@wayai/cli 0.3.136 → 0.3.137

package/dist/index.js

@@ -236,7 +236,7 @@ var init_mask_secrets = __esm({
     "use strict";
     CREDENTIAL_KEY_RE = /token|secret|credential|password|passwd|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt/i;
     NUMERIC_CREDENTIAL_KEY_RE = /(?:password|passwd|pin|token|secret|credential|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt)$/i;
-    FULLY_MASKED_VALUE_RE = /^(?:(?:Bearer|Basic)\s+)?(?:way_|wst_)?\[REDACTED(?:_JWT|_BASE64)?\]$/;
+    FULLY_MASKED_VALUE_RE = /^(?:(?:Bearer|Basic)\s+)?(?:way_|wst_|rec_)?\[REDACTED(?:_JWT|_BASE64)?\]$/;
     isCredentialKey = (key) => CREDENTIAL_KEY_RE.test(key);
     isBase64UrlChar = (char) => {
       const code = char.charCodeAt(0);
@@ -249,6 +249,12 @@ var init_mask_secrets = __esm({
       [/\bway_[A-Za-z0-9_-]{8,}/g, "way_[REDACTED]"],
       // wst_ single-use WebSocket tickets (same opaque base64url format).
       [/\bwst_[A-Za-z0-9_-]{8,}/g, "wst_[REDACTED]"],
+      // rec_ Data-surface API tokens. Same opaque base64url shape, and needed for
+      // the same reason as way_: the credential-KEY rules below only fire when the
+      // token sits behind a recognisable key, so a `rec_` token that appears bare in
+      // an error body's prose would otherwise pass through unmasked. Unpadded
+      // base64url, so the trailing base64 rule does not cover it either.
+      [/\brec_[A-Za-z0-9_-]{8,}/g, "rec_[REDACTED]"],
       // Stripe API keys and webhook signing secrets. Keep this aligned with
       // packages/core/src/redact.ts; both modules protect observability sinks.
       [
@@ -15052,7 +15058,7 @@ var init_registry = __esm({
         disposition: "namespaced",
         surviving: "bases tokens",
         clause: 3,
-        shipped: false,
+        shipped: true,
         reason: "Mints base tokens; WayAI's own token surface mints platform tokens."
       },
       {
@@ -15060,7 +15066,7 @@ var init_registry = __esm({
         disposition: "namespaced",
         surviving: "bases secrets",
         clause: 3,
-        shipped: false,
+        shipped: true,
         reason: "Base org vault; WayAI has connection credentials."
       },
       {
@@ -15068,7 +15074,7 @@ var init_registry = __esm({
         disposition: "namespaced",
         surviving: "bases sql",
         clause: 3,
-        shipped: false,
+        shipped: true,
         reason: "WayAI already has tenant SQL over conversation analytics."
       },
       {
@@ -15076,7 +15082,7 @@ var init_registry = __esm({
         disposition: "namespaced",
         surviving: "bases import",
         clause: 3,
-        shipped: false,
+        shipped: true,
         reason: "WayAI has outbound-contact import."
       },
       {
@@ -15084,7 +15090,7 @@ var init_registry = __esm({
         disposition: "namespaced",
         surviving: "bases batch",
         clause: 3,
-        shipped: false,
+        shipped: true,
         reason: "Too generic to stand alone."
       },
       {
@@ -15092,7 +15098,7 @@ var init_registry = __esm({
         disposition: "namespaced",
         surviving: "bases providers",
         clause: 3,
-        shipped: false,
+        shipped: true,
         reason: "WayAI's provider is a connector."
       },
       {
@@ -15101,14 +15107,14 @@ var init_registry = __esm({
         surviving: "admin bases",
         clause: 3,
         shipped: false,
-        reason: "Clause 3's group exception: `wayai admin` is an existing group with its own gating and subgroups, so the operator surface joins it as a peer rather than sitting under `bases`."
+        reason: "Clause 3's group exception: `wayai admin` is an existing group with its own gating and subgroups, so the operator surface joins it as a peer rather than sitting under `bases`. UNSHIPPED pending a transport: the Data backend's operator routes live at `/admin/*`, a SIBLING of `/v1/*`, and the merged CLI reaches Data only through WayAI's `/api/data` proxy, which contains every forwarded path under `/v1` by construction (`rekor/upstream-url.ts`). The standalone CLI could call them because it held a second `api_url` pointed straight at the Data backend \u2014 the thing the merge deliberately removed. Shipping needs a proxy channel for operator routes plus platform-admin gating on it, which is a backend change, not a CLI one."
       },
       {
         original: "report",
         disposition: "namespaced",
         surviving: "bases report",
         clause: 3,
-        shipped: false,
+        shipped: true,
         reason: "Two report queues still exist, so the merged CLI must be able to file to either. The two collapse when the queues do."
       },
       // --- Neither: one verb each, routing by workspace subtree. ---
@@ -16868,15 +16874,15 @@ function scanResourceFiles(dir, prefix = "") {
       files.push(...scanResourceFiles(path12.join(dir, entry.name), relPath));
     } else if (entry.isFile()) {
       const fullPath = path12.join(dir, entry.name);
-      const stat = fs10.statSync(fullPath);
-      if (stat.size > MAX_RESOURCE_FILE_SIZE3) {
-        console.warn(`  Warning: skipping ${relPath} (${(stat.size / 1024 / 1024).toFixed(1)}MB exceeds 10MB limit)`);
+      const stat2 = fs10.statSync(fullPath);
+      if (stat2.size > MAX_RESOURCE_FILE_SIZE3) {
+        console.warn(`  Warning: skipping ${relPath} (${(stat2.size / 1024 / 1024).toFixed(1)}MB exceeds 10MB limit)`);
         continue;
       }
       const fileEntry = {
         path: relPath,
         mime_type: guessMimeType(entry.name),
-        file_size: stat.size
+        file_size: stat2.size
       };
       const data = fs10.readFileSync(fullPath);
       fileEntry.hash = computeHash(data);
@@ -17068,34 +17074,34 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
     if (abs !== root && !abs.startsWith(root + path13.sep)) {
       throw expected(`${label}: attachment "${entry}" escapes the hub folder.`);
     }
-    let stat;
+    let stat2;
     try {
-      stat = fs11.statSync(abs);
+      stat2 = fs11.statSync(abs);
     } catch {
     }
-    if (!stat?.isFile()) {
+    if (!stat2?.isFile()) {
       throw expected(`${label}: attachment "${entry}" not found.`);
     }
     if (!realpathContained(root, abs)) {
       throw expected(`${label}: attachment "${entry}" resolves outside the hub folder (symlinks are not allowed).`);
     }
-    if (stat.size > MAX_RESOURCE_FILE_SIZE3) {
+    if (stat2.size > MAX_RESOURCE_FILE_SIZE3) {
       throw expected(
-        `${label}: attachment "${entry}" is ${(stat.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
+        `${label}: attachment "${entry}" is ${(stat2.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
       );
     }
     const data = fs11.readFileSync(abs);
     const hash = computeHash(data);
     const fileName = path13.basename(abs);
     const mimeType = guessMimeType(fileName) ?? "application/octet-stream";
-    refs.push({ hash, file_name: fileName, mime_type: mimeType, file_size: stat.size });
+    refs.push({ hash, file_name: fileName, mime_type: mimeType, file_size: stat2.size });
     if (!bytesByHash.has(hash)) {
       bytesByHash.set(hash, {
         hash,
         content_base64: data.toString("base64"),
         file_name: fileName,
         mime_type: mimeType,
-        file_size: stat.size
+        file_size: stat2.size
       });
     }
   }
@@ -19396,18 +19402,18 @@ __export(send_message_exports, {
 import * as fs19 from "fs";
 import * as path25 from "path";
 function statAttachment(filePath) {
-  let stat;
+  let stat2;
   try {
-    stat = fs19.statSync(filePath);
+    stat2 = fs19.statSync(filePath);
   } catch {
     console.error(`Error: file not found: ${filePath}`);
     process.exit(1);
   }
-  if (stat.isDirectory()) {
+  if (stat2.isDirectory()) {
     console.error(`Error: not a file: ${filePath}`);
     process.exit(1);
   }
-  return { filePath, size: stat.size };
+  return { filePath, size: stat2.size };
 }
 function readAttachment(filePath, size) {
   const fileName = path25.basename(filePath);
@@ -20674,7 +20680,7 @@ async function stopEvalSessionWithRetries(stop, opts = {}) {
   const attempts = opts.attempts ?? STOP_ATTEMPTS;
   const attemptTimeoutMs = opts.attemptTimeoutMs ?? STOP_ATTEMPT_TIMEOUT_MS;
   const backoffMs = opts.backoffMs ?? STOP_BACKOFF_MS;
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const sleep3 = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   let lastError = new Error("Stop was never attempted");
   for (let attempt = 1; attempt <= attempts; attempt++) {
     let timeout;
@@ -20695,7 +20701,7 @@ async function stopEvalSessionWithRetries(stop, opts = {}) {
       if (timeout !== void 0) clearTimeout(timeout);
     }
     const delay2 = backoffMs[attempt - 1];
-    if (attempt < attempts && delay2) await sleep2(delay2);
+    if (attempt < attempts && delay2) await sleep3(delay2);
   }
   throw lastError;
 }
@@ -24981,8 +24987,8 @@ async function createDataClient(orgId) {
   }
   const org = selected ?? readRepoConfig()?.organization_id;
   return {
-    async request(method, v1Path, body) {
-      const envelope = await api.dataRequest(method, v1Path, body, org);
+    async request(method, path31, body) {
+      const envelope = await api.dataRequest(method, path31, body, org);
       return envelope.data;
     },
     async collectPages(makePath) {
@@ -25011,6 +25017,23 @@ async function createDataClient(orgId) {
     }
   };
 }
+function dataErrorEnvelope(err) {
+  if (!(err instanceof ApiError)) return null;
+  try {
+    const parsed = JSON.parse(err.body);
+    return parsed?.error ?? null;
+  } catch {
+    return null;
+  }
+}
+function dataErrorCode(err) {
+  const code = dataErrorEnvelope(err)?.code;
+  return typeof code === "string" && code ? code : null;
+}
+function dataErrorDetails(err) {
+  const details = dataErrorEnvelope(err)?.details;
+  return details && typeof details === "object" ? details : void 0;
+}
 var MAX_PAGES;
 var init_client = __esm({
   "src/data/client.ts"() {
@@ -25080,6 +25103,36 @@ function printFields(obj) {
     console.log(`${key.padEnd(width)}  ${formatCell2(value)}`);
   }
 }
+function printBatchResult(response) {
+  const obj = response && typeof response === "object" ? response : {};
+  const results = Array.isArray(obj.results) ? obj.results : [];
+  const batchId = typeof obj.batch_id === "string" ? obj.batch_id : "(none)";
+  console.log(
+    `batch_id: ${sanitizeTerminalText(batchId)} \xB7 ${results.length} operation${results.length === 1 ? "" : "s"}`
+  );
+  if (results.length === 0) return;
+  printRows(
+    results.map((r, i) => ({
+      "#": String(i),
+      operation: r?.type ?? "",
+      result: summarizeBatchResult(r)
+    }))
+  );
+}
+function summarizeBatchResult(r) {
+  if (!r || typeof r !== "object") return String(r ?? "");
+  if (r.deleted === true) return "deleted";
+  const entity = r.record ?? r.relationship ?? r.record_type;
+  if (entity && typeof entity === "object") {
+    const e = entity;
+    const id = typeof e.id === "string" ? e.id : void 0;
+    const label = typeof e.record_type === "string" ? e.record_type : typeof e.rel_type === "string" ? e.rel_type : typeof e.name === "string" ? e.name : void 0;
+    const version = e.version != null ? ` v${String(e.version)}` : "";
+    if (id && label) return `${label}/${id}${version}`;
+    if (id) return `${id}${version}`;
+  }
+  return JSON.stringify(r);
+}
 function cellAt(row, column) {
   return formatCell2(row?.[column]);
 }
@@ -25126,11 +25179,23 @@ function foreignSegment(value, label = "id") {
 function pathSegments(value, label = "path") {
   return value.split("/").map((segment) => foreignSegment(segment, label)).join("/");
 }
-function parseData(data) {
-  if (data.startsWith("@")) {
-    return JSON.parse(readFileSync19(data.slice(1), "utf-8"));
+function parseData(data, flag) {
+  const prefix = flag ? `${flag}: ` : "";
+  const source = data.startsWith("@") ? data.slice(1) : void 0;
+  let text = data;
+  if (source !== void 0) {
+    try {
+      text = readFileSync19(source, "utf-8");
+    } catch (e) {
+      throw expected(`${prefix}${source}: ${e instanceof Error ? e.message : "could not be read"}`);
+    }
+  }
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    const where = source !== void 0 ? ` in ${source}` : "";
+    throw expected(`${prefix}invalid JSON${where}: ${e instanceof Error ? e.message : String(e)}`);
   }
-  return JSON.parse(data);
 }
 function toolsetMcpUrl(slug) {
   return `https://data-mcp.wayai.pro/t/${slug}/mcp`;
@@ -25140,8 +25205,17 @@ function globals(cmd) {
   while (namespace.parent?.parent) namespace = namespace.parent;
   return namespace.opts();
 }
+function withBaseOption(command2) {
+  return command2.option("--base <id>", "Base id (or set WAYAI_BASE)");
+}
+function baseOptionHolder(cmd) {
+  for (let c = cmd; c; c = c.parent ?? void 0) {
+    if (c.options.some((o) => o.long === "--base")) return c;
+  }
+  return void 0;
+}
 function findBase(cmd) {
-  return globals(cmd).base;
+  return baseOptionHolder(cmd)?.opts()?.base;
 }
 function requireBase(cmd) {
   const base = findBase(cmd) ?? process.env.WAYAI_BASE ?? "";
@@ -25176,12 +25250,35 @@ async function readSecret(source, label) {
   if (!value) throw expected(`${label} is required.`);
   return value;
 }
+function isInteractive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+function parseDuration(input, flag = "duration") {
+  const match = DURATION_RE.exec(input.trim());
+  const value = Number(match?.[1] ?? 0);
+  const unit = match?.[2];
+  const unitMs = unit ? DURATION_UNIT_MS[unit] : void 0;
+  if (!unitMs || value <= 0) {
+    throw expected(
+      `Invalid ${flag} ${JSON.stringify(input)} \u2014 use <number><unit> with unit s/m/h/d (e.g. 10m, 2h, 30d).`
+    );
+  }
+  return value * unitMs;
+}
+var DURATION_RE, DURATION_UNIT_MS;
 var init_helpers = __esm({
   "src/data/helpers.ts"() {
     "use strict";
     init_base_id();
     init_expected();
     init_utils();
+    DURATION_RE = /^(\d+)([smhd])$/;
+    DURATION_UNIT_MS = {
+      s: 1e3,
+      m: 6e4,
+      h: 36e5,
+      d: 864e5
+    };
   }
 });
 
@@ -25363,6 +25460,1031 @@ var init_attachments = __esm({
   }
 });
 
+// src/data/commands/batch.ts
+import { Command as Command3 } from "commander";
+function buildBasesBatchCommand() {
+  return withBaseOption(new Command3("batch")).description("Execute atomic batch operations (up to 1,000 operations)").requiredOption("--operations <json>", "Operations array (inline JSON or @filename)").action(async function(opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const operations = parseData(opts.operations, "--operations");
+    const client = await createDataClient();
+    const data = await client.request("POST", `/v1/${base}/batch`, {
+      operations: Array.isArray(operations) ? operations : [operations]
+    });
+    const format = outputFormat(this);
+    if (format === "json") {
+      printOutput(data, format);
+      return;
+    }
+    printBatchResult(data);
+  });
+}
+var init_batch = __esm({
+  "src/data/commands/batch.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+  }
+});
+
+// src/data/commands/import.ts
+import { createReadStream } from "fs";
+import { access, constants, stat } from "fs/promises";
+import { createInterface as createInterface3 } from "readline";
+import { randomUUID } from "crypto";
+import { Command as Command4 } from "commander";
+function isRetryable(err) {
+  if (isNetworkError(err)) return true;
+  if (!(err instanceof ApiError)) return false;
+  const code = dataErrorCode(err);
+  if (code && RETRYABLE_CODES.has(code)) return true;
+  return err.status >= 500 && err.status !== 501;
+}
+function isExpiredSession(err) {
+  if (!(err instanceof ApiError) || err.status !== 409) return false;
+  if (dataErrorCode(err) !== "IMPORT_SESSION_CLOSED") return false;
+  return dataErrorDetails(err)?.status === "expired";
+}
+async function withRetry(state, fn, what) {
+  let lastErr;
+  for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (!isRetryable(err) || attempt === MAX_ATTEMPTS) throw err;
+      const code = err instanceof ApiError ? dataErrorCode(err) : null;
+      if (!code || !RETRYABLE_CODES.has(code)) state.sawAmbiguous = true;
+      const delay2 = BASE_BACKOFF_MS * 2 ** (attempt - 1);
+      console.error(
+        `  ${what}: ${err.message} \u2014 retrying in ${delay2}ms (${attempt}/${MAX_ATTEMPTS - 1})`
+      );
+      await sleep2(delay2);
+    }
+  }
+  throw lastErr;
+}
+async function* readChunks(file, size, startChunk) {
+  const rl = createInterface3({ input: createReadStream(file, "utf8"), crlfDelay: Infinity });
+  let rows = [];
+  let index = 0;
+  let lineNo = 0;
+  let inChunk = 0;
+  for await (const line of rl) {
+    lineNo++;
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (index < startChunk) {
+      if (++inChunk === size) {
+        inChunk = 0;
+        index++;
+      }
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      throw expected(`${file}:${lineNo}: not valid JSON. Each line must be one JSON object.`);
+    }
+    rows.push(parsed);
+    if (rows.length === size) {
+      yield { index, rows };
+      rows = [];
+      index++;
+    }
+  }
+  if (rows.length > 0) yield { index, rows };
+}
+async function beginSession(state, client, base, recordType2, requestKey) {
+  const res = await withRetry(
+    state,
+    () => client.request("POST", `/v1/${base}/import/begin`, {
+      request_key: requestKey,
+      record_type: recordType2
+    }),
+    "begin"
+  );
+  return res.session;
+}
+function buildBasesImportCommand() {
+  const importCmd = withBaseOption(new Command4("import")).description(
+    "Bulk historical import: load an NDJSON backfill, list sessions, or undo one"
+  );
+  importCmd.command("run <record_type>").description(
+    "Load an NDJSON file into a record type (one JSON object per line, each {external_id, data})"
+  ).requiredOption("--file <path>", "NDJSON file to import").option(
+    "--chunk-size <n>",
+    "Rows per request, max 1000. Must match the original run when resuming.",
+    String(MAX_CHUNK_ROWS)
+  ).option(
+    "--request-key <key>",
+    "Idempotency key for this logical run (default: generated). Re-use it to resume."
+  ).option(
+    "--start-chunk <n>",
+    "Skip chunks before this index \u2014 resume a run that stopped partway",
+    "0"
+  ).option("--no-finalize", "Leave the session open (resume later with the same --request-key)").action(async function(recordType2, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const state = { sawAmbiguous: false };
+    const chunkSize = Number(opts.chunkSize);
+    if (!Number.isInteger(chunkSize) || chunkSize < 1 || chunkSize > MAX_CHUNK_ROWS) {
+      throw expected(`--chunk-size must be an integer between 1 and ${MAX_CHUNK_ROWS}.`);
+    }
+    const startChunk = Number(opts.startChunk);
+    if (!Number.isInteger(startChunk) || startChunk < 0) {
+      throw expected("--start-chunk must be a non-negative integer.");
+    }
+    if (startChunk > 0 && !this.getOptionValueSource("chunkSize")?.startsWith("cli")) {
+      throw expected(
+        "--start-chunk requires --chunk-size to be given explicitly, and it must match the original run."
+      );
+    }
+    try {
+      if ((await stat(opts.file)).isDirectory()) throw new Error("is a directory");
+      await access(opts.file, constants.R_OK);
+    } catch {
+      throw expected(`--file ${opts.file}: not a readable file.`);
+    }
+    const client = await createDataClient();
+    const requestKey = opts.requestKey ?? `cli-${randomUUID()}`;
+    if (!opts.requestKey) {
+      console.error(`request_key: ${requestKey}  (pass --request-key to resume this run)`);
+    }
+    let session = await beginSession(state, client, base, recordType2, requestKey);
+    console.error(`import_id: ${session.import_id}`);
+    const importIds = [session.import_id];
+    let written = 0;
+    let skipped = 0;
+    let sent = 0;
+    let nextIndex = startChunk;
+    try {
+      for await (const { index, rows } of readChunks(opts.file, chunkSize, startChunk)) {
+        nextIndex = index;
+        const body = { import_id: session.import_id, chunk_index: index, rows };
+        let result;
+        try {
+          result = await withRetry(
+            state,
+            () => client.request("POST", `/v1/${base}/import/chunk`, body),
+            `chunk ${index}`
+          );
+        } catch (err) {
+          if (!isExpiredSession(err)) throw err;
+          console.error(
+            `  chunk ${index}: session expired (month boundary) \u2014 starting a fresh session and re-sending.`
+          );
+          console.error(
+            `  NOTE: this run now spans two import_ids; undo needs both. Previous: ${session.import_id}`
+          );
+          session = await beginSession(state, client, base, recordType2, requestKey);
+          importIds.push(session.import_id);
+          console.error(`  import_id: ${session.import_id}`);
+          result = await withRetry(
+            state,
+            () => client.request("POST", `/v1/${base}/import/chunk`, {
+              ...body,
+              import_id: session.import_id
+            }),
+            `chunk ${index}`
+          );
+        }
+        written += result.rows_written ?? 0;
+        skipped += result.rows_skipped ?? 0;
+        sent++;
+        nextIndex = index + 1;
+        if (sent % 10 === 0) {
+          console.error(`  ${sent} chunks \u2014 ${written} written, ${skipped} unchanged`);
+        }
+      }
+      if (opts.finalize) {
+        await withRetry(
+          state,
+          () => client.request(
+            "POST",
+            `/v1/${base}/import/${pathSegment(session.import_id, "import id")}/finalize`
+          ),
+          "finalize"
+        );
+      }
+    } catch (err) {
+      console.error(
+        `
+Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
+  --start-chunk ${nextIndex} --chunk-size ${chunkSize} --request-key ${requestKey}
+(keep every other flag you passed \u2014 the base and org decide where the rows land, and the chunk size decides which rows each index covers.)`
+      );
+      throw err;
+    }
+    printOutput(
+      {
+        import_ids: importIds,
+        rows_written: written,
+        rows_skipped: skipped,
+        chunks_sent: sent,
+        finalized: opts.finalize
+      },
+      outputFormat(this)
+    );
+  });
+  importCmd.command("list").description("List import sessions, newest first \u2014 find a stuck run or the id to undo").option("--limit <n>", "Maximum sessions to return").option("--offset <n>", "Sessions to skip").action(async function(opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const qs = new URLSearchParams();
+    if (opts.limit) qs.set("limit", opts.limit);
+    if (opts.offset) qs.set("offset", opts.offset);
+    const suffix = qs.toString() ? `?${qs}` : "";
+    const client = await createDataClient();
+    printOutput(
+      await client.request("GET", `/v1/${base}/import/sessions${suffix}`),
+      outputFormat(this)
+    );
+  });
+  importCmd.command("rollback <import_id>").description(
+    "Undo an import \u2014 deletes only the rows it CREATED. Re-importing corrected data is usually the better fix."
+  ).option("--yes", "Skip the confirmation prompt").action(async function(importId, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const format = outputFormat(this);
+    const state = { sawAmbiguous: false };
+    const client = await createDataClient();
+    if (!opts.yes && !isInteractive()) {
+      throw expected(
+        "Refusing to roll back an import without confirmation \u2014 pass --yes to run non-interactively."
+      );
+    }
+    if (!opts.yes) {
+      const plan = await client.request("GET", `/v1/${base}/import/${pathSegment(importId, "import id")}/rollback-plan?counts=true`);
+      const n = plan.matched_records ?? 0;
+      if (n === 0) {
+        console.error("No rows left to undo \u2014 closing the import session.");
+      } else {
+        const ok = await confirm(
+          `Delete ${n} record${n === 1 ? "" : "s"} created by this import into "${sanitizeTerminalText(String(plan.record_type))}", plus every relationship pointing at them?`
+        );
+        if (!ok) {
+          console.error("Aborted.");
+          return;
+        }
+      }
+    }
+    let records = 0;
+    let relationships = 0;
+    let calls = 0;
+    let incomplete = false;
+    for (let sweep = 0; ; sweep++) {
+      const res = await withRetry(
+        state,
+        () => client.request("POST", `/v1/${base}/import/${pathSegment(importId, "import id")}/rollback`),
+        "rollback"
+      );
+      records += res.swept.records;
+      relationships += res.swept.relationships;
+      calls++;
+      if (res.complete) break;
+      const sweptNothing = res.swept.records === 0 && res.swept.relationships === 0;
+      if (sweptNothing || sweep + 1 >= MAX_ROLLBACK_SWEEPS) {
+        incomplete = true;
+        console.error(
+          sweptNothing ? "  the sweep stopped making progress before the server reported it complete \u2014 re-run to continue." : `  stopped after ${MAX_ROLLBACK_SWEEPS} sweeps without completing \u2014 re-run to continue.`
+        );
+        break;
+      }
+      if (format !== "json") {
+        console.error(`  swept ${records} records, ${relationships} relationships so far\u2026`);
+      }
+    }
+    if (state.sawAmbiguous && format !== "json") {
+      console.error(
+        "Note: a request was re-sent after its outcome was unknown, so the counts below are a lower bound \u2014 a page that committed before its response was lost is not included."
+      );
+    }
+    printOutput(
+      {
+        import_id: importId,
+        swept: { records, relationships },
+        requests: calls,
+        // The server's own completion claim, carried so a script can tell an
+        // undo that FINISHED from one that stopped early and needs re-running.
+        complete: !incomplete,
+        ...state.sawAmbiguous ? { counts_are_lower_bound: true } : {}
+      },
+      format
+    );
+    if (incomplete) return process.exit(1);
+  });
+  return importCmd;
+}
+var MAX_CHUNK_ROWS, MAX_ATTEMPTS, MAX_ROLLBACK_SWEEPS, BASE_BACKOFF_MS, RETRYABLE_CODES, sleep2;
+var init_import = __esm({
+  "src/data/commands/import.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_api_client();
+    init_network_error();
+    init_terminal_output();
+    init_utils();
+    init_expected();
+    MAX_CHUNK_ROWS = 1e3;
+    MAX_ATTEMPTS = 5;
+    MAX_ROLLBACK_SWEEPS = 1e3;
+    BASE_BACKOFF_MS = 500;
+    RETRYABLE_CODES = /* @__PURE__ */ new Set(["BASE_OVERLOADED", "SERVICE_UNAVAILABLE", "RATE_LIMITED"]);
+    sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+  }
+});
+
+// src/data/commands/providers.ts
+import { Command as Command5 } from "commander";
+import { writeFileSync as writeFileSync15 } from "fs";
+function providerSegment(provider) {
+  if (!VALID_PROVIDERS.includes(provider)) {
+    throw expected(`Unknown provider ${JSON.stringify(provider)}. Expected one of: ${VALID_PROVIDERS_HELP}.`);
+  }
+  return pathSegment(provider, "provider");
+}
+function buildBasesProvidersCommand() {
+  const providers = withBaseOption(new Command5("providers")).description(
+    "Import/export tool definitions between LLM providers and record types"
+  );
+  providers.command("import <provider>").description(`Import tool definitions as record types. Providers: ${VALID_PROVIDERS_HELP}`).requiredOption("--tools <json>", "Tool definitions (inline JSON or @filename)").action(async function(provider, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const tools = parseData(opts.tools, "--tools");
+    const client = await createDataClient();
+    printOutput(
+      await client.request("POST", `/v1/${base}/providers/${providerSegment(provider)}/import`, {
+        tools: Array.isArray(tools) ? tools : [tools]
+      }),
+      outputFormat(this)
+    );
+  });
+  providers.command("export <provider>").description(`Export record types as tool definitions. Providers: ${VALID_PROVIDERS_HELP}`).option("--record-types <ids>", "Comma-separated record type ids (omit for all)").option("--to <file>", "Write the exported definitions to a file instead of stdout").action(async function(provider, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const recordTypes = opts.recordTypes ? splitList(opts.recordTypes) : [];
+    const query = recordTypes.length ? `?record_types=${encodeURIComponent(recordTypes.join(","))}` : "";
+    const client = await createDataClient();
+    const data = await client.request(
+      "GET",
+      `/v1/${base}/providers/${providerSegment(provider)}/export${query}`
+    );
+    if (opts.to) {
+      try {
+        writeFileSync15(opts.to, JSON.stringify(data, null, 2));
+      } catch (e) {
+        throw expected(`--to ${opts.to}: ${e instanceof Error ? e.message : "could not be written"}`);
+      }
+      printOutput({ written_to: opts.to }, outputFormat(this));
+      return;
+    }
+    printOutput(data, outputFormat(this));
+  });
+  providers.command("import-call <provider> <record_type>").description(
+    `Create a record from a tool call in provider format. Providers: ${VALID_PROVIDERS_HELP}`
+  ).requiredOption("--data <json>", "Tool call data in provider format (inline JSON or @filename)").option("--external-id <id>", "External id for idempotent upsert").option("--external-source <source>", "External source identifier").action(async function(provider, recordType2, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    const callData = parseData(opts.data, "--data");
+    const queryParts = [];
+    if (opts.externalId) queryParts.push(`external_id=${encodeURIComponent(opts.externalId)}`);
+    if (opts.externalSource) {
+      queryParts.push(`external_source=${encodeURIComponent(opts.externalSource)}`);
+    }
+    const qs = queryParts.length ? `?${queryParts.join("&")}` : "";
+    const client = await createDataClient();
+    printOutput(
+      await client.request(
+        "POST",
+        `/v1/${base}/providers/${providerSegment(provider)}/records/${pathSegment(recordType2, "record_type")}${qs}`,
+        callData
+      ),
+      outputFormat(this)
+    );
+  });
+  return providers;
+}
+var VALID_PROVIDERS, VALID_PROVIDERS_HELP;
+var init_providers = __esm({
+  "src/data/commands/providers.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_expected();
+    VALID_PROVIDERS = ["openai", "anthropic", "google", "mcp"];
+    VALID_PROVIDERS_HELP = VALID_PROVIDERS.join(", ");
+  }
+});
+
+// src/data/commands/report.ts
+import { Command as Command6 } from "commander";
+import { readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname9, join as join27 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function resolveCliVersion() {
+  for (const candidate of [
+    join27(here, "..", "package.json"),
+    join27(here, "..", "..", "..", "package.json")
+  ]) {
+    try {
+      const version = JSON.parse(readFileSync21(candidate, "utf-8")).version;
+      if (typeof version === "string" && version) return version;
+    } catch {
+    }
+  }
+  return "unknown";
+}
+function resolveReportClientVersions(projectRoot, cliVersion) {
+  const versions = { cli_version: cliVersion };
+  try {
+    const skillVersion = lowestInstalledVersion(findInstalledSkills(projectRoot));
+    if (skillVersion) versions.skill_version = skillVersion;
+  } catch {
+  }
+  return versions;
+}
+function reportActionError2(err) {
+  if (err instanceof ApiError) {
+    if (err.status === 404) {
+      console.error("Report not found, or it was not filed by you.");
+    } else if (err.status === 403) {
+      console.error("This report is agent-authored and can only be handled by a platform admin.");
+    } else if (err.status === 409) {
+      console.error(err.message);
+    } else if (err.status === 429) {
+      console.error("Rate limit exceeded. Please try again later.");
+    } else {
+      console.error(`Request failed: ${err.message}`);
+    }
+    return process.exit(1);
+  }
+  throw err;
+}
+function buildBasesReportCommand() {
+  const report = new Command6("report").description(
+    "File a report to the Data triage queue and verify the outcome"
+  );
+  report.command("create").description("Submit a report to the Data triage queue (deduplicated)").requiredOption("--title <title>", "Short summary").requiredOption("--description <text>", "What happened").option("--source <source>", "Origin: cli_report (default) | review | security_audit").option("--classification <c>", "Nature: bug (default) | flaky_test | security | enhancement").option(
+    "--dedup-key <key>",
+    'Stable dedup key (e.g. "<file>::<test>"); collapses repeat occurrences'
+  ).option("--severity <level>", "low | medium | high | critical").option("--steps <text>", "Steps to reproduce").option("--error-message <text>", "Exact error text if any").option("--context <text>", "Additional context (logs, request ids)").option("--locale <code>", "Notification locale (en | pt | es)", "en").option("--reporter-email <addr>", "Override reporter email (defaults to session email)").option("--base-id <id>", "Base the error relates to (defaults to the configured base)").option("--record-type <name>", "Record type the error relates to").option("--record-id <id>", "Record id (UUID) the error relates to").option("--external-id <id>", "External id of the related record").option("--external-source <src>", "External source of the related record").option("--relationship-id <id>", "Relationship id the error relates to").action(async function(opts) {
+    const body = {
+      title: opts.title,
+      description: opts.description,
+      locale: opts.locale
+    };
+    if (opts.source) body.source = opts.source;
+    if (opts.classification) body.classification = opts.classification;
+    if (opts.dedupKey) body.dedup_key = opts.dedupKey;
+    if (opts.severity) body.severity = opts.severity;
+    if (opts.steps) body.steps = opts.steps;
+    if (opts.errorMessage) body.error_message = opts.errorMessage;
+    if (opts.context) body.context = opts.context;
+    if (opts.reporterEmail) body.reporter_email = opts.reporterEmail;
+    const baseId = opts.baseId ?? findBase(this) ?? process.env.WAYAI_BASE;
+    if (baseId) body.base_id = baseId;
+    if (opts.recordType) body.record_type = opts.recordType;
+    if (opts.recordId) body.record_id = opts.recordId;
+    if (opts.externalId) body.external_id = opts.externalId;
+    if (opts.externalSource) body.external_source = opts.externalSource;
+    if (opts.relationshipId) body.relationship_id = opts.relationshipId;
+    const versions = resolveReportClientVersions(
+      findGitRoot() ?? process.cwd(),
+      resolveCliVersion()
+    );
+    body.cli_version = versions.cli_version;
+    if (versions.skill_version) body.skill_version = versions.skill_version;
+    const client = await createDataClient();
+    const data = await client.request("POST", "/v1/reports", body);
+    if (outputFormat(this) === "json") {
+      printOutput(data, "json");
+      return;
+    }
+    if (data.created) {
+      console.log(`Report submitted (id: ${data.report_id}).`);
+      console.log("Our team will review and follow up by email if you provided one.");
+    } else if (data.recurrence?.reopened) {
+      console.log(`Report reopened for another look (id: ${data.report_id}).`);
+    } else if (data.recurrence) {
+      console.log(
+        `A matching report remains closed (id: ${data.report_id}); this occurrence was recorded.`
+      );
+    } else {
+      console.log(
+        `A matching report already exists (id: ${data.report_id}) \u2014 your submission was merged into it.`
+      );
+    }
+  });
+  report.command("list").description("List your reports, newest first").option("--status <s>", "Filter by status (e.g. shipped \u2014 awaiting your verification)").action(async function(opts) {
+    const client = await createDataClient();
+    const qs = opts.status ? `?status=${encodeURIComponent(opts.status)}` : "";
+    try {
+      const rows = await client.request("GET", `/v1/reports${qs}`);
+      if (outputFormat(this) === "json") {
+        printOutput(rows, "json");
+        return;
+      }
+      if (rows.length === 0) {
+        console.log("No reports found.");
+        return;
+      }
+      for (const r of rows) {
+        const title = sanitizeTerminalText(r.title?.replace(/\s+/g, " ").trim() || "(untitled)");
+        console.log(
+          `${r.report_id}  ${r.status.padEnd(10)}  ${(r.classification ?? "bug").padEnd(12)}  ${title}`
+        );
+      }
+    } catch (err) {
+      reportActionError2(err);
+    }
+  });
+  report.command("get <report_id>").description("Show one of your reports: status + the message thread").action(async function(reportId) {
+    const client = await createDataClient();
+    try {
+      const data = await client.request("GET", `/v1/reports/${pathSegment(reportId, "report id")}`);
+      if (outputFormat(this) === "json") {
+        printOutput(data, "json");
+        return;
+      }
+      const { report: row, messages } = data;
+      console.log(`Report ${row.report_id}`);
+      console.log(`  title:          ${sanitizeTerminalText(row.title ?? "(unavailable)")}`);
+      console.log(
+        `  description:    ${sanitizeTerminalText(row.description ?? "(unavailable)")}`
+      );
+      console.log(`  status:         ${row.status}`);
+      console.log(`  classification: ${row.classification ?? "bug"}`);
+      if (row.contest_count > 0) console.log(`  contests:       ${row.contest_count}`);
+      if (row.dismissal_final) console.log("  dismissal:      final (non-contestable)");
+      if (messages.length > 0) {
+        console.log("\n  Thread:");
+        for (const m of messages) {
+          console.log(`    [${m.author_role}] ${sanitizeTerminalText(m.body)}`);
+        }
+      }
+      if (row.status === "shipped") {
+        console.log(
+          `
+  This fix is shipped. Run \`wayai bases report accept ${row.report_id}\` if it works,`
+        );
+        console.log(
+          `  or \`wayai bases report contest ${row.report_id} --reason "..."\` if it does not.`
+        );
+      }
+    } catch (err) {
+      reportActionError2(err);
+    }
+  });
+  report.command("accept <report_id>").description("Accept a shipped fix (\u2192 addressed)").action(async function(reportId) {
+    const client = await createDataClient();
+    try {
+      const data = await client.request(
+        "POST",
+        `/v1/reports/${pathSegment(reportId, "report id")}/accept`
+      );
+      if (outputFormat(this) === "json") {
+        printOutput(data, "json");
+        return;
+      }
+      console.log(`Accepted. Report ${data.report.report_id} \u2192 ${data.report.status}.`);
+    } catch (err) {
+      reportActionError2(err);
+    }
+  });
+  report.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {
+    const client = await createDataClient();
+    try {
+      const data = await client.request(
+        "POST",
+        `/v1/reports/${pathSegment(reportId, "report id")}/contest`,
+        { reason: opts.reason }
+      );
+      if (outputFormat(this) === "json") {
+        printOutput(data, "json");
+        return;
+      }
+      console.log(
+        `Contested. Report ${data.report.report_id} \u2192 ${data.report.status} (back to triage).`
+      );
+    } catch (err) {
+      reportActionError2(err);
+    }
+  });
+  return report;
+}
+var here;
+var init_report2 = __esm({
+  "src/data/commands/report.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_api_client();
+    init_terminal_output();
+    init_workspace();
+    init_skill_version();
+    here = dirname9(fileURLToPath2(import.meta.url));
+  }
+});
+
+// src/data/commands/secrets.ts
+import { Command as Command7 } from "commander";
+import { readFileSync as readFileSync22 } from "fs";
+function withValueSourceOptions(cmd, what) {
+  return cmd.option(
+    "--file <path>",
+    `Read ${what} from a file and base64-encode it (certificates, keystores, service-account JSON)`
+  ).option("--value-stdin", `Read ${what} from stdin (recommended for CI)`).option("--value-prompt", `Prompt for ${what}, masked`);
+}
+async function resolveValue(opts, label) {
+  if (opts.file !== void 0) {
+    if (opts.valueStdin || opts.valuePrompt) {
+      throw expected("--file cannot be combined with --value-stdin or --value-prompt \u2014 pass one.");
+    }
+    try {
+      return readFileSync22(opts.file).toString("base64");
+    } catch (e) {
+      throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
+    }
+  }
+  return readSecret(
+    {
+      stdin: opts.valueStdin,
+      prompt: opts.valuePrompt,
+      stdinFlag: "--value-stdin",
+      promptHint: "--value-prompt"
+    },
+    label
+  );
+}
+function listAllSecrets(client, expiringDays) {
+  return client.collectPages((cursor) => {
+    const params = new URLSearchParams({ limit: String(SECRET_LIST_PAGE_LIMIT) });
+    if (expiringDays !== void 0) params.set("expiring_within_days", expiringDays);
+    if (cursor) params.set("cursor", cursor);
+    return `/v1/vault/secrets?${params.toString()}`;
+  });
+}
+function buildBasesSecretsCommand() {
+  const secrets = new Command7("secrets").description("Manage organization vault secrets");
+  withValueSourceOptions(
+    secrets.command("create").description("Store a vault secret (value read from stdin, a masked prompt, or --file)").requiredOption("--name <name>", "Secret name").option("--content-type <mime>", "MIME type of the value (e.g. application/x-pkcs12)").option(
+      "--expires-at <date>",
+      "Expiry as ISO-8601 (e.g. 2027-01-01T00:00:00Z) \u2014 surfaced by `list --expiring`"
+    ).option("--tags <tags>", "Comma-separated tags"),
+    "the secret value"
+  ).action(async function(opts) {
+    const body = {
+      name: opts.name,
+      value: await resolveValue(opts, "Secret value")
+    };
+    if (opts.contentType) body.content_type = opts.contentType;
+    if (opts.expiresAt) body.expires_at = opts.expiresAt;
+    if (opts.tags) body.tags = splitList(opts.tags);
+    const client = await createDataClient();
+    printOutput(await client.request("POST", "/v1/vault/secrets", body), outputFormat(this));
+  });
+  secrets.command("list").description("List vault secrets (values masked)").option("--expiring", "Only secrets expiring within --days (default 30)").option("--days <n>", "Window for --expiring, in days", "30").action(async function(opts) {
+    const client = await createDataClient();
+    const secretRows = await listAllSecrets(client, opts.expiring ? opts.days : void 0);
+    printOutput(secretRows, outputFormat(this));
+  });
+  secrets.command("get <id>").description("Get vault secret metadata (value masked)").action(async function(id) {
+    const client = await createDataClient();
+    printOutput(
+      await client.request("GET", `/v1/vault/secrets/${pathSegment(id, "secret id")}`),
+      outputFormat(this)
+    );
+  });
+  withValueSourceOptions(
+    secrets.command("rotate <id>").description("Rotate a secret by installing a new caller-supplied value").option("--expires-at <date>", "Set the rotated credential's new expiry (ISO-8601)"),
+    "the new secret value"
+  ).action(async function(id, opts) {
+    const body = { value: await resolveValue(opts, "New secret value") };
+    if (opts.expiresAt) body.expires_at = opts.expiresAt;
+    const client = await createDataClient();
+    printOutput(
+      await client.request("POST", `/v1/vault/secrets/${pathSegment(id, "secret id")}/rotate`, body),
+      outputFormat(this)
+    );
+  });
+  secrets.command("delete <id>").description("Delete a vault secret").option("-y, --yes", "Skip confirmation prompt").action(async function(id, opts) {
+    if (!opts.yes) {
+      if (!isInteractive()) {
+        throw expected("Refusing to delete without confirmation \u2014 pass --yes to delete non-interactively.");
+      }
+      if (!await confirm(`Delete vault secret ${id}? This cannot be undone.`)) {
+        console.log("Aborted");
+        return;
+      }
+    }
+    const client = await createDataClient();
+    await client.request("DELETE", `/v1/vault/secrets/${pathSegment(id, "secret id")}`);
+    printOutput({ id, deleted: true }, outputFormat(this));
+  });
+  return secrets;
+}
+var SECRET_LIST_PAGE_LIMIT;
+var init_secrets = __esm({
+  "src/data/commands/secrets.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_utils();
+    init_expected();
+    SECRET_LIST_PAGE_LIMIT = 250;
+  }
+});
+
+// src/data/commands/sql.ts
+import { Command as Command8 } from "commander";
+import { readFileSync as readFileSync23 } from "fs";
+function buildBasesSqlCommand() {
+  return withBaseOption(new Command8("sql")).description("Execute a read-only SQL query against base data").argument("[query]", "SQL query (SELECT only)").option("--file <path>", "Read SQL from a file instead of the argument").option(
+    "--param <kv...>",
+    "Named parameters as key=value pairs (e.g. --param status=issued)"
+  ).action(async function(queryArg, opts) {
+    const base = pathSegment(requireBase(this), "--base");
+    let query;
+    if (opts.file) {
+      try {
+        query = readFileSync23(opts.file, "utf-8").trim();
+      } catch (e) {
+        throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
+      }
+      if (!query) throw expected(`--file ${opts.file} is empty \u2014 it must contain a SELECT query.`);
+    } else if (queryArg) {
+      query = queryArg;
+    } else {
+      throw expected("Provide a SQL query as an argument or via --file.");
+    }
+    const params = {};
+    for (const kv of opts.param ?? []) {
+      const eqIdx = kv.indexOf("=");
+      if (eqIdx === -1) {
+        throw expected(`Invalid --param ${JSON.stringify(kv)}, expected key=value.`);
+      }
+      params[kv.slice(0, eqIdx)] = kv.slice(eqIdx + 1);
+    }
+    const body = { query };
+    if (Object.keys(params).length > 0) body.params = params;
+    const client = await createDataClient();
+    printOutput(await client.request("POST", `/v1/${base}/sql`, body), outputFormat(this));
+  });
+}
+var init_sql = __esm({
+  "src/data/commands/sql.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_expected();
+  }
+});
+
+// src/data/commands/tokens.ts
+import { Command as Command9 } from "commander";
+function addTokenLifecycleOptions(cmd) {
+  return cmd.option("--expires-at <date>", "Expiration date (ISO 8601, e.g. 2026-06-01T00:00:00Z)").option(
+    "--ttl <duration>",
+    "Relative expiry, e.g. 10m, 2h, 7d (use for disposable probe/test tokens)"
+  ).option(
+    "--description <text>",
+    'What holds this token (e.g. "behind credential X"); shown in list and revoke warnings'
+  ).addHelpText("after", TOKEN_OUTPUT_HELP);
+}
+function tokenCreationOutput(cmd, opts) {
+  return opts.tokenOnly ? "token" : outputFormat(cmd);
+}
+function printCreatedToken(data, output) {
+  if (output !== "token") {
+    printOutput(data, output);
+    return;
+  }
+  const token = typeof data === "object" && data !== null && "token" in data ? data.token : void 0;
+  if (typeof token !== "string" || !RAW_TOKEN_PATTERN.test(token)) {
+    throw new Error("Token creation response did not contain a valid rec_ token");
+  }
+  console.log(token);
+}
+function resolveExpiresAt(opts) {
+  if (opts.ttl && opts.expiresAt) {
+    throw expected("--ttl and --expires-at are mutually exclusive \u2014 pass one.");
+  }
+  if (opts.ttl) return new Date(Date.now() + parseDuration(opts.ttl, "--ttl")).toISOString();
+  return opts.expiresAt;
+}
+function applyTokenLifecycleOpts(body, opts) