@wayai/cli 0.3.105 → 0.3.107

package/dist/index.js

@@ -441,11 +441,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path30) {
+function addApiBreadcrumb(method, path31) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path30}`,
+    message: `${method} ${path31}`,
     level: "info"
   });
 }
@@ -507,9 +507,9 @@ var init_api_client = __esm({
     ApiError = class extends Error {
       status;
       body;
-      constructor(method, path30, status, body) {
+      constructor(method, path31, status, body) {
         const safeBody = maskSecretsInMessage(body);
-        super(`API request failed: ${method} ${path30} (${status}): ${safeBody}`);
+        super(`API request failed: ${method} ${path31} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
@@ -657,8 +657,8 @@ var init_api_client = __esm({
           ...organizationId && { organization_id: organizationId }
         });
       }
-      async lookup(path30, opts) {
-        const params = new URLSearchParams({ path: path30 });
+      async lookup(path31, opts) {
+        const params = new URLSearchParams({ path: path31 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -1058,9 +1058,9 @@ var init_api_client = __esm({
        * sandbox for this conversation, or the blob was purged).
        */
       async downloadArchiveSandboxFs(hubId, conversationId) {
-        const path30 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
-        addApiBreadcrumb("GET", path30);
-        const url = `${this.apiUrl}${path30}`;
+        const path31 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
+        addApiBreadcrumb("GET", path31);
+        const url = `${this.apiUrl}${path31}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -1074,7 +1074,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path30, response.status, await response.text());
+          throw new ApiError("GET", path31, response.status, await response.text());
         }
         return new Uint8Array(await response.arrayBuffer());
       }
@@ -1114,9 +1114,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path30, body) {
-        addApiBreadcrumb(method, path30);
-        const url = `${this.apiUrl}${path30}`;
+      async request(method, path31, body) {
+        addApiBreadcrumb(method, path31);
+        const url = `${this.apiUrl}${path31}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body);
@@ -1140,7 +1140,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path30, response.status, errorBody);
+          throw new ApiError(method, path31, response.status, errorBody);
         }
       }
       /** Issue a single authenticated request with the client's current token. */
@@ -1575,8 +1575,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path30, errorMaps, issueData } = params;
-      const fullPath = [...path30, ...issueData.path || []];
+      const { data, path: path31, errorMaps, issueData } = params;
+      const fullPath = [...path31, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1887,11 +1887,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path30, key) {
+      constructor(parent, value, path31, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path30;
+        this._path = path31;
         this._key = key;
       }
       get path() {
@@ -5375,12 +5375,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path30, errors, opts = {}) {
+function validateSchema(schema, path31, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path30 || "<root>",
+      path: path31 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -5388,7 +5388,7 @@ function validateSchema(schema, path30, errors, opts = {}) {
   }
   if (!isRecord(schema)) {
     errors.push({
-      path: path30,
+      path: path31,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -5396,14 +5396,14 @@ function validateSchema(schema, path30, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path30 ? `${path30}.type` : "type",
+        path: path31 ? `${path31}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path30}.type`,
+      path: `${path31}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -5412,25 +5412,25 @@ function validateSchema(schema, path30, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       errors.push({
-        path: `${path30}.enum`,
+        path: `${path31}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path30}.enum`,
+        path: `${path31}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path30}.enum`,
+        path: `${path31}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path30}.enum[${i}]`,
+            path: `${path31}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -5440,7 +5440,7 @@ function validateSchema(schema, path30, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path30}.${key}`,
+        path: `${path31}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -5449,45 +5449,45 @@ function validateSchema(schema, path30, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord(schema.properties)) {
       errors.push({
-        path: `${path30}.properties`,
+        path: `${path31}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path30}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path31}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path30}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path31}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path30}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path31}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord(schema[key])) {
-      validateSchema(schema[key], `${path30}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path31}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path30}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path31}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path30}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path31}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path30}.${k}`;
+    const fieldPath = `${path31}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -5787,10 +5787,10 @@ function refineHubAsCodeEvals(config, ctx) {
 function refineHubAsCodeEvalAttachments(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path30, turn, name) => {
+  const addTurnIssue = (path31, turn, name) => {
     const error = evalTurnAttachmentsError(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path30, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path31, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes(turn)) referencedHashes.add(hash);
@@ -5911,10 +5911,10 @@ function refineHubAsCodeResources(config, ctx) {
     });
   }
 }
-function isSafeTemplatePath(path30) {
-  if (path30.length === 0 || path30.length > 300) return false;
-  if (path30.startsWith("/") || path30.includes("\\")) return false;
-  const segments = path30.split("/");
+function isSafeTemplatePath(path31) {
+  if (path31.length === 0 || path31.length > 300) return false;
+  if (path31.startsWith("/") || path31.includes("\\")) return false;
+  const segments = path31.split("/");
   return segments.every(
     (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
   );
@@ -5958,7 +5958,7 @@ function findStepBoundaries(transcript) {
   }
   return out;
 }
-var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, appMessageBody, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, MAX_RESOURCE_FILE_SIZE, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminHubIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminSetOrgHarnessBody, adminSetHubHarnessBody, adminScopedTargetBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT;
+var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, appMessageBody, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, MAX_RESOURCE_FILE_SIZE, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminHubIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminSetOrgHarnessBody, adminSetHubHarnessBody, adminScopedTargetBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
@@ -8424,6 +8424,20 @@ var init_dist = __esm({
     ]);
     reportLocaleSchema = external_exports.enum(["en", "pt", "es"]);
     reportMessageAuthorRoleSchema = external_exports.enum(["reporter", "triage", "fixer", "system"]);
+    reportMessageSchema = external_exports.object({
+      message_id: external_exports.string(),
+      author_role: reportMessageAuthorRoleSchema,
+      /** The status transition this note accompanied (e.g. 'shipped'); null for a free/system note. */
+      transition: external_exports.string().nullable(),
+      body: external_exports.string(),
+      created_at: timestampSchema,
+      /**
+       * Visibility: `false` = reporter-facing (the default for every narrative entry); `true` =
+       * triage-internal (e.g. a `hold` rationale) — surfaced to platform admins only and NEVER
+       * returned on the reporter read path. The reporter's `GET /api/reports/:id` filters these out.
+       */
+      internal: external_exports.boolean()
+    });
     sentryRefStatusSchema = external_exports.enum(["valid", "not_found", "mismatch", "unverified"]);
     createReportBody = external_exports.object({
       title: external_exports.string().min(5).max(256),
@@ -8455,6 +8469,30 @@ var init_dist = __esm({
     }).strict().refine((b) => Object.keys(b).length > 0, {
       message: "at least one field must be provided"
     });
+    reporterReportSummarySchema = external_exports.object({
+      report_id: external_exports.string(),
+      title: external_exports.string(),
+      description: external_exports.string(),
+      classification: reportClassificationSchema,
+      status: reportStatusSchema,
+      created_at: timestampSchema,
+      triaged_at: timestampSchema.nullable(),
+      resolved_at: timestampSchema.nullable(),
+      /** How many times the reporter has contested (gates the hard cap). */
+      contest_count: external_exports.number(),
+      /** True once triage issued a non-contestable (final) dismissal. */
+      dismissal_final: external_exports.boolean()
+    });
+    reporterListResponseSchema = external_exports.object({
+      data: external_exports.array(reporterReportSummarySchema)
+    });
+    getReportResponseSchema = external_exports.object({
+      report: reporterReportSummarySchema,
+      messages: external_exports.array(reportMessageSchema)
+    });
+    reporterTransitionResponseSchema = external_exports.object({
+      report: reporterReportSummarySchema
+    });
     contestReportBody = external_exports.object({
       reason: external_exports.string().min(1).max(5e3)
     });
@@ -9614,9 +9652,9 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path30 = getVersionCachePath(filename);
-    if (!existsSync4(path30)) return null;
-    const parsed = JSON.parse(readFileSync5(path30, "utf-8"));
+    const path31 = getVersionCachePath(filename);
+    if (!existsSync4(path31)) return null;
+    const parsed = JSON.parse(readFileSync5(path31, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -9636,10 +9674,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path30 = getVersionCachePath(filename);
-  const dir = dirname3(path30);
+  const path31 = getVersionCachePath(filename);
+  const dir = dirname3(path31);
   if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(path30, JSON.stringify(cache));
+  writeFileSync2(path31, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -9678,14 +9716,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path30 = join7(projectRoot, rel);
-    if (!existsSync5(path30)) continue;
+    const path31 = join7(projectRoot, rel);
+    if (!existsSync5(path31)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path30, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path31, "utf-8"));
     } catch {
     }
-    found.push({ path: path30, version });
+    found.push({ path: path31, version });
   }
   return found;
 }
@@ -11304,12 +11342,12 @@ function typeMatches2(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema2(schema, path30, errors, opts = {}) {
+function validateSchema2(schema, path31, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH2) {
     errors.push({
-      path: path30 || "<root>",
+      path: path31 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH2} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -11317,7 +11355,7 @@ function validateSchema2(schema, path30, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path30,
+      path: path31,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -11325,14 +11363,14 @@ function validateSchema2(schema, path30, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path30 ? `${path30}.type` : "type",
+        path: path31 ? `${path31}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches2(schema.type, ALLOWED_TYPES2)) {
     errors.push({
-      path: `${path30}.type`,
+      path: `${path31}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES2].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -11341,25 +11379,25 @@ function validateSchema2(schema, path30, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS2.includes(e);
       errors.push({
-        path: `${path30}.enum`,
+        path: `${path31}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path30}.enum`,
+        path: `${path31}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path30}.enum`,
+        path: `${path31}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive2(e[i])) {
           errors.push({
-            path: `${path30}.enum[${i}]`,
+            path: `${path31}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -11369,7 +11407,7 @@ function validateSchema2(schema, path30, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path30}.${key}`,
+        path: `${path31}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -11378,45 +11416,45 @@ function validateSchema2(schema, path30, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path30}.properties`,
+        path: `${path31}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema2(propSchema, `${path30}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema2(propSchema, `${path31}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes2(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema2(sub, `${path30}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema2(sub, `${path31}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema2(schema.items, `${path30}.items`, errors, { depth: depth + 1 });
+      validateSchema2(schema.items, `${path31}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS2) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema2(schema[key], `${path30}.${key}`, errors, { depth: depth + 1 });
+      validateSchema2(schema[key], `${path31}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS2) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema2(sub, `${path30}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema2(sub, `${path31}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS2) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema2(sub, `${path30}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema2(sub, `${path31}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path30}.${k}`;
+    const fieldPath = `${path31}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS2) {
       if (v === token) {
@@ -11690,10 +11728,10 @@ function refineHubAsCodeEvals2(config, ctx) {
 function refineHubAsCodeEvalAttachments2(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path30, turn, name) => {
+  const addTurnIssue = (path31, turn, name) => {
     const error = evalTurnAttachmentsError2(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path30, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path31, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes2(turn)) referencedHashes.add(hash);
@@ -11814,10 +11852,10 @@ function refineHubAsCodeResources2(config, ctx) {
     });
   }
 }
-function isSafeTemplatePath2(path30) {
-  if (path30.length === 0 || path30.length > 300) return false;
-  if (path30.startsWith("/") || path30.includes("\\")) return false;
-  const segments = path30.split("/");
+function isSafeTemplatePath2(path31) {
+  if (path31.length === 0 || path31.length > 300) return false;
+  if (path31.startsWith("/") || path31.includes("\\")) return false;
+  const segments = path31.split("/");
   return segments.every(
     (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
   );
@@ -11845,14 +11883,14 @@ function isPlainObject(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 }
-function isSanitizableSliceFile(path30) {
-  if (!/\.ya?ml$/i.test(path30)) return false;
-  return path30 !== "resources" && !path30.startsWith("resources/");
+function isSanitizableSliceFile(path31) {
+  if (!/\.ya?ml$/i.test(path31)) return false;
+  return path31 !== "resources" && !path31.startsWith("resources/");
 }
 function distinctUsesBackends(uses) {
   return [...new Set((uses ?? []).map((u) => u.backend))];
 }
-var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, EVAL_ATTACHMENT_HASH_REGEX2, evalAttachmentRef2, turnMayCarryAttachments2, ATTACHMENTS_USER_ONLY_MESSAGE2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, appMessageBody2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, MAX_RESOURCE_FILE_SIZE2, MAX_10MB_BASE64_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_CARRIERS2, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2, MAX_RESOURCE_ENCODED_BYTES2, MAX_HUB_AS_CODE_RESOURCES2, MAX_HUB_AS_CODE_RESOURCE_FILES2, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES2, MAX_CI_CONFIG_BODY_BYTES2, hubAsCodeResourceFileSchema2, hubAsCodeResourceSchema2, uuidPattern2, ciUuidSchema2, boundedHubAsCodeResourcesSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminHubIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminSetOrgHarnessBody2, adminSetHubHarnessBody2, adminScopedTargetBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
+var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, EVAL_ATTACHMENT_HASH_REGEX2, evalAttachmentRef2, turnMayCarryAttachments2, ATTACHMENTS_USER_ONLY_MESSAGE2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, appMessageBody2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, MAX_RESOURCE_FILE_SIZE2, MAX_10MB_BASE64_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_CARRIERS2, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2, MAX_RESOURCE_ENCODED_BYTES2, MAX_HUB_AS_CODE_RESOURCES2, MAX_HUB_AS_CODE_RESOURCE_FILES2, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES2, MAX_CI_CONFIG_BODY_BYTES2, hubAsCodeResourceFileSchema2, hubAsCodeResourceSchema2, uuidPattern2, ciUuidSchema2, boundedHubAsCodeResourcesSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminHubIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminSetOrgHarnessBody2, adminSetHubHarnessBody2, adminScopedTargetBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, reportMessageSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, reporterReportSummarySchema2, reporterListResponseSchema2, getReportResponseSchema2, reporterTransitionResponseSchema2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -14161,6 +14199,20 @@ var init_contracts = __esm({
     ]);
     reportLocaleSchema2 = external_exports.enum(["en", "pt", "es"]);
     reportMessageAuthorRoleSchema2 = external_exports.enum(["reporter", "triage", "fixer", "system"]);
+    reportMessageSchema2 = external_exports.object({
+      message_id: external_exports.string(),
+      author_role: reportMessageAuthorRoleSchema2,
+      /** The status transition this note accompanied (e.g. 'shipped'); null for a free/system note. */
+      transition: external_exports.string().nullable(),
+      body: external_exports.string(),
+      created_at: timestampSchema2,
+      /**
+       * Visibility: `false` = reporter-facing (the default for every narrative entry); `true` =
+       * triage-internal (e.g. a `hold` rationale) — surfaced to platform admins only and NEVER
+       * returned on the reporter read path. The reporter's `GET /api/reports/:id` filters these out.
+       */
+      internal: external_exports.boolean()
+    });
     sentryRefStatusSchema2 = external_exports.enum(["valid", "not_found", "mismatch", "unverified"]);
     createReportBody2 = external_exports.object({
       title: external_exports.string().min(5).max(256),
@@ -14192,6 +14244,30 @@ var init_contracts = __esm({
     }).strict().refine((b) => Object.keys(b).length > 0, {
       message: "at least one field must be provided"
     });
+    reporterReportSummarySchema2 = external_exports.object({
+      report_id: external_exports.string(),
+      title: external_exports.string(),
+      description: external_exports.string(),
+      classification: reportClassificationSchema2,
+      status: reportStatusSchema2,
+      created_at: timestampSchema2,
+      triaged_at: timestampSchema2.nullable(),
+      resolved_at: timestampSchema2.nullable(),
+      /** How many times the reporter has contested (gates the hard cap). */
+      contest_count: external_exports.number(),
+      /** True once triage issued a non-contestable (final) dismissal. */
+      dismissal_final: external_exports.boolean()
+    });
+    reporterListResponseSchema2 = external_exports.object({
+      data: external_exports.array(reporterReportSummarySchema2)
+    });
+    getReportResponseSchema2 = external_exports.object({
+      report: reporterReportSummarySchema2,
+      messages: external_exports.array(reportMessageSchema2)
+    });
+    reporterTransitionResponseSchema2 = external_exports.object({
+      report: reporterReportSummarySchema2
+    });
     contestReportBody2 = external_exports.object({
       reason: external_exports.string().min(1).max(5e3)
     });
@@ -14864,897 +14940,951 @@ var init_resource_files = __esm({
   }
 });
 
-// src/lib/yaml-writer.ts
+// src/lib/eval-attachments.ts
 import * as fs11 from "fs";
 import * as path13 from "path";
-import * as yaml4 from "js-yaml";
-function buildEvalYamlObject(evalEntry, slug) {
-  const out = {};
-  if (evalEntry.id) out.id = evalEntry.id;
-  if (evalEntry.name !== slug) out.name = evalEntry.name;
-  out.agent = evalEntry.agent;
-  if (evalEntry.agent_id) out.agent_id = evalEntry.agent_id;
-  if (typeof evalEntry.runs === "number" && evalEntry.runs !== 1) {
-    out.runs = evalEntry.runs;
-  }
-  if (evalEntry.enabled === false) {
-    out.enabled = false;
-  }
-  if (evalEntry.history && evalEntry.history.length > 0) {
-    out.history = evalEntry.history;
-  }
-  if (typeof evalEntry.fixture === "string" && evalEntry.fixture.trim()) {
-    out.fixture = evalEntry.fixture.trim();
-  }
-  if (typeof evalEntry.target_base === "string" && evalEntry.target_base.trim()) {
-    out.target_base = evalEntry.target_base.trim();
+function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
+  const raw = turn.attachments;
+  if (raw === void 0 || raw === null) return void 0;
+  if (!Array.isArray(raw) || raw.length === 0) {
+    if (Array.isArray(raw)) return void 0;
+    throw expected(`${label}: "attachments" must be a list of file paths.`);
   }
-  if (evalEntry.variables && Object.keys(evalEntry.variables).length > 0) {
-    out.variables = evalEntry.variables;
+  if (turn.role !== "user") {
+    throw expected(`${label}: attachments are only allowed on user turns (this turn is "${String(turn.role)}").`);
   }
-  out.input = evalEntry.input;
-  out.expected = evalEntry.expected;
-  if (evalEntry.evaluator_instructions) {
-    out.evaluator_instructions = evalEntry.evaluator_instructions;
+  const refs = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string" || !entry.trim()) {
+      throw expected(`${label}: each attachment must be a hub-relative file path string.`);
+    }
+    const abs = path13.resolve(hubFolder, entry);
+    const root = path13.resolve(hubFolder);
+    if (abs !== root && !abs.startsWith(root + path13.sep)) {
+      throw expected(`${label}: attachment "${entry}" escapes the hub folder.`);
+    }
+    let stat;
+    try {
+      stat = fs11.statSync(abs);
+    } catch {
+    }
+    if (!stat?.isFile()) {
+      throw expected(`${label}: attachment "${entry}" not found.`);
+    }
+    if (!realpathContained(root, abs)) {
+      throw expected(`${label}: attachment "${entry}" resolves outside the hub folder (symlinks are not allowed).`);
+    }
+    if (stat.size > MAX_RESOURCE_FILE_SIZE3) {
+      throw expected(
+        `${label}: attachment "${entry}" is ${(stat.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
+      );
+    }
+    const data = fs11.readFileSync(abs);
+    const hash = computeHash(data);
+    const fileName = path13.basename(abs);
+    const mimeType = guessMimeType(fileName) ?? "application/octet-stream";
+    refs.push({ hash, file_name: fileName, mime_type: mimeType, file_size: stat.size });
+    if (!bytesByHash.has(hash)) {
+      bytesByHash.set(hash, {
+        hash,
+        content_base64: data.toString("base64"),
+        file_name: fileName,
+        mime_type: mimeType,
+        file_size: stat.size
+      });
+    }
   }
-  return out;
+  return refs;
 }
-function writeHubFolder(hubFolder, payload, options = {}) {
-  const agentsDir = path13.join(hubFolder, "agents");
-  if (!fs11.existsSync(hubFolder)) {
-    fs11.mkdirSync(hubFolder, { recursive: true });
-  }
-  if (!fs11.existsSync(agentsDir)) {
-    fs11.mkdirSync(agentsDir, { recursive: true });
-  }
-  const yamlPayload = buildYamlPayload(payload);
-  const agentFiles = extractAgentFiles(payload);
-  const yamlContent = yaml4.dump(yamlPayload, YAML_DUMP_OPTIONS);
-  fs11.writeFileSync(path13.join(hubFolder, "hub.yaml"), yamlContent, "utf-8");
-  if (options.seedAgentContext ?? true) {
-    writeIfAbsent(path13.join(hubFolder, "AGENTS.md"), perHubAgentsMd(path13.basename(hubFolder)));
-    writeIfAbsent(path13.join(hubFolder, "CLAUDE.md"), CLAUDE_MD_SHIM);
+function applyTurnAttachments(hubFolder, turn, label, bytesByHash) {
+  const refs = resolveTurnAttachments(hubFolder, turn, label, bytesByHash);
+  if (refs) turn.attachments = refs;
+  else delete turn.attachments;
+}
+function assertAttachmentsAreLocalPaths(turn, label) {
+  const attachments = turn?.attachments;
+  if (!Array.isArray(attachments)) return;
+  for (const entry of attachments) {
+    if (entry !== null && typeof entry === "object" && "hash" in entry) {
+      throw new Error(
+        `wire-shape attachment ref reached YAML serialization \u2014 CLI bug (${label}): the payload was not run through materializeHubFolder before writing.`
+      );
+    }
   }
-  const oldYamlPath = path13.join(hubFolder, "wayai.yaml");
-  if (fs11.existsSync(oldYamlPath)) {
-    fs11.unlinkSync(oldYamlPath);
+}
+function forEachAttachableTurn(payload, fn) {
+  for (const ev of payload.evals ?? []) {
+    if (ev.input) fn(ev.input);
+    for (const t of ev.history ?? []) fn(t);
   }
-  const yamlSlugs = writeAgentYamlFiles(agentsDir, payload.agents || []);
-  const mdSlugs = /* @__PURE__ */ new Set();
-  for (const { slug, content } of agentFiles) {
-    mdSlugs.add(slug);
-    fs11.writeFileSync(path13.join(agentsDir, `${slug}.md`), content, "utf-8");
+  for (const jr of payload.journeys ?? []) {
+    for (const t of jr.transcript ?? []) fn(t);
   }
-  const existingFiles = fs11.readdirSync(agentsDir);
-  for (const file of existingFiles) {
-    if (file.endsWith(".yaml")) {
-      const slug = file.slice(0, -5);
-      if (!yamlSlugs.has(slug)) {
-        fs11.unlinkSync(path13.join(agentsDir, file));
+}
+function rewriteEvalAttachmentsToLocalPaths(payload) {
+  const urlByHash = new Map((payload.eval_attachment_files ?? []).map((f) => [f.hash, f.download_url]));
+  const safeName = (ref) => {
+    const base = path13.basename(ref.file_name);
+    return base === "" || base === "." || base === ".." ? ref.hash.slice(0, 16) : base;
+  };
+  const hashesByName = /* @__PURE__ */ new Map();
+  const collect = (turn) => {
+    if (!Array.isArray(turn.attachments)) return;
+    for (const ref of turn.attachments) {
+      if (!ref?.hash || !ref.file_name) continue;
+      const name = safeName(ref);
+      let set = hashesByName.get(name);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        hashesByName.set(name, set);
       }
-    } else if (file.endsWith(".md")) {
-      const slug = file.slice(0, -3);
-      if (!mdSlugs.has(slug)) {
-        fs11.unlinkSync(path13.join(agentsDir, file));
+      set.add(ref.hash);
+    }
+  };
+  forEachAttachableTurn(payload, collect);
+  const pathByKey = /* @__PURE__ */ new Map();
+  const usedLower = /* @__PURE__ */ new Set();
+  const localPathFor = (ref) => {
+    const name = safeName(ref);
+    const key = `${ref.hash} ${name}`;
+    const existing = pathByKey.get(key);
+    if (existing) return existing;
+    const ext = path13.extname(name);
+    const stem = path13.basename(name, ext);
+    const collides = (hashesByName.get(name)?.size ?? 0) > 1;
+    let rel = collides ? `${ATTACHMENTS_DIR}/${stem}-${ref.hash.slice(0, 8)}${ext}` : `${ATTACHMENTS_DIR}/${name}`;
+    if (usedLower.has(rel.toLowerCase())) {
+      let n = 12;
+      while (usedLower.has(rel.toLowerCase()) && n <= ref.hash.length) {
+        rel = `${ATTACHMENTS_DIR}/${stem}-${ref.hash.slice(0, n)}${ext}`;
+        n += 4;
+      }
+      for (let extra = 2; usedLower.has(rel.toLowerCase()); extra++) {
+        rel = `${ATTACHMENTS_DIR}/${stem}-${ref.hash}-${extra}${ext}`;
       }
     }
-  }
-  writeResourceFiles(hubFolder, payload.resources || []);
-  writeEvalYamlFiles(hubFolder, payload.evals || []);
-  writeJourneyYamlFiles(hubFolder, payload.journeys || []);
-}
-function setPreviewLabelInHubYaml(hubFolder, label) {
-  const yamlPath = resolveHubYamlPath(hubFolder);
-  if (!yamlPath) return;
-  const obj = yaml4.load(fs11.readFileSync(yamlPath, "utf-8")) ?? {};
-  if (label) obj.preview_label = label;
-  else delete obj.preview_label;
-  fs11.writeFileSync(yamlPath, yaml4.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
-}
-function buildYamlPayload(payload) {
-  const result = {
-    version: payload.version,
-    hub_id: payload.hub_id,
-    hub_environment: payload.hub_environment
+    usedLower.add(rel.toLowerCase());
+    pathByKey.set(key, rel);
+    return rel;
   };
-  if (payload.preview_label) {
-    result.preview_label = payload.preview_label;
-  }
-  result.hub = payload.hub;
-  if (payload.resources && payload.resources.length > 0) {
-    result.resources = payload.resources.map((r) => {
-      const { files, ...rest } = r;
-      return rest;
+  const downloads = /* @__PURE__ */ new Map();
+  forEachAttachableTurn(payload, (turn) => {
+    if (!Array.isArray(turn.attachments)) return;
+    turn.attachments = turn.attachments.map((ref) => {
+      const rel = localPathFor(ref);
+      const url = urlByHash.get(ref.hash);
+      if (url && !downloads.has(rel)) downloads.set(rel, { relPath: rel, url, hash: ref.hash });
+      return rel;
     });
-  }
-  if (payload.states && payload.states.length > 0) {
-    result.states = payload.states;
-  }
-  if (payload.teams && payload.teams.length > 0) {
-    result.teams = payload.teams;
-  }
-  if (payload.connections && payload.connections.length > 0) {
-    result.connections = payload.connections;
-  }
-  if (payload.outbound_contacts && payload.outbound_contacts.length > 0) {
-    result.outbound_contacts = payload.outbound_contacts;
-  }
-  if (payload.outbound_lists && payload.outbound_lists.length > 0) {
-    result.outbound_lists = payload.outbound_lists;
-  }
-  if (payload.outbound_schedules && payload.outbound_schedules.length > 0) {
-    result.outbound_schedules = payload.outbound_schedules;
-  }
-  return result;
+  });
+  delete payload.eval_attachment_files;
+  return [...downloads.values()];
 }
-function writeAgentYamlFiles(agentsDir, agents) {
-  const slugs = /* @__PURE__ */ new Set();
-  for (const agent of agents) {
-    const slug = slugify(agent.name);
-    slugs.add(slug);
-    const entry = { ...agent };
-    delete entry.instructions;
-    const yamlContent = yaml4.dump(entry, YAML_DUMP_OPTIONS);
-    fs11.writeFileSync(path13.join(agentsDir, `${slug}.yaml`), yamlContent, "utf-8");
+async function downloadEvalAttachments(hubFolder, downloads) {
+  const attachDir = path13.resolve(hubFolder, ATTACHMENTS_DIR);
+  let written = 0;
+  if (!ensureRealSubdirNoSymlink(hubFolder, attachDir, downloads.length > 0)) {
+    console.warn(`  Warning: ${ATTACHMENTS_DIR}/ is not reachable inside the hub folder without a symlink; skipping attachment sync.`);
+    return written;
   }
-  return slugs;
-}
-function extractAgentFiles(payload) {
-  const files = [];
-  for (const agent of payload.agents || []) {
-    if (agent.instructions) {
-      files.push({
-        slug: slugify(agent.name),
-        content: agent.instructions
-      });
+  if (!fs11.existsSync(attachDir)) return written;
+  for (const dl of downloads) {
+    const abs = path13.resolve(hubFolder, dl.relPath);
+    if (abs !== attachDir && !abs.startsWith(attachDir + path13.sep)) continue;
+    let existing;
+    try {
+      existing = fs11.lstatSync(abs);
+    } catch {
     }
-  }
-  return files;
-}
-function writeEvalYamlFiles(hubFolder, evals) {
-  const evalsDir = path13.join(hubFolder, "evals");
-  if (evals.length === 0) {
-    if (fs11.existsSync(evalsDir)) {
-      cleanEvalOrphans(evalsDir, /* @__PURE__ */ new Set());
-      try {
-        if (fs11.readdirSync(evalsDir).length === 0) fs11.rmdirSync(evalsDir);
-      } catch {
+    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs11.readFileSync(abs)) === dl.hash) {
+      continue;
+    }
+    try {
+      const res = await fetch(dl.url);
+      if (!res.ok) {
+        console.warn(`  Warning: failed to download ${dl.relPath} (HTTP ${res.status})`);
+        continue;
       }
+      if (writeFileNoFollow(hubFolder, abs, Buffer.from(await res.arrayBuffer()))) written++;
+    } catch (err) {
+      console.warn(`  Warning: failed to download ${dl.relPath}: ${err instanceof Error ? err.message : String(err)}`);
     }
-    return;
   }
-  if (!fs11.existsSync(evalsDir)) {
-    fs11.mkdirSync(evalsDir, { recursive: true });
+  const keep = new Set(downloads.map((d) => path13.resolve(hubFolder, d.relPath)));
+  for (const name of fs11.readdirSync(attachDir)) {
+    const abs = path13.join(attachDir, name);
+    const st = fs11.lstatSync(abs);
+    if ((st.isFile() || st.isSymbolicLink()) && !keep.has(abs)) fs11.rmSync(abs);
   }
-  const writtenRelPaths = /* @__PURE__ */ new Set();
-  for (const evalEntry of evals) {
-    const slug = slugify(evalEntry.name);
-    const setName = evalEntry.path && evalEntry.path.trim().length > 0 ? evalEntry.path : null;
-    const relPath = setName ? `${setName}/${slug}.yaml` : `${slug}.yaml`;
-    const targetPath = path13.join(evalsDir, relPath);
-    if (!targetPath.startsWith(evalsDir + path13.sep)) {
-      console.warn(`  Warning: skipping eval "${evalEntry.name}" (scenario set "${setName}" escapes evals/ \u2014 possible bad backend data)`);
-      continue;
-    }
-    if (setName) {
-      const setDir = path13.join(evalsDir, setName);
-      if (!fs11.existsSync(setDir)) {
-        fs11.mkdirSync(setDir, { recursive: true });
-      }
-    }
-    const yamlContent = yaml4.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
-    fs11.writeFileSync(targetPath, yamlContent, "utf-8");
-    writtenRelPaths.add(relPath);
+  return written;
+}
+var ATTACHMENTS_DIR;
+var init_eval_attachments = __esm({
+  "src/lib/eval-attachments.ts"() {
+    "use strict";
+    init_resource_files();
+    init_fs_safety();
+    init_parser();
+    ATTACHMENTS_DIR = "attachments";
   }
-  cleanEvalOrphans(evalsDir, writtenRelPaths);
+});
+
+// src/lib/parser.ts
+import * as fs12 from "fs";
+import * as path14 from "path";
+import * as yaml4 from "js-yaml";
+function expected(message) {
+  const err = new Error(message);
+  err.isExpected = true;
+  return err;
 }
-function cleanEvalOrphans(evalsDir, writtenRelPaths) {
-  const entries = fs11.readdirSync(evalsDir, { withFileTypes: true });
-  for (const entry of entries) {
-    const fullPath = path13.join(evalsDir, entry.name);
-    if (entry.isFile()) {
-      if (entry.name.endsWith(".yaml") && !writtenRelPaths.has(entry.name)) {
-        fs11.unlinkSync(fullPath);
-      }
-      continue;
+function parseHubFolder(hubFolder, opts) {
+  const yamlPath = resolveHubYamlPath(hubFolder);
+  if (!yamlPath) {
+    const err = new Error(`hub.yaml not found in ${hubFolder}`);
+    err.isExpected = true;
+    throw err;
+  }
+  const yamlContent = fs12.readFileSync(yamlPath, "utf-8");
+  let config;
+  try {
+    config = yaml4.load(yamlContent);
+  } catch (err) {
+    if (err instanceof yaml4.YAMLException) {
+      const userError = new Error(`Invalid YAML in ${yamlPath}: ${err.message}`);
+      userError.isExpected = true;
+      throw userError;
     }
-    if (entry.isDirectory()) {
-      const setName = entry.name;
-      const subEntries = fs11.readdirSync(fullPath, { withFileTypes: true });
-      for (const sub of subEntries) {
-        if (sub.isFile() && sub.name.endsWith(".yaml")) {
-          const relPath = `${setName}/${sub.name}`;
-          if (!writtenRelPaths.has(relPath)) {
-            fs11.unlinkSync(path13.join(fullPath, sub.name));
-          }
-        }
+    throw err;
+  }
+  if (!config || typeof config !== "object") {
+    const invalidError = new Error(`Invalid YAML in ${yamlPath}`);
+    invalidError.isExpected = true;
+    throw invalidError;
+  }
+  if (!opts?.allowNewHub) {
+    if (!config.hub_id) {
+      const err = new Error(`Missing hub_id in ${yamlPath}`);
+      err.isExpected = true;
+      throw err;
+    }
+    if (!config.hub_environment) {
+      const err = new Error(`Missing hub_environment in ${yamlPath}`);
+      err.isExpected = true;
+      throw err;
+    }
+  }
+  const agentYamlFiles = scanAgentYamlFiles(hubFolder);
+  const rawAgents = agentYamlFiles.length > 0 ? agentYamlFiles : config.agents;
+  const agents = rawAgents?.map((agent) => {
+    const resolved = { ...agent };
+    if (typeof resolved.instructions === "string" && resolved.instructions.endsWith(".md")) {
+      const instrValue = resolved.instructions;
+      const instructionsPath = instrValue.startsWith("agents/") ? path14.join(hubFolder, instrValue) : path14.join(hubFolder, "agents", instrValue);
+      if (fs12.existsSync(instructionsPath)) {
+        resolved.instructions = fs12.readFileSync(instructionsPath, "utf-8");
+      } else {
+        const err = new Error(
+          `Agent instructions file not found: ${instructionsPath} (referenced by agent "${agent.name}")`
+        );
+        err.isExpected = true;
+        throw err;
       }
-      try {
-        if (fs11.readdirSync(fullPath).length === 0) fs11.rmdirSync(fullPath);
-      } catch {
+    } else if (resolved.instructions === void 0 && typeof agent.name === "string") {
+      const conventionPath = path14.join(hubFolder, "agents", `${slugify(agent.name)}.md`);
+      if (fs12.existsSync(conventionPath)) {
+        resolved.instructions = fs12.readFileSync(conventionPath, "utf-8");
       }
     }
+    return resolved;
+  });
+  const resources = parseResources(hubFolder, config.resources || []);
+  const payload = {
+    version: config.version || 1,
+    hub_id: config.hub_id || "",
+    hub_environment: config.hub_environment || "preview",
+    hub: config.hub
+  };
+  if (config.preview_label) {
+    payload.preview_label = config.preview_label;
   }
-}
-function buildJourneyYamlObject(journeyEntry, slug) {
-  const out = {};
-  if (journeyEntry.id) out.id = journeyEntry.id;
-  if (journeyEntry.name !== slug) out.name = journeyEntry.name;
-  out.agent = journeyEntry.agent;
-  if (journeyEntry.agent_id) out.agent_id = journeyEntry.agent_id;
-  if (journeyEntry.enabled === false) {
-    out.enabled = false;
+  if (agents && agents.length > 0) {
+    payload.agents = agents;
   }
-  if (journeyEntry.evaluator_instructions) {
-    out.evaluator_instructions = journeyEntry.evaluator_instructions;
+  if (resources.length > 0) {
+    payload.resources = resources;
   }
-  if (typeof journeyEntry.fixture === "string" && journeyEntry.fixture.trim()) {
-    out.fixture = journeyEntry.fixture.trim();
+  if (config.states && config.states.length > 0) {
+    payload.states = config.states;
   }
-  if (typeof journeyEntry.target_base === "string" && journeyEntry.target_base.trim()) {
-    out.target_base = journeyEntry.target_base.trim();
+  if (config.teams && config.teams.length > 0) {
+    payload.teams = config.teams;
   }
-  if (journeyEntry.variables && Object.keys(journeyEntry.variables).length > 0) {
-    out.variables = journeyEntry.variables;
+  if (Array.isArray(config.connections)) {
+    payload.connections = config.connections;
   }
-  if (journeyEntry.transcript && journeyEntry.transcript.length > 0) {
-    out.transcript = journeyEntry.transcript;
+  if (config.outbound_contacts && config.outbound_contacts.length > 0) {
+    payload.outbound_contacts = config.outbound_contacts;
   }
-  if (journeyEntry.step_config && Object.keys(journeyEntry.step_config).length > 0) {
-    out.step_config = journeyEntry.step_config;
+  if (config.outbound_lists && config.outbound_lists.length > 0) {
+    payload.outbound_lists = config.outbound_lists;
   }
-  return out;
-}
-function writeJourneyYamlFiles(hubFolder, journeys) {
-  const journeysDir = path13.join(hubFolder, "journeys");
-  if (journeys.length === 0) {
-    if (fs11.existsSync(journeysDir)) {
-      cleanJourneyOrphans(journeysDir, /* @__PURE__ */ new Set());
-      try {
-        if (fs11.readdirSync(journeysDir).length === 0) fs11.rmdirSync(journeysDir);
-      } catch {
-      }
-    }
-    return;
+  if (config.outbound_schedules && config.outbound_schedules.length > 0) {
+    payload.outbound_schedules = config.outbound_schedules;
   }
-  if (!fs11.existsSync(journeysDir)) {
-    fs11.mkdirSync(journeysDir, { recursive: true });
+  const bytesByHash = /* @__PURE__ */ new Map();
+  const evals = scanEvalYamlFiles(hubFolder, bytesByHash);
+  if (evals.length > 0) {
+    payload.evals = evals;
   }
-  const writtenFiles = /* @__PURE__ */ new Set();
-  const usedSlugs = /* @__PURE__ */ new Set();
-  for (const journeyEntry of journeys) {
-    const slug = ensureUniqueSlug(slugify(journeyEntry.name), usedSlugs);
-    const fileName = `${slug}.yaml`;
-    const yamlContent = yaml4.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
-    fs11.writeFileSync(path13.join(journeysDir, fileName), yamlContent, "utf-8");
-    writtenFiles.add(fileName);
+  const journeys = scanJourneyYamlFiles(hubFolder, bytesByHash);
+  if (journeys.length > 0) {
+    payload.journeys = journeys;
   }
-  cleanJourneyOrphans(journeysDir, writtenFiles);
+  if (bytesByHash.size > 0) {
+    payload.eval_attachment_files = [...bytesByHash.values()];
+  }
+  return payload;
 }
-function cleanJourneyOrphans(journeysDir, writtenFiles) {
-  const entries = fs11.readdirSync(journeysDir, { withFileTypes: true });
-  for (const entry of entries) {
-    if (entry.isFile() && entry.name.endsWith(".yaml") && !writtenFiles.has(entry.name)) {
-      fs11.unlinkSync(path13.join(journeysDir, entry.name));
+function scanEvalYamlFiles(hubFolder, bytesByHash) {
+  const evalsDir = path14.join(hubFolder, "evals");
+  if (!fs12.existsSync(evalsDir)) return [];
+  const evals = [];
+  const seen = /* @__PURE__ */ new Set();
+  const topEntries = fs12.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of topEntries) {
+    if (entry.isFile() && entry.name.endsWith(".yaml")) {
+      collectEval(evals, seen, path14.join(evalsDir, entry.name), `evals/${entry.name}`, null, hubFolder, bytesByHash);
+    } else if (entry.isDirectory()) {
+      const setName = entry.name;
+      const setDir = path14.join(evalsDir, setName);
+      const setEntries = fs12.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      for (const sub of setEntries) {
+        if (sub.isDirectory()) {
+          throw expected(
+            `Nested scenario sets are not supported: ${path14.relative(hubFolder, path14.join(setDir, sub.name))}. Move scenarios up to evals/${setName}/.`
+          );
+        }
+        if (sub.isFile() && sub.name.endsWith(".yaml")) {
+          collectEval(evals, seen, path14.join(setDir, sub.name), `evals/${setName}/${sub.name}`, setName, hubFolder, bytesByHash);
+        }
+      }
     }
   }
+  return evals;
 }
-function writeResourceFiles(hubFolder, resources) {
-  const resourcesDir = path13.join(hubFolder, "resources");
-  const currentSlugs = /* @__PURE__ */ new Set();
-  for (const resource of resources) {
-    const resSlug = slugify(resource.name);
-    currentSlugs.add(resSlug);
-    const resDir = path13.join(resourcesDir, resSlug);
-    writeResourceFileTree(resDir, resource.files || [], hubFolder);
+function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesByHash) {
+  const evalEntry = parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash);
+  if (!evalEntry) return;
+  const key = `${evalEntry.name}|${setName ?? ""}`;
+  if (seen.has(key)) {
+    const where = setName ? `scenario set "${setName}"` : "root";
+    throw expected(
+      `Duplicate eval at ${where}: "${evalEntry.name}" (in ${path14.basename(filePath)}). Each (name, scenario set) pair must be unique.`
+    );
   }
-  if (fs11.existsSync(resourcesDir)) {
-    const existingDirs = fs11.readdirSync(resourcesDir, { withFileTypes: true });
-    for (const entry of existingDirs) {
-      if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
-        fs11.rmSync(path13.join(resourcesDir, entry.name), { recursive: true, force: true });
-      }
+  seen.add(key);
+  evals.push(evalEntry);
+}
+function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
+  const content = fs12.readFileSync(filePath, "utf-8");
+  let raw;
+  try {
+    raw = yaml4.load(content);
+  } catch (err) {
+    if (err instanceof yaml4.YAMLException) {
+      throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
+    throw err;
   }
-}
-var YAML_DUMP_OPTIONS;
-var init_yaml_writer = __esm({
-  "src/lib/yaml-writer.ts"() {
-    "use strict";
-    init_dist();
-    init_utils();
-    init_resource_files();
-    init_workspace_files();
-    YAML_DUMP_OPTIONS = {
-      lineWidth: -1,
-      // don't wrap lines
-      noRefs: true,
-      // don't use YAML anchors
-      quotingType: '"',
-      forceQuotes: false,
-      sortKeys: false
-    };
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    console.warn(`  Warning: skipping ${relPath} (not a YAML object)`);
+    return null;
   }
-});
-
-// src/lib/eval-attachments.ts
-import * as fs12 from "fs";
-import * as path14 from "path";
-function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
-  const raw = turn.attachments;
-  if (raw === void 0 || raw === null) return void 0;
-  if (!Array.isArray(raw) || raw.length === 0) {
-    if (Array.isArray(raw)) return void 0;
-    throw expected(`${label}: "attachments" must be a list of file paths.`);
+  const data = raw;
+  const fileSlug = path14.basename(filePath, ".yaml");
+  const evalName = typeof data.name === "string" && data.name.trim().length > 0 ? data.name : fileSlug;
+  if (typeof data.agent !== "string" || data.agent.trim().length === 0) {
+    throw expected(`Eval "${evalName}" in ${relPath}: missing required field "agent" (string).`);
   }
-  if (turn.role !== "user") {
-    throw expected(`${label}: attachments are only allowed on user turns (this turn is "${String(turn.role)}").`);
+  if (!data.input || typeof data.input !== "object" || Array.isArray(data.input)) {
+    throw expected(`Eval "${evalName}" in ${relPath}: missing required field "input" (object).`);
   }
-  const refs = [];
-  for (const entry of raw) {
-    if (typeof entry !== "string" || !entry.trim()) {
-      throw expected(`${label}: each attachment must be a hub-relative file path string.`);
-    }
-    const abs = path14.resolve(hubFolder, entry);
-    const root = path14.resolve(hubFolder);
-    if (abs !== root && !abs.startsWith(root + path14.sep)) {
-      throw expected(`${label}: attachment "${entry}" escapes the hub folder.`);
-    }
-    let stat;
-    try {
-      stat = fs12.statSync(abs);
-    } catch {
-    }
-    if (!stat?.isFile()) {
-      throw expected(`${label}: attachment "${entry}" not found.`);
-    }
-    if (!realpathContained(root, abs)) {
-      throw expected(`${label}: attachment "${entry}" resolves outside the hub folder (symlinks are not allowed).`);
-    }
-    if (stat.size > MAX_RESOURCE_FILE_SIZE3) {
+  if (!data.expected || typeof data.expected !== "object" || Array.isArray(data.expected)) {
+    throw expected(`Eval "${evalName}" in ${relPath}: missing required field "expected" (object).`);
+  }
+  const input = { ...data.input };
+  applyTurnAttachments(hubFolder, input, `Eval "${evalName}" input`, bytesByHash);
+  const evalEntry = {
+    name: evalName,
+    agent: data.agent,
+    path: setName,
+    input,
+    expected: data.expected
+  };
+  if (typeof data.id === "string") evalEntry.id = data.id;
+  if (typeof data.agent_id === "string") evalEntry.agent_id = data.agent_id;
+  if (typeof data.runs === "number") evalEntry.runs = data.runs;
+  if (data.enabled === false) evalEntry.enabled = false;
+  if (Array.isArray(data.history)) {
+    evalEntry.history = data.history.map((turn, i) => {
+      const t = { ...turn };
+      applyTurnAttachments(hubFolder, t, `Eval "${evalName}" history[${i}]`, bytesByHash);
+      return t;
+    });
+  }
+  if (typeof data.evaluator_instructions === "string") {
+    evalEntry.evaluator_instructions = data.evaluator_instructions;
+  }
+  const variables = parseVariablesMap(data.variables, `Eval "${evalName}" in ${relPath}`);
+  if (variables) evalEntry.variables = variables;
+  const fixture = parseFixtureField(data.fixture, `Eval "${evalName}" in ${relPath}`, "fixture");
+  if (fixture) evalEntry.fixture = fixture;
+  const targetBase = parseFixtureField(data.target_base, `Eval "${evalName}" in ${relPath}`, "target_base");
+  if (targetBase) evalEntry.target_base = targetBase;
+  return evalEntry;
+}
+function parseVariablesMap(raw, label) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const vars = raw;
+  if (Object.keys(vars).length === 0) return void 0;
+  if (!Object.values(vars).every((v) => Array.isArray(v))) {
+    throw expected(`${label}: "variables" must be a map of arrays (variables.<name>: [ ... ]).`);
+  }
+  return vars;
+}
+function parseFixtureField(raw, label, key) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw !== "string") {
+    throw expected(`${label}: "${key}" must be a string (the Rekor fixture name).`);
+  }
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function scanJourneyYamlFiles(hubFolder, bytesByHash) {
+  const journeysDir = path14.join(hubFolder, "journeys");
+  if (!fs12.existsSync(journeysDir)) return [];
+  const journeys = [];
+  const seen = /* @__PURE__ */ new Set();
+  const entries = fs12.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
       throw expected(
-        `${label}: attachment "${entry}" is ${(stat.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
+        `Subfolders are not supported under journeys/: ${path14.relative(hubFolder, path14.join(journeysDir, entry.name))}. A journey owns its own managed scenario set \u2014 put each journey in a single journeys/<slug>.yaml file.`
       );
     }
-    const data = fs12.readFileSync(abs);
-    const hash = computeHash(data);
-    const fileName = path14.basename(abs);
-    const mimeType = guessMimeType(fileName) ?? "application/octet-stream";
-    refs.push({ hash, file_name: fileName, mime_type: mimeType, file_size: stat.size });
-    if (!bytesByHash.has(hash)) {
-      bytesByHash.set(hash, {
-        hash,
-        content_base64: data.toString("base64"),
-        file_name: fileName,
-        mime_type: mimeType,
-        file_size: stat.size
-      });
+    if (!entry.isFile() || !entry.name.endsWith(".yaml")) continue;
+    const journeyEntry = parseJourneyYaml(path14.join(journeysDir, entry.name), `journeys/${entry.name}`, hubFolder, bytesByHash);
+    if (!journeyEntry) continue;
+    if (seen.has(journeyEntry.name)) {
+      throw expected(
+        `Duplicate journey: "${journeyEntry.name}" (in ${entry.name}). Each journey name must be unique.`
+      );
     }
+    seen.add(journeyEntry.name);
+    journeys.push(journeyEntry);
   }
-  return refs;
-}
-function applyTurnAttachments(hubFolder, turn, label, bytesByHash) {
-  const refs = resolveTurnAttachments(hubFolder, turn, label, bytesByHash);
-  if (refs) turn.attachments = refs;
-  else delete turn.attachments;
+  return journeys;
 }
-function forEachAttachableTurn(payload, fn) {
-  for (const ev of payload.evals ?? []) {
-    if (ev.input) fn(ev.input);
-    for (const t of ev.history ?? []) fn(t);
+function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
+  const content = fs12.readFileSync(filePath, "utf-8");
+  let raw;
+  try {
+    raw = yaml4.load(content);
+  } catch (err) {
+    if (err instanceof yaml4.YAMLException) {
+      throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
+    }
+    throw err;
   }
-  for (const jr of payload.journeys ?? []) {
-    for (const t of jr.transcript ?? []) fn(t);
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    console.warn(`  Warning: skipping ${relPath} (not a YAML object)`);
+    return null;
   }
-}
-function rewriteEvalAttachmentsToLocalPaths(payload) {
-  const urlByHash = new Map((payload.eval_attachment_files ?? []).map((f) => [f.hash, f.download_url]));
-  const safeName = (ref) => {
-    const base = path14.basename(ref.file_name);
-    return base === "" || base === "." || base === ".." ? ref.hash.slice(0, 16) : base;
-  };
-  const hashesByName = /* @__PURE__ */ new Map();
-  const collect = (turn) => {
-    if (!Array.isArray(turn.attachments)) return;
-    for (const ref of turn.attachments) {
-      if (!ref?.hash || !ref.file_name) continue;
-      const name = safeName(ref);
-      let set = hashesByName.get(name);
-      if (!set) {
-        set = /* @__PURE__ */ new Set();
-        hashesByName.set(name, set);
-      }
-      set.add(ref.hash);
-    }
-  };
-  forEachAttachableTurn(payload, collect);
-  const pathByKey = /* @__PURE__ */ new Map();
-  const usedLower = /* @__PURE__ */ new Set();
-  const localPathFor = (ref) => {
-    const name = safeName(ref);
-    const key = `${ref.hash} ${name}`;
-    const existing = pathByKey.get(key);
-    if (existing) return existing;
-    const ext = path14.extname(name);
-    const stem = path14.basename(name, ext);
-    const collides = (hashesByName.get(name)?.size ?? 0) > 1;
-    let rel = collides ? `${ATTACHMENTS_DIR}/${stem}-${ref.hash.slice(0, 8)}${ext}` : `${ATTACHMENTS_DIR}/${name}`;
-    if (usedLower.has(rel.toLowerCase())) {
-      let n = 12;
-      while (usedLower.has(rel.toLowerCase()) && n <= ref.hash.length) {
-        rel = `${ATTACHMENTS_DIR}/${stem}-${ref.hash.slice(0, n)}${ext}`;
-        n += 4;
-      }
-      for (let extra = 2; usedLower.has(rel.toLowerCase()); extra++) {
-        rel = `${ATTACHMENTS_DIR}/${stem}-${ref.hash}-${extra}${ext}`;
-      }
-    }
-    usedLower.add(rel.toLowerCase());
-    pathByKey.set(key, rel);
-    return rel;
+  const data = raw;
+  const fileSlug = path14.basename(filePath, ".yaml");
+  const journeyName = typeof data.name === "string" && data.name.trim().length > 0 ? data.name : fileSlug;
+  if (typeof data.agent !== "string" || data.agent.trim().length === 0) {
+    throw expected(`Journey "${journeyName}" in ${relPath}: missing required field "agent" (string).`);
+  }
+  if (data.transcript !== void 0 && !Array.isArray(data.transcript)) {
+    throw expected(`Journey "${journeyName}" in ${relPath}: "transcript" must be an array.`);
+  }
+  if (data.step_config !== void 0 && (typeof data.step_config !== "object" || Array.isArray(data.step_config) || data.step_config === null)) {
+    throw expected(`Journey "${journeyName}" in ${relPath}: "step_config" must be an object keyed by step_id.`);
+  }
+  const journeyEntry = {
+    name: journeyName,
+    agent: data.agent
   };
-  const downloads = /* @__PURE__ */ new Map();
-  forEachAttachableTurn(payload, (turn) => {
-    if (!Array.isArray(turn.attachments)) return;
-    turn.attachments = turn.attachments.map((ref) => {
-      const rel = localPathFor(ref);
-      const url = urlByHash.get(ref.hash);
-      if (url && !downloads.has(rel)) downloads.set(rel, { relPath: rel, url, hash: ref.hash });
-      return rel;
+  if (typeof data.id === "string") journeyEntry.id = data.id;
+  if (typeof data.agent_id === "string") journeyEntry.agent_id = data.agent_id;
+  if (data.enabled === false) journeyEntry.enabled = false;
+  if (typeof data.evaluator_instructions === "string") {
+    journeyEntry.evaluator_instructions = data.evaluator_instructions;
+  }
+  if (Array.isArray(data.transcript)) {
+    journeyEntry.transcript = data.transcript.map((turn, i) => {
+      const t = { ...turn };
+      applyTurnAttachments(hubFolder, t, `Journey "${journeyName}" transcript[${i}]`, bytesByHash);
+      return t;
     });
-  });
-  delete payload.eval_attachment_files;
-  return [...downloads.values()];
-}
-async function downloadEvalAttachments(hubFolder, downloads) {
-  const attachDir = path14.resolve(hubFolder, ATTACHMENTS_DIR);
-  let written = 0;
-  if (!ensureRealSubdirNoSymlink(hubFolder, attachDir, downloads.length > 0)) {
-    console.warn(`  Warning: ${ATTACHMENTS_DIR}/ is not reachable inside the hub folder without a symlink; skipping attachment sync.`);
-    return written;
   }
-  if (!fs12.existsSync(attachDir)) return written;
-  for (const dl of downloads) {
-    const abs = path14.resolve(hubFolder, dl.relPath);
-    if (abs !== attachDir && !abs.startsWith(attachDir + path14.sep)) continue;
-    let existing;
+  if (data.step_config && typeof data.step_config === "object" && !Array.isArray(data.step_config)) {
+    journeyEntry.step_config = data.step_config;
+  }
+  const variables = parseVariablesMap(data.variables, `Journey "${journeyName}" in ${relPath}`);
+  if (variables) journeyEntry.variables = variables;
+  const fixture = parseFixtureField(data.fixture, `Journey "${journeyName}" in ${relPath}`, "fixture");
+  if (fixture) journeyEntry.fixture = fixture;
+  const targetBase = parseFixtureField(data.target_base, `Journey "${journeyName}" in ${relPath}`, "target_base");
+  if (targetBase) journeyEntry.target_base = targetBase;
+  return journeyEntry;
+}
+function scanAgentYamlFiles(hubFolder) {
+  const agentsDir = path14.join(hubFolder, "agents");
+  if (!fs12.existsSync(agentsDir)) return [];
+  const yamlFiles = fs12.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
+  if (yamlFiles.length === 0) return [];
+  const agents = [];
+  for (const file of yamlFiles) {
+    const filePath = path14.join(agentsDir, file);
+    const content = fs12.readFileSync(filePath, "utf-8");
+    let agent;
     try {
-      existing = fs12.lstatSync(abs);
-    } catch {
+      agent = yaml4.load(content);
+    } catch (err) {
+      if (err instanceof yaml4.YAMLException) {
+        const userError = new Error(`Invalid YAML in agents/${file}: ${err.message}`);
+        userError.isExpected = true;
+        throw userError;
+      }
+      throw err;
     }
-    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs12.readFileSync(abs)) === dl.hash) {
+    if (!agent || typeof agent !== "object") continue;
+    if (!agent.name) {
+      console.warn(`  Warning: skipping ${file} (missing 'name' field)`);
       continue;
     }
-    try {
-      const res = await fetch(dl.url);
-      if (!res.ok) {
-        console.warn(`  Warning: failed to download ${dl.relPath} (HTTP ${res.status})`);
-        continue;
+    agents.push(agent);
+  }
+  return agents;
+}
+function parseResources(hubFolder, configResources) {
+  const resourcesDir = path14.join(hubFolder, "resources");
+  const results = [];
+  for (const res of configResources) {
+    const resource = {
+      name: res.name
+    };
+    if (res.id) resource.id = res.id;
+    if (res.type === "knowledge" || res.type === "skill") resource.type = res.type;
+    else if (res.type !== void 0) throw new Error(`Invalid resource type for "${resource.name}": expected knowledge or skill`);
+    if (res.description) resource.description = res.description;
+    if (res.enabled === false) resource.enabled = false;
+    if (res.user_browsable) resource.user_browsable = res.user_browsable;
+    if (res.skill_name) resource.skill_name = res.skill_name;
+    const resSlug = slugify(resource.name);
+    const resDir = path14.join(resourcesDir, resSlug);
+    if (fs12.existsSync(resDir)) {
+      const files = scanResourceFiles(resDir, "");
+      if (files.length > 0) {
+        resource.files = files;
       }
-      if (writeFileNoFollow(hubFolder, abs, Buffer.from(await res.arrayBuffer()))) written++;
-    } catch (err) {
-      console.warn(`  Warning: failed to download ${dl.relPath}: ${err instanceof Error ? err.message : String(err)}`);
     }
+    results.push(resource);
   }
-  const keep = new Set(downloads.map((d) => path14.resolve(hubFolder, d.relPath)));
-  for (const name of fs12.readdirSync(attachDir)) {
-    const abs = path14.join(attachDir, name);
-    const st = fs12.lstatSync(abs);
-    if ((st.isFile() || st.isSymbolicLink()) && !keep.has(abs)) fs12.rmSync(abs);
-  }
-  return written;
+  return results;
 }
-var ATTACHMENTS_DIR;
-var init_eval_attachments = __esm({
-  "src/lib/eval-attachments.ts"() {
+var init_parser = __esm({
+  "src/lib/parser.ts"() {
     "use strict";
+    init_utils();
     init_resource_files();
-    init_fs_safety();
-    init_parser();
-    ATTACHMENTS_DIR = "attachments";
+    init_eval_attachments();
   }
 });
 
-// src/lib/parser.ts
-import * as fs13 from "fs";
-import * as path15 from "path";
-import * as yaml5 from "js-yaml";
-function expected(message) {
-  const err = new Error(message);
-  err.isExpected = true;
-  return err;
-}
-function parseHubFolder(hubFolder, opts) {
-  const yamlPath = resolveHubYamlPath(hubFolder);
-  if (!yamlPath) {
-    const err = new Error(`hub.yaml not found in ${hubFolder}`);
-    err.isExpected = true;
-    throw err;
-  }
-  const yamlContent = fs13.readFileSync(yamlPath, "utf-8");
-  let config;
-  try {
-    config = yaml5.load(yamlContent);
-  } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
-      const userError = new Error(`Invalid YAML in ${yamlPath}: ${err.message}`);
-      userError.isExpected = true;
-      throw userError;
+// src/lib/diff-display.ts
+function printDiff(summary) {
+  const lines = summary.split("\n");
+  for (const line of lines) {
+    if (line.startsWith("**") && line.endsWith("**")) {
+      console.log(`
+\x1B[1m${line.replace(/\*\*/g, "")}\x1B[0m`);
+    } else if (line.trimStart().startsWith("+ ")) {
+      console.log(`\x1B[32m${line}\x1B[0m`);
+    } else if (line.trimStart().startsWith("- ")) {
+      console.log(`\x1B[31m${line}\x1B[0m`);
+    } else if (line.trimStart().startsWith("~ ")) {
+      console.log(`\x1B[33m${line}\x1B[0m`);
+    } else if (line.includes("(no changes)")) {
+      console.log(`\x1B[2m${line}\x1B[0m`);
+    } else {
+      console.log(line);
     }
-    throw err;
-  }
-  if (!config || typeof config !== "object") {
-    const invalidError = new Error(`Invalid YAML in ${yamlPath}`);
-    invalidError.isExpected = true;
-    throw invalidError;
   }
-  if (!opts?.allowNewHub) {
-    if (!config.hub_id) {
-      const err = new Error(`Missing hub_id in ${yamlPath}`);
-      err.isExpected = true;
-      throw err;
-    }
-    if (!config.hub_environment) {
-      const err = new Error(`Missing hub_environment in ${yamlPath}`);
-      err.isExpected = true;
-      throw err;
-    }
+  console.log();
+}
+var init_diff_display = __esm({
+  "src/lib/diff-display.ts"() {
+    "use strict";
   }
-  const agentYamlFiles = scanAgentYamlFiles(hubFolder);
-  const rawAgents = agentYamlFiles.length > 0 ? agentYamlFiles : config.agents;
-  const agents = rawAgents?.map((agent) => {
-    const resolved = { ...agent };
-    if (typeof resolved.instructions === "string" && resolved.instructions.endsWith(".md")) {
-      const instrValue = resolved.instructions;
-      const instructionsPath = instrValue.startsWith("agents/") ? path15.join(hubFolder, instrValue) : path15.join(hubFolder, "agents", instrValue);
-      if (fs13.existsSync(instructionsPath)) {
-        resolved.instructions = fs13.readFileSync(instructionsPath, "utf-8");
-      } else {
-        const err = new Error(
-          `Agent instructions file not found: ${instructionsPath} (referenced by agent "${agent.name}")`
-        );
-        err.isExpected = true;
-        throw err;
-      }
-    } else if (resolved.instructions === void 0 && typeof agent.name === "string") {
-      const conventionPath = path15.join(hubFolder, "agents", `${slugify(agent.name)}.md`);
-      if (fs13.existsSync(conventionPath)) {
-        resolved.instructions = fs13.readFileSync(conventionPath, "utf-8");
-      }
-    }
-    return resolved;
-  });
-  const resources = parseResources(hubFolder, config.resources || []);
-  const payload = {
-    version: config.version || 1,
-    hub_id: config.hub_id || "",
-    hub_environment: config.hub_environment || "preview",
-    hub: config.hub
-  };
-  if (config.preview_label) {
-    payload.preview_label = config.preview_label;
+});
+
+// src/lib/yaml-writer.ts
+import * as fs13 from "fs";
+import * as path15 from "path";
+import * as yaml5 from "js-yaml";
+function buildEvalYamlObject(evalEntry, slug) {
+  const out = {};
+  if (evalEntry.id) out.id = evalEntry.id;
+  if (evalEntry.name !== slug) out.name = evalEntry.name;
+  out.agent = evalEntry.agent;
+  if (evalEntry.agent_id) out.agent_id = evalEntry.agent_id;
+  if (typeof evalEntry.runs === "number" && evalEntry.runs !== 1) {
+    out.runs = evalEntry.runs;
   }
-  if (agents && agents.length > 0) {
-    payload.agents = agents;
+  if (evalEntry.enabled === false) {
+    out.enabled = false;
   }
-  if (resources.length > 0) {
-    payload.resources = resources;
+  if (evalEntry.history && evalEntry.history.length > 0) {
+    for (const turn of evalEntry.history) assertAttachmentsAreLocalPaths(turn, `eval "${evalEntry.name}" history`);
+    out.history = evalEntry.history;
   }
-  if (config.states && config.states.length > 0) {
-    payload.states = config.states;
+  if (typeof evalEntry.fixture === "string" && evalEntry.fixture.trim()) {
+    out.fixture = evalEntry.fixture.trim();
   }
-  if (config.teams && config.teams.length > 0) {
-    payload.teams = config.teams;
+  if (typeof evalEntry.target_base === "string" && evalEntry.target_base.trim()) {
+    out.target_base = evalEntry.target_base.trim();
   }
-  if (Array.isArray(config.connections)) {
-    payload.connections = config.connections;
+  if (evalEntry.variables && Object.keys(evalEntry.variables).length > 0) {
+    out.variables = evalEntry.variables;
   }
-  if (config.outbound_contacts && config.outbound_contacts.length > 0) {
-    payload.outbound_contacts = config.outbound_contacts;
+  assertAttachmentsAreLocalPaths(evalEntry.input, `eval "${evalEntry.name}" input`);
+  out.input = evalEntry.input;
+  out.expected = evalEntry.expected;
+  if (evalEntry.evaluator_instructions) {
+    out.evaluator_instructions = evalEntry.evaluator_instructions;
   }
-  if (config.outbound_lists && config.outbound_lists.length > 0) {
-    payload.outbound_lists = config.outbound_lists;
+  return out;
+}
+function writeHubFolder(hubFolder, payload, options = {}) {
+  const agentsDir = path15.join(hubFolder, "agents");
+  if (!fs13.existsSync(hubFolder)) {
+    fs13.mkdirSync(hubFolder, { recursive: true });
   }
-  if (config.outbound_schedules && config.outbound_schedules.length > 0) {
-    payload.outbound_schedules = config.outbound_schedules;
+  if (!fs13.existsSync(agentsDir)) {
+    fs13.mkdirSync(agentsDir, { recursive: true });
   }
-  const bytesByHash = /* @__PURE__ */ new Map();
-  const evals = scanEvalYamlFiles(hubFolder, bytesByHash);
-  if (evals.length > 0) {
-    payload.evals = evals;
+  const yamlPayload = buildYamlPayload(payload);
+  const agentFiles = extractAgentFiles(payload);
+  const yamlContent = yaml5.dump(yamlPayload, YAML_DUMP_OPTIONS);
+  fs13.writeFileSync(path15.join(hubFolder, "hub.yaml"), yamlContent, "utf-8");
+  if (options.seedAgentContext ?? true) {
+    writeIfAbsent(path15.join(hubFolder, "AGENTS.md"), perHubAgentsMd(path15.basename(hubFolder)));
+    writeIfAbsent(path15.join(hubFolder, "CLAUDE.md"), CLAUDE_MD_SHIM);
   }
-  const journeys = scanJourneyYamlFiles(hubFolder, bytesByHash);
-  if (journeys.length > 0) {
-    payload.journeys = journeys;
+  const oldYamlPath = path15.join(hubFolder, "wayai.yaml");
+  if (fs13.existsSync(oldYamlPath)) {
+    fs13.unlinkSync(oldYamlPath);
   }
-  if (bytesByHash.size > 0) {
-    payload.eval_attachment_files = [...bytesByHash.values()];
+  const yamlSlugs = writeAgentYamlFiles(agentsDir, payload.agents || []);
+  const mdSlugs = /* @__PURE__ */ new Set();
+  for (const { slug, content } of agentFiles) {
+    mdSlugs.add(slug);
+    fs13.writeFileSync(path15.join(agentsDir, `${slug}.md`), content, "utf-8");
   }
-  return payload;
-}
-function scanEvalYamlFiles(hubFolder, bytesByHash) {
-  const evalsDir = path15.join(hubFolder, "evals");
-  if (!fs13.existsSync(evalsDir)) return [];
-  const evals = [];
-  const seen = /* @__PURE__ */ new Set();
-  const topEntries = fs13.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
-  for (const entry of topEntries) {
-    if (entry.isFile() && entry.name.endsWith(".yaml")) {
-      collectEval(evals, seen, path15.join(evalsDir, entry.name), `evals/${entry.name}`, null, hubFolder, bytesByHash);
-    } else if (entry.isDirectory()) {
-      const setName = entry.name;
-      const setDir = path15.join(evalsDir, setName);
-      const setEntries = fs13.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
-      for (const sub of setEntries) {
-        if (sub.isDirectory()) {
-          throw expected(
-            `Nested scenario sets are not supported: ${path15.relative(hubFolder, path15.join(setDir, sub.name))}. Move scenarios up to evals/${setName}/.`
-          );
-        }
-        if (sub.isFile() && sub.name.endsWith(".yaml")) {
-          collectEval(evals, seen, path15.join(setDir, sub.name), `evals/${setName}/${sub.name}`, setName, hubFolder, bytesByHash);
-        }
+  const existingFiles = fs13.readdirSync(agentsDir);
+  for (const file of existingFiles) {
+    if (file.endsWith(".yaml")) {
+      const slug = file.slice(0, -5);
+      if (!yamlSlugs.has(slug)) {
+        fs13.unlinkSync(path15.join(agentsDir, file));
+      }
+    } else if (file.endsWith(".md")) {
+      const slug = file.slice(0, -3);
+      if (!mdSlugs.has(slug)) {
+        fs13.unlinkSync(path15.join(agentsDir, file));
       }
     }
   }
-  return evals;
+  writeResourceFiles(hubFolder, payload.resources || []);
+  writeEvalYamlFiles(hubFolder, payload.evals || []);
+  writeJourneyYamlFiles(hubFolder, payload.journeys || []);
 }
-function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesByHash) {
-  const evalEntry = parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash);
-  if (!evalEntry) return;
-  const key = `${evalEntry.name}|${setName ?? ""}`;
-  if (seen.has(key)) {
-    const where = setName ? `scenario set "${setName}"` : "root";
-    throw expected(
-      `Duplicate eval at ${where}: "${evalEntry.name}" (in ${path15.basename(filePath)}). Each (name, scenario set) pair must be unique.`
-    );
-  }
-  seen.add(key);
-  evals.push(evalEntry);
+function setPreviewLabelInHubYaml(hubFolder, label) {
+  const yamlPath = resolveHubYamlPath(hubFolder);
+  if (!yamlPath) return;
+  const obj = yaml5.load(fs13.readFileSync(yamlPath, "utf-8")) ?? {};
+  if (label) obj.preview_label = label;
+  else delete obj.preview_label;
+  fs13.writeFileSync(yamlPath, yaml5.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
 }
-function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
-  const content = fs13.readFileSync(filePath, "utf-8");
-  let raw;
-  try {
-    raw = yaml5.load(content);
-  } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
-      throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
-    }
-    throw err;
+function buildYamlPayload(payload) {
+  const result = {
+    version: payload.version,
+    hub_id: payload.hub_id,
+    hub_environment: payload.hub_environment
+  };
+  if (payload.preview_label) {
+    result.preview_label = payload.preview_label;
   }
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    console.warn(`  Warning: skipping ${relPath} (not a YAML object)`);
-    return null;
+  result.hub = payload.hub;
+  if (payload.resources && payload.resources.length > 0) {
+    result.resources = payload.resources.map((r) => {
+      const { files, ...rest } = r;
+      return rest;
+    });
   }
-  const data = raw;
-  const fileSlug = path15.basename(filePath, ".yaml");
-  const evalName = typeof data.name === "string" && data.name.trim().length > 0 ? data.name : fileSlug;
-  if (typeof data.agent !== "string" || data.agent.trim().length === 0) {
-    throw expected(`Eval "${evalName}" in ${relPath}: missing required field "agent" (string).`);
+  if (payload.states && payload.states.length > 0) {
+    result.states = payload.states;
   }
-  if (!data.input || typeof data.input !== "object" || Array.isArray(data.input)) {
-    throw expected(`Eval "${evalName}" in ${relPath}: missing required field "input" (object).`);
+  if (payload.teams && payload.teams.length > 0) {
+    result.teams = payload.teams;
   }
-  if (!data.expected || typeof data.expected !== "object" || Array.isArray(data.expected)) {
-    throw expected(`Eval "${evalName}" in ${relPath}: missing required field "expected" (object).`);
+  if (payload.connections && payload.connections.length > 0) {
+    result.connections = payload.connections;
   }
-  const input = { ...data.input };
-  applyTurnAttachments(hubFolder, input, `Eval "${evalName}" input`, bytesByHash);
-  const evalEntry = {
-    name: evalName,
-    agent: data.agent,
-    path: setName,
-    input,
-    expected: data.expected
-  };
-  if (typeof data.id === "string") evalEntry.id = data.id;
-  if (typeof data.agent_id === "string") evalEntry.agent_id = data.agent_id;
-  if (typeof data.runs === "number") evalEntry.runs = data.runs;
-  if (data.enabled === false) evalEntry.enabled = false;
-  if (Array.isArray(data.history)) {
-    evalEntry.history = data.history.map((turn, i) => {
-      const t = { ...turn };
-      applyTurnAttachments(hubFolder, t, `Eval "${evalName}" history[${i}]`, bytesByHash);
-      return t;
-    });
+  if (payload.outbound_contacts && payload.outbound_contacts.length > 0) {
+    result.outbound_contacts = payload.outbound_contacts;
   }
-  if (typeof data.evaluator_instructions === "string") {
-    evalEntry.evaluator_instructions = data.evaluator_instructions;
+  if (payload.outbound_lists && payload.outbound_lists.length > 0) {
+    result.outbound_lists = payload.outbound_lists;
   }
-  const variables = parseVariablesMap(data.variables, `Eval "${evalName}" in ${relPath}`);
-  if (variables) evalEntry.variables = variables;
-  const fixture = parseFixtureField(data.fixture, `Eval "${evalName}" in ${relPath}`, "fixture");
-  if (fixture) evalEntry.fixture = fixture;
-  const targetBase = parseFixtureField(data.target_base, `Eval "${evalName}" in ${relPath}`, "target_base");
-  if (targetBase) evalEntry.target_base = targetBase;
-  return evalEntry;
+  if (payload.outbound_schedules && payload.outbound_schedules.length > 0) {
+    result.outbound_schedules = payload.outbound_schedules;
+  }
+  return result;
 }
-function parseVariablesMap(raw, label) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
-  const vars = raw;
-  if (Object.keys(vars).length === 0) return void 0;
-  if (!Object.values(vars).every((v) => Array.isArray(v))) {
-    throw expected(`${label}: "variables" must be a map of arrays (variables.<name>: [ ... ]).`);
+function writeAgentYamlFiles(agentsDir, agents) {
+  const slugs = /* @__PURE__ */ new Set();
+  for (const agent of agents) {
+    const slug = slugify(agent.name);
+    slugs.add(slug);
+    const entry = { ...agent };
+    delete entry.instructions;
+    const yamlContent = yaml5.dump(entry, YAML_DUMP_OPTIONS);
+    fs13.writeFileSync(path15.join(agentsDir, `${slug}.yaml`), yamlContent, "utf-8");
   }
-  return vars;
+  return slugs;
 }
-function parseFixtureField(raw, label, key) {
-  if (raw === void 0 || raw === null) return void 0;
-  if (typeof raw !== "string") {
-    throw expected(`${label}: "${key}" must be a string (the Rekor fixture name).`);
+function extractAgentFiles(payload) {
+  const files = [];
+  for (const agent of payload.agents || []) {
+    if (agent.instructions) {
+      files.push({
+        slug: slugify(agent.name),
+        content: agent.instructions
+      });
+    }
   }
-  const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
+  return files;
 }
-function scanJourneyYamlFiles(hubFolder, bytesByHash) {
-  const journeysDir = path15.join(hubFolder, "journeys");
-  if (!fs13.existsSync(journeysDir)) return [];
-  const journeys = [];
-  const seen = /* @__PURE__ */ new Set();
-  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+function writeEvalYamlFiles(hubFolder, evals) {
+  const evalsDir = path15.join(hubFolder, "evals");
+  if (evals.length === 0) {
+    if (fs13.existsSync(evalsDir)) {
+      cleanEvalOrphans(evalsDir, /* @__PURE__ */ new Set());
+      try {
+        if (fs13.readdirSync(evalsDir).length === 0) fs13.rmdirSync(evalsDir);
+      } catch {
+      }
+    }
+    return;
+  }
+  if (!fs13.existsSync(evalsDir)) {
+    fs13.mkdirSync(evalsDir, { recursive: true });
+  }
+  const writtenRelPaths = /* @__PURE__ */ new Set();
+  for (const evalEntry of evals) {
+    const slug = slugify(evalEntry.name);
+    const setName = evalEntry.path && evalEntry.path.trim().length > 0 ? evalEntry.path : null;
+    const relPath = setName ? `${setName}/${slug}.yaml` : `${slug}.yaml`;
+    const targetPath = path15.join(evalsDir, relPath);
+    if (!targetPath.startsWith(evalsDir + path15.sep)) {
+      console.warn(`  Warning: skipping eval "${evalEntry.name}" (scenario set "${setName}" escapes evals/ \u2014 possible bad backend data)`);
+      continue;
+    }
+    if (setName) {
+      const setDir = path15.join(evalsDir, setName);
+      if (!fs13.existsSync(setDir)) {
+        fs13.mkdirSync(setDir, { recursive: true });
+      }
+    }
+    const yamlContent = yaml5.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
+    fs13.writeFileSync(targetPath, yamlContent, "utf-8");
+    writtenRelPaths.add(relPath);
+  }
+  cleanEvalOrphans(evalsDir, writtenRelPaths);
+}
+function cleanEvalOrphans(evalsDir, writtenRelPaths) {
+  const entries = fs13.readdirSync(evalsDir, { withFileTypes: true });
   for (const entry of entries) {
-    if (entry.isDirectory()) {
-      throw expected(
-        `Subfolders are not supported under journeys/: ${path15.relative(hubFolder, path15.join(journeysDir, entry.name))}. A journey owns its own managed scenario set \u2014 put each journey in a single journeys/<slug>.yaml file.`
-      );
+    const fullPath = path15.join(evalsDir, entry.name);
+    if (entry.isFile()) {
+      if (entry.name.endsWith(".yaml") && !writtenRelPaths.has(entry.name)) {
+        fs13.unlinkSync(fullPath);
+      }
+      continue;
     }
-    if (!entry.isFile() || !entry.name.endsWith(".yaml")) continue;
-    const journeyEntry = parseJourneyYaml(path15.join(journeysDir, entry.name), `journeys/${entry.name}`, hubFolder, bytesByHash);
-    if (!journeyEntry) continue;
-    if (seen.has(journeyEntry.name)) {
-      throw expected(
-        `Duplicate journey: "${journeyEntry.name}" (in ${entry.name}). Each journey name must be unique.`
-      );
+    if (entry.isDirectory()) {
+      const setName = entry.name;
+      const subEntries = fs13.readdirSync(fullPath, { withFileTypes: true });
+      for (const sub of subEntries) {
+        if (sub.isFile() && sub.name.endsWith(".yaml")) {
+          const relPath = `${setName}/${sub.name}`;
+          if (!writtenRelPaths.has(relPath)) {
+            fs13.unlinkSync(path15.join(fullPath, sub.name));
+          }
+        }
+      }
+      try {
+        if (fs13.readdirSync(fullPath).length === 0) fs13.rmdirSync(fullPath);
+      } catch {
+      }
     }
-    seen.add(journeyEntry.name);
-    journeys.push(journeyEntry);
   }
-  return journeys;
 }
-function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
-  const content = fs13.readFileSync(filePath, "utf-8");
-  let raw;
-  try {
-    raw = yaml5.load(content);
-  } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
-      throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
-    }
-    throw err;
-  }
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    console.warn(`  Warning: skipping ${relPath} (not a YAML object)`);
-    return null;
+function buildJourneyYamlObject(journeyEntry, slug) {
+  const out = {};
+  if (journeyEntry.id) out.id = journeyEntry.id;
+  if (journeyEntry.name !== slug) out.name = journeyEntry.name;
+  out.agent = journeyEntry.agent;
+  if (journeyEntry.agent_id) out.agent_id = journeyEntry.agent_id;
+  if (journeyEntry.enabled === false) {
+    out.enabled = false;
   }
-  const data = raw;
-  const fileSlug = path15.basename(filePath, ".yaml");
-  const journeyName = typeof data.name === "string" && data.name.trim().length > 0 ? data.name : fileSlug;
-  if (typeof data.agent !== "string" || data.agent.trim().length === 0) {
-    throw expected(`Journey "${journeyName}" in ${relPath}: missing required field "agent" (string).`);
+  if (journeyEntry.evaluator_instructions) {
+    out.evaluator_instructions = journeyEntry.evaluator_instructions;
   }
-  if (data.transcript !== void 0 && !Array.isArray(data.transcript)) {
-    throw expected(`Journey "${journeyName}" in ${relPath}: "transcript" must be an array.`);
+  if (typeof journeyEntry.fixture === "string" && journeyEntry.fixture.trim()) {
+    out.fixture = journeyEntry.fixture.trim();
   }
-  if (data.step_config !== void 0 && (typeof data.step_config !== "object" || Array.isArray(data.step_config) || data.step_config === null)) {
-    throw expected(`Journey "${journeyName}" in ${relPath}: "step_config" must be an object keyed by step_id.`);
+  if (typeof journeyEntry.target_base === "string" && journeyEntry.target_base.trim()) {
+    out.target_base = journeyEntry.target_base.trim();
   }
-  const journeyEntry = {
-    name: journeyName,
-    agent: data.agent
-  };
-  if (typeof data.id === "string") journeyEntry.id = data.id;
-  if (typeof data.agent_id === "string") journeyEntry.agent_id = data.agent_id;
-  if (data.enabled === false) journeyEntry.enabled = false;
-  if (typeof data.evaluator_instructions === "string") {
-    journeyEntry.evaluator_instructions = data.evaluator_instructions;
+  if (journeyEntry.variables && Object.keys(journeyEntry.variables).length > 0) {
+    out.variables = journeyEntry.variables;
   }
-  if (Array.isArray(data.transcript)) {
-    journeyEntry.transcript = data.transcript.map((turn, i) => {
-      const t = { ...turn };
-      applyTurnAttachments(hubFolder, t, `Journey "${journeyName}" transcript[${i}]`, bytesByHash);
-      return t;
-    });
+  if (journeyEntry.transcript && journeyEntry.transcript.length > 0) {
+    for (const turn of journeyEntry.transcript) assertAttachmentsAreLocalPaths(turn, `journey "${journeyEntry.name}" transcript`);
+    out.transcript = journeyEntry.transcript;
   }
-  if (data.step_config && typeof data.step_config === "object" && !Array.isArray(data.step_config)) {
-    journeyEntry.step_config = data.step_config;
+  if (journeyEntry.step_config && Object.keys(journeyEntry.step_config).length > 0) {
+    out.step_config = journeyEntry.step_config;
   }
-  const variables = parseVariablesMap(data.variables, `Journey "${journeyName}" in ${relPath}`);
-  if (variables) journeyEntry.variables = variables;
-  const fixture = parseFixtureField(data.fixture, `Journey "${journeyName}" in ${relPath}`, "fixture");
-  if (fixture) journeyEntry.fixture = fixture;
-  const targetBase = parseFixtureField(data.target_base, `Journey "${journeyName}" in ${relPath}`, "target_base");
-  if (targetBase) journeyEntry.target_base = targetBase;
-  return journeyEntry;
+  return out;
 }
-function scanAgentYamlFiles(hubFolder) {
-  const agentsDir = path15.join(hubFolder, "agents");
-  if (!fs13.existsSync(agentsDir)) return [];
-  const yamlFiles = fs13.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
-  if (yamlFiles.length === 0) return [];
