.join(hubFolder, "resources");
+  const resourcesDir = path15.join(hubFolder, "resources");
   const results = [];
   for (const res of configResources) {
     const resource = {
@@ -11702,8 +12132,8 @@ function parseResources(hubFolder, configResources) {
     if (res.user_browsable) resource.user_browsable = res.user_browsable;
     if (res.skill_name) resource.skill_name = res.skill_name;
     const resSlug = slugify(resource.name);
-    const resDir = path13.join(resourcesDir, resSlug);
-    if (fs11.existsSync(resDir)) {
+    const resDir = path15.join(resourcesDir, resSlug);
+    if (fs13.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) {
         resource.files = files;
@@ -11718,6 +12148,7 @@ var init_parser = __esm({
     "use strict";
     init_utils();
     init_resource_files();
+    init_eval_attachments();
   }
 });
 
@@ -11757,8 +12188,8 @@ __export(pull_exports, {
   resolveHubTarget: () => resolveHubTarget,
   writeProductionMirror: () => writeProductionMirror
 });
-import * as fs12 from "fs";
-import * as path14 from "path";
+import * as fs14 from "fs";
+import * as path16 from "path";
 function parseArgs4(args2) {
   let autoConfirm = false;
   let hubSelector;
@@ -11777,7 +12208,7 @@ function resolveHubTarget(workspaceDir, selector) {
   const allHubs = scanWorkspaceHubs(workspaceDir);
   if (selector) {
     const match = allHubs.find(
-      (h) => h.hubId === selector || path14.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path16.basename(h.hubFolder) === selector
     );
     if (match) return { hubId: match.hubId, hubFolder: match.hubFolder };
     if (UUID_RE2.test(selector)) return { hubId: selector, hubFolder: null };
@@ -11794,7 +12225,7 @@ function resolveHubTarget(workspaceDir, selector) {
   }
   console.error(`Multiple hubs found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
   for (const h of previewHubs) {
-    console.error(`  ${path14.basename(h.hubFolder)} (${h.hubId})`);
+    console.error(`  ${path16.basename(h.hubFolder)} (${h.hubId})`);
   }
   process.exit(1);
 }
@@ -11821,6 +12252,7 @@ async function pullCommand(args2) {
     return;
   }
   assertHubMatchesBinding(hubId);
+  const attachmentDownloads = rewriteEvalAttachmentsToLocalPaths(payload);
   let hubFolder = existingFolder;
   let wroteFiles = false;
   if (!hubFolder) {
@@ -11832,10 +12264,11 @@ async function pullCommand(args2) {
       payload.preview_label,
       payload.branch_name
     );
-    fs12.mkdirSync(path14.dirname(hubFolder), { recursive: true });
+    fs14.mkdirSync(path16.dirname(hubFolder), { recursive: true });
     console.log("Writing hub configuration...");
     writeHubFolder(hubFolder, payload);
     await downloadBinaryResourceFiles(hubFolder, payload);
+    await downloadEvalAttachments(hubFolder, attachmentDownloads);
     const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
     console.log(`Hub configuration written to ${finalFolder}`);
     wroteFiles = true;
@@ -11848,6 +12281,7 @@ async function pullCommand(args2) {
       if (!diffResult.has_changes && !connectionsChanged) {
         writeHubFolder(hubFolder, payload);
         await downloadBinaryResourceFiles(hubFolder, payload);
+        await downloadEvalAttachments(hubFolder, attachmentDownloads);
         const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
         wroteFiles = true;
         if (finalFolder === hubFolder) {
@@ -11871,6 +12305,7 @@ async function pullCommand(args2) {
         if (!cancelled) {
           writeHubFolder(hubFolder, payload);
           await downloadBinaryResourceFiles(hubFolder, payload);
+          await downloadEvalAttachments(hubFolder, attachmentDownloads);
           const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
           console.log(`Hub configuration written to ${finalFolder}`);
           wroteFiles = true;
@@ -11880,6 +12315,7 @@ async function pullCommand(args2) {
       console.log("Writing hub configuration...");
       writeHubFolder(hubFolder, payload);
       await downloadBinaryResourceFiles(hubFolder, payload);
+      await downloadEvalAttachments(hubFolder, attachmentDownloads);
       const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
       console.log(`Hub configuration written to ${finalFolder}`);
       wroteFiles = true;
@@ -11893,9 +12329,11 @@ async function pullCommand(args2) {
 }
 async function writeProductionMirror(workspaceDir, prodPayload) {
   const folder = resolveHubFolder(workspaceDir, prodPayload.hub_id, prodPayload.hub.name, "production", null, null);
-  fs12.mkdirSync(path14.dirname(folder), { recursive: true });
+  fs14.mkdirSync(path16.dirname(folder), { recursive: true });
+  const attachmentDownloads = rewriteEvalAttachmentsToLocalPaths(prodPayload);
   writeHubFolder(folder, prodPayload, { seedAgentContext: false });
   await downloadBinaryResourceFiles(folder, prodPayload);
+  await downloadEvalAttachments(folder, attachmentDownloads);
   const finalFolder = autoRenameHubFolder(folder, prodPayload.hub.name, "production", prodPayload.hub_id, null, null);
   prependMirrorMarker(finalFolder, prodPayload.hub_id);
   return finalFolder;
@@ -11910,13 +12348,13 @@ async function mirrorLinkedProduction(client, workspaceDir, productionHubId, org
   }
 }
 function prependMirrorMarker(hubFolder, productionHubId) {
-  const hubYaml = path14.join(hubFolder, "hub.yaml");
+  const hubYaml = path16.join(hubFolder, "hub.yaml");
   try {
-    const content = fs12.readFileSync(hubYaml, "utf-8");
+    const content = fs14.readFileSync(hubYaml, "utf-8");
     if (content.startsWith(MIRROR_MARKER_PREFIX)) return;
     const marker = `${MIRROR_MARKER_PREFIX} ${productionHubId}. Edits are ignored; push is blocked. Edit the linked preview hub instead.
 `;
-    fs12.writeFileSync(hubYaml, marker + content, "utf-8");
+    fs14.writeFileSync(hubYaml, marker + content, "utf-8");
   } catch {
   }
 }
@@ -11925,8 +12363,8 @@ async function downloadBinaryResourceFiles(hubFolder, payload) {
   let downloadCount = 0;
   for (const resource of resources) {
     if (!resource.files) continue;
-    const resDir = path14.join(hubFolder, "resources", slugify(resource.name));
-    downloadCount += await downloadBinaryFiles(resDir, resource.files);
+    const resDir = path16.join(hubFolder, "resources", slugify(resource.name));
+    downloadCount += await downloadBinaryFiles(resDir, resource.files, hubFolder);
   }
   if (downloadCount > 0) {
     console.log(`Downloaded ${downloadCount} binary resource file(s).`);
@@ -11956,6 +12394,7 @@ var init_pull = __esm({
     init_diff_display();
     init_utils();
     init_resource_files();
+    init_eval_attachments();
     init_workspace();
     init_layout();
     init_workspace_files();
@@ -11970,6 +12409,7 @@ var push_exports = {};
 __export(push_exports, {
   autoRenameAgentFiles: () => autoRenameAgentFiles,
   createAndPushNewHub: () => createAndPushNewHub,
+  printErrors: () => printErrors,
   printSyncResult: () => printSyncResult,
   printWarnings: () => printWarnings,
   pushCommand: () => pushCommand,
@@ -11977,8 +12417,8 @@ __export(push_exports, {
   selectExistingHub: () => selectExistingHub,
   shouldWarnIgnoredPreviewLabel: () => shouldWarnIgnoredPreviewLabel
 });
-import * as fs13 from "fs";
-import * as path15 from "path";
+import * as fs15 from "fs";
+import * as path17 from "path";
 import * as yaml6 from "js-yaml";
 function parseArgs5(args2) {
   let autoConfirm = false;
@@ -12000,6 +12440,10 @@ function shouldWarnIgnoredPreviewLabel(localLabel, serverLabel) {
   return Boolean(localLabel) && serverLabel !== void 0 && localLabel !== serverLabel;
 }
 function printSyncResult(result) {
+  if (result.errors && result.errors.length > 0) {
+    printErrors(result.errors);
+    throw new Error(`Sync failed with ${result.errors.length} error(s). No completion was reported; inspect the errors above.`);
+  }
   console.log(`
 Sync complete. Preview hub: ${result.preview_hub_id}`);
   const c = result.changes;
@@ -12046,9 +12490,6 @@ Sync complete. Preview hub: ${result.preview_hub_id}`);
   if (parts.length > 0) {
     console.log(`Changes: ${parts.join(", ")}`);
   }
-  if (result.errors && result.errors.length > 0) {
-    printWarnings(result.errors);
-  }
   if (result.warnings && result.warnings.length > 0) {
     printWarnings(result.warnings.map((w) => w.message));
   }
@@ -12061,14 +12502,22 @@ function printWarnings(warnings) {
     console.log(`  \x1B[33m! ${w}\x1B[0m`);
   }
 }
+function printErrors(errors) {
+  if (errors.length === 0) return;
+  console.error(`
+\x1B[31mErrors (${errors.length}):\x1B[0m`);
+  for (const error of errors) {
+    console.error(`  \x1B[31m! ${error}\x1B[0m`);
+  }
+}
 async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId) {
-  const agentsDir = path15.join(hubFolder, "agents");
+  const agentsDir = path17.join(hubFolder, "agents");
   let agentsWithIds = [];
-  if (fs13.existsSync(agentsDir)) {
-    const yamlFiles = fs13.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml"));
+  if (fs15.existsSync(agentsDir)) {
+    const yamlFiles = fs15.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml"));
     for (const file of yamlFiles) {
       try {
-        const content = fs13.readFileSync(path15.join(agentsDir, file), "utf-8");
+        const content = fs15.readFileSync(path17.join(agentsDir, file), "utf-8");
         const agent = yaml6.load(content);
         if (agent?.id && agent.name) {
           agentsWithIds.push({ id: agent.id, name: agent.name });
@@ -12081,7 +12530,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId) {
   if (agentsWithIds.length === 0) {
     const yamlPath = resolveHubYamlPath(hubFolder);
     if (!yamlPath) return;
-    const yamlContent = fs13.readFileSync(yamlPath, "utf-8");
+    const yamlContent = fs15.readFileSync(yamlPath, "utf-8");
     const config = yaml6.load(yamlContent);
     agentsWithIds = (config.agents || []).filter((a) => !!a.id && !!a.name);
   }
@@ -12111,18 +12560,18 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId) {
     }
   }
   if (renames.length === 0) return;
-  if (!fs13.existsSync(agentsDir)) return;
-  for (const file of fs13.readdirSync(agentsDir)) {
+  if (!fs15.existsSync(agentsDir)) return;
+  for (const file of fs15.readdirSync(agentsDir)) {
     if (file.startsWith("__rename_temp_") && (file.endsWith(".md") || file.endsWith(".yaml"))) {
       console.warn(`  Warning: removing orphaned temp file agents/${file}`);
-      fs13.unlinkSync(path15.join(agentsDir, file));
+      fs15.unlinkSync(path17.join(agentsDir, file));
     }
   }
   const renameFileIfExists = (dir, oldName, newName) => {
-    const oldPath = path15.join(dir, oldName);
-    const newPath = path15.join(dir, newName);
-    if (!fs13.existsSync(oldPath)) return false;
-    fs13.renameSync(oldPath, newPath);
+    const oldPath = path17.join(dir, oldName);
+    const newPath = path17.join(dir, newName);
+    if (!fs15.existsSync(oldPath)) return false;
+    fs15.renameSync(oldPath, newPath);
     return true;
   };
   const oldSlugs = new Set(renames.map((r) => r.oldSlug));
@@ -12155,9 +12604,9 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId) {
     }
   } else {
     for (const { oldSlug, newSlug } of renames) {
-      const hasOldFile = extensions.some((ext) => fs13.existsSync(path15.join(agentsDir, `${oldSlug}${ext}`)));
+      const hasOldFile = extensions.some((ext) => fs15.existsSync(path17.join(agentsDir, `${oldSlug}${ext}`)));
       if (!hasOldFile) continue;
-      const hasNewFile = extensions.some((ext) => fs13.existsSync(path15.join(agentsDir, `${newSlug}${ext}`)));
+      const hasNewFile = extensions.some((ext) => fs15.existsSync(path17.join(agentsDir, `${newSlug}${ext}`)));
       if (hasNewFile) {
         console.warn(`  Warning: skipping rename agents/${oldSlug}.* \u2192 agents/${newSlug}.* (target already exists)`);
         continue;
@@ -12172,7 +12621,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId) {
   if (completedRenames.length === 0) return;
   const mainYamlPath = resolveHubYamlPath(hubFolder);
   if (mainYamlPath) {
-    const mainYamlContent = fs13.readFileSync(mainYamlPath, "utf-8");
+    const mainYamlContent = fs15.readFileSync(mainYamlPath, "utf-8");
     const substitutionMap = /* @__PURE__ */ new Map();
     for (const { oldSlug, newSlug } of completedRenames) {
       substitutionMap.set(`agents/${oldSlug}.md`, `agents/${newSlug}.md`);
@@ -12183,8 +12632,8 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId) {
       (_match, prefix, pathMatch) => `${prefix}${substitutionMap.get(pathMatch) ?? pathMatch}`
     );
     if (updatedYaml !== mainYamlContent) {
-      fs13.writeFileSync(mainYamlPath, updatedYaml, "utf-8");
-      console.log(`  Updated instructions paths in ${path15.basename(mainYamlPath)}`);
+      fs15.writeFileSync(mainYamlPath, updatedYaml, "utf-8");
+      console.log(`  Updated instructions paths in ${path17.basename(mainYamlPath)}`);
     }
   }
 }
@@ -12245,7 +12694,7 @@ async function pushSingleHub(client, hubId, hubFolder, autoConfirm, organization
 function selectExistingHub(workspaceDir, allHubs, selector, wsLabel) {
   if (selector) {
     const match = allHubs.find(
-      (h) => h.hubId === selector || path15.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path17.basename(h.hubFolder) === selector
     );
     if (!match) {
       console.error(`No hub matching --hub ${selector} found in ${wsLabel}/.`);
@@ -12288,7 +12737,7 @@ New hub: "${newHub.hubName}" (${hubType})`);
     process.exit(1);
   }
   console.log(`Hub created: ${createdHub.hub_name} (${hubId})`);
-  const content = fs13.readFileSync(hubYamlPath, "utf-8");
+  const content = fs15.readFileSync(hubYamlPath, "utf-8");
   const hasVersion = content.match(/^version:\s/m);
   let updated;
   if (hasVersion) {
@@ -12304,7 +12753,7 @@ hub_id: "${hubId}"
 hub_environment: preview
 ${content}`;
   }
-  fs13.writeFileSync(hubYamlPath, updated, "utf-8");
+  fs15.writeFileSync(hubYamlPath, updated, "utf-8");
   autoBindIfUnbound(hubId);
