@wayai/cli 0.3.135 → 0.3.136

package/dist/index.js

@@ -7546,6 +7546,20 @@ var init_contracts = __esm({
       production_bases: external_exports.boolean(),
       /** Opaque to Rekor; compared for equality only, to reset `usage:` counters (§2.3). */
       window_key: external_exports.string().min(1),
+      /**
+       * The window's TRUE lower bound, for the reconcile's `operations_log` sum (§2.2).
+       *
+       * OPTIONAL, and that is not a rollout convenience — it is what "never gates" means
+       * on the writer's side. The tier sources can be absent (a paid row carrying
+       * `current_period_end` with no `current_period_start`) and inverted pairs are a
+       * §2.2 diagnostic, so requiring it here would let an inert field throw the strict
+       * parse and leave the org with NO projection — permanently stale under §2.3, with
+       * §2.5's fail-closed gates refusing base creation and 503-ing every import. The
+       * writer emits it whenever it has a sound value and omits it otherwise; Rekor's
+       * observed-flip fallback covers the gap, and rollout step 3 keeps that fallback
+       * for exactly this reason.
+       */
+      window_start: external_exports.string().datetime().optional(),
       /** The sole staleness authority (§2.3). Never triggers a counter reset. */
       window_resets_at: external_exports.string().datetime()
     }).strict();
@@ -8700,7 +8714,8 @@ __export(api_client_exports, {
   ApiClient: () => ApiClient,
   ApiError: () => ApiError,
   dataErrorMessage: () => dataErrorMessage,
-  toDataProxyPath: () => toDataProxyPath
+  toDataProxyPath: () => toDataProxyPath,
+  withOrgSelector: () => withOrgSelector
 });
 function isRetryableErrorBody(body) {
   try {
@@ -8716,6 +8731,11 @@ function toDataProxyPath(v1Path) {
   }
   return `${DATA_PROXY_PREFIX}${v1Path.slice(REKOR_V1_PREFIX.length)}`;
 }
+function withOrgSelector(path31, orgId) {
+  if (!orgId) return path31;
+  const separator = path31.includes("?") ? "&" : "?";
+  return `${path31}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
+}
 function dataErrorMessage(err) {
   if (!(err instanceof ApiError)) return null;
   let parsed;
@@ -9328,12 +9348,12 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path31, body) {
+      async request(method, path31, body, extraHeaders, contentType) {
         addApiBreadcrumb(method, path31);
         const url = `${this.apiUrl}${path31}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
-          let response = await this.send(url, method, body);
+          let response = await this.send(url, method, body, extraHeaders, contentType);
           if (response.status === 401 && this.onUnauthorized && !refreshedOn401) {
             refreshedOn401 = true;
             let refreshed;
@@ -9343,7 +9363,7 @@ var init_api_client = __esm({
             }
             if (refreshed) {
               this.accessToken = refreshed;
-              response = await this.send(url, method, body);
+              response = await this.send(url, method, body, extraHeaders, contentType);
             }
           }
           if (response.ok) {
@@ -9384,30 +9404,98 @@ var init_api_client = __esm({
        * since it is WayAI's selector and not an input Rekor sees.
        */
       async dataRequest(method, v1Path, body, orgId) {
-        const separator = v1Path.includes("?") ? "&" : "?";
-        const orgQuery = orgId ? `${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}` : "";
         const envelope = await this.request(
           method,
-          `${toDataProxyPath(v1Path)}${orgQuery}`,
+          withOrgSelector(toDataProxyPath(v1Path), orgId),
           body
         );
         return envelope ?? {};
       }
+      /**
+       * Upload raw bytes to a Data `/v1` path — file content and record
+       * attachments, the two places that surface takes a body which is not JSON.
+       * `extraHeaders` carries the surface's own metadata headers, which are
+       * caller-supplied and so cannot displace the org selector or anything `send`
+       * pins.
+       */
+      async dataUpload(v1Path, bytes, contentType, orgId, extraHeaders) {
+        const envelope = await this.request(
+          "PUT",
+          withOrgSelector(toDataProxyPath(v1Path), orgId),
+          bytes,
+          extraHeaders,
+          // NOT a header on the map above: `send` pins the content type out of
+          // caller reach, and takes it here so it always describes the real body.
+          contentType
+        );
+        return envelope ?? {};
+      }
+      /**
+       * Download a Data `/v1` path's raw bytes. Distinct from `dataRequest`, which
+       * parses the JSON envelope: the response here is the stored blob itself, so
+       * this reads `arrayBuffer()`. Single-refresh-on-401 like `request`, but no
+       * transient-retry loop — re-streaming a blob is not worth a cold-start probe.
+       */
+      async dataDownload(v1Path, orgId) {
+        const path31 = withOrgSelector(toDataProxyPath(v1Path), orgId);
+        addApiBreadcrumb("GET", path31);
+        const url = `${this.apiUrl}${path31}`;
+        let response = await this.send(url, "GET");
+        if (response.status === 401 && this.onUnauthorized) {
+          let refreshed;
+          try {
+            refreshed = await this.onUnauthorized();
+          } catch {
+          }
+          if (refreshed) {
+            this.accessToken = refreshed;
+            response = await this.send(url, "GET");
+          }
+        }
+        if (!response.ok) {
+          throw new ApiError("GET", path31, response.status, await response.text());
+        }
+        return {
+          bytes: new Uint8Array(await response.arrayBuffer()),
+          contentType: response.headers.get("Content-Type") ?? "application/octet-stream"
+        };
+      }
+      /**
+       * The absolute URL of a Data `/v1` path, for handing the user a link they can
+       * fetch themselves. Only the address — every request the CLI issues goes
+       * through the methods above, which carry the session.
+       */
+      dataUrl(v1Path, orgId) {
+        return `${this.apiUrl}${withOrgSelector(toDataProxyPath(v1Path), orgId)}`;
+      }
       /** Issue a single authenticated request with the client's current token. */
-      send(url, method, body) {
+      send(url, method, body, extraHeaders, contentType) {
         return fetch(url, {
           method,
           headers: {
+            // Caller-supplied FIRST, so everything pinned below is out of their
+            // reach: a metadata header cannot restate the credential or mislabel
+            // the body.
+            ...extraHeaders,
             Authorization: `Bearer ${this.accessToken}`,
-            "Content-Type": "application/json",
-            // Names the calling process, on every request. A HINT, not an
+            // The content type describes THIS body, so it is derived from the body
+            // rather than accepted from `extraHeaders` — which is pinned out above,
+            // and would otherwise be the one way to mislabel a JSON request.
+            // `||`, not `??`: an empty content type is not a content type, and an
+            // unlabelled body should fall back rather than announce nothing.
+            "Content-Type": body instanceof Uint8Array ? contentType || "application/octet-stream" : "application/json",
+            // Names the calling surface for the Data Worker's audit rows, which
+            // record `cli` vs `api` vs `mcp` (contracts §1.4). A HINT, not an
             // authorization input: any client can send it, so the backend must
             // normalize it against what it knows about its own ingress rather than
             // trust it. Nothing is granted or denied on its value; the Data Worker's
             // audit rows are its consumer (contracts §1.4).
             "X-WayAI-Client": "cli"
           },
-          body: body ? JSON.stringify(body) : void 0
+          // Bytes go on the wire verbatim (file content, attachments); everything
+          // else is JSON. Encoding a Uint8Array through JSON.stringify would send
+          // `{"0":137,…}` — a corrupt upload rather than a failed one.
+          body: !body ? void 0 : body instanceof Uint8Array ? body : JSON.stringify(body)
         });
       }
     };
@@ -12849,6 +12937,20 @@ var init_dist = __esm({
       production_bases: external_exports.boolean(),
       /** Opaque to Rekor; compared for equality only, to reset `usage:` counters (§2.3). */
       window_key: external_exports.string().min(1),
+      /**
+       * The window's TRUE lower bound, for the reconcile's `operations_log` sum (§2.2).
+       *
+       * OPTIONAL, and that is not a rollout convenience — it is what "never gates" means
+       * on the writer's side. The tier sources can be absent (a paid row carrying
+       * `current_period_end` with no `current_period_start`) and inverted pairs are a
+       * §2.2 diagnostic, so requiring it here would let an inert field throw the strict
+       * parse and leave the org with NO projection — permanently stale under §2.3, with
+       * §2.5's fail-closed gates refusing base creation and 503-ing every import. The
+       * writer emits it whenever it has a sound value and omits it otherwise; Rekor's
+       * observed-flip fallback covers the gap, and rollout step 3 keeps that fallback
+       * for exactly this reason.
+       */
+      window_start: external_exports.string().datetime().optional(),
       /** The sole staleness authority (§2.3). Never triggers a counter reset. */
       window_resets_at: external_exports.string().datetime()
     }).strict();
@@ -13979,6 +14081,18 @@ var init_dist = __esm({
   }
 });
 
+// src/lib/expected.ts
+function expected(message) {
+  const err = new Error(message);
+  err.isExpected = true;
+  return err;
+}
+var init_expected = __esm({
+  "src/lib/expected.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/layout.ts
 import * as fs from "fs";
 import * as path from "path";
@@ -14700,11 +14814,31 @@ function isNewerVersion(latest, current) {
   }
   return false;
 }
+function resolveSecretSource(source) {
+  if (source.stdin && source.prompt) {
+    throw expected(`${source.stdinFlag} and ${source.promptHint} are mutually exclusive \u2014 pass one.`);
+  }
+  if (source.stdin) {
+    if (process.stdin.isTTY) {
+      throw expected(
+        `${source.stdinFlag} needs piped input. Pipe it \u2014 printf %s "$SECRET" | wayai \u2026 ${source.stdinFlag} \u2014 or ${source.promptHint}.`
+      );
+    }
+    return "stdin";
+  }
+  if (!process.stdin.isTTY) {
+    throw expected(
+      `A secret cannot be prompted for when stdin is not a terminal. Pipe it instead: printf %s "$SECRET" | wayai \u2026 ${source.stdinFlag}`
+    );
+  }
+  return "prompt";
+}
 var UUID_RE2, slugify, OWN_HELP_COMMANDS;
 var init_utils = __esm({
   "src/lib/utils.ts"() {
     "use strict";
     init_dist();
+    init_expected();
     UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     slugify = slugifySkillName;
     OWN_HELP_COMMANDS = /* @__PURE__ */ new Set([
@@ -14789,7 +14923,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "records",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity. No WayAI command of this name."
       },
       {
@@ -14797,7 +14931,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "record-types",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14805,7 +14939,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "relationships",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14813,7 +14947,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "relationship-types",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14821,7 +14955,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "query-relationships",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology traversal over relationships."
       },
       {
@@ -14829,7 +14963,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "files",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Unambiguous: WayAI has no `files` command \u2014 hub-local resource files are reached through hub config-as-code, and the two file surfaces stay deliberately separate."
       },
       {
@@ -14837,7 +14971,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "file-types",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14845,7 +14979,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "attachments",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14853,7 +14987,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "toolsets",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14861,7 +14995,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "actions",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14869,7 +15003,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "triggers",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14877,7 +15011,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "inbound-webhooks",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity."
       },
       {
@@ -14885,7 +15019,7 @@ var init_registry = __esm({
         disposition: "top-level",
         surviving: "seed",
         clause: 2,
-        shipped: false,
+        shipped: true,
         reason: "Ontology entity. `wayai status` vs `wayai seed lease status` differ by depth, not by word."
       },
       // --- Clause 3: namespaced. ---
@@ -15457,18 +15591,6 @@ var init_token_store = __esm({
   }
 });
 
-// src/lib/expected.ts
-function expected(message) {
-  const err = new Error(message);
-  err.isExpected = true;
-  return err;
-}
-var init_expected = __esm({
-  "src/lib/expected.ts"() {
-    "use strict";
-  }
-});
-
 // src/lib/auth.ts
 var auth_exports = {};
 __export(auth_exports, {
@@ -17011,7 +17133,7 @@ function rewriteEvalAttachmentsToLocalPaths(payload) {
     return base === "" || base === "." || base === ".." ? ref.hash.slice(0, 16) : base;
   };
   const hashesByName = /* @__PURE__ */ new Map();
-  const collect = (turn) => {
+  const collect2 = (turn) => {
     if (!Array.isArray(turn.attachments)) return;
     for (const ref of turn.attachments) {
       if (!ref?.hash || !ref.file_name) continue;
@@ -17024,7 +17146,7 @@ function rewriteEvalAttachmentsToLocalPaths(payload) {
       set.add(ref.hash);
     }
   };
-  forEachAttachableTurn(payload, collect);
+  forEachAttachableTurn(payload, collect2);
   const pathByKey = /* @__PURE__ */ new Map();
   const usedLower = /* @__PURE__ */ new Set();
   const localPathFor = (ref) => {
@@ -22512,11 +22634,19 @@ async function updateCredentialCommand(args2) {
   const body = {};
   if (wantsSecret) {
     let input;
-    if (parsed.stdin) {
-      if (process.stdin.isTTY) {
-        console.error("--stdin requires piped input. Use --secret for an interactive masked prompt.");
-        process.exit(1);
-      }
+    let secretSource;
+    try {
+      secretSource = resolveSecretSource({
+        stdin: parsed.stdin,
+        prompt: parsed.secretPrompt,
+        stdinFlag: "--stdin",
+        promptHint: "use --secret for an interactive masked prompt"
+      });
+    } catch (err) {
+      console.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+    if (secretSource === "stdin") {
       input = await readStdin();
     } else if (authType === "basic_auth") {
       const username = await prompt("Enter username: ");
@@ -24868,6 +24998,16 @@ async function createDataClient(orgId) {
         seen.add(cursor);
       }
       return all;
+    },
+    async upload(v1Path, bytes, contentType, headers) {
+      const envelope = await api.dataUpload(v1Path, bytes, contentType, org, headers);
+      return envelope.data;
+    },
+    download(v1Path) {
+      return api.dataDownload(v1Path, org);
+    },
+    url(v1Path) {
+      return api.dataUrl(v1Path, org);
     }
   };
 }
@@ -24977,29 +25117,249 @@ function pathSegment(id, label = "id") {
   }
   return encodeURIComponent(id);
 }
+function foreignSegment(value, label = "id") {
+  if (value === "." || value === "..") {
+    throw expected(`Invalid ${label}: ${JSON.stringify(value)} is a path traversal segment.`);
+  }
+  return encodeURIComponent(value);
+}
+function pathSegments(value, label = "path") {
+  return value.split("/").map((segment) => foreignSegment(segment, label)).join("/");
+}
 function parseData(data) {
   if (data.startsWith("@")) {
     return JSON.parse(readFileSync19(data.slice(1), "utf-8"));
   }
   return JSON.parse(data);
 }
+function toolsetMcpUrl(slug) {
+  return `https://data-mcp.wayai.pro/t/${slug}/mcp`;
+}
 function globals(cmd) {
   let namespace = cmd;
   while (namespace.parent?.parent) namespace = namespace.parent;
   return namespace.opts();
 }
+function findBase(cmd) {
+  return globals(cmd).base;
+}
+function requireBase(cmd) {
+  const base = findBase(cmd) ?? process.env.WAYAI_BASE ?? "";
+  if (base) return base;
+  console.error("Error: --base is required (or set WAYAI_BASE)");
+  return process.exit(1);
+}
 function outputFormat(cmd) {
   const opts = globals(cmd);
   return opts.json || opts.output === "json" ? "json" : "table";
 }
+function historyQuery(opts) {
+  const qs = new URLSearchParams();
+  if (opts.limit) qs.set("limit", opts.limit);
+  if (opts.offset) qs.set("offset", opts.offset);
+  if (opts.diff) qs.set("diff", "true");
+  const q = qs.toString();
+  return q ? `?${q}` : "";
+}
 function splitList(value) {
   return value.split(",").map((v) => v.trim()).filter((v) => v.length > 0);
 }
+function parseByteCount(flag, value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 0) {
+    throw expected(`${flag} must be a whole number of bytes (0 = unlimited), not ${JSON.stringify(value)}.`);
+  }
+  return n;
+}
+async function readSecret(source, label) {
+  const value = resolveSecretSource(source) === "stdin" ? (await readStdin()).trim() : (await promptSecret(`${label}: `)).trim();
+  if (!value) throw expected(`${label} is required.`);
+  return value;
+}
 var init_helpers = __esm({
   "src/data/helpers.ts"() {
     "use strict";
     init_base_id();
     init_expected();
+    init_utils();
+  }
+});
+
+// src/data/commands/actions.ts
+import { Command } from "commander";
+function buildActionsCommand() {
+  const actions = new Command("actions").description(
+    "Manage Actions \u2014 reusable, named definitions: one record_type + one operation, or a composite of atomic write steps (--config with `steps`)"
+  );
+  actions.command("upsert <id>").description(
+    "Create or update an Action \u2014 one record_type + one operation, or a composite (--config with `steps`)"
+  ).option(
+    "--record-type <record_type>",
+    "The record_type this action operates over (single-op; omit for a composite)"
+  ).option(
+    "--operation <op>",
+    "The operation: create | get | list | update | delete (single-op; omit for a composite)"
+  ).option("--description <desc>", "Agent-facing description").option(
+    "--config <json>",
+    'Full Action config as JSON. Single-op: writable_fields, filterable_fields (per field: field (required), param, match, enum, pattern, optional, description \u2014 a declared field generates a required param unless optional: true; a range match is always optional), base_filter (a Filter DSL predicate merged server-side into every list call, invisible to the agent; list only, over a native record_type or a source-backed one whose list endpoint declares local_filters; the value "$now" resolves to the instant of each call, on a date-time field with a range op), precondition, binding, external_source, expose_*/default_* (machinery params are hidden unless expose_<param>: true). Composite: `steps` \u2014 an ordered list of atomic write steps ({key, record_type|rel_type, operation, writable_fields?, precondition?}) run in one transaction. Use @file.json to read from file.'
+  ).action(async function(id, opts) {
+    let body;
+    if (opts.config) {
+      body = parseData(opts.config);
+      if (opts.recordType) body.record_type = opts.recordType;
+      if (opts.operation) body.operation = opts.operation;
+      if (opts.description) body.description = opts.description;
+    } else {
+      if (!opts.recordType || !opts.operation) {
+        throw expected("Provide --record-type and --operation (or --config <json>).");
+      }
+      body = { record_type: opts.recordType, operation: opts.operation };
+      if (opts.description) body.description = opts.description;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("PUT", `/v1/${base}/actions/${pathSegment(id, "action id")}`, body),
+      outputFormat(this)
+    );
+  });
+  actions.command("get <id>").description("Get an Action by id").action(async function(id) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/actions/${pathSegment(id, "action id")}`), outputFormat(this));
+  });
+  actions.command("list").description("List Actions in this base").action(async function() {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/actions`), outputFormat(this));
+  });
+  actions.command("delete <id>").description("Delete an Action").option("-y, --yes", "Skip confirmation").action(async function(id, opts) {
+    if (!opts.yes && !await confirm(`Delete action ${id}? This cannot be undone.`)) {
+      console.log("Aborted.");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/${base}/actions/${pathSegment(id, "action id")}`);
+    console.log(`Deleted action ${id}`);
+  });
+  return actions;
+}
+var init_actions = __esm({
+  "src/data/commands/actions.ts"() {
+    "use strict";
+    init_expected();
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
+});
+
+// src/data/commands/attachments.ts
+import { Command as Command2 } from "commander";
+import { readFileSync as readFileSync20 } from "fs";
+function findAttachmentByFilename(attachments, filename) {
+  return attachments.find((a) => a.key.endsWith(`/${filename}`)) ?? null;
+}
+function uploadPathFrom(uploadUrl) {
+  if (typeof uploadUrl !== "string") {
+    throw expected(
+      `The server returned an upload target this CLI will not send credentials to: ${String(uploadUrl)}`
+    );
+  }
+  let resolved;
+  try {
+    resolved = new URL(toDataProxyPath(uploadUrl), CONTAINMENT_ORIGIN);
+  } catch {
+    throw expected(
+      `The server returned an upload target this CLI will not send credentials to: ${uploadUrl}`
+    );
+  }
+  if (resolved.origin !== CONTAINMENT_ORIGIN || !resolved.pathname.startsWith(`${DATA_PROXY_PREFIX}/`)) {
+    throw expected(
+      `The server returned an upload target this CLI will not send credentials to: ${uploadUrl}`
+    );
+  }
+  return uploadUrl;
+}
+function buildAttachmentsCommand() {
+  const attachments = new Command2("attachments").description("Manage record attachments");
+  attachments.command("upload <record_type> <id>").description(
+    "Get a presigned upload URL for a record attachment. With --file, uploads the file content in one step."
+  ).requiredOption("--filename <name>", "File name or path (e.g. docs/guide.md)").option("--content-type <type>", "MIME type", "application/octet-stream").option("--file <path>", "Local file to upload (skips presigned URL output, uploads directly)").action(async function(recordType2, id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const data = await client.request(
+      "POST",
+      `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(id, "record id")}/attachments`,
+      { filename: opts.filename, content_type: opts.contentType }
+    );
+    if (!opts.file) {
+      printOutput(data, outputFormat(this));
+      return;
+    }
+    const body = readFileSync20(opts.file);
+    await client.upload(uploadPathFrom(data?.upload_url), body, opts.contentType);
+    printOutput({ ...data, uploaded: true }, outputFormat(this));
+  });
+  attachments.command("url <record_type> <id>").description("Get a download URL for an attachment by filename").requiredOption("--filename <name>", "File name or path (e.g. docs/guide.md)").action(async function(recordType2, id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const rows = await client.request(
+      "GET",
+      `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(id, "record id")}/attachments`
+    );
+    const match = findAttachmentByFilename(rows ?? [], opts.filename);
+    if (!match) {
+      throw expected(`Attachment "${opts.filename}" not found`);
+    }
+    printOutput(
+      { download_url: client.url(`/v1/${base}/attachments/${pathSegments(match.key, "attachment key")}`), ...match },
+      outputFormat(this)
+    );
+  });
+  attachments.command("list <record_type> <id>").description("List attachments for a record").option("--prefix <path>", "Filter by path prefix (e.g. docs/)").action(async function(recordType2, id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const query = opts.prefix ? `?prefix=${encodeURIComponent(opts.prefix)}` : "";
+    printOutput(
+      await client.request(
+        "GET",
+        `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(id, "record id")}/attachments${query}`
+      ),
+      outputFormat(this)
+    );
+  });
+  attachments.command("delete <record_type> <id> <attachment-id>").description("Delete an attachment").option("-y, --yes", "Skip confirmation prompt").action(async function(recordType2, id, attachmentId, opts) {
+    if (!opts.yes && !await confirm(
+      `Delete attachment ${attachmentId} on ${recordType2}/${id}? This cannot be undone.`
+    )) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request(
+      "DELETE",
+      `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(id, "record id")}/attachments/${pathSegment(attachmentId, "attachment id")}`
+    );
+    console.log("Deleted");
+  });
+  return attachments;
+}
+var CONTAINMENT_ORIGIN;
+var init_attachments = __esm({
+  "src/data/commands/attachments.ts"() {
+    "use strict";
+    init_expected();
+    init_contracts();
+    init_api_client();
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+    CONTAINMENT_ORIGIN = "https://containment.invalid";
   }
 });
 
@@ -25029,7 +25389,7 @@ var init_base_binding = __esm({
 });
 
 // src/data/commands/bases.ts
-import { Command } from "commander";
+import { Command as Command3 } from "commander";
 import * as fs24 from "fs";
 import * as path30 from "path";
 import * as yaml9 from "js-yaml";
@@ -25045,7 +25405,7 @@ function parseEnum(flag, value, allowed) {
   return value;
 }
 function buildBasesCommand() {
-  const bases = new Command("bases").description("Manage bases");
+  const bases = new Command3("bases").description("Manage bases");
   bases.command("list").description("List all bases").option("--tag <tag>", "Filter by tag").action(async function(opts) {
     const client = await createDataClient();
     const qs = opts.tag ? `?tag=${encodeURIComponent(opts.tag)}` : "";
@@ -25287,32 +25647,1105 @@ var init_bases = __esm({
   }
 });
 
-// src/data/program.ts
-var program_exports = {};
-__export(program_exports, {
-  DATA_NAMESPACES: () => DATA_NAMESPACES,
-  buildDataProgram: () => buildDataProgram,
-  isDataNamespace: () => isDataNamespace,
-  runDataCommand: () => runDataCommand,
-  withBaseOption: () => withBaseOption,
-  withDataGlobals: () => withDataGlobals
+// src/data/commands/file-types.ts
+import { Command as Command4 } from "commander";
+function buildFileTypesCommand() {
+  const fileTypes = new Command4("file-types").description(
+    "Manage file types (Buckets) \u2014 storage policy + optional metadata schema for files"
+  );
+  fileTypes.command("list").description("List all file types in a base").action(async function() {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/file-types`), outputFormat(this));
+  });
+  fileTypes.command("get <id>").description("Get a file type").action(async function(id) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/file-types/${pathSegment(id, "file_type")}`), outputFormat(this));
+  });
+  fileTypes.command("upsert <id>").description("Create or update a file type (preview bases only)").requiredOption("--name <name>", "File type name").option("--description <desc>", "Description").option("--max-size <bytes>", "Max bytes per file (0 = unlimited)").option(
+    "--allowed-content-types <json>",
+    "Allowed content-types, JSON array (inline or @filename)"
+  ).option("--metadata-schema <json>", "JSON Schema for file metadata (inline JSON or @filename)").action(async function(id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const body = { name: opts.name };
+    if (opts.description) body.description = opts.description;
+    if (opts.maxSize !== void 0) body.max_size = parseByteCount("--max-size", opts.maxSize);
+    if (opts.allowedContentTypes) {
+      body.allowed_content_types = parseData(opts.allowedContentTypes);
+    }
+    if (opts.metadataSchema) body.metadata_schema = parseData(opts.metadataSchema);
+    printOutput(
+      await client.request("PUT", `/v1/${base}/file-types/${pathSegment(id, "file_type")}`, body),
+      outputFormat(this)
+    );
+  });
+  fileTypes.command("delete <id>").description("Delete a file type (cascades its files)").option("-y, --yes", "Skip confirmation prompt").action(async function(id, opts) {
+    if (!opts.yes && !await confirm(
+      `Delete file type "${id}"? This cascades its files and cannot be undone.`
+    )) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/${base}/file-types/${pathSegment(id, "file_type")}`);
+    console.log("Deleted");
+  });
+  return fileTypes;
+}
+var init_file_types = __esm({
+  "src/data/commands/file-types.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
 });
-import { Command as Command2 } from "commander";
-function withDataGlobals(command2) {
-  return command2.option("--org <uuid>", "Organization to operate against (overrides .wayai.yaml)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
+
+// src/data/commands/files.ts
+import { Command as Command5 } from "commander";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "fs";
+import { basename as basename14 } from "path";
+function renderFileDiff(fileType, filePath, from, to, d) {
+  console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
+  const md = d.metadata_delta;
+  if (md) {
+    for (const f of ["path", "size", "content_type", "label"]) {
+      const change = md[f];
+      if (change) console.log(sanitizeTerminalText(`  ${f}: ${JSON.stringify(change.from)} \u2192 ${JSON.stringify(change.to)}`));
+    }
+    const meta = md.metadata;
+    for (const [k, v] of Object.entries(meta?.added ?? {})) {
+      console.log(sanitizeTerminalText(`  metadata + ${k}: ${JSON.stringify(v)}`));
+    }
+    for (const k of Object.keys(meta?.removed ?? {})) console.log(sanitizeTerminalText(`  metadata - ${k}`));
+    for (const [k, v] of Object.entries(meta?.changed ?? {})) {
+      console.log(sanitizeTerminalText(`  metadata ~ ${k}: ${JSON.stringify(v.from)} \u2192 ${JSON.stringify(v.to)}`));
+    }
+  }
+  const content = d.content;
+  if (!content?.changed) {
+    console.log("  content: unchanged");
+    return;
+  }
+  if (content.kind === "text" && content.lines) {
+    console.log("");
+    for (const l of content.lines) console.log(sanitizeTerminalText(`${l.op} ${l.text}`));
+  } else {
+    console.log(sanitizeTerminalText(`  content: changed (${content.kind})`));
+  }
 }
-function withBaseOption(command2) {
-  return command2.option("--base <id>", "Base id (or set WAYAI_BASE)");
+function downloadTarget(remotePath, to) {
+  if (to) return to;
+  const derived = basename14(remotePath);
+  if (derived === "" || derived === "." || derived === "..") {
+    throw expected(
+      `Cannot derive a local filename from "${remotePath}" \u2014 pass --to <local> to name it.`
+    );
+  }
+  return derived;
 }
-function routeErrorsToCli(command2) {
-  command2.exitOverride().configureOutput({ outputError: () => {
+function buildFilesCommand() {
+  const files = new Command5("files").description(
+    "Manage files (path-addressed, versioned content) within a file type"
+  );
+  files.command("put <file_type> <path>").description(
+    "Upload a local file to a path (e.g. wayai files put reports q3/summary.pdf --file ./summary.pdf)"
+  ).requiredOption("--file <local>", "Local file to upload").option("--content-type <type>", "MIME type", "application/octet-stream").action(async function(fileType, filePath, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const body = readFileSync22(opts.file);
+    const client = await createDataClient();
+    printOutput(
+      await client.upload(
+        `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath)}`,
+        body,
+        opts.contentType
+      ),
+      outputFormat(this)
+    );
+  });
+  files.command("get <file_type> <path>").description(
+    "Download a file (or --meta for metadata only). --version N reads a specific retained content version."
+  ).option("--to <local>", "Local file to save to (defaults to the file basename)").option("--meta", "Print metadata JSON instead of downloading the content").option("--version <n>", "Read a specific content version (default: latest)").action(async function(fileType, filePath, opts) {
+    const encoded = pathSegments(filePath);
+    const versionQs = opts.version !== void 0 ? `version=${encodeURIComponent(opts.version)}` : "";
+    const base = pathSegment(requireBase(this), "--base");
+    if (opts.meta) {
+      const qs = ["meta=1", versionQs].filter(Boolean).join("&");
+      const client2 = await createDataClient();
+      printOutput(
+        await client2.request("GET", `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${encoded}?${qs}`),
+        outputFormat(this)
+      );
+      return;
+    }
+    const out = downloadTarget(filePath, opts.to);
+    const client = await createDataClient();
+    const { bytes } = await client.download(
+      `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${encoded}${versionQs ? `?${versionQs}` : ""}`
+    );
+    writeFileSync15(out, bytes);
+    console.log(`Downloaded to ${out}`);
+  });
+  files.command("history <file_type> <path>").description("List the content versions of a file (newest first)").option("--limit <n>", "Max versions to return").option("--offset <n>", "Pagination offset").action(async function(fileType, filePath, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const qs = new URLSearchParams({ history: "1" });
+    if (opts.limit) qs.set("limit", opts.limit);
+    if (opts.offset) qs.set("offset", opts.offset);
+    printOutput(
+      await client.request(
+        "GET",
+        `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath)}?${qs}`
+      ),
+      outputFormat(this)
+    );
+  });
+  files.command("diff <file_type> <path>").description("Diff two content versions of a file \u2014 metadata delta plus a text content diff").requiredOption("--from <n>", "Base version number").requiredOption("--to <n>", "Target version number").action(async function(fileType, filePath, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const qs = new URLSearchParams({ diff: "1", from: opts.from, to: opts.to });
+    const data = await client.request(
+      "GET",
+      `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath)}?${qs}`
+    );
+    if (outputFormat(this) === "json") {
+      printOutput(data, "json");
+      return;
+    }
+    renderFileDiff(fileType, filePath, opts.from, opts.to, data);
+  });
+  files.command("list <file_type>").description("List files by path prefix").option("--prefix <path>", "Path prefix filter (e.g. q3/)").option("--depth <n>", "Max folder depth below the prefix (1 = immediate children)").option("--limit <n>", "Max results").option("--offset <n>", "Pagination offset").action(async function(fileType, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const qs = new URLSearchParams();
+    if (opts.prefix) qs.set("prefix", opts.prefix);
+    if (opts.depth) qs.set("depth", opts.depth);
+    if (opts.limit) qs.set("limit", opts.limit);
+    if (opts.offset) qs.set("offset", opts.offset);
+    const q = qs.toString();
+    printOutput(
+      await client.request("GET", `/v1/${base}/files/${pathSegment(fileType, "file_type")}${q ? `?${q}` : ""}`),
+      outputFormat(this)
+    );
+  });
+  files.command("mv <file_type> <from> <to>").description("Rename/move a file (the blob is untouched)").action(async function(fileType, from, to) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("PATCH", `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(from)}`, {
+        new_path: to
+      }),
+      outputFormat(this)
+    );
+  });
+  files.command("rm <file_type> <path>").description("Delete a file").option("-y, --yes", "Skip confirmation prompt").action(async function(fileType, filePath, opts) {
+    if (!opts.yes && !await confirm(`Delete file "${fileType}/${filePath}"? This cannot be undone.`)) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath)}`);
+    console.log("Deleted");
+  });
+  files.command("mount <file_type>").description(
+    "Mint an S3 credential so any harness can mount this file type as a filesystem (s3fs, cloud mount SDKs). Read-only by default; the secret is shown once."
+  ).option("--expires-in <seconds>", "Credential lifetime in seconds (default 30 days, max 90)").option(
+    "--mode <mode>",
+    "read_only (default) or read_write \u2014 the whole-bucket mode when no --path is given"
+  ).option(
+    "--path <prefix>",
+    "Confine to a path prefix (repeatable); optionally suffix :read_only|:read_write per prefix (e.g. drafts/:read_write)",
+    (v, acc) => {
+      acc.push(v);
+      return acc;
+    },
+    []
+  ).action(async function(fileType, opts) {
+    const body = { file_type: fileType };
+    if (opts.mode) {
+      if (opts.mode !== "read_only" && opts.mode !== "read_write") {
+        throw expected("--mode must be 'read_only' or 'read_write'.");
+      }
+      body.mode = opts.mode;
+    }
+    if (opts.path.length > 0) {
+      body.paths = opts.path.map((p) => {
+        const m = /^(.*):(read_only|read_write)$/.exec(p);
+        return m ? { prefix: m[1], mode: m[2] } : { prefix: p, mode: opts.mode ?? "read_only" };
+      });
+    }
+    if (opts.expiresIn !== void 0) {
+      const n = Number(opts.expiresIn);
+      if (!Number.isFinite(n)) {
+        throw expected("--expires-in must be a number of seconds.");
+      }
+      body.expires_in = n;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("POST", `/v1/${base}/s3-credentials`, body),
+      outputFormat(this)
+    );
+  });
+  return files;
+}
+var init_files = __esm({
+  "src/data/commands/files.ts"() {
+    "use strict";
+    init_expected();
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+    init_terminal_output();
+  }
+});
+
+// src/data/commands/inbound-webhooks.ts
+import { randomUUID } from "crypto";
+import { Command as Command6 } from "commander";
+function buildInboundWebhooksCommand() {
+  const inboundWebhooks = new Command6("inbound-webhooks").description(
+    "Manage inbound webhook endpoints"
+  );
+  inboundWebhooks.command("create").description("Create a new inbound webhook").requiredOption("--name <name>", "Inbound webhook name").option("--secret-stdin", "Read the HMAC shared secret from stdin (recommended for CI)").option("--id <id>", "Inbound webhook ID (auto-generated if omitted)").option("--record-type-scope <record_types>", "Comma-separated record_type scope").option(
+    "--field-mapping <json>",
+    'Inline mapping applied to the payload before write \u2014 a field_mapping JSON, e.g. {"to_external":{"status":"state"}} (to_external renames auto-invert on read); an explicit inbound-rename block and {"computed":{...}} are also accepted. Mutually exclusive with --source-binding.'
+  ).option(
+    "--source-binding <json>",
+    `Reuse a record_type source's field_mapping for the inbound translation \u2014 {"record_type":"<id>","source":"<name>"}. Mutually exclusive with --field-mapping.`
+  ).option(
+    "--ingest-auth <json>",
+    'Inbound auth scheme. Default (omitted) = HMAC signature. Static-header senders: {"type":"static_header","header":"X-Account-Key"} \u2014 the configured header is compared to the shared secret (constant-time) instead of an HMAC.'
+  ).option(
+    "--hydration <json>",
+    `Make this a reference-style ("notification + fetch") webhook: a thin delivery names a record id; the base fetches the full record via the bound source's read endpoint and stores it. Requires --source-binding and a single native --record-type-scope. JSON: {"id_path":"record_id","event_path":"event","event_map":{"ResourceDeleted":"delete"},"default_op":"upsert","merge":true}. Set "merge":true to refresh only the mapped (upstream-owned) fields on re-sync and preserve the locally-owned fields (status/tags/scores) on the same record.`
+  ).action(async function(opts) {
+    const secret = await readSecret(
+      {
+        stdin: opts.secretStdin,
+        // No prompt flag here — the prompt is this command's default.
+        prompt: void 0,
+        stdinFlag: "--secret-stdin",
+        promptHint: "omit --secret-stdin to be prompted"
+      },
+      "HMAC shared secret"
+    );
+    const body = {
+      name: opts.name,
+      secret,
+      enabled: true
+    };
+    if (opts.recordTypeScope) body.record_type_scope = splitList(opts.recordTypeScope);
+    if (opts.fieldMapping) body.field_mapping = parseData(opts.fieldMapping);
+    if (opts.sourceBinding) body.source_binding = parseData(opts.sourceBinding);
+    if (opts.ingestAuth) body.ingest_auth = parseData(opts.ingestAuth);
+    if (opts.hydration) body.hydration = parseData(opts.hydration);
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const inboundWebhookId = opts.id ?? randomUUID();
+    printOutput(
+      await client.request(
+        "PUT",
+        `/v1/${base}/inbound-webhooks/${pathSegment(inboundWebhookId, "--id")}`,
+        body
+      ),
+      outputFormat(this)
+    );
+  });
+  inboundWebhooks.command("get <id>").description("Get an inbound webhook").action(async function(id) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("GET", `/v1/${base}/inbound-webhooks/${pathSegment(id, "inbound webhook id")}`),
+      outputFormat(this)
+    );
+  });
+  inboundWebhooks.command("list").description("List all inbound webhooks").action(async function() {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/inbound-webhooks`), outputFormat(this));
+  });
+  inboundWebhooks.command("deliveries").description(
+    'List hydration delivery status for reference-style ("notification + fetch") webhooks'
+  ).option("--status <status>", "Filter by status (pending|delivered|failed|dead)").option("--inbound-webhook <id>", "Filter to one inbound webhook").action(async function(opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const params = new URLSearchParams();
+    if (opts.status) params.set("status", opts.status);
+    if (opts.inboundWebhook) params.set("inbound_webhook_id", opts.inboundWebhook);
+    const qs = params.toString() ? `?${params.toString()}` : "";
+    printOutput(
+      await client.request("GET", `/v1/${base}/inbound-webhooks/deliveries${qs}`),
+      outputFormat(this)
+    );
+  });
+  inboundWebhooks.command("delete <id>").description("Delete an inbound webhook").option("-y, --yes", "Skip confirmation prompt").action(async function(id, opts) {
+    if (!opts.yes && !await confirm(`Delete inbound webhook ${id}? This cannot be undone.`)) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/${base}/inbound-webhooks/${pathSegment(id, "inbound webhook id")}`);
+    console.log("Deleted");
+  });
+  return inboundWebhooks;
+}
+var init_inbound_webhooks = __esm({
+  "src/data/commands/inbound-webhooks.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
+});
+
+// src/data/commands/query-relationships.ts
+import { Command as Command7 } from "commander";
+function buildQueryRelationshipsCommand() {
+  return new Command7("query-relationships").description("Query related records").argument("<record_type>", "RecordType of the source record").argument("<id>", "Source record ID").option("--type <type>", "Filter by relationship type").option("--direction <dir>", "Direction: outgoing, incoming, or both", "both").option("--limit <n>", "Max results", "50").option("--offset <n>", "Skip results", "0").action(async function(recordType2, id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const params = new URLSearchParams();
+    if (opts.type) params.set("rel_type", opts.type);
+    params.set("direction", DIRECTIONS[opts.direction] ?? opts.direction);
+    params.set("limit", opts.limit);
+    params.set("offset", opts.offset);
+    printOutput(
+      await client.request(
+        "GET",
+        `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(id, "record id")}/related?${params.toString()}`
+      ),
+      outputFormat(this)
+    );
+  });
+}
+var DIRECTIONS;
+var init_query_relationships = __esm({
+  "src/data/commands/query-relationships.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    DIRECTIONS = {
+      outgoing: "source",
+      incoming: "target",
+      both: "both"
+    };
+  }
+});
+
+// src/data/commands/record-types.ts
+import { Command as Command8 } from "commander";
+function buildRecordTypesCommand() {
+  const recordTypes = new Command8("record-types").description("Manage record_types");
+  recordTypes.command("list").description("List all record_types in a base").action(async function() {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/record-types`), outputFormat(this));
+  });
+  recordTypes.command("get <id>").description("Get a record_type").action(async function(id) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/record-types/${pathSegment(id, "record_type")}`), outputFormat(this));
+  });
+  recordTypes.command("upsert <id>").description("Create or update a record_type").requiredOption("--name <name>", "RecordType name").option("--description <desc>", "Description").option("--schema <json>", "JSON Schema (inline JSON or @filename)").option("--icon <icon>", "Icon name").option("--color <color>", "Hex color").option("--sources <json>", "External sources config (inline JSON or @filename)").action(async function(id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const body = { name: opts.name };
+    if (opts.description) body.description = opts.description;
+    if (opts.schema) body.json_schema = parseData(opts.schema);
+    if (opts.icon) body.icon = opts.icon;
+    if (opts.color) body.color = opts.color;
+    if (opts.sources) body.sources = parseData(opts.sources);
+    printOutput(
+      await client.request("PUT", `/v1/${base}/record-types/${pathSegment(id, "record_type")}`, body),
+      outputFormat(this)
+    );
+  });
+  recordTypes.command("delete <id>").description("Delete a record_type").option("-y, --yes", "Skip confirmation prompt").action(async function(id, opts) {
+    if (!opts.yes && !await confirm(`Delete record_type "${id}"? This cannot be undone.`)) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/${base}/record-types/${pathSegment(id, "record_type")}`);
+    console.log("Deleted");
+  });
+  recordTypes.command("history <id>").description(
+    "View the change history (audit log) for a record_type \u2014 every schema/config version, who changed it, and when"
+  ).option("--limit <n>", "Max results").option("--offset <n>", "Pagination offset").option("--diff", "Include field-level diffs between versions").action(async function(id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("GET", `/v1/${base}/audit/record-types/${pathSegment(id, "record_type")}${historyQuery(opts)}`),
+      outputFormat(this)
+    );
+  });
+  return recordTypes;
+}
+var init_record_types = __esm({
+  "src/data/commands/record-types.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
+});
+
+// src/data/commands/records.ts
+import { Command as Command9 } from "commander";
+function recordKey(id, externalSource) {
+  return externalSource ? foreignSegment(id, "external id") : pathSegment(id, "record id");
+}
+function buildRecordsCommand() {
+  const records = new Command9("records").description("Manage records");
+  records.command("upsert <record_type>").description("Create or update a record").requiredOption("--data <json>", "Record data (inline JSON or @filename)").option("--id <id>", "Internal record ID (UUID) to update a known record").option("--external-id <id>", "External/agent-supplied ID for idempotent upsert").option("--external-source <source>", "Source system for external_id (e.g. stripe)").action(async function(recordType2, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const body = { data: parseData(opts.data) };
+    if (opts.externalId) body.external_id = opts.externalId;
+    if (opts.externalSource) body.external_source = opts.externalSource;
+    const path31 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
+    printOutput(await client.request("PUT", path31, body), outputFormat(this));
+  });
+  records.command("query <record_type>").description("List/search records: exact filters + fuzzy `search`, sorting, pagination").option(
+    "--external-source <source>",
+    "List from an external source (proxy-backed record_type). Combine with --filter when the source forwards filters."
+  ).option(
+    "--filter <json>",
+    "Filter DSL expression (inline JSON or @filename). Use the `search` operator for fuzzy matching."
+  ).option(
+    "--sort <json>",
+    'Sort expressions (inline JSON or @filename), e.g. [{"field":"data.created","direction":"desc"}]'
+  ).option("--fields <list>", "Comma-separated field projection").option("--limit <n>", "Max results").option("--offset <n>", "Pagination offset").action(async function(recordType2, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const qs = new URLSearchParams();
+    if (opts.externalSource) qs.set("external_source", opts.externalSource);
+    if (opts.filter) qs.set("filter", JSON.stringify(parseData(opts.filter)));
+    if (opts.sort) qs.set("sort", JSON.stringify(parseData(opts.sort)));
+    if (opts.fields) qs.set("fields", opts.fields);
+    if (opts.limit) qs.set("limit", opts.limit);
+    if (opts.offset) qs.set("offset", opts.offset);
+    const q = qs.toString();
+    printOutput(
+      await client.request("GET", `/v1/${base}/records/${pathSegment(recordType2, "record_type")}${q ? `?${q}` : ""}`),
+      outputFormat(this)
+    );
+  });
+  records.command("get <record_type> <id>").description(
+    "Get a record by internal ID, or by external_id (pass --external-source to scope it)"
+  ).option(
+    "--external-source <source>",
+    "Treat <id> as an external_id scoped to this source system (e.g. stripe)"
+  ).action(async function(recordType2, id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    let path31 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    if (opts.externalSource) path31 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
+    printOutput(await client.request("GET", path31), outputFormat(this));
+  });
+  records.command("delete <record_type> <id>").description(
+    "Delete a record by internal ID, or by external_id (pass --external-source to scope it)"
+  ).option("-y, --yes", "Skip confirmation prompt").option(
+    "--external-source <source>",
+    "Treat <id> as an external_id scoped to this source system (e.g. stripe)"
+  ).action(async function(recordType2, id, opts) {
+    if (!opts.yes && !await confirm(`Delete record ${recordType2}/${id}? This cannot be undone.`)) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    let path31 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    if (opts.externalSource) {
+      path31 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
+    }
+    await client.request("DELETE", path31);
+    console.log("Deleted");
+  });
+  records.command("history <id>").description(
+    "View the change history (audit log) for a record \u2014 every version, who changed it, and when"
+  ).option("--limit <n>", "Max results").option("--offset <n>", "Pagination offset").option("--diff", "Include field-level diffs between versions").action(async function(id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("GET", `/v1/${base}/audit/records/${pathSegment(id, "record id")}${historyQuery(opts)}`),
+      outputFormat(this)
+    );
+  });
+  return records;
+}
+var init_records = __esm({
+  "src/data/commands/records.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
+});
+
+// src/data/commands/relationship-types.ts
+import { Command as Command10 } from "commander";
+function buildRelationshipTypesCommand() {
+  const relationshipTypes = new Command10("relationship-types").description(
+    "Manage relationship types (the schema for a relationship's metadata)"
+  );
+  relationshipTypes.command("list").description("List all relationship types in a base").action(async function() {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("GET", `/v1/${base}/relationship-types`),
+      outputFormat(this)
+    );
+  });
+  relationshipTypes.command("get <rel_type>").description("Get a relationship type").action(async function(relType) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("GET", `/v1/${base}/relationship-types/${pathSegment(relType, "rel_type")}`),
+      outputFormat(this)
+    );
+  });
+  relationshipTypes.command("upsert <rel_type>").description("Create or update a relationship type").option("--description <desc>", "Description").option(
+    "--schema <json>",
+    "JSON Schema for the relationship data (inline JSON or @filename). Omit to allow any data."
+  ).option(
+    "--source-record-types <json>",
+    "JSON array of allowed source record_types (inline JSON or @filename)"
+  ).option(
+    "--target-record-types <json>",
+    "JSON array of allowed target record_types (inline JSON or @filename)"
+  ).action(async function(relType, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const body = {};
+    if (opts.description) body.description = opts.description;
+    if (opts.schema) body.data_schema = parseData(opts.schema);
+    if (opts.sourceRecordTypes) body.source_record_types = parseData(opts.sourceRecordTypes);
+    if (opts.targetRecordTypes) body.target_record_types = parseData(opts.targetRecordTypes);
+    printOutput(
+      await client.request("PUT", `/v1/${base}/relationship-types/${pathSegment(relType, "rel_type")}`, body),
+      outputFormat(this)
+    );
+  });
+  relationshipTypes.command("delete <rel_type>").description("Delete a relationship type").option("-y, --yes", "Skip confirmation prompt").action(async function(relType, opts) {
+    if (!opts.yes && !await confirm(`Delete relationship type "${relType}"? This cannot be undone.`)) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/${base}/relationship-types/${pathSegment(relType, "rel_type")}`);
+    console.log("Deleted");
+  });
+  relationshipTypes.command("history <id>").description(
+    "View the change history (audit log) for a relationship type \u2014 every config version, who changed it, and when"
+  ).option("--limit <n>", "Max results").option("--offset <n>", "Pagination offset").option("--diff", "Include field-level diffs between versions").action(async function(id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request(
+        "GET",
+        `/v1/${base}/audit/relationship-types/${pathSegment(id, "rel_type")}${historyQuery(opts)}`
+      ),
+      outputFormat(this)
+    );
+  });
+  return relationshipTypes;
+}
+var init_relationship_types = __esm({
+  "src/data/commands/relationship-types.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
+});
+
+// src/data/commands/relationships.ts
+import { Command as Command11 } from "commander";
+function relationshipKey(id, relType) {
+  return relType ? foreignSegment(id, "external id") : pathSegment(id, "relationship id");
+}
+function endpointBodyFields(role, byId, byExternal, externalSource) {
+  if ((byId ? 1 : 0) + (byExternal ? 1 : 0) !== 1) {
+    throw expected(`Provide exactly one of --${role} or --${role}-external.`);
+  }
+  const ref = byId ?? byExternal;
+  const segments = ref.split("/");
+  const [recordType2, key] = segments;
+  if (segments.length !== 2 || !recordType2 || !key) {
+    throw expected(
+      `--${role}${byId ? "" : "-external"} must be <record_type/${byId ? "id" : "external_id"}>, got '${ref}'.`
+    );
+  }
+  if (externalSource && !byExternal) {
+    throw expected(`--${role}-external-source requires --${role}-external.`);
+  }
+  const fields = { [`${role}_record_type`]: recordType2 };
+  if (byId) {
+    fields[`${role}_id`] = key;
+  } else {
+    fields[`${role}_external_id`] = key;
+    if (externalSource) fields[`${role}_external_source`] = externalSource;
+  }
+  return fields;
+}
+function byKeyQuery(relType, externalSource) {
+  const qs = new URLSearchParams();
+  if (relType) qs.set("rel_type", relType);
+  if (externalSource) qs.set("external_source", externalSource);
+  const q = qs.toString();
+  return q ? `?${q}` : "";
+}
+function buildRelationshipsCommand() {
+  const relationships = new Command11("relationships").description(
+    "Manage relationships between records"
+  );
+  relationships.command("upsert").description("Create or update a relationship").option("--source <record_type/id>", "Source record by internal id").option(
+    "--source-external <record_type/external_id>",
+    "Source record by external_id (the record must exist)"
+  ).option("--source-external-source <name>", "Source system scoping --source-external").option("--target <record_type/id>", "Target record by internal id").option(
+    "--target-external <record_type/external_id>",
+    "Target record by external_id (the record must exist)"
+  ).option("--target-external-source <name>", "Source system scoping --target-external").requiredOption("--type <type>", "Relationship type").option("--id <id>", "Relationship ID").option(
+    "--external-id <key>",
+    "The relationship's own external key: a retried upsert with the same key updates the first row instead of duplicating it"
+  ).option("--external-source <name>", "Source system scoping the relationship's --external-id").option("--data <json>", "Relationship metadata (inline JSON or @filename)").action(async function(opts) {
+    const body = {
+      rel_type: opts.type,
+      ...endpointBodyFields("source", opts.source, opts.sourceExternal, opts.sourceExternalSource),
+      ...endpointBodyFields("target", opts.target, opts.targetExternal, opts.targetExternalSource)
+    };
+    if (opts.id) body.id = opts.id;
+    if (opts.externalId) body.external_id = opts.externalId;
+    if (opts.externalSource) body.external_source = opts.externalSource;
+    if (opts.data) body.data = parseData(opts.data);
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const path31 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
+    printOutput(await client.request("PUT", path31, body), outputFormat(this));
+  });
+  relationships.command("get <id>").description(
+    "Get a relationship by ID (or by its external key: pass the external_id with --rel-type)"
+  ).option(
+    "--rel-type <type>",
+    "Treat <id> as the relationship external_id, scoped to this relationship type"
+  ).option("--external-source <name>", "Source system scoping the external_id (with --rel-type)").action(async function(id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request(
+        "GET",
+        `/v1/${base}/relationships/${relationshipKey(id, opts.relType)}${byKeyQuery(opts.relType, opts.externalSource)}`
+      ),
+      outputFormat(this)
+    );
+  });
+  relationships.command("delete <id>").description(
+    "Delete a relationship by ID (or by its external key: pass the external_id with --rel-type)"
+  ).option(
+    "--rel-type <type>",
+    "Treat <id> as the relationship external_id, scoped to this relationship type"
+  ).option("--external-source <name>", "Source system scoping the external_id (with --rel-type)").option("-y, --yes", "Skip confirmation prompt").action(async function(id, opts) {
+    if (!opts.yes && !await confirm(`Delete relationship ${id}? This cannot be undone.`)) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request(
+      "DELETE",
+      `/v1/${base}/relationships/${relationshipKey(id, opts.relType)}${byKeyQuery(opts.relType, opts.externalSource)}`
+    );
+    console.log("Deleted");
+  });
+  relationships.command("history <id>").description(
+    "View the change history (audit log) for a relationship \u2014 every version, who changed it, and when"
+  ).option("--limit <n>", "Max results").option("--offset <n>", "Pagination offset").option("--diff", "Include field-level diffs between versions").action(async function(id, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("GET", `/v1/${base}/audit/relationships/${pathSegment(id, "relationship id")}${historyQuery(opts)}`),
+      outputFormat(this)
+    );
+  });
+  return relationships;
+}
+var init_relationships = __esm({
+  "src/data/commands/relationships.ts"() {
+    "use strict";
+    init_expected();
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
+});
+
+// src/data/commands/seed.ts
+import { Command as Command12 } from "commander";
+function buildSeedCommand() {
+  const seed = new Command12("seed").description(
+    "Apply, reset, or clear a seed fixture on a preview base (hermetic eval data)"
+  );
+  seed.command("apply <name>").description(
+    "Idempotently upsert the fixture (keyed by external_id, so re-applying never twins). Preview-only."
+  ).action(async function(name) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("POST", `/v1/${base}/seeds/${pathSegment(name, "fixture name")}/apply`),
+      outputFormat(this)
+    );
+  });
+  seed.command("reset <name>").description(
+    "Restore the declared baseline: re-apply in place (fixing trigger-mutated records) and prune owned rows the fixture no longer declares. Record types listed in exclusive_record_types are treated as authoritative \u2014 reset also removes their non-declared records (agent-created residue) and any relationships referencing them. Preview-only."
+  ).action(async function(name) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("POST", `/v1/${base}/seeds/${pathSegment(name, "fixture name")}/reset`),
+      outputFormat(this)
+    );
+  });
+  seed.command("clear <name>").description("Delete every row the fixture owns (teardown). Preview-only.").action(async function(name) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("POST", `/v1/${base}/seeds/${pathSegment(name, "fixture name")}/clear`),
+      outputFormat(this)
+    );
+  });
+  seed.command("list").description("List the seed fixtures defined on a base").action(async function() {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/seeds`), outputFormat(this));
+  });
+  seed.command("get <name>").description("Show a seed fixture definition (its declared records and relationships)").action(async function(name) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/seeds/${pathSegment(name, "fixture name")}`), outputFormat(this));
+  });
+  const lease = seed.command("lease").description("Coordinate an isolated fixture lease");
+  lease.command("acquire <fixture>").description("Reset a fixture and atomically acquire the preview base for one eval run").requiredOption("--lease-id <uuidv7>", "Client-generated UUIDv7 (permanently single-use)").requiredOption(
+    "--owner-ref <ref>",
+    "Safe ID: 1-200 letters/digits or ._:@/+~=- (descriptive only)"
+  ).action(async function(fixture, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("POST", `/v1/${base}/seed-leases/acquire`, {
+        lease_id: opts.leaseId,
+        fixture,
+        owner_ref: opts.ownerRef
+      }),
+      outputFormat(this)
+    );
+  });
+  lease.command("status").description("Inspect your lease, or learn only whether another actor has locked the base").option("--lease-id <uuidv7>", "Inspect a specific lease ID").action(async function(opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const params = new URLSearchParams();
+    if (opts.leaseId !== void 0) params.set("lease_id", opts.leaseId);
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    printOutput(
+      await client.request("GET", `/v1/${base}/seed-leases/status${query}`),
+      outputFormat(this)
+    );
+  });
+  lease.command("release <fixture>").description("Clear fixture-owned data and release the matching lease").requiredOption("--lease-id <uuidv7>", "The UUIDv7 used to acquire the lease").requiredOption("--owner-ref <ref>", "Same safe ID: 1-200 letters/digits or ._:@/+~=-").action(async function(fixture, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("POST", `/v1/${base}/seed-leases/release`, {
+        lease_id: opts.leaseId,
+        fixture,
+        owner_ref: opts.ownerRef
+      }),
+      outputFormat(this)
+    );
+  });
+  return seed;
+}
+var init_seed = __esm({
+  "src/data/commands/seed.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+  }
+});
+
+// src/data/commands/toolsets.ts
+import { Command as Command13 } from "commander";
+function collect(value, previous) {
+  return [...previous, value];
+}
+function parseSpec(spec) {
+  const [key, opsStr] = spec.split(":");
+  if (!key || !opsStr) {
+    throw expected(`Invalid spec '${spec}'. Expected format: name:op1,op2`);
+  }
+  return { key, ops: splitList(opsStr) };
+}
+function parseActionRef(spec) {
+  const [action, actionName] = spec.split("=");
+  if (!action) {
+    throw expected(`Invalid --action '${spec}'. Expected an Action id, or <action_id>=<surface_name>.`);
+  }
+  return actionName ? { action, action_name: actionName } : { action };
+}
+function parseRelSpec(spec) {
+  const { key, ops } = parseSpec(spec);
+  return { rel_type: key, operations: ops };
+}
+function buildToolsetsCommand() {
+  const toolsets = new Command13("toolsets").description("Manage MCP toolsets");
+  toolsets.command("upsert <slug>").description("Create or update an MCP toolset").option("--name <name>", "Toolset display name (required unless using --config)").option("--description <desc>", "Toolset description").option(
+    "--action <ref>",
+    "Reference an Action by id, optionally renamed: <action_id> or <action_id>=<surface_name> (repeatable). Create Actions first with `wayai actions upsert`.",
+    collect,
+    []
+  ).option("--relationship <spec>", "Relationship tool spec: rel_type:op1,op2 (repeatable)", collect, []).option("--batch <spec>", "Batch operation spec: record_type_or_rel:op1,op2 (repeatable)", collect, []).option("--sql-query", "Enable sql_query tool").option(
+    "--config <json>",
+    "Full toolset config as JSON. A toolset composes first-class Actions by reference \u2014 its `actions` are refs {action: <action_id>, action_name?, description_override?}. Create the Actions with `wayai actions upsert` (each carries its own record_type, operation, and guard/shaping config: filterable_fields, writable_fields, precondition, binding). Use @file.json to read from file."
+  ).option(
+    "--mint-token",
+    "After upsert, also mint a toolset-bound (consumer) token for this base and print it (handy for sandbox-testing the preview toolset)"
+  ).action(async function(slug, opts) {
+    let body;
+    if (opts.config) {
+      body = parseData(opts.config);
+    } else {
+      if (!opts.name) {
+        throw expected("--name is required (or use --config for full JSON config)");
+      }
+      body = { name: opts.name, actions: opts.action.map(parseActionRef) };
+      if (opts.description) body.description = opts.description;
+      if (opts.relationship.length > 0) {
+        body.relationships = opts.relationship.map(parseRelSpec);
+      }
+      if (opts.batch.length > 0) {
+        const operations = {};
+        for (const spec of opts.batch) {
+          const parsed = parseSpec(spec);
+          operations[parsed.key] = parsed.ops;
+        }
+        body.batch = { enabled: true, operations };
+      }
+      if (opts.sqlQuery) body.sql_query = true;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const format = outputFormat(this);
+    printOutput(await client.request("PUT", `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`, body), format);
+    if (opts.mintToken) {
+      const tokenData = await client.request("POST", "/v1/tokens", {
+        name: `${slug} consumer`,
+        toolset_binding: { base_id: base, toolset_id: slug }
+      });
+      if (format === "json") {
+        printOutput(tokenData, format);
+      } else {
+        console.log("\nToolset-bound token:");
+        printOutput(tokenData, format);
+        console.log(`MCP URL: ${toolsetMcpUrl(slug)}`);
+      }
+    }
+  });
+  toolsets.command("get <slug>").description("Get a toolset").option("--resolved", "Include resolved record_type schemas").action(async function(slug, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const path31 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
+    printOutput(await client.request("GET", path31), outputFormat(this));
+  });
+  toolsets.command("list").description("List all toolsets").action(async function() {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/toolsets`), outputFormat(this));
+  });
+  toolsets.command("delete <slug>").description("Delete a toolset").option("-y, --yes", "Skip confirmation prompt").action(async function(slug, opts) {
+    if (!opts.yes && !await confirm(`Delete toolset "${slug}"? This cannot be undone.`)) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`);
+    console.log("Deleted");
+  });
+  toolsets.command("url <slug>").description("Get the MCP connection URL for a toolset").action((slug) => {
+    console.log(toolsetMcpUrl(slug));
+  });
+  return toolsets;
+}
+var init_toolsets = __esm({
+  "src/data/commands/toolsets.ts"() {
+    "use strict";
+    init_expected();
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
+});
+
+// src/data/commands/triggers.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { Command as Command14 } from "commander";
+function buildTriggersCommand() {
+  const triggers = new Command14("triggers").description(
+    "Manage triggers (outbound webhooks, internal writes, external writes)"
+  );
+  triggers.command("create").description(
+    "Create a trigger (a webhook, an internal_write that patches a referenced record, or an external_write that mirrors the record to an external source)"
+  ).requiredOption("--name <name>", "Trigger name").requiredOption("--events <events>", "Comma-separated event types").option("--url <url>", "Webhook target URL (webhook actions)").option("--secret-stdin", "Read the webhook HMAC signing secret from stdin (webhook actions)").option("--secret-prompt", "Prompt for the webhook HMAC signing secret, masked (webhook actions)").option(
+    "--action <json>",
+    `Action JSON. webhook {"type":"webhook","url":...,"secret":...}; internal_write {"type":"internal_write","target":"slots","match":{"source_field":"data.slot_id"},"patch":{"status":"busy"},"precondition":{"field":"data.status","op":"eq","value":"free"},"mode":"async"} (mode: "async" applies after the write, "transactional" applies atomically so a precondition miss rolls the write back); external_write {"type":"external_write","record_type":"upstream_appointments","source":"legacy","op":"create","watched_fields":"mapped"} (writes the triggering record through that source's write path \u2014 translation, endpoint, auth \u2014 and links the upstream-assigned id back as external_id; "record_type" defaults to the triggering record_type, "op" defaults from the event; "watched_fields" scopes UPDATE dispatch to writes that changed an upstream-mapped field \u2014 "mapped" = the source's to_external keys, or an explicit array of data fields \u2014 so an overlay-only write skips the redundant upstream push; omit to fire on every update)`
+  ).option("--id <id>", "Trigger ID (auto-generated if omitted)").option("--record-type-scope <record_types>", "Comma-separated record_type scope").option("--filter <json>", "Filter expression (JSON)").option(
+    "--skip-cascade-writes <bool>",
+    "Skip firing on cascade-originated (internal_write) writes (default true)"
+  ).action(async function(opts) {
+    if (!opts.action && !opts.url) {
+      throw expected("Provide --url (webhook) or --action <json> (e.g. an internal_write action).");
+    }
+    const body = {
+      name: opts.name,
+      events: splitList(opts.events),
+      enabled: true
+    };
+    if (opts.action) {
+      body.action = parseData(opts.action);
+    } else {
+      body.url = opts.url;
+      if (opts.secretStdin || opts.secretPrompt) {
+        body.secret = await readSecret(
+          {
+            stdin: opts.secretStdin,
+            prompt: opts.secretPrompt,
+            stdinFlag: "--secret-stdin",
+            promptHint: "--secret-prompt"
+          },
+          "Webhook signing secret"
+        );
+      }
+    }
+    if (opts.recordTypeScope) body.record_type_scope = splitList(opts.recordTypeScope);
+    if (opts.filter) body.filter = parseData(opts.filter);
+    if (opts.skipCascadeWrites !== void 0) {
+      body.skip_cascade_writes = opts.skipCascadeWrites !== "false";
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const triggerId = opts.id ?? randomUUID2();
+    printOutput(
+      await client.request("PUT", `/v1/${base}/triggers/${pathSegment(triggerId, "--id")}`, body),
+      outputFormat(this)
+    );
+  });
+  triggers.command("get <id>").description("Get a trigger").action(async function(id) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/triggers/${pathSegment(id, "trigger id")}`), outputFormat(this));
+  });
+  triggers.command("list").description("List all triggers").action(async function() {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    printOutput(await client.request("GET", `/v1/${base}/triggers`), outputFormat(this));
+  });
+  triggers.command("deliveries").description("List trigger delivery attempts (status, retries, errors)").option("--status <status>", "Filter by status (pending | delivered | failed | dead)").option("--trigger-id <id>", "Filter by trigger id").action(async function(opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    const params = new URLSearchParams();
+    if (opts.status) params.set("status", opts.status);
+    if (opts.triggerId) params.set("trigger_id", opts.triggerId);
+    const qs = params.toString();
+    printOutput(
+      await client.request("GET", `/v1/${base}/triggers/deliveries${qs ? `?${qs}` : ""}`),
+      outputFormat(this)
+    );
+  });
+  triggers.command("delete <id>").description("Delete a trigger").option("-y, --yes", "Skip confirmation prompt").action(async function(id, opts) {
+    if (!opts.yes && !await confirm(`Delete trigger ${id}? This cannot be undone.`)) {
+      console.log("Aborted");
+      return;
+    }
+    const base = pathSegment(requireBase(this), "--base");
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/${base}/triggers/${pathSegment(id, "trigger id")}`);
+    console.log("Deleted");
+  });
+  return triggers;
+}
+var init_triggers = __esm({
+  "src/data/commands/triggers.ts"() {
+    "use strict";
+    init_expected();
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+  }
+});
+
+// src/data/program.ts
+var program_exports = {};
+__export(program_exports, {
+  DATA_NAMESPACES: () => DATA_NAMESPACES,
+  buildDataProgram: () => buildDataProgram,
+  isDataNamespace: () => isDataNamespace,
+  runDataCommand: () => runDataCommand,
+  withBaseOption: () => withBaseOption,
+  withDataGlobals: () => withDataGlobals
+});
+import { Command as Command15 } from "commander";
+function withDataGlobals(command2) {
+  return command2.option("--org <uuid>", "Organization to operate against (overrides .wayai.yaml)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
+}
+function withBaseOption(command2) {
+  return command2.option("--base <id>", "Base id (or set WAYAI_BASE)");
+}
+function routeErrorsToCli(command2) {
+  command2.exitOverride().configureOutput({ outputError: () => {
   } });
   for (const child of command2.commands) routeErrorsToCli(child);
   return command2;
 }
 function buildDataProgram() {
-  const program = new Command2("wayai");
+  const program = new Command15("wayai");
   program.addCommand(withDataGlobals(buildBasesCommand()));
+  for (const build of [
+    buildRecordsCommand,
+    buildRecordTypesCommand,
+    buildRelationshipsCommand,
+    buildRelationshipTypesCommand,
+    buildQueryRelationshipsCommand,
+    buildFilesCommand,
+    buildFileTypesCommand,
+    buildAttachmentsCommand,
+    buildToolsetsCommand,
+    buildActionsCommand,
+    buildTriggersCommand,
+    buildInboundWebhooksCommand,
+    buildSeedCommand
+  ]) {
+    program.addCommand(withBaseOption(withDataGlobals(build())));
+  }
   program.hook("preAction", (_thisCommand, actionCommand) => {
     setDataOrgOverride(globals(actionCommand).org);
   });
@@ -25341,7 +26774,20 @@ async function runDataCommand(namespace, args2) {
 var init_program = __esm({
   "src/data/program.ts"() {
     "use strict";
+    init_actions();
+    init_attachments();
     init_bases();
+    init_file_types();
+    init_files();
+    init_inbound_webhooks();
+    init_query_relationships();
+    init_record_types();
+    init_records();
+    init_relationship_types();
+    init_relationships();
+    init_seed();
+    init_toolsets();
+    init_triggers();
     init_helpers();
     init_expected();
     init_org_context();
@@ -25356,7 +26802,7 @@ init_errors2();
 init_mask_secrets();
 init_utils();
 init_registry();
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname9, join as join28 } from "path";
 
@@ -25514,13 +26960,13 @@ Run \`wayai admin skill install\` to update.`);
 
 // src/index.ts
 var __dirname = dirname9(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync21(join28(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync23(join28(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
 async function main() {
   if (shouldInterceptHelp(command, args, /* @__PURE__ */ new Set([...OWN_HELP_COMMANDS, ...DATA_NAMESPACES]))) {
-    printHelp3();
+    await printHelp3();
     return;
   }
   if (command && !wantsHelp(args)) {
@@ -25712,7 +27158,7 @@ async function main() {
     case "--help":
     case "-h":
     case void 0:
-      printHelp3();
+      await printHelp3();
       break;
     case "--version":
     case "-v":
@@ -25725,12 +27171,18 @@ async function main() {
         break;
       }
       console.error(`Unknown command: ${command}`);
-      printHelp3();
+      await printHelp3();
       process.exit(1);
     }
   }
 }
-function printHelp3() {
+async function dataHelpBlock() {
+  const { buildDataProgram: buildDataProgram2 } = await Promise.resolve().then(() => (init_program(), program_exports));
+  const namespaces = buildDataProgram2().commands;
+  const width = Math.max(...namespaces.map((c) => c.name().length));
+  return namespaces.map((c) => `  ${c.name().padEnd(width)}  ${c.description()}`.trimEnd()).join("\n");
+}
+async function printHelp3() {
   console.log(`
 wayai \u2014 WayAI CLI
 
@@ -25778,12 +27230,11 @@ Commands:
   report edit        Amend your own pending report (title/description/error/steps/context)
   update             Update CLI to the latest version
 
-Data (bases):
-  bases              Manage bases (list/get/create/update/delete, previews, promote)
+Data \u2014 one namespace per entity. Run \`wayai <namespace> --help\` for its tree.
+${await dataHelpBlock()}
   bases promote      Promote a preview base to production (distinct from \`publish\`, which promotes a hub)
   bases use <base>   Bind this worktree to a base (\`wayai use\` binds a hub)
   bases unbind       Clear this worktree's base binding
-  Run \`wayai bases --help\` for the full tree.
 
 Flags:
   --yes, -y              Skip confirmation prompts (useful for CI and scripting)