-  const agents = [];
-  for (const file of yamlFiles) {
-    const filePath = path15.join(agentsDir, file);
-    const content = fs13.readFileSync(filePath, "utf-8");
-    let agent;
-    try {
-      agent = yaml5.load(content);
-    } catch (err) {
-      if (err instanceof yaml5.YAMLException) {
-        const userError = new Error(`Invalid YAML in agents/${file}: ${err.message}`);
-        userError.isExpected = true;
-        throw userError;
+function writeJourneyYamlFiles(hubFolder, journeys) {
+  const journeysDir = path15.join(hubFolder, "journeys");
+  if (journeys.length === 0) {
+    if (fs13.existsSync(journeysDir)) {
+      cleanJourneyOrphans(journeysDir, /* @__PURE__ */ new Set());
+      try {
+        if (fs13.readdirSync(journeysDir).length === 0) fs13.rmdirSync(journeysDir);
+      } catch {
       }
-      throw err;
     }
-    if (!agent || typeof agent !== "object") continue;
-    if (!agent.name) {
-      console.warn(`  Warning: skipping ${file} (missing 'name' field)`);
-      continue;
+    return;
+  }
+  if (!fs13.existsSync(journeysDir)) {
+    fs13.mkdirSync(journeysDir, { recursive: true });
+  }
+  const writtenFiles = /* @__PURE__ */ new Set();
+  const usedSlugs = /* @__PURE__ */ new Set();
+  for (const journeyEntry of journeys) {
+    const slug = ensureUniqueSlug(slugify(journeyEntry.name), usedSlugs);
+    const fileName = `${slug}.yaml`;
+    const yamlContent = yaml5.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
+    fs13.writeFileSync(path15.join(journeysDir, fileName), yamlContent, "utf-8");
+    writtenFiles.add(fileName);
+  }
+  cleanJourneyOrphans(journeysDir, writtenFiles);
+}
+function cleanJourneyOrphans(journeysDir, writtenFiles) {
+  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isFile() && entry.name.endsWith(".yaml") && !writtenFiles.has(entry.name)) {
+      fs13.unlinkSync(path15.join(journeysDir, entry.name));
     }
-    agents.push(agent);
   }
-  return agents;
 }
-function parseResources(hubFolder, configResources) {
+function writeResourceFiles(hubFolder, resources) {
   const resourcesDir = path15.join(hubFolder, "resources");
-  const results = [];
-  for (const res of configResources) {
-    const resource = {
-      name: res.name
-    };
-    if (res.id) resource.id = res.id;
-    if (res.type === "knowledge" || res.type === "skill") resource.type = res.type;
-    else if (res.type !== void 0) throw new Error(`Invalid resource type for "${resource.name}": expected knowledge or skill`);
-    if (res.description) resource.description = res.description;
-    if (res.enabled === false) resource.enabled = false;
-    if (res.user_browsable) resource.user_browsable = res.user_browsable;
-    if (res.skill_name) resource.skill_name = res.skill_name;
+  const currentSlugs = /* @__PURE__ */ new Set();
+  for (const resource of resources) {
     const resSlug = slugify(resource.name);
+    currentSlugs.add(resSlug);
     const resDir = path15.join(resourcesDir, resSlug);
-    if (fs13.existsSync(resDir)) {
-      const files = scanResourceFiles(resDir, "");
-      if (files.length > 0) {
-        resource.files = files;
+    writeResourceFileTree(resDir, resource.files || [], hubFolder);
+  }
+  if (fs13.existsSync(resourcesDir)) {
+    const existingDirs = fs13.readdirSync(resourcesDir, { withFileTypes: true });
+    for (const entry of existingDirs) {
+      if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
+        fs13.rmSync(path15.join(resourcesDir, entry.name), { recursive: true, force: true });
       }
     }
-    results.push(resource);
   }
-  return results;
 }
-var init_parser = __esm({
-  "src/lib/parser.ts"() {
+var YAML_DUMP_OPTIONS;
+var init_yaml_writer = __esm({
+  "src/lib/yaml-writer.ts"() {
     "use strict";
+    init_dist();
     init_utils();
     init_resource_files();
     init_eval_attachments();
+    init_workspace_files();
+    YAML_DUMP_OPTIONS = {
+      lineWidth: -1,
+      // don't wrap lines
+      noRefs: true,
+      // don't use YAML anchors
+      quotingType: '"',
+      forceQuotes: false,
+      sortKeys: false
+    };
   }
 });
 
-// src/lib/diff-display.ts
-function printDiff(summary) {
-  const lines = summary.split("\n");
-  for (const line of lines) {
-    if (line.startsWith("**") && line.endsWith("**")) {
-      console.log(`
-\x1B[1m${line.replace(/\*\*/g, "")}\x1B[0m`);
-    } else if (line.trimStart().startsWith("+ ")) {
-      console.log(`\x1B[32m${line}\x1B[0m`);
-    } else if (line.trimStart().startsWith("- ")) {
-      console.log(`\x1B[31m${line}\x1B[0m`);
-    } else if (line.trimStart().startsWith("~ ")) {
-      console.log(`\x1B[33m${line}\x1B[0m`);
-    } else if (line.includes("(no changes)")) {
-      console.log(`\x1B[2m${line}\x1B[0m`);
-    } else {
-      console.log(line);
-    }
+// src/lib/hub-materializer.ts
+import * as path16 from "path";
+async function materializeHubFolder(hubFolder, payload, options = {}) {
+  if (materialized.has(payload)) {
+    throw new Error(
+      "materializeHubFolder called twice on the same payload object \u2014 CLI bug. The first run rewrote the payload in place; fetch a fresh payload to write again."
+    );
   }
-  console.log();
+  materialized.add(payload);
+  const attachmentDownloads = rewriteEvalAttachmentsToLocalPaths(payload);
+  writeHubFolder(hubFolder, payload, options);
+  await downloadBinaryResourceFiles(hubFolder, payload);
+  const attachmentsWritten = await downloadEvalAttachments(hubFolder, attachmentDownloads);
+  return { attachmentsWritten };
 }
-var init_diff_display = __esm({
-  "src/lib/diff-display.ts"() {
+async function downloadBinaryResourceFiles(hubFolder, payload) {
+  const resources = payload.resources || [];
+  let downloadCount = 0;
+  for (const resource of resources) {
+    if (!resource.files) continue;
+    const resDir = path16.join(hubFolder, "resources", slugify(resource.name));
+    downloadCount += await downloadBinaryFiles(resDir, resource.files, hubFolder);
+  }
+  if (downloadCount > 0) {
+    console.log(`Downloaded ${downloadCount} binary resource file(s).`);
+  }
+}
+var materialized;
+var init_hub_materializer = __esm({
+  "src/lib/hub-materializer.ts"() {
     "use strict";
+    init_yaml_writer();
+    init_eval_attachments();
+    init_resource_files();
+    init_utils();
+    materialized = /* @__PURE__ */ new WeakSet();
   }
 });
 
@@ -15762,13 +15892,12 @@ var init_diff_display = __esm({
 var pull_exports = {};
 __export(pull_exports, {
   connectionsEqual: () => connectionsEqual,
-  downloadBinaryResourceFiles: () => downloadBinaryResourceFiles,
   pullCommand: () => pullCommand,
   resolveHubTarget: () => resolveHubTarget,
   writeProductionMirror: () => writeProductionMirror
 });
 import * as fs14 from "fs";
-import * as path16 from "path";
+import * as path17 from "path";
 function parseArgs4(args2) {
   let autoConfirm = false;
   let hubSelector;
@@ -15787,7 +15916,7 @@ function resolveHubTarget(workspaceDir, selector) {
   const allHubs = scanWorkspaceHubs(workspaceDir);
   if (selector) {
     const match = allHubs.find(
-      (h) => h.hubId === selector || path16.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path17.basename(h.hubFolder) === selector
     );
     if (match) return { hubId: match.hubId, hubFolder: match.hubFolder };
     if (UUID_RE2.test(selector)) return { hubId: selector, hubFolder: null };
@@ -15804,7 +15933,7 @@ function resolveHubTarget(workspaceDir, selector) {
   }
   console.error(`Multiple hubs found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
   for (const h of previewHubs) {
-    console.error(`  ${path16.basename(h.hubFolder)} (${h.hubId})`);
+    console.error(`  ${path17.basename(h.hubFolder)} (${h.hubId})`);
   }
   process.exit(1);
 }
@@ -15831,7 +15960,6 @@ async function pullCommand(args2) {
     return;
   }
   assertHubMatchesBinding(hubId);
-  const attachmentDownloads = rewriteEvalAttachmentsToLocalPaths(payload);
   let hubFolder = existingFolder;
   let wroteFiles = false;
   if (!hubFolder) {
@@ -15843,31 +15971,20 @@ async function pullCommand(args2) {
       payload.preview_label,
       payload.branch_name
     );
-    fs14.mkdirSync(path16.dirname(hubFolder), { recursive: true });
+    fs14.mkdirSync(path17.dirname(hubFolder), { recursive: true });
     console.log("Writing hub configuration...");
-    writeHubFolder(hubFolder, payload);
-    await downloadBinaryResourceFiles(hubFolder, payload);
-    await downloadEvalAttachments(hubFolder, attachmentDownloads);
+    await materializeHubFolder(hubFolder, payload);
     const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
     console.log(`Hub configuration written to ${finalFolder}`);
     wroteFiles = true;
   } else {
-    let cancelled = false;
+    let action = "overwrite";
     try {
       const localPayload = parseHubFolder(hubFolder);
       const diffResult = await client.diff(hubId, prepareResourcePayload(localPayload, payload), "pull", organizationId);
       const connectionsChanged = !connectionsEqual(localPayload.connections, payload.connections);
       if (!diffResult.has_changes && !connectionsChanged) {
-        writeHubFolder(hubFolder, payload);
-        await downloadBinaryResourceFiles(hubFolder, payload);
-        await downloadEvalAttachments(hubFolder, attachmentDownloads);
-        const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
-        wroteFiles = true;
-        if (finalFolder === hubFolder) {
-          console.log("Metadata synced \u2014 no config changes.");
-        } else {
-          console.log("Metadata synced; folder renamed.");
-        }
+        action = "sync_metadata";
       } else {
         console.log("\nChanges to apply locally:");
         if (connectionsChanged) {
@@ -15878,28 +15995,27 @@ async function pullCommand(args2) {
           const ok = await confirm("Apply these changes?");
           if (!ok) {
             console.log("Cancelled.");
-            cancelled = true;
+            return;
           }
         }
-        if (!cancelled) {
-          writeHubFolder(hubFolder, payload);
-          await downloadBinaryResourceFiles(hubFolder, payload);
-          await downloadEvalAttachments(hubFolder, attachmentDownloads);
-          const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
-          console.log(`Hub configuration written to ${finalFolder}`);
-          wroteFiles = true;
-        }
+        action = "apply";
       }
     } catch {
-      console.log("Writing hub configuration...");
-      writeHubFolder(hubFolder, payload);
-      await downloadBinaryResourceFiles(hubFolder, payload);
-      await downloadEvalAttachments(hubFolder, attachmentDownloads);
-      const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
+      action = "overwrite";
+    }
+    if (action === "overwrite") console.log("Writing hub configuration...");
+    await materializeHubFolder(hubFolder, payload);
+    const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
+    wroteFiles = true;
+    if (action === "sync_metadata") {
+      if (finalFolder === hubFolder) {
+        console.log("Metadata synced \u2014 no config changes.");
+      } else {
+        console.log("Metadata synced; folder renamed.");
+      }
+    } else {
       console.log(`Hub configuration written to ${finalFolder}`);
-      wroteFiles = true;
     }
-    if (cancelled) return;
   }
   if (wroteFiles) autoBindIfUnbound(hubId);
   if (payload.production_hub_id) {
@@ -15908,11 +16024,8 @@ async function pullCommand(args2) {
 }
 async function writeProductionMirror(workspaceDir, prodPayload) {
   const folder = resolveHubFolder(workspaceDir, prodPayload.hub_id, prodPayload.hub.name, "production", null, null);
-  fs14.mkdirSync(path16.dirname(folder), { recursive: true });
-  const attachmentDownloads = rewriteEvalAttachmentsToLocalPaths(prodPayload);
-  writeHubFolder(folder, prodPayload, { seedAgentContext: false });
-  await downloadBinaryResourceFiles(folder, prodPayload);
-  await downloadEvalAttachments(folder, attachmentDownloads);
+  fs14.mkdirSync(path17.dirname(folder), { recursive: true });
+  await materializeHubFolder(folder, prodPayload, { seedAgentContext: false });
   const finalFolder = autoRenameHubFolder(folder, prodPayload.hub.name, "production", prodPayload.hub_id, null, null);
   prependMirrorMarker(finalFolder, prodPayload.hub_id);
   return finalFolder;
@@ -15927,7 +16040,7 @@ async function mirrorLinkedProduction(client, workspaceDir, productionHubId, org
   }
 }
 function prependMirrorMarker(hubFolder, productionHubId) {
-  const hubYaml = path16.join(hubFolder, "hub.yaml");
+  const hubYaml = path17.join(hubFolder, "hub.yaml");
   try {
     const content = fs14.readFileSync(hubYaml, "utf-8");
     if (content.startsWith(MIRROR_MARKER_PREFIX)) return;
@@ -15937,18 +16050,6 @@ function prependMirrorMarker(hubFolder, productionHubId) {
   } catch {
   }
 }
-async function downloadBinaryResourceFiles(hubFolder, payload) {
-  const resources = payload.resources || [];
-  let downloadCount = 0;
-  for (const resource of resources) {
-    if (!resource.files) continue;
-    const resDir = path16.join(hubFolder, "resources", slugify(resource.name));
-    downloadCount += await downloadBinaryFiles(resDir, resource.files, hubFolder);
-  }
-  if (downloadCount > 0) {
-    console.log(`Downloaded ${downloadCount} binary resource file(s).`);
-  }
-}
 function connectionsEqual(a, b) {
   const listA = a || [];
   const listB = b || [];
@@ -15968,12 +16069,11 @@ var init_pull = __esm({
     "use strict";
     init_auth();
     init_api_client();
-    init_yaml_writer();
     init_parser();
     init_diff_display();
     init_utils();
     init_resource_files();
-    init_eval_attachments();
+    init_hub_materializer();
     init_workspace();
     init_layout();
     init_workspace_files();
@@ -15994,10 +16094,11 @@ __export(push_exports, {
   pushCommand: () => pushCommand,
   reportUnresolvedPushTarget: () => reportUnresolvedPushTarget,
   selectExistingHub: () => selectExistingHub,
-  shouldWarnIgnoredPreviewLabel: () => shouldWarnIgnoredPreviewLabel
+  shouldWarnIgnoredPreviewLabel: () => shouldWarnIgnoredPreviewLabel,
+  syncAfterPush: () => syncAfterPush
 });
 import * as fs15 from "fs";
-import * as path17 from "path";
+import * as path18 from "path";
 import * as yaml6 from "js-yaml";
 function parseArgs5(args2) {
   let autoConfirm = false;
@@ -16090,13 +16191,13 @@ function printErrors(errors) {
   }
 }
 async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, remoteConfig) {
-  const agentsDir = path17.join(hubFolder, "agents");
+  const agentsDir = path18.join(hubFolder, "agents");
   let agentsWithIds = [];
   if (fs15.existsSync(agentsDir)) {
     const yamlFiles = fs15.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml"));
     for (const file of yamlFiles) {
       try {
-        const content = fs15.readFileSync(path17.join(agentsDir, file), "utf-8");
+        const content = fs15.readFileSync(path18.join(agentsDir, file), "utf-8");
         const agent = yaml6.load(content);
         if (agent?.id && agent.name) {
           agentsWithIds.push({ id: agent.id, name: agent.name });
@@ -16145,12 +16246,12 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
   for (const file of fs15.readdirSync(agentsDir)) {
     if (file.startsWith("__rename_temp_") && (file.endsWith(".md") || file.endsWith(".yaml"))) {
       console.warn(`  Warning: removing orphaned temp file agents/${file}`);
-      fs15.unlinkSync(path17.join(agentsDir, file));
+      fs15.unlinkSync(path18.join(agentsDir, file));
     }
   }
   const renameFileIfExists = (dir, oldName, newName) => {
-    const oldPath = path17.join(dir, oldName);
-    const newPath = path17.join(dir, newName);
+    const oldPath = path18.join(dir, oldName);
+    const newPath = path18.join(dir, newName);
     if (!fs15.existsSync(oldPath)) return false;
     fs15.renameSync(oldPath, newPath);
     return true;
@@ -16185,9 +16286,9 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     }
   } else {
     for (const { oldSlug, newSlug } of renames) {
-      const hasOldFile = extensions.some((ext) => fs15.existsSync(path17.join(agentsDir, `${oldSlug}${ext}`)));
+      const hasOldFile = extensions.some((ext) => fs15.existsSync(path18.join(agentsDir, `${oldSlug}${ext}`)));
       if (!hasOldFile) continue;
-      const hasNewFile = extensions.some((ext) => fs15.existsSync(path17.join(agentsDir, `${newSlug}${ext}`)));
+      const hasNewFile = extensions.some((ext) => fs15.existsSync(path18.join(agentsDir, `${newSlug}${ext}`)));
       if (hasNewFile) {
         console.warn(`  Warning: skipping rename agents/${oldSlug}.* \u2192 agents/${newSlug}.* (target already exists)`);
         continue;
@@ -16214,15 +16315,14 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     );
     if (updatedYaml !== mainYamlContent) {
       fs15.writeFileSync(mainYamlPath, updatedYaml, "utf-8");
-      console.log(`  Updated instructions paths in ${path17.basename(mainYamlPath)}`);
+      console.log(`  Updated instructions paths in ${path18.basename(mainYamlPath)}`);
     }
   }
 }
 async function syncAfterPush(client, hubId, hubFolder, organizationId) {
   try {
     const remoteConfig = await client.pull(hubId, organizationId);
-    writeHubFolder(hubFolder, remoteConfig);
-    await downloadBinaryResourceFiles(hubFolder, remoteConfig);
+    await materializeHubFolder(hubFolder, remoteConfig);
     console.log("Local files synced with server.");
     const finalFolder = autoRenameHubFolder(hubFolder, remoteConfig.hub.name, remoteConfig.hub_environment, hubId, remoteConfig.preview_label, remoteConfig.branch_name);
     if (finalFolder !== hubFolder) {
@@ -16283,7 +16383,7 @@ async function pushSingleHub(client, hubId, hubFolder, autoConfirm, organization
 function selectExistingHub(workspaceDir, allHubs, selector, wsLabel) {
   if (selector) {
     const match = allHubs.find(
-      (h) => h.hubId === selector || path17.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path18.basename(h.hubFolder) === selector
     );
     if (!match) {
       console.error(`No hub matching --hub ${selector} found in ${wsLabel}/.`);
@@ -16351,7 +16451,7 @@ function reportUnresolvedPushTarget(reason, existingHubs, newHubs, selector, wsL
     if (existingHubs.length > 0) {
       console.error(`No pushable hub found in ${wsLabel}/ \u2014 only read-only production mirror folder(s). Edit the linked preview hub, pull one, or create a new hub with \`wayai create\`:`);
       for (const h of existingHubs) {
-        console.error(`  ${path17.basename(h.hubFolder)} (${h.hubId}, production mirror)`);
+        console.error(`  ${path18.basename(h.hubFolder)} (${h.hubId}, production mirror)`);
       }
     } else {
       console.error(`No hub folders found. Create hub files in ${wsLabel}/<hub>/hub.yaml with \`hub: { name: ... }\` and run \`wayai push\` (or \`wayai create\`).`);
@@ -16364,10 +16464,10 @@ function reportUnresolvedPushTarget(reason, existingHubs, newHubs, selector, wsL
     console.error(`Multiple hub folders found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
   }
   for (const h of existingHubs) {
-    console.error(`  ${path17.basename(h.hubFolder)} (${h.hubId})`);
+    console.error(`  ${path18.basename(h.hubFolder)} (${h.hubId})`);
   }
   for (const h of newHubs) {
-    console.error(`  ${path17.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
+    console.error(`  ${path18.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
   }
   process.exit(1);
 }
@@ -16405,8 +16505,8 @@ async function pushCommand(args2) {
     if (label) {
       console.warn("Note: --label is only used when creating a new hub. To change an existing hub's label, use `wayai relabel`.");
     }
-    console.log(`Target hub: ${path17.basename(existing.hubFolder)} (${existing.hubId})`);
-    assertHubMatchesBinding(existing.hubId, path17.basename(existing.hubFolder));
+    console.log(`Target hub: ${path18.basename(existing.hubFolder)} (${existing.hubId})`);
+    assertHubMatchesBinding(existing.hubId, path18.basename(existing.hubFolder));
     await pushSingleHub(client, existing.hubId, existing.hubFolder, autoConfirm, organizationId);
     return;
   }
@@ -16419,8 +16519,7 @@ var init_push = __esm({
     init_auth();
     init_api_client();
     init_parser();
-    init_yaml_writer();
-    init_pull();
+    init_hub_materializer();
     init_resource_files();
     init_diff_display();
     init_utils();
@@ -16437,7 +16536,7 @@ var create_exports = {};
 __export(create_exports, {
   createCommand: () => createCommand
 });
-import * as path18 from "path";
+import * as path19 from "path";
 import * as fs16 from "fs";
 function parseArgs6(args2) {
   let autoConfirm = false;
@@ -16474,7 +16573,7 @@ async function createCommand(args2) {
   const resolution = resolveNewHubForCreate(workspaceDir, existingHubs, newHubs, folderSelector);
   if (!resolution.ok) {
     if (resolution.reason === "exists") {
-      const folder = path18.basename(resolution.existing.hubFolder);
+      const folder = path19.basename(resolution.existing.hubFolder);
       console.error(`Hub "${folder}" already exists (${resolution.existing.hubId}). Use \`wayai push --hub ${folder}\` to update it.`);
       process.exit(1);
     }
@@ -16488,7 +16587,7 @@ async function createCommand(args2) {
     }
     console.error(`Multiple new hub folders found in ${wsLabel}/. Pass the folder name (\`wayai create <folder>\`) or run from inside one:`);
     for (const h of newHubs) {
-      console.error(`  ${path18.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
+      console.error(`  ${path19.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
     }
     process.exit(1);
   }
@@ -16600,7 +16699,7 @@ __export(replicate_exports, {
   replicateCommand: () => replicateCommand
 });
 import * as fs17 from "fs";
-import * as path19 from "path";
+import * as path20 from "path";
 function parseArgs8(args2) {
   let label;
   let hubSelector;
@@ -16646,9 +16745,8 @@ async function replicateCommand(args2) {
     payload.preview_label,
     payload.branch_name
   );
-  fs17.mkdirSync(path19.dirname(hubFolder), { recursive: true });
-  writeHubFolder(hubFolder, payload);
-  await downloadBinaryResourceFiles(hubFolder, payload);
+  fs17.mkdirSync(path20.dirname(hubFolder), { recursive: true });
+  await materializeHubFolder(hubFolder, payload);
   hubFolder = autoRenameHubFolder(
     hubFolder,
     payload.hub.name,
@@ -16658,15 +16756,15 @@ async function replicateCommand(args2) {
     payload.branch_name
   );
   autoBindIfUnbound(previewHubId);
-  console.log(`Preview written to ${path19.basename(hubFolder)}`);
-  console.log(`  Switch to it with: wayai use ${path19.basename(hubFolder)}`);
+  console.log(`Preview written to ${path20.basename(hubFolder)}`);
+  console.log(`  Switch to it with: wayai use ${path20.basename(hubFolder)}`);
 }
 var init_replicate = __esm({
   "src/commands/replicate.ts"() {
     "use strict";
     init_auth();
     init_api_client();
-    init_yaml_writer();
+    init_hub_materializer();
     init_pull();
     init_workspace();
     init_layout();
@@ -16681,7 +16779,7 @@ var relabel_exports = {};
 __export(relabel_exports, {
   relabelCommand: () => relabelCommand
 });
-import * as path20 from "path";
+import * as path21 from "path";
 function parseArgs9(args2) {
   let label;
   let clear = false;
@@ -16725,7 +16823,7 @@ async function relabelCommand(args2) {
     } else {
       console.error(`Multiple hubs found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
       for (const h of previewHubs) {
-        console.error(`  ${path20.basename(h.hubFolder)} (${h.hubId})`);
+        console.error(`  ${path21.basename(h.hubFolder)} (${h.hubId})`);
       }
     }
     process.exit(1);
@@ -16734,7 +16832,7 @@ async function relabelCommand(args2) {
     console.log("This is a read-only production mirror \u2014 production hubs have no preview label. Relabel the linked preview hub instead.");
     return;
   }
-  assertHubMatchesBinding(target.hubId, path20.basename(target.hubFolder));
+  assertHubMatchesBinding(target.hubId, path21.basename(target.hubFolder));
   console.log(normalizedLabel ? `Setting preview label to "${normalizedLabel}"...` : "Clearing preview label...");
   const { data } = await client.relabelPreview(target.hubId, normalizedLabel);
   const row = data[0];
@@ -16750,7 +16848,7 @@ async function relabelCommand(args2) {
   );
   console.log(serverLabel ? `Preview label set to "${serverLabel}".` : "Preview label cleared.");
   if (finalFolder !== target.hubFolder) {
-    console.log(`Hub folder is now ${path20.basename(finalFolder)}`);
+    console.log(`Hub folder is now ${path21.basename(finalFolder)}`);
   }
 }
 var init_relabel = __esm({
@@ -16776,7 +16874,7 @@ __export(publish_exports, {
   renderHubDiff: () => renderHubDiff,
   runPublish: () => runPublish
 });
-import * as path21 from "path";
+import * as path22 from "path";
 function parseArgs10(args2) {
   let autoConfirm = false;
   let hubSelector;
@@ -16890,7 +16988,7 @@ async function publishCommand(args2) {
       return;
     }
   }
-  assertHubMatchesBinding(hubId, hubFolder ? path21.basename(hubFolder) : void 0);
+  assertHubMatchesBinding(hubId, hubFolder ? path22.basename(hubFolder) : void 0);
   await runPublish(client, { hubId, localConfig, organizationId, autoConfirm });
 }
 var STATUS_STYLE;
@@ -16923,7 +17021,7 @@ var use_exports = {};
 __export(use_exports, {
   useCommand: () => useCommand
 });
-import * as path22 from "path";
+import * as path23 from "path";
 async function useCommand(args2) {
   const target = args2[0];
   if (!target || target.startsWith("-")) {
@@ -16945,7 +17043,7 @@ async function useCommand(args2) {
     const match = findHubByFolderName(workspaceDir, target);
     if (!match) {
       const newHubs = scanNewHubs(workspaceDir);
-      const pending = newHubs.find((h) => path22.basename(h.hubFolder) === target);
+      const pending = newHubs.find((h) => path23.basename(h.hubFolder) === target);
       if (pending) {
         console.error(
           `"${target}" is a new hub that hasn't been created on the platform yet, so it has no id to bind to.
@@ -16956,10 +17054,10 @@ Create it first \u2014 the worktree binds automatically afterward:
       }
       console.error(`No hub matching "${target}" found in ${wsLabel}/. Pass a UUID or a folder name from:`);
       for (const h of scanWorkspaceHubs(workspaceDir)) {
-        console.error(`  ${path22.basename(h.hubFolder)} (${h.hubId})`);
+        console.error(`  ${path23.basename(h.hubFolder)} (${h.hubId})`);
       }
       for (const h of newHubs) {
-        console.error(`  ${path22.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path22.basename(h.hubFolder)}\`)`);
+        console.error(`  ${path23.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path23.basename(h.hubFolder)}\`)`);
       }
       process.exit(1);
     }
@@ -16999,10 +17097,10 @@ __export(migrate_exports, {
 });
 import { execFileSync as execFileSync3 } from "child_process";
 import * as fs18 from "fs";
-import * as path23 from "path";
+import * as path24 from "path";
 function isTracked(gitRoot, p) {
   try {
-    execFileSync3("git", ["ls-files", "--error-unmatch", "--", path23.relative(gitRoot, p)], {
+    execFileSync3("git", ["ls-files", "--error-unmatch", "--", path24.relative(gitRoot, p)], {
       cwd: gitRoot,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -17012,10 +17110,10 @@ function isTracked(gitRoot, p) {
   }
 }
 function moveDir(gitRoot, from, to) {
-  fs18.mkdirSync(path23.dirname(to), { recursive: true });
+  fs18.mkdirSync(path24.dirname(to), { recursive: true });
   if (isTracked(gitRoot, from)) {
     try {
-      execFileSync3("git", ["mv", path23.relative(gitRoot, from), path23.relative(gitRoot, to)], {
+      execFileSync3("git", ["mv", path24.relative(gitRoot, from), path24.relative(gitRoot, to)], {
         cwd: gitRoot,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -17032,12 +17130,12 @@ async function migrateCommand(_args) {
     console.error("Not inside a git repository.");
     process.exit(1);
   }
-  const rel = (p) => path23.relative(gitRoot, p);
-  const newWs = path23.join(gitRoot, WAYAI_LAYOUT.wsDir);
-  const legacyWs = path23.join(gitRoot, WAYAI_LAYOUT.legacy.wsDir);
-  const legacyOrg = path23.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
-  const newHubs = path23.join(newWs, WAYAI_LAYOUT.hubsSubdir);
-  const newOrg = path23.join(newWs, WAYAI_LAYOUT.orgSubdir);
+  const rel = (p) => path24.relative(gitRoot, p);
+  const newWs = path24.join(gitRoot, WAYAI_LAYOUT.wsDir);
+  const legacyWs = path24.join(gitRoot, WAYAI_LAYOUT.legacy.wsDir);
+  const legacyOrg = path24.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
+  const newHubs = path24.join(newWs, WAYAI_LAYOUT.hubsSubdir);
+  const newOrg = path24.join(newWs, WAYAI_LAYOUT.orgSubdir);
   const hasLegacyWs = isDirectory(legacyWs);
   const hasLegacyOrg = isDirectory(legacyOrg);
   if (!hasLegacyWs && !hasLegacyOrg) {
@@ -17112,7 +17210,7 @@ __export(send_message_exports, {
   sendMessageCommand: () => sendMessageCommand
 });
 import * as fs19 from "fs";
-import * as path24 from "path";
+import * as path25 from "path";
 function statAttachment(filePath) {
   let stat;
   try {
@@ -17128,8 +17226,8 @@ function statAttachment(filePath) {
   return { filePath, size: stat.size };
 }
 function readAttachment(filePath, size) {
-  const fileName = path24.basename(filePath);
-  const ext = path24.extname(fileName).replace(/^\./, "");
+  const fileName = path25.basename(filePath);
+  const ext = path25.extname(fileName).replace(/^\./, "");
   return {
     file_name: fileName,
     file_binary: fs19.readFileSync(filePath).toString("base64"),
@@ -17179,7 +17277,7 @@ async function sendMessageCommand(args2) {
   }
   const stats = filePaths.map(statAttachment);
   const filesTotal = stats.reduce((sum, s) => sum + base64Length(s.size), 0);
-  const fileDetail = () => stats.map((s) => `${path24.basename(s.filePath)} ${asMb(s.size)} MB`).join(", ");
+  const fileDetail = () => stats.map((s) => `${path25.basename(s.filePath)} ${asMb(s.size)} MB`).join(", ");
   if (filesTotal > MAX_MESSAGE_BODY_BYTES2) {
     console.error(
       `Error: ${fileDetail()} encode to ~${asMb(filesTotal)} MB, over the ${asMb(MAX_MESSAGE_BODY_BYTES2)} MB per-request limit.`
@@ -18640,7 +18738,7 @@ __export(eval_capture_exports, {
   evalCaptureCommand: () => evalCaptureCommand
 });
 import * as fs20 from "fs";
-import * as path25 from "path";
+import * as path26 from "path";
 import * as yaml7 from "js-yaml";
 function isValidSetName(name) {
   if (name.length === 0 || name === "." || name === "..") return false;
@@ -18706,15 +18804,15 @@ async function evalCaptureCommand(args2) {
   const setFolderName = targetSetName;
   const scenarioName = parsed.evalName ?? `Capture ${parsed.conversationId.slice(0, 8)}`;
   const slug = slugify(scenarioName);
-  const evalsDir = path25.join(hubFolder, "evals");
-  const targetDir = path25.join(evalsDir, setFolderName);
-  const targetPath = path25.join(targetDir, `${slug}.yaml`);
-  if (!targetPath.startsWith(evalsDir + path25.sep)) {
-    console.error(`Resolved path "${path25.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
+  const evalsDir = path26.join(hubFolder, "evals");
+  const targetDir = path26.join(evalsDir, setFolderName);
+  const targetPath = path26.join(targetDir, `${slug}.yaml`);
+  if (!targetPath.startsWith(evalsDir + path26.sep)) {
+    console.error(`Resolved path "${path26.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
     process.exit(1);
   }
   if (fs20.existsSync(targetPath)) {
-    console.error(`File already exists: ${path25.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
+    console.error(`File already exists: ${path26.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
     process.exit(1);
   }
   console.log("Resolving scenario set...");
@@ -18748,7 +18846,7 @@ async function evalCaptureCommand(args2) {
   const yamlObj = buildEvalYamlObject(evalEntry, slug);
   fs20.mkdirSync(targetDir, { recursive: true });
   fs20.writeFileSync(targetPath, yaml7.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
-  const relPath = path25.relative(process.cwd(), targetPath);
+  const relPath = path26.relative(process.cwd(), targetPath);
   console.log(`
 Wrote ${relPath}`);
   console.log("Run `wayai pull` to refresh the agent display name, then commit. The scenario is already on the platform.");
@@ -19976,22 +20074,22 @@ var init_set_connection_credential = __esm({
 
 // src/lib/org-workspace.ts
 import * as fs21 from "fs";
-import * as path26 from "path";
+import * as path27 from "path";
 import * as yaml8 from "js-yaml";
 function getOrgDir(gitRoot) {
   return resolveLayout(gitRoot).orgDir;
 }
 function orgManifestExists(orgDir) {
-  return fs21.existsSync(path26.join(orgDir, ORG_MANIFEST_NAME));
+  return fs21.existsSync(path27.join(orgDir, ORG_MANIFEST_NAME));
 }
 function parseOrgResources(orgDir) {
-  const manifestPath = path26.join(orgDir, ORG_MANIFEST_NAME);
+  const manifestPath = path27.join(orgDir, ORG_MANIFEST_NAME);
   let manifest = {};
   if (fs21.existsSync(manifestPath)) {
     manifest = yaml8.load(fs21.readFileSync(manifestPath, "utf-8")) ?? {};
   }
   const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
-  const resourcesDir = path26.join(orgDir, "resources");
+  const resourcesDir = path27.join(orgDir, "resources");
   const resources = rawResources.map((res) => {
     const resource = { name: res.name };
     if (res.id) resource.id = res.id;
@@ -20003,7 +20101,7 @@ function parseOrgResources(orgDir) {
     if (res.environment) resource.environment = res.environment;
     if (Array.isArray(res.tags)) resource.tags = res.tags;
     if (Array.isArray(res.folders)) resource.folders = res.folders;
-    const resDir = path26.join(resourcesDir, slugify(resource.name));
+    const resDir = path27.join(resourcesDir, slugify(resource.name));
     if (fs21.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) resource.files = files;
@@ -20020,21 +20118,21 @@ function writeOrgResources(orgDir, payload) {
     return rest;
   });
   fs21.writeFileSync(
-    path26.join(orgDir, ORG_MANIFEST_NAME),
+    path27.join(orgDir, ORG_MANIFEST_NAME),
     yaml8.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
     "utf-8"
   );
-  const resourcesDir = path26.join(orgDir, "resources");
+  const resourcesDir = path27.join(orgDir, "resources");
   const currentSlugs = /* @__PURE__ */ new Set();
   for (const resource of resources) {
     const resSlug = slugify(resource.name);
     currentSlugs.add(resSlug);
-    writeResourceFileTree(path26.join(resourcesDir, resSlug), resource.files || [], orgDir);
+    writeResourceFileTree(path27.join(resourcesDir, resSlug), resource.files || [], orgDir);
   }
   if (fs21.existsSync(resourcesDir)) {
     for (const entry of fs21.readdirSync(resourcesDir, { withFileTypes: true })) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
-        fs21.rmSync(path26.join(resourcesDir, entry.name), { recursive: true, force: true });
+        fs21.rmSync(path27.join(resourcesDir, entry.name), { recursive: true, force: true });
       }
     }
   }
@@ -20043,7 +20141,7 @@ async function downloadOrgBinaryFiles(orgDir, payload) {
   let count = 0;
   for (const resource of payload.resources ?? []) {
     if (!resource.files) continue;
-    const resDir = path26.join(orgDir, "resources", slugify(resource.name));
+    const resDir = path27.join(orgDir, "resources", slugify(resource.name));
     count += await downloadBinaryFiles(resDir, resource.files, orgDir);
   }
   if (count > 0) console.log(`Downloaded ${count} binary resource file(s).`);
@@ -20300,13 +20398,13 @@ var init_list = __esm({
 
 // src/lib/template-files.ts
 import * as fs22 from "fs";
-import * as path27 from "path";
+import * as path28 from "path";
 function readDirToFileMap(rootDir) {
   const out = {};
   function walk(dir, prefix) {
     const entries = fs22.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const abs = path27.join(dir, entry.name);
+      const abs = path28.join(dir, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) walk(abs, rel);
       else if (entry.isFile()) out[rel] = fs22.readFileSync(abs, "utf-8");
@@ -20321,7 +20419,7 @@ function detectCollisions(targetDir, files) {
     if (!isSafeTemplatePath2(rel)) {
       throw new Error(`Refusing to inspect unsafe template path: ${rel}`);
     }
-    if (fs22.existsSync(path27.join(targetDir, rel))) collisions.push(rel);
+    if (fs22.existsSync(path28.join(targetDir, rel))) collisions.push(rel);
   }
   return collisions.sort((a, b) => a.localeCompare(b));
 }
@@ -20331,8 +20429,8 @@ function writeFileMap(targetDir, files) {
     if (!isSafeTemplatePath2(rel)) {
       throw new Error(`Refusing to write unsafe template path: ${rel}`);
     }
-    const abs = path27.join(targetDir, rel);
-    fs22.mkdirSync(path27.dirname(abs), { recursive: true });
+    const abs = path28.join(targetDir, rel);
+    fs22.mkdirSync(path28.dirname(abs), { recursive: true });
     fs22.writeFileSync(abs, body, "utf-8");
     written.push(rel);
   }
@@ -20343,7 +20441,7 @@ function listDirRelFiles(dir) {
   function walk(d, prefix) {
     for (const entry of fs22.readdirSync(d, { withFileTypes: true })) {
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-      if (entry.isDirectory()) walk(path27.join(d, entry.name), rel);
+      if (entry.isDirectory()) walk(path28.join(d, entry.name), rel);
       else if (entry.isFile()) out.push(rel);
     }
   }
@@ -20370,7 +20468,7 @@ var templates_exports = {};
 __export(templates_exports, {
   templateCommand: () => templateCommand
 });
-import * as path28 from "path";
+import * as path29 from "path";
 async function templateCommand(args2) {
   const [sub, ...rest] = args2;
   switch (sub) {
@@ -20486,8 +20584,8 @@ async function runTemplatePull(rest) {
     console.log(`Template "${slug}" has no WayAI slice${hint}`);
     return;
   }
-  const targetDir = path28.join(resolveLayout(gitRoot).hubsDir, slug);
-  const relTarget = path28.relative(gitRoot, targetDir);
+  const targetDir = path29.join(resolveLayout(gitRoot).hubsDir, slug);
+  const relTarget = path29.relative(gitRoot, targetDir);
   const collisions = detectCollisions(targetDir, detail.files);
   if (dryRun) {
     const planned = Object.keys(detail.files).sort((a, b) => a.localeCompare(b));
@@ -20678,7 +20776,7 @@ __export(admin_exports, {
   adminCommand: () => adminCommand
 });
 import * as fs23 from "fs";
-import * as path29 from "path";
+import * as path30 from "path";
 import * as yaml10 from "js-yaml";
 async function adminCommand(args2) {
   const [group, ...afterGroup] = args2;
@@ -21132,10 +21230,10 @@ function loadTemplateManifest(slug) {
     console.error("Not in a git repository. Run from the tutorials/ authoring repo.");
     process.exit(1);
   }
-  const templateDir = path29.join(resolveTemplatesDir(gitRoot), slug);
-  const manifestPath = path29.join(templateDir, "template.yaml");
+  const templateDir = path30.join(resolveTemplatesDir(gitRoot), slug);
+  const manifestPath = path30.join(templateDir, "template.yaml");
   if (!fs23.existsSync(manifestPath)) {
-    console.error(`template.yaml not found at ${path29.relative(gitRoot, manifestPath)}`);
+    console.error(`template.yaml not found at ${path30.relative(gitRoot, manifestPath)}`);
     process.exit(1);
   }
   let manifest;
@@ -21170,19 +21268,19 @@ async function runTemplatePush(positional) {
     const wayaiEntry = manifest.wayai.locales[locale];
     let wayaiFiles;
     if (wayaiEntry) {
-      const sliceDir = path29.resolve(templateDir, wayaiEntry.source);
+      const sliceDir = path30.resolve(templateDir, wayaiEntry.source);
       if (!fs23.existsSync(sliceDir)) {
         console.error(`wayai source not found for ${locale}: ${wayaiEntry.source} (resolved ${sliceDir})`);
         process.exit(1);
       }
       if (!isInsideTemplateDir(sliceDir, templateDir)) {
         console.warn(
-          `Note: ${locale} source points at a live hub (${wayaiEntry.source}); it can go stale on a hub recreate. Run \`wayai admin template freeze ${slug} --locale ${locale} --from ${path29.basename(sliceDir)}\` to commit a stable frozen slice.`
+          `Note: ${locale} source points at a live hub (${wayaiEntry.source}); it can go stale on a hub recreate. Run \`wayai admin template freeze ${slug} --locale ${locale} --from ${path30.basename(sliceDir)}\` to commit a stable frozen slice.`
         );
       }
       wayaiFiles = readDirToFileMap(sliceDir);
     }
-    const readmePath = path29.join(templateDir, `README.${locale}.md`);
+    const readmePath = path30.join(templateDir, `README.${locale}.md`);
     const readmeMarkdown = fs23.existsSync(readmePath) ? fs23.readFileSync(readmePath, "utf-8") : "";
     locales[locale] = {
       readmeMarkdown,
@@ -21194,9 +21292,9 @@ async function runTemplatePush(positional) {
   }
   let hero;
   if (manifest.hero) {
-    const heroPath = path29.resolve(templateDir, manifest.hero);
+    const heroPath = path30.resolve(templateDir, manifest.hero);
     if (fs23.existsSync(heroPath)) {
-      hero = { filename: path29.basename(heroPath), dataBase64: fs23.readFileSync(heroPath).toString("base64") };
+      hero = { filename: path30.basename(heroPath), dataBase64: fs23.readFileSync(heroPath).toString("base64") };
     } else {
       console.error(`Warning: hero not found at ${manifest.hero}; skipping.`);
     }
@@ -21222,7 +21320,7 @@ async function runTemplatePush(positional) {
   }
 }
 function isInsideTemplateDir(dest, templateDir) {
-  return dest === templateDir || dest.startsWith(templateDir + path29.sep);
+  return dest === templateDir || dest.startsWith(templateDir + path30.sep);
 }
 async function runTemplateFreeze(positional, flagArgs) {
   const slug = positional[0];
@@ -21283,7 +21381,7 @@ async function runTemplateFreeze(positional, flagArgs) {
     process.exit(1);
   }
   const entry = manifest.wayai.locales[targetLocale];
-  const dest = path29.resolve(templateDir, entry.source);
+  const dest = path30.resolve(templateDir, entry.source);
   if (!isInsideTemplateDir(dest, templateDir) || dest === templateDir) {
     console.error(
       `source for "${targetLocale}" must be a committed path inside ${slug}/ (e.g. "./${targetLocale}/slice"), but resolved to:
@@ -21302,7 +21400,7 @@ Set it to a subdir of the template folder and re-run freeze.`
     const hubs = scanWorkspaceHubs(hubsDir);
     if (hubs.length) {
       console.error("Available hubs:");
-      for (const h of hubs) console.error(`  ${path29.basename(h.hubFolder)} (${h.hubId})`);
+      for (const h of hubs) console.error(`  ${path30.basename(h.hubFolder)} (${h.hubId})`);
     }
     console.error(`
 Pass --from <folder|uuid>${selector ? "." : " or run `wayai use <hub>` first."}`);
@@ -21310,12 +21408,12 @@ Pass --from <folder|uuid>${selector ? "." : " or run `wayai use <hub>` first."}`
   }
   const liveFiles = readDirToFileMap(hubFolder);
   if (Object.keys(liveFiles).length === 0) {
-    console.error(`Source hub folder has no files to freeze: ${path29.relative(gitRoot, hubFolder)}`);
+    console.error(`Source hub folder has no files to freeze: ${path30.relative(gitRoot, hubFolder)}`);
     process.exit(1);
   }
   const sanitized = sanitizeWayaiSliceFiles(liveFiles);
-  const relDest = path29.relative(gitRoot, dest);
-  const relSrc = path29.relative(gitRoot, hubFolder);
+  const relDest = path30.relative(gitRoot, dest);
+  const relSrc = path30.relative(gitRoot, hubFolder);
   if (dryRun) {
     const existing = new Set(listDirRelFiles(dest));
     const nextKeys = new Set(Object.keys(sanitized));
@@ -21375,7 +21473,7 @@ async function runTemplatePull2(positional, flagArgs) {
     console.log(JSON.stringify(detail, null, 2));
     return;
   }
-  const target = outDir ? path29.resolve(outDir) : path29.join(process.cwd(), "template-store-pull", slug);
+  const target = outDir ? path30.resolve(outDir) : path30.join(process.cwd(), "template-store-pull", slug);
   const written = writeFileMap(target, detail.files);
   console.log(`Pulled "${slug}" from the store \u2192 ${target} (${written.length} file${written.length === 1 ? "" : "s"}).`);
   const uses = detail.uses ?? [];
@@ -21398,13 +21496,13 @@ async function runSkillInstall(positional) {
     throw err;
   }
   const root = findGitRoot() ?? process.cwd();
-  const present = HARNESS_SKILL_DIRS.filter((dir) => fs23.existsSync(path29.join(root, dir)));
+  const present = HARNESS_SKILL_DIRS.filter((dir) => fs23.existsSync(path30.join(root, dir)));
   const targets = present.length > 0 ? present : HARNESS_SKILL_DIRS;
   const fileCount = Object.keys(res.files).length;
   const relDirs = targets.map((harness) => {
-    const targetDir = path29.join(root, harness, "skills", name);
+    const targetDir = path30.join(root, harness, "skills", name);
     writeFileMap(targetDir, res.files);
-    return `${path29.relative(root, targetDir)}/`;
+    return `${path30.relative(root, targetDir)}/`;
   });
   console.log(`Installed skill "${name}" (${fileCount} file${fileCount === 1 ? "" : "s"}) \u2192 ${relDirs.join(", ")}`);
   console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
@@ -21869,7 +21967,7 @@ async function runReportList(flagArgs) {
     }
     console.log(`Reports: ${result.data.length}/${result.total}`);
     for (const r of result.data) {
-      const age = Math.floor((Date.now() - r.created_at) / 1e3 / 60);
+      const age = Math.floor((Date.now() - Date.parse(r.created_at)) / 1e3 / 60);
       const meta = [
         r.source,
         r.status,
@@ -22290,6 +22388,21 @@ var init_admin = __esm({
   }
 });
 
+// src/lib/terminal-output.ts
+import { stripVTControlCharacters } from "util";
+function sanitizeTerminalText(value) {
+  const normalizedNewlines = value.replace(/\r\n?/g, "\n");
+  return stripVTControlCharacters(normalizedNewlines).replace(
+    /[\u0000-\u0009\u000b-\u001f\u007f-\u009f]/g,
+    ""
+  );
+}
+var init_terminal_output = __esm({
+  "src/lib/terminal-output.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/version-status.ts
 function componentStatus(current, latest) {
   return { current, latest, behind: Boolean(current && latest && isNewerVersion(latest, current)) };
@@ -22602,7 +22715,8 @@ async function reportListCommand(args2) {
       return;
     }
     for (const r of result.data) {
-      console.log(`${r.report_id}  ${r.status.padEnd(10)}  ${r.classification}`);
+      const title = sanitizeTerminalText(r.title).replace(/\s+/g, " ").trim();
+      console.log(`${r.report_id}  ${r.status.padEnd(10)}  ${r.classification}  ${title}`);
     }
   } catch (err) {
     reportActionError(err);
@@ -22624,7 +22738,11 @@ async function reportGetCommand(args2) {
       return;
     }
     const { report, messages } = result;
+    const title = sanitizeTerminalText(report.title);
+    const description = sanitizeTerminalText(report.description);
     console.log(`Report ${report.report_id}`);
+    console.log(`  title:          ${title}`);
+    console.log(`  description:    ${description.replace(/\n/g, "\n                  ")}`);
     console.log(`  status:         ${report.status}`);
     console.log(`  classification: ${report.classification}`);
     if (report.contest_count > 0) console.log(`  contests:       ${report.contest_count}`);
@@ -22632,7 +22750,7 @@ async function reportGetCommand(args2) {
     if (messages.length > 0) {
       console.log("\n  Thread:");
       for (const m of messages) {
-        console.log(`    [${m.author_role}] ${m.body}`);
+        console.log(`    [${m.author_role}] ${sanitizeTerminalText(m.body)}`);
       }
     }
     if (report.status === "shipped") {
@@ -22701,6 +22819,7 @@ var init_report = __esm({
     "use strict";
     init_auth();
     init_api_client();
+    init_terminal_output();
     init_report_edit_args();
     init_report_create();
   }
@@ -22748,7 +22867,7 @@ var init_update = __esm({
 init_sentry();
 import { readFileSync as readFileSync20 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname9, join as join27 } from "path";
+import { dirname as dirname9, join as join28 } from "path";
 
 // src/lib/errors.ts
 init_api_client();
@@ -22928,7 +23047,7 @@ Run \`wayai admin skill install\` to update.`);
 
 // src/index.ts
 var __dirname = dirname9(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync20(join27(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync20(join28(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);