   await pushSingleHub(client, hubId, newHub.hubFolder, opts.autoConfirm, opts.organizationId, { skipAgentRename: true });
 }
@@ -12313,7 +12762,7 @@ function reportUnresolvedPushTarget(reason, existingHubs, newHubs, selector, wsL
     if (existingHubs.length > 0) {
       console.error(`No pushable hub found in ${wsLabel}/ \u2014 only read-only production mirror folder(s). Edit the linked preview hub, pull one, or create a new hub with \`wayai create\`:`);
       for (const h of existingHubs) {
-        console.error(`  ${path15.basename(h.hubFolder)} (${h.hubId}, production mirror)`);
+        console.error(`  ${path17.basename(h.hubFolder)} (${h.hubId}, production mirror)`);
       }
     } else {
       console.error(`No hub folders found. Create hub files in ${wsLabel}/<hub>/hub.yaml with \`hub: { name: ... }\` and run \`wayai push\` (or \`wayai create\`).`);
@@ -12326,10 +12775,10 @@ function reportUnresolvedPushTarget(reason, existingHubs, newHubs, selector, wsL
     console.error(`Multiple hub folders found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
   }
   for (const h of existingHubs) {
-    console.error(`  ${path15.basename(h.hubFolder)} (${h.hubId})`);
+    console.error(`  ${path17.basename(h.hubFolder)} (${h.hubId})`);
   }
   for (const h of newHubs) {
-    console.error(`  ${path15.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
+    console.error(`  ${path17.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
   }
   process.exit(1);
 }
@@ -12348,7 +12797,7 @@ async function pushCommand(args2) {
       console.error(`Created ${file}`);
     }
   }
-  if (!fs13.existsSync(workspaceDir)) {
+  if (!fs15.existsSync(workspaceDir)) {
     console.error(`No ${wsLabel}/ directory found. Run \`wayai pull\` first or create hub files in ${wsLabel}/<hub>/hub.yaml.`);
     process.exit(1);
   }
@@ -12367,8 +12816,8 @@ async function pushCommand(args2) {
     if (label) {
       console.warn("Note: --label is only used when creating a new hub. To change an existing hub's label, use `wayai relabel`.");
     }
-    console.log(`Target hub: ${path15.basename(existing.hubFolder)} (${existing.hubId})`);
-    assertHubMatchesBinding(existing.hubId, path15.basename(existing.hubFolder));
+    console.log(`Target hub: ${path17.basename(existing.hubFolder)} (${existing.hubId})`);
+    assertHubMatchesBinding(existing.hubId, path17.basename(existing.hubFolder));
     await pushSingleHub(client, existing.hubId, existing.hubFolder, autoConfirm, organizationId);
     return;
   }
@@ -12398,8 +12847,8 @@ var create_exports = {};
 __export(create_exports, {
   createCommand: () => createCommand
 });
-import * as path16 from "path";
-import * as fs14 from "fs";
+import * as path18 from "path";
+import * as fs16 from "fs";
 function parseArgs6(args2) {
   let autoConfirm = false;
   let folderSelector;
@@ -12426,7 +12875,7 @@ async function createCommand(args2) {
   const gitRoot = findGitRoot();
   const wsLabel = hubsDirLabel(gitRoot);
   if (gitRoot) warnLayoutOnce(gitRoot);
-  if (!fs14.existsSync(workspaceDir)) {
+  if (!fs16.existsSync(workspaceDir)) {
     console.error(`No ${wsLabel}/ directory found. Create hub files in ${wsLabel}/<hub>/hub.yaml with \`hub: { name: ... }\` first.`);
     process.exit(1);
   }
@@ -12435,7 +12884,7 @@ async function createCommand(args2) {
   const resolution = resolveNewHubForCreate(workspaceDir, existingHubs, newHubs, folderSelector);
   if (!resolution.ok) {
     if (resolution.reason === "exists") {
-      const folder = path16.basename(resolution.existing.hubFolder);
+      const folder = path18.basename(resolution.existing.hubFolder);
       console.error(`Hub "${folder}" already exists (${resolution.existing.hubId}). Use \`wayai push --hub ${folder}\` to update it.`);
       process.exit(1);
     }
@@ -12449,7 +12898,7 @@ async function createCommand(args2) {
     }
     console.error(`Multiple new hub folders found in ${wsLabel}/. Pass the folder name (\`wayai create <folder>\`) or run from inside one:`);
     for (const h of newHubs) {
-      console.error(`  ${path16.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
+      console.error(`  ${path18.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
     }
     process.exit(1);
   }
@@ -12631,12 +13080,12 @@ function typeMatches2(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema2(schema, path28, errors, opts = {}) {
+function validateSchema2(schema, path30, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH2) {
     errors.push({
-      path: path28 || "<root>",
+      path: path30 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH2} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -12644,7 +13093,7 @@ function validateSchema2(schema, path28, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path28,
+      path: path30,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -12652,14 +13101,14 @@ function validateSchema2(schema, path28, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path28 ? `${path28}.type` : "type",
+        path: path30 ? `${path30}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches2(schema.type, ALLOWED_TYPES2)) {
     errors.push({
-      path: `${path28}.type`,
+      path: `${path30}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES2].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -12668,25 +13117,25 @@ function validateSchema2(schema, path28, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS2.includes(e);
       errors.push({
-        path: `${path28}.enum`,
+        path: `${path30}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path28}.enum`,
+        path: `${path30}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path28}.enum`,
+        path: `${path30}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive2(e[i])) {
           errors.push({
-            path: `${path28}.enum[${i}]`,
+            path: `${path30}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -12696,7 +13145,7 @@ function validateSchema2(schema, path28, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path28}.${key}`,
+        path: `${path30}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -12705,45 +13154,45 @@ function validateSchema2(schema, path28, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path28}.properties`,
+        path: `${path30}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema2(propSchema, `${path28}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema2(propSchema, `${path30}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes2(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema2(sub, `${path28}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema2(sub, `${path30}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema2(schema.items, `${path28}.items`, errors, { depth: depth + 1 });
+      validateSchema2(schema.items, `${path30}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS2) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema2(schema[key], `${path28}.${key}`, errors, { depth: depth + 1 });
+      validateSchema2(schema[key], `${path30}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS2) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema2(sub, `${path28}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema2(sub, `${path30}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS2) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema2(sub, `${path28}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema2(sub, `${path30}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path28}.${k}`;
+    const fieldPath = `${path30}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS2) {
       if (v === token) {
@@ -12818,15 +13267,17 @@ function describeRole2(role) {
   return `a ${typeof role}`;
 }
 function asEvalInputRecord2(input) {
-  const value = typeof input === "string" ? (() => {
-    try {
-      return JSON.parse(input);
-    } catch {
-      return null;
-    }
-  })() : input;
+  const value = parseMaybeJson2(input);
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+function parseMaybeJson2(value) {
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
 function evalInputRoleError2(input) {
   const record = asEvalInputRecord2(input);
   if (record === null) return null;
@@ -12837,6 +13288,32 @@ function evalInputRoleError2(input) {
   }
   return `role must be ${EVAL_INPUT_ROLE_LIST2} (received ${describeRole2(role)}) \u2014 an eval trigger is what the responder answers, and an assistant or tool role gives it nothing to answer`;
 }
+function evalTurnAttachmentsError2(turn) {
+  const record = asEvalInputRecord2(turn);
+  if (record === null) return null;
+  const attachments = record.attachments;
+  if (attachments === void 0 || attachments === null) return null;
+  if (!Array.isArray(attachments)) return "attachments must be an array";
+  if (attachments.length === 0) return null;
+  if (attachments.length > MAX_ATTACHMENTS_PER_MESSAGE2) {
+    return `attachments must have at most ${MAX_ATTACHMENTS_PER_MESSAGE2} items`;
+  }
+  if (!turnMayCarryAttachments2({ role: String(record.role), attachments })) {
+    return ATTACHMENTS_USER_ONLY_MESSAGE2;
+  }
+  for (let i = 0; i < attachments.length; i++) {
+    const parsed = evalAttachmentRef2.safeParse(attachments[i]);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0];
+      return `attachments[${i}].${issue?.path.join(".") || "?"} is invalid: ${issue?.message ?? "malformed"}`;
+    }
+  }
+  return null;
+}
+function asEvalHistoryArray2(history) {
+  const value = parseMaybeJson2(history);
+  return Array.isArray(value) ? value : null;
+}
 function refineEvalMessageTextRole2(value, ctx) {
   const error = evalInputRoleError2(value.eval.message_text);
   if (error) {
@@ -12847,6 +13324,38 @@ function refineEvalMessageTextRole2(value, ctx) {
     });
   }
 }
+function refineEvalAttachments2(value, ctx) {
+  const triggerError = evalTurnAttachmentsError2(value.eval.message_text);
+  if (triggerError) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["eval", "message_text", "attachments"],
+      message: triggerError
+    });
+  }
+  const history = asEvalHistoryArray2(value.eval.message_history);
+  if (!history) return;
+  for (let i = 0; i < history.length; i++) {
+    const error = evalTurnAttachmentsError2(history[i]);
+    if (error) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["eval", "message_history", i, "attachments"],
+        message: error
+      });
+    }
+  }
+}
+function collectTurnAttachmentHashes2(turn) {
+  const atts = asEvalInputRecord2(turn)?.attachments;
+  if (!Array.isArray(atts)) return [];
+  const hashes = [];
+  for (const a of atts) {
+    const parsed = evalAttachmentRef2.safeParse(a);
+    if (parsed.success) hashes.push(parsed.data.hash);
+  }
+  return hashes;
+}
 function refineHubAsCodeCustomTools2(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -12954,10 +13463,84 @@ function refineHubAsCodeEvals2(config, ctx) {
     }
   }
 }
-function isSafeTemplatePath2(path28) {
-  if (path28.length === 0 || path28.length > 300) return false;
-  if (path28.startsWith("/") || path28.includes("\\")) return false;
-  const segments = path28.split("/");
+function refineHubAsCodeEvalAttachments2(config, ctx) {
+  const cfg = config;
+  const referencedHashes = /* @__PURE__ */ new Set();
+  const addTurnIssue = (path30, turn, name) => {
+    const error = evalTurnAttachmentsError2(turn);
+    if (error) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path30, message: `${name}: ${error}` });
+      return;
+    }
+    for (const hash of collectTurnAttachmentHashes2(turn)) referencedHashes.add(hash);
+  };
+  if (Array.isArray(cfg.evals)) {
+    cfg.evals.forEach((entry, e) => {
+      const ev = entry;
+      const name = `eval "${ev?.name ?? "<unnamed>"}"`;
+      addTurnIssue(["evals", e, "input"], ev?.input, name);
+      if (Array.isArray(ev?.history)) {
+        ev.history.forEach((turn, h) => addTurnIssue(["evals", e, "history", h], turn, name));
+      }
+    });
+  }
+  if (Array.isArray(cfg.journeys)) {
+    cfg.journeys.forEach((entry, j) => {
+      const jr = entry;
+      const name = `journey "${jr?.name ?? "<unnamed>"}"`;
+      if (Array.isArray(jr?.transcript)) {
+        jr.transcript.forEach((turn, t) => addTurnIssue(["journeys", j, "transcript", t], turn, name));
+      }
+    });
+  }
+  const carriedHashes = /* @__PURE__ */ new Set();
+  const files = cfg.eval_attachment_files;
+  if (Array.isArray(files)) {
+    if (files.length > MAX_EVAL_ATTACHMENT_CARRIERS2) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["eval_attachment_files"],
+        message: `too many attachment carriers (${files.length}); the maximum is ${MAX_EVAL_ATTACHMENT_CARRIERS2}`
+      });
+    }
+    let aggregateEncoded = 0;
+    files.forEach((f, i) => {
+      const h = f?.hash;
+      if (typeof h === "string") carriedHashes.add(h);
+      const b64 = f?.content_base64;
+      if (typeof b64 === "string") {
+        aggregateEncoded += b64.length;
+        if (b64.length > MAX_EVAL_ATTACHMENT_ENCODED_BYTES2) {
+          ctx.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["eval_attachment_files", i, "content_base64"],
+            message: `attachment ${typeof h === "string" ? `${h.slice(0, 12)}\u2026 ` : ""}exceeds the ${(MAX_RESOURCE_FILE_SIZE3 / 1024 / 1024).toFixed(0)}MB size limit`
+          });
+        }
+      }
+    });
+    if (aggregateEncoded > MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["eval_attachment_files"],
+        message: `total attachment bytes exceed the ${(MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2 / 1024 / 1024).toFixed(0)}MB per-push limit \u2014 split the push or reduce attachments`
+      });
+    }
+  }
+  for (const hash of referencedHashes) {
+    if (!carriedHashes.has(hash)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["eval_attachment_files"],
+        message: `attachment ${hash.slice(0, 12)}\u2026 is referenced by a turn but its bytes are missing from eval_attachment_files`
+      });
+    }
+  }
+}
+function isSafeTemplatePath2(path30) {
+  if (path30.length === 0 || path30.length > 300) return false;
+  if (path30.startsWith("/") || path30.includes("\\")) return false;
+  const segments = path30.split("/");
   return segments.every(
     (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
   );
@@ -12985,14 +13568,14 @@ function isPlainObject(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 }
-function isSanitizableSliceFile(path28) {
-  if (!/\.ya?ml$/i.test(path28)) return false;
-  return path28 !== "resources" && !path28.startsWith("resources/");
+function isSanitizableSliceFile(path30) {
+  if (!/\.ya?ml$/i.test(path30)) return false;
+  return path30 !== "resources" && !path30.startsWith("resources/");
 }
 function distinctUsesBackends(uses) {
   return [...new Set((uses ?? []).map((u) => u.backend))];
 }
-var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, appMessageBody2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminHubIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminSetOrgHarnessBody2, adminSetHubHarnessBody2, adminScopedTargetBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
+var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, EVAL_ATTACHMENT_HASH_REGEX2, evalAttachmentRef2, turnMayCarryAttachments2, ATTACHMENTS_USER_ONLY_MESSAGE2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, appMessageBody2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, MAX_RESOURCE_FILE_SIZE3, MAX_EVAL_ATTACHMENT_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_CARRIERS2, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminHubIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminSetOrgHarnessBody2, adminSetHubHarnessBody2, adminScopedTargetBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -14164,10 +14747,10 @@ var init_contracts = __esm({
     ROLE_ECHO_MAX2 = 40;
     createEvalBody2 = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    }).superRefine(refineEvalMessageTextRole2);
+    }).superRefine(refineEvalMessageTextRole2).superRefine(refineEvalAttachments2);
     updateEvalBody2 = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    }).superRefine(refineEvalMessageTextRole2);
+    }).superRefine(refineEvalMessageTextRole2).superRefine(refineEvalAttachments2);
     getEvalsQuery2 = external_exports.object({
       hub_id: external_exports.string().uuid(),
       agent_id: external_exports.string().uuid().optional(),
@@ -14294,6 +14877,15 @@ var init_contracts = __esm({
       journey_name: external_exports.string().min(1).max(200),
       evaluator_instructions: external_exports.string().max(4e3).optional()
     });
+    EVAL_ATTACHMENT_HASH_REGEX2 = /^[a-f0-9]{64}$/;
+    evalAttachmentRef2 = external_exports.object({
+      hash: external_exports.string().regex(EVAL_ATTACHMENT_HASH_REGEX2),
+      file_name: external_exports.string().min(1).max(255),
+      mime_type: external_exports.string().min(1).max(255),
+      file_size: external_exports.number().int().positive().optional()
+    });
+    turnMayCarryAttachments2 = (turn) => !turn.attachments || turn.attachments.length === 0 || turn.role === "user";
+    ATTACHMENTS_USER_ONLY_MESSAGE2 = "attachments are only valid on user turns";
     journeyIdParam2 = external_exports.object({ id: external_exports.string().uuid() });
     journeyToolCallSchema2 = external_exports.object({
       id: external_exports.string(),
@@ -14305,7 +14897,10 @@ var init_contracts = __esm({
       content: external_exports.string().nullable().optional(),
       tool_calls: external_exports.array(journeyToolCallSchema2).optional(),
       tool_call_id: external_exports.string().optional(),
-      step_id: external_exports.string().optional()
+      step_id: external_exports.string().optional(),
+      attachments: external_exports.array(evalAttachmentRef2).max(MAX_ATTACHMENTS_PER_MESSAGE2).optional()
+    }).refine(turnMayCarryAttachments2, {
+      message: ATTACHMENTS_USER_ONLY_MESSAGE2
     });
     journeyStepOverrideSchema2 = external_exports.object({
       number_of_runs: external_exports.number().int().positive().max(100).optional(),
@@ -14810,6 +15405,10 @@ var init_contracts = __esm({
       agent_id: external_exports.string().uuid().nullable().optional(),
       trigger_message: external_exports.string().nullable().optional()
     });
+    MAX_RESOURCE_FILE_SIZE3 = 10 * 1024 * 1024;
+    MAX_EVAL_ATTACHMENT_ENCODED_BYTES2 = Math.ceil(MAX_RESOURCE_FILE_SIZE3 / 3) * 4 + 16;
+    MAX_EVAL_ATTACHMENT_CARRIERS2 = 1e3;
+    MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2 = 16 * 1024 * 1024;
     uuidPattern2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     ciUuidSchema2 = external_exports.string().regex(uuidPattern2, "must be a valid UUID");
     hubAsCodeConfigSchema2 = external_exports.object({
@@ -14822,6 +15421,7 @@ var init_contracts = __esm({
       refineHubAsCodeKanbanStatuses2(config, ctx);
       refineHubAsCodeLanes2(config, ctx);
       refineHubAsCodeEvals2(config, ctx);
+      refineHubAsCodeEvalAttachments2(config, ctx);
     });
     ciPullHubIdParam2 = external_exports.object({
       hub_id: ciUuidSchema2
@@ -15711,8 +16311,8 @@ var replicate_exports = {};
 __export(replicate_exports, {
   replicateCommand: () => replicateCommand
 });
-import * as fs15 from "fs";
-import * as path17 from "path";
+import * as fs17 from "fs";
+import * as path19 from "path";
 function parseArgs8(args2) {
   let label;
   let hubSelector;
@@ -15758,7 +16358,7 @@ async function replicateCommand(args2) {
     payload.preview_label,
     payload.branch_name
   );
-  fs15.mkdirSync(path17.dirname(hubFolder), { recursive: true });
+  fs17.mkdirSync(path19.dirname(hubFolder), { recursive: true });
   writeHubFolder(hubFolder, payload);
   await downloadBinaryResourceFiles(hubFolder, payload);
   hubFolder = autoRenameHubFolder(
@@ -15770,8 +16370,8 @@ async function replicateCommand(args2) {
     payload.branch_name
   );
   autoBindIfUnbound(previewHubId);
-  console.log(`Preview written to ${path17.basename(hubFolder)}`);
-  console.log(`  Switch to it with: wayai use ${path17.basename(hubFolder)}`);
+  console.log(`Preview written to ${path19.basename(hubFolder)}`);
+  console.log(`  Switch to it with: wayai use ${path19.basename(hubFolder)}`);
 }
 var init_replicate = __esm({
   "src/commands/replicate.ts"() {
@@ -15793,7 +16393,7 @@ var relabel_exports = {};
 __export(relabel_exports, {
   relabelCommand: () => relabelCommand
 });
-import * as path18 from "path";
+import * as path20 from "path";
 function parseArgs9(args2) {
   let label;
   let clear = false;
@@ -15837,7 +16437,7 @@ async function relabelCommand(args2) {
     } else {
       console.error(`Multiple hubs found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
       for (const h of previewHubs) {
-        console.error(`  ${path18.basename(h.hubFolder)} (${h.hubId})`);
+        console.error(`  ${path20.basename(h.hubFolder)} (${h.hubId})`);
       }
     }
     process.exit(1);
@@ -15846,7 +16446,7 @@ async function relabelCommand(args2) {
     console.log("This is a read-only production mirror \u2014 production hubs have no preview label. Relabel the linked preview hub instead.");
     return;
   }
-  assertHubMatchesBinding(target.hubId, path18.basename(target.hubFolder));
+  assertHubMatchesBinding(target.hubId, path20.basename(target.hubFolder));
   console.log(normalizedLabel ? `Setting preview label to "${normalizedLabel}"...` : "Clearing preview label...");
   const { data } = await client.relabelPreview(target.hubId, normalizedLabel);
   const row = data[0];
@@ -15862,7 +16462,7 @@ async function relabelCommand(args2) {
   );
   console.log(serverLabel ? `Preview label set to "${serverLabel}".` : "Preview label cleared.");
   if (finalFolder !== target.hubFolder) {
-    console.log(`Hub folder is now ${path18.basename(finalFolder)}`);
+    console.log(`Hub folder is now ${path20.basename(finalFolder)}`);
   }
 }
 var init_relabel = __esm({
@@ -15888,7 +16488,7 @@ __export(publish_exports, {
   renderHubDiff: () => renderHubDiff,
   runPublish: () => runPublish
 });
-import * as path19 from "path";
+import * as path21 from "path";
 function parseArgs10(args2) {
   let autoConfirm = false;
   let hubSelector;
@@ -15994,7 +16594,7 @@ async function publishCommand(args2) {
       return;
     }
   }
-  assertHubMatchesBinding(hubId, hubFolder ? path19.basename(hubFolder) : void 0);
+  assertHubMatchesBinding(hubId, hubFolder ? path21.basename(hubFolder) : void 0);
   await runPublish(client, { hubId, localConfig, organizationId, autoConfirm });
 }
 var STATUS_STYLE;
@@ -16026,7 +16626,7 @@ var use_exports = {};
 __export(use_exports, {
   useCommand: () => useCommand
 });
-import * as path20 from "path";
+import * as path22 from "path";
 async function useCommand(args2) {
   const target = args2[0];
   if (!target || target.startsWith("-")) {
@@ -16048,7 +16648,7 @@ async function useCommand(args2) {
     const match = findHubByFolderName(workspaceDir, target);
     if (!match) {
       const newHubs = scanNewHubs(workspaceDir);
-      const pending = newHubs.find((h) => path20.basename(h.hubFolder) === target);
+      const pending = newHubs.find((h) => path22.basename(h.hubFolder) === target);
       if (pending) {
         console.error(
           `"${target}" is a new hub that hasn't been created on the platform yet, so it has no id to bind to.
@@ -16059,10 +16659,10 @@ Create it first \u2014 the worktree binds automatically afterward:
       }
       console.error(`No hub matching "${target}" found in ${wsLabel}/. Pass a UUID or a folder name from:`);
       for (const h of scanWorkspaceHubs(workspaceDir)) {
-        console.error(`  ${path20.basename(h.hubFolder)} (${h.hubId})`);
+        console.error(`  ${path22.basename(h.hubFolder)} (${h.hubId})`);
       }
       for (const h of newHubs) {
-        console.error(`  ${path20.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path20.basename(h.hubFolder)}\`)`);
+        console.error(`  ${path22.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path22.basename(h.hubFolder)}\`)`);
       }
       process.exit(1);
     }
@@ -16101,11 +16701,11 @@ __export(migrate_exports, {
   migrateCommand: () => migrateCommand
 });
 import { execFileSync as execFileSync3 } from "child_process";
-import * as fs16 from "fs";
-import * as path21 from "path";
+import * as fs18 from "fs";
+import * as path23 from "path";
 function isTracked(gitRoot, p) {
   try {
-    execFileSync3("git", ["ls-files", "--error-unmatch", "--", path21.relative(gitRoot, p)], {
+    execFileSync3("git", ["ls-files", "--error-unmatch", "--", path23.relative(gitRoot, p)], {
       cwd: gitRoot,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -16115,10 +16715,10 @@ function isTracked(gitRoot, p) {
   }
 }
 function moveDir(gitRoot, from, to) {
-  fs16.mkdirSync(path21.dirname(to), { recursive: true });
+  fs18.mkdirSync(path23.dirname(to), { recursive: true });
   if (isTracked(gitRoot, from)) {
     try {
-      execFileSync3("git", ["mv", path21.relative(gitRoot, from), path21.relative(gitRoot, to)], {
+      execFileSync3("git", ["mv", path23.relative(gitRoot, from), path23.relative(gitRoot, to)], {
         cwd: gitRoot,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -16126,7 +16726,7 @@ function moveDir(gitRoot, from, to) {
     } catch {
     }
   }
-  fs16.renameSync(from, to);
+  fs18.renameSync(from, to);
   return "fs";
 }
 async function migrateCommand(_args) {
@@ -16135,12 +16735,12 @@ async function migrateCommand(_args) {
     console.error("Not inside a git repository.");
     process.exit(1);
   }
-  const rel = (p) => path21.relative(gitRoot, p);
-  const newWs = path21.join(gitRoot, WAYAI_LAYOUT.wsDir);
-  const legacyWs = path21.join(gitRoot, WAYAI_LAYOUT.legacy.wsDir);
-  const legacyOrg = path21.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
-  const newHubs = path21.join(newWs, WAYAI_LAYOUT.hubsSubdir);
-  const newOrg = path21.join(newWs, WAYAI_LAYOUT.orgSubdir);
+  const rel = (p) => path23.relative(gitRoot, p);
+  const newWs = path23.join(gitRoot, WAYAI_LAYOUT.wsDir);
+  const legacyWs = path23.join(gitRoot, WAYAI_LAYOUT.legacy.wsDir);
+  const legacyOrg = path23.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
+  const newHubs = path23.join(newWs, WAYAI_LAYOUT.hubsSubdir);
+  const newOrg = path23.join(newWs, WAYAI_LAYOUT.orgSubdir);
   const hasLegacyWs = isDirectory(legacyWs);
   const hasLegacyOrg = isDirectory(legacyOrg);
   if (!hasLegacyWs && !hasLegacyOrg) {
@@ -16214,12 +16814,12 @@ var send_message_exports = {};
 __export(send_message_exports, {
   sendMessageCommand: () => sendMessageCommand
 });
-import * as fs17 from "fs";
-import * as path22 from "path";
+import * as fs19 from "fs";
+import * as path24 from "path";
 function statAttachment(filePath) {
   let stat;
   try {
-    stat = fs17.statSync(filePath);
+    stat = fs19.statSync(filePath);
   } catch {
     console.error(`Error: file not found: ${filePath}`);
     process.exit(1);
@@ -16231,11 +16831,11 @@ function statAttachment(filePath) {
   return { filePath, size: stat.size };
 }
 function readAttachment(filePath, size) {
-  const fileName = path22.basename(filePath);
-  const ext = path22.extname(fileName).replace(/^\./, "");
+  const fileName = path24.basename(filePath);
+  const ext = path24.extname(fileName).replace(/^\./, "");
   return {
     file_name: fileName,
-    file_binary: fs17.readFileSync(filePath).toString("base64"),
+    file_binary: fs19.readFileSync(filePath).toString("base64"),
     file_size: size,
     ...ext && { file_extension: ext }
   };
@@ -16282,7 +16882,7 @@ async function sendMessageCommand(args2) {
   }
   const stats = filePaths.map(statAttachment);
   const filesTotal = stats.reduce((sum, s) => sum + base64Length(s.size), 0);
-  const fileDetail = () => stats.map((s) => `${path22.basename(s.filePath)} ${asMb(s.size)} MB`).join(", ");
+  const fileDetail = () => stats.map((s) => `${path24.basename(s.filePath)} ${asMb(s.size)} MB`).join(", ");
   if (filesTotal > MAX_MESSAGE_BODY_BYTES2) {
     console.error(
       `Error: ${fileDetail()} encode to ~${asMb(filesTotal)} MB, over the ${asMb(MAX_MESSAGE_BODY_BYTES2)} MB per-request limit.`
@@ -17517,7 +18117,7 @@ Timeout after ${timeoutSeconds}s. Session is still running.`);
   console.log(`Check results: wayai eval-results --session ${sessionId}`);
 }
 function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function parsePacing(raw) {
   const NAMED = EVAL_PACING_PRESET_NAMES.filter((p) => p !== "custom");
@@ -17742,8 +18342,8 @@ var eval_capture_exports = {};
 __export(eval_capture_exports, {
   evalCaptureCommand: () => evalCaptureCommand
 });
-import * as fs18 from "fs";
-import * as path23 from "path";
+import * as fs20 from "fs";
+import * as path25 from "path";
 import * as yaml7 from "js-yaml";
 function isValidSetName(name) {
   if (name.length === 0 || name === "." || name === "..") return false;
@@ -17809,15 +18409,15 @@ async function evalCaptureCommand(args2) {
   const setFolderName = targetSetName;
   const scenarioName = parsed.evalName ?? `Capture ${parsed.conversationId.slice(0, 8)}`;
   const slug = slugify(scenarioName);
-  const evalsDir = path23.join(hubFolder, "evals");
-  const targetDir = path23.join(evalsDir, setFolderName);
-  const targetPath = path23.join(targetDir, `${slug}.yaml`);
-  if (!targetPath.startsWith(evalsDir + path23.sep)) {
-    console.error(`Resolved path "${path23.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
+  const evalsDir = path25.join(hubFolder, "evals");
+  const targetDir = path25.join(evalsDir, setFolderName);
+  const targetPath = path25.join(targetDir, `${slug}.yaml`);
+  if (!targetPath.startsWith(evalsDir + path25.sep)) {
+    console.error(`Resolved path "${path25.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
     process.exit(1);
   }
-  if (fs18.existsSync(targetPath)) {
-    console.error(`File already exists: ${path23.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
+  if (fs20.existsSync(targetPath)) {
+    console.error(`File already exists: ${path25.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
     process.exit(1);
   }
   console.log("Resolving scenario set...");
@@ -17849,9 +18449,9 @@ async function evalCaptureCommand(args2) {
     ...captured.evaluator_instructions ? { evaluator_instructions: captured.evaluator_instructions } : {}
   };
   const yamlObj = buildEvalYamlObject(evalEntry, slug);
-  fs18.mkdirSync(targetDir, { recursive: true });
-  fs18.writeFileSync(targetPath, yaml7.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
-  const relPath = path23.relative(process.cwd(), targetPath);
+  fs20.mkdirSync(targetDir, { recursive: true });
+  fs20.writeFileSync(targetPath, yaml7.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
+  const relPath = path25.relative(process.cwd(), targetPath);
   console.log(`
 Wrote ${relPath}`);
   console.log("Run `wayai pull` to refresh the agent display name, then commit. The scenario is already on the platform.");
@@ -19078,23 +19678,23 @@ var init_set_connection_credential = __esm({
 });
 
 // src/lib/org-workspace.ts
-import * as fs19 from "fs";
-import * as path24 from "path";
+import * as fs21 from "fs";
+import * as path26 from "path";
 import * as yaml8 from "js-yaml";
 function getOrgDir(gitRoot) {
   return resolveLayout(gitRoot).orgDir;
 }
 function orgManifestExists(orgDir) {
-  return fs19.existsSync(path24.join(orgDir, ORG_MANIFEST_NAME));
+  return fs21.existsSync(path26.join(orgDir, ORG_MANIFEST_NAME));
 }
 function parseOrgResources(orgDir) {
-  const manifestPath = path24.join(orgDir, ORG_MANIFEST_NAME);
+  const manifestPath = path26.join(orgDir, ORG_MANIFEST_NAME);
   let manifest = {};
-  if (fs19.existsSync(manifestPath)) {
-    manifest = yaml8.load(fs19.readFileSync(manifestPath, "utf-8")) ?? {};
+  if (fs21.existsSync(manifestPath)) {
+    manifest = yaml8.load(fs21.readFileSync(manifestPath, "utf-8")) ?? {};
   }
   const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
-  const resourcesDir = path24.join(orgDir, "resources");
+  const resourcesDir = path26.join(orgDir, "resources");
   const resources = rawResources.map((res) => {
     const resource = { name: res.name };
     if (res.id) resource.id = res.id;
@@ -19106,8 +19706,8 @@ function parseOrgResources(orgDir) {
     if (res.environment) resource.environment = res.environment;
     if (Array.isArray(res.tags)) resource.tags = res.tags;
     if (Array.isArray(res.folders)) resource.folders = res.folders;
-    const resDir = path24.join(resourcesDir, slugify(resource.name));
-    if (fs19.existsSync(resDir)) {
+    const resDir = path26.join(resourcesDir, slugify(resource.name));
+    if (fs21.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) resource.files = files;
     }
@@ -19116,28 +19716,28 @@ function parseOrgResources(orgDir) {
   return { version: 1, resources };
 }
 function writeOrgResources(orgDir, payload) {
-  fs19.mkdirSync(orgDir, { recursive: true });
+  fs21.mkdirSync(orgDir, { recursive: true });
   const resources = payload.resources ?? [];
   const manifestResources = resources.map((r) => {
     const { files: _files, ...rest } = r;
     return rest;
   });
-  fs19.writeFileSync(
-    path24.join(orgDir, ORG_MANIFEST_NAME),
+  fs21.writeFileSync(
+    path26.join(orgDir, ORG_MANIFEST_NAME),
     yaml8.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
     "utf-8"
   );
-  const resourcesDir = path24.join(orgDir, "resources");
+  const resourcesDir = path26.join(orgDir, "resources");
   const currentSlugs = /* @__PURE__ */ new Set();
   for (const resource of resources) {
     const resSlug = slugify(resource.name);
     currentSlugs.add(resSlug);
-    writeResourceFileTree(path24.join(resourcesDir, resSlug), resource.files || []);
+    writeResourceFileTree(path26.join(resourcesDir, resSlug), resource.files || [], orgDir);
   }
-  if (fs19.existsSync(resourcesDir)) {
-    for (const entry of fs19.readdirSync(resourcesDir, { withFileTypes: true })) {
+  if (fs21.existsSync(resourcesDir)) {
+    for (const entry of fs21.readdirSync(resourcesDir, { withFileTypes: true })) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
-        fs19.rmSync(path24.join(resourcesDir, entry.name), { recursive: true, force: true });
+        fs21.rmSync(path26.join(resourcesDir, entry.name), { recursive: true, force: true });
       }
     }
   }
@@ -19146,8 +19746,8 @@ async function downloadOrgBinaryFiles(orgDir, payload) {
   let count = 0;
   for (const resource of payload.resources ?? []) {
     if (!resource.files) continue;
-    const resDir = path24.join(orgDir, "resources", slugify(resource.name));
-    count += await downloadBinaryFiles(resDir, resource.files);
+    const resDir = path26.join(orgDir, "resources", slugify(resource.name));
+    count += await downloadBinaryFiles(resDir, resource.files, orgDir);
   }
   if (count > 0) console.log(`Downloaded ${count} binary resource file(s).`);
 }
@@ -19402,20 +20002,20 @@ var init_list = __esm({
 });
 
 // src/lib/template-files.ts
-import * as fs20 from "fs";
-import * as path25 from "path";
+import * as fs22 from "fs";
+import * as path27 from "path";
 function readDirToFileMap(rootDir) {
   const out = {};
   function walk(dir, prefix) {
-    const entries = fs20.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    const entries = fs22.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const abs = path25.join(dir, entry.name);
+      const abs = path27.join(dir, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) walk(abs, rel);
-      else if (entry.isFile()) out[rel] = fs20.readFileSync(abs, "utf-8");
+      else if (entry.isFile()) out[rel] = fs22.readFileSync(abs, "utf-8");
     }
   }
-  if (fs20.existsSync(rootDir)) walk(rootDir, "");
+  if (fs22.existsSync(rootDir)) walk(rootDir, "");
   return out;
 }
 function detectCollisions(targetDir, files) {
@@ -19424,7 +20024,7 @@ function detectCollisions(targetDir, files) {
     if (!isSafeTemplatePath2(rel)) {
       throw new Error(`Refusing to inspect unsafe template path: ${rel}`);
     }
-    if (fs20.existsSync(path25.join(targetDir, rel))) collisions.push(rel);
+    if (fs22.existsSync(path27.join(targetDir, rel))) collisions.push(rel);
   }
   return collisions.sort((a, b) => a.localeCompare(b));
 }
@@ -19434,9 +20034,9 @@ function writeFileMap(targetDir, files) {
     if (!isSafeTemplatePath2(rel)) {
       throw new Error(`Refusing to write unsafe template path: ${rel}`);
     }
-    const abs = path25.join(targetDir, rel);
-    fs20.mkdirSync(path25.dirname(abs), { recursive: true });
-    fs20.writeFileSync(abs, body, "utf-8");
+    const abs = path27.join(targetDir, rel);
+    fs22.mkdirSync(path27.dirname(abs), { recursive: true });
+    fs22.writeFileSync(abs, body, "utf-8");
     written.push(rel);
   }
   return written;
@@ -19444,20 +20044,20 @@ function writeFileMap(targetDir, files) {
 function listDirRelFiles(dir) {
   const out = [];
   function walk(d, prefix) {
-    for (const entry of fs20.readdirSync(d, { withFileTypes: true })) {
+    for (const entry of fs22.readdirSync(d, { withFileTypes: true })) {
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-      if (entry.isDirectory()) walk(path25.join(d, entry.name), rel);
+      if (entry.isDirectory()) walk(path27.join(d, entry.name), rel);
       else if (entry.isFile()) out.push(rel);
     }
   }
-  if (fs20.existsSync(dir)) walk(dir, "");
+  if (fs22.existsSync(dir)) walk(dir, "");
   return out;
 }
 function writeSliceSnapshot(targetDir, files) {
   const keep = new Set(Object.keys(files));
   const removed = listDirRelFiles(targetDir).filter((rel) => !keep.has(rel)).sort((a, b) => a.localeCompare(b));
   const written = writeFileMap(targetDir, files).sort((a, b) => a.localeCompare(b));
-  if (fs20.existsSync(targetDir)) cleanOrphanFiles(targetDir, "", keep);
+  if (fs22.existsSync(targetDir)) cleanOrphanFiles(targetDir, "", keep);
   return { written, removed };
 }
 var init_template_files = __esm({
@@ -19473,7 +20073,7 @@ var templates_exports = {};
 __export(templates_exports, {
   templateCommand: () => templateCommand
 });
-import * as path26 from "path";
+import * as path28 from "path";
 async function templateCommand(args2) {
   const [sub, ...rest] = args2;
   switch (sub) {
@@ -19589,8 +20189,8 @@ async function runTemplatePull(rest) {
     console.log(`Template "${slug}" has no WayAI slice${hint}`);
     return;
   }
-  const targetDir = path26.join(resolveLayout(gitRoot).hubsDir, slug);
-  const relTarget = path26.relative(gitRoot, targetDir);
+  const targetDir = path28.join(resolveLayout(gitRoot).hubsDir, slug);
+  const relTarget = path28.relative(gitRoot, targetDir);
   const collisions = detectCollisions(targetDir, detail.files);
   if (dryRun) {
     const planned = Object.keys(detail.files).sort((a, b) => a.localeCompare(b));
@@ -19716,21 +20316,37 @@ import * as yaml9 from "js-yaml";
 function sanitizeWayaiSliceFiles(files) {
   const out = {};
   for (const [filePath, body] of Object.entries(files)) {
-    out[filePath] = isSanitizableSliceFile(filePath) ? sanitizeOne(body) : body;
+    out[filePath] = isSanitizableSliceFile(filePath) ? sanitizeOne(filePath, body) : body;
   }
   return out;
 }
-function sanitizeOne(body) {
+function sanitizeOne(filePath, body) {
   let parsed;
   try {
     parsed = yaml9.load(body);
   } catch {
     return body;
   }
-  const scrubbed = excludeTemplateAuthorData(stripTemplateInstanceIds(parsed));
+  const scrubbed = stripEvalAttachments(filePath, excludeTemplateAuthorData(stripTemplateInstanceIds(parsed)));
   if (JSON.stringify(parsed) === JSON.stringify(scrubbed)) return body;
   return yaml9.dump(scrubbed, YAML_DUMP_OPTIONS);
 }
+function stripEvalAttachments(filePath, value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const doc = { ...value };
+  const dropOnTurn = (turn) => {
+    if (!turn || typeof turn !== "object" || Array.isArray(turn) || !("attachments" in turn)) return turn;
+    const { attachments: _drop, ...rest } = turn;
+    return rest;
+  };
+  if (/^evals\//.test(filePath)) {
+    if ("input" in doc) doc.input = dropOnTurn(doc.input);
+    if (Array.isArray(doc.history)) doc.history = doc.history.map(dropOnTurn);
+  } else if (/^journeys\//.test(filePath)) {
+    if (Array.isArray(doc.transcript)) doc.transcript = doc.transcript.map(dropOnTurn);
+  }
+  return doc;
+}
 var init_template_sanitize = __esm({
   "src/lib/template-sanitize.ts"() {
     "use strict";
@@ -19764,8 +20380,8 @@ var admin_exports = {};
 __export(admin_exports, {
   adminCommand: () => adminCommand
 });
-import * as fs21 from "fs";
-import * as path27 from "path";
+import * as fs23 from "fs";
+import * as path29 from "path";
 import * as yaml10 from "js-yaml";
 async function adminCommand(args2) {
   const [group, ...afterGroup] = args2;
@@ -20087,7 +20703,7 @@ async function runArchiveRead(positional, flagArgs) {
       exitOnApiError(err);
       throw err;
     }
-    fs21.writeFileSync(outPath, zip);
+    fs23.writeFileSync(outPath, zip);
     console.log(`Wrote ${zip.byteLength} bytes to ${outPath}`);
     return;
   }
@@ -20219,15 +20835,15 @@ function loadTemplateManifest(slug) {
     console.error("Not in a git repository. Run from the tutorials/ authoring repo.");
     process.exit(1);
   }
-  const templateDir = path27.join(resolveTemplatesDir(gitRoot), slug);
-  const manifestPath = path27.join(templateDir, "template.yaml");
-  if (!fs21.existsSync(manifestPath)) {
-    console.error(`template.yaml not found at ${path27.relative(gitRoot, manifestPath)}`);
+  const templateDir = path29.join(resolveTemplatesDir(gitRoot), slug);
+  const manifestPath = path29.join(templateDir, "template.yaml");
+  if (!fs23.existsSync(manifestPath)) {
+    console.error(`template.yaml not found at ${path29.relative(gitRoot, manifestPath)}`);
     process.exit(1);
   }
   let manifest;
   try {
-    manifest = templateYamlSchema2.parse(yaml10.load(fs21.readFileSync(manifestPath, "utf-8")));
+    manifest = templateYamlSchema2.parse(yaml10.load(fs23.readFileSync(manifestPath, "utf-8")));
   } catch (err) {
     console.error(`Invalid template.yaml: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
@@ -20257,20 +20873,20 @@ async function runTemplatePush(positional) {
     const wayaiEntry = manifest.wayai.locales[locale];
     let wayaiFiles;
     if (wayaiEntry) {
-      const sliceDir = path27.resolve(templateDir, wayaiEntry.source);
-      if (!fs21.existsSync(sliceDir)) {
+      const sliceDir = path29.resolve(templateDir, wayaiEntry.source);
+      if (!fs23.existsSync(sliceDir)) {
         console.error(`wayai source not found for ${locale}: ${wayaiEntry.source} (resolved ${sliceDir})`);
         process.exit(1);
       }
       if (!isInsideTemplateDir(sliceDir, templateDir)) {
         console.warn(
-          `Note: ${locale} source points at a live hub (${wayaiEntry.source}); it can go stale on a hub recreate. Run \`wayai admin template freeze ${slug} --locale ${locale} --from ${path27.basename(sliceDir)}\` to commit a stable frozen slice.`
+          `Note: ${locale} source points at a live hub (${wayaiEntry.source}); it can go stale on a hub recreate. Run \`wayai admin template freeze ${slug} --locale ${locale} --from ${path29.basename(sliceDir)}\` to commit a stable frozen slice.`
         );
       }
       wayaiFiles = readDirToFileMap(sliceDir);
     }
-    const readmePath = path27.join(templateDir, `README.${locale}.md`);
-    const readmeMarkdown = fs21.existsSync(readmePath) ? fs21.readFileSync(readmePath, "utf-8") : "";
+    const readmePath = path29.join(templateDir, `README.${locale}.md`);
+    const readmeMarkdown = fs23.existsSync(readmePath) ? fs23.readFileSync(readmePath, "utf-8") : "";
     locales[locale] = {
       readmeMarkdown,
       ...wayaiFiles && { wayaiFiles },
@@ -20281,9 +20897,9 @@ async function runTemplatePush(positional) {
   }
   let hero;
   if (manifest.hero) {
-    const heroPath = path27.resolve(templateDir, manifest.hero);
-    if (fs21.existsSync(heroPath)) {
-      hero = { filename: path27.basename(heroPath), dataBase64: fs21.readFileSync(heroPath).toString("base64") };
+    const heroPath = path29.resolve(templateDir, manifest.hero);
+    if (fs23.existsSync(heroPath)) {
+      hero = { filename: path29.basename(heroPath), dataBase64: fs23.readFileSync(heroPath).toString("base64") };
     } else {
       console.error(`Warning: hero not found at ${manifest.hero}; skipping.`);
     }
@@ -20309,7 +20925,7 @@ async function runTemplatePush(positional) {
   }
 }
 function isInsideTemplateDir(dest, templateDir) {
-  return dest === templateDir || dest.startsWith(templateDir + path27.sep);
+  return dest === templateDir || dest.startsWith(templateDir + path29.sep);
 }
 async function runTemplateFreeze(positional, flagArgs) {
   const slug = positional[0];
@@ -20370,7 +20986,7 @@ async function runTemplateFreeze(positional, flagArgs) {
     process.exit(1);
   }
   const entry = manifest.wayai.locales[targetLocale];
-  const dest = path27.resolve(templateDir, entry.source);
+  const dest = path29.resolve(templateDir, entry.source);
   if (!isInsideTemplateDir(dest, templateDir) || dest === templateDir) {
     console.error(
       `source for "${targetLocale}" must be a committed path inside ${slug}/ (e.g. "./${targetLocale}/slice"), but resolved to:
@@ -20389,7 +21005,7 @@ Set it to a subdir of the template folder and re-run freeze.`
     const hubs = scanWorkspaceHubs(hubsDir);
     if (hubs.length) {
       console.error("Available hubs:");
-      for (const h of hubs) console.error(`  ${path27.basename(h.hubFolder)} (${h.hubId})`);
+      for (const h of hubs) console.error(`  ${path29.basename(h.hubFolder)} (${h.hubId})`);
     }
     console.error(`
 Pass --from <folder|uuid>${selector ? "." : " or run `wayai use <hub>` first."}`);
@@ -20397,12 +21013,12 @@ Pass --from <folder|uuid>${selector ? "." : " or run `wayai use <hub>` first."}`
   }
   const liveFiles = readDirToFileMap(hubFolder);
   if (Object.keys(liveFiles).length === 0) {
-    console.error(`Source hub folder has no files to freeze: ${path27.relative(gitRoot, hubFolder)}`);
+    console.error(`Source hub folder has no files to freeze: ${path29.relative(gitRoot, hubFolder)}`);
     process.exit(1);
   }
   const sanitized = sanitizeWayaiSliceFiles(liveFiles);
-  const relDest = path27.relative(gitRoot, dest);
-  const relSrc = path27.relative(gitRoot, hubFolder);
+  const relDest = path29.relative(gitRoot, dest);
+  const relSrc = path29.relative(gitRoot, hubFolder);
   if (dryRun) {
     const existing = new Set(listDirRelFiles(dest));
     const nextKeys = new Set(Object.keys(sanitized));
@@ -20462,7 +21078,7 @@ async function runTemplatePull2(positional, flagArgs) {
     console.log(JSON.stringify(detail, null, 2));
     return;
   }
-  const target = outDir ? path27.resolve(outDir) : path27.join(process.cwd(), "template-store-pull", slug);
+  const target = outDir ? path29.resolve(outDir) : path29.join(process.cwd(), "template-store-pull", slug);
   const written = writeFileMap(target, detail.files);
   console.log(`Pulled "${slug}" from the store \u2192 ${target} (${written.length} file${written.length === 1 ? "" : "s"}).`);
   const uses = detail.uses ?? [];
@@ -20485,13 +21101,13 @@ async function runSkillInstall(positional) {
     throw err;
   }
   const root = findGitRoot() ?? process.cwd();
-  const present = HARNESS_SKILL_DIRS.filter((dir) => fs21.existsSync(path27.join(root, dir)));
+  const present = HARNESS_SKILL_DIRS.filter((dir) => fs23.existsSync(path29.join(root, dir)));
   const targets = present.length > 0 ? present : HARNESS_SKILL_DIRS;
   const fileCount = Object.keys(res.files).length;
   const relDirs = targets.map((harness) => {
-    const targetDir = path27.join(root, harness, "skills", name);
+    const targetDir = path29.join(root, harness, "skills", name);
     writeFileMap(targetDir, res.files);
-    return `${path27.relative(root, targetDir)}/`;
+    return `${path29.relative(root, targetDir)}/`;
   });
   console.log(`Installed skill "${name}" (${fileCount} file${fileCount === 1 ? "" : "s"}) \u2192 ${relDirs.join(", ")}`);
   console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
@@ -21833,9 +22449,9 @@ var init_update = __esm({
 
 // src/index.ts
 init_sentry();
-import { readFileSync as readFileSync19 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname9, join as join25 } from "path";
+import { dirname as dirname9, join as join27 } from "path";
 
 // src/lib/errors.ts
 init_api_client();
@@ -21867,7 +22483,7 @@ init_skill_version();
 import { exec } from "child_process";
 var REFRESH_TIMEOUT_MS = 1e4;
 function refreshCliCache() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve6) => {
     exec("npm view @wayai/cli version", { timeout: REFRESH_TIMEOUT_MS }, (err, stdout) => {
       if (!err) {
         const latest = stdout.trim();
@@ -21878,7 +22494,7 @@ function refreshCliCache() {
           }
         }
       }
-      resolve4();
+      resolve6();
     });
   });
 }
@@ -21904,8 +22520,8 @@ async function refreshSkillCache() {
 }
 async function refreshAdminSkillCache() {
   let timer;
-  const deadline = new Promise((resolve4) => {
-    timer = setTimeout(resolve4, REFRESH_TIMEOUT_MS);
+  const deadline = new Promise((resolve6) => {
+    timer = setTimeout(resolve6, REFRESH_TIMEOUT_MS);
   });
   await Promise.race([deadline, fetchAndCacheAdminSkillVersion().catch(() => {
   })]);
@@ -22015,7 +22631,7 @@ Run \`wayai admin skill install\` to update.`);
 
 // src/index.ts
 var __dirname = dirname9(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync19(join25(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync20(join27(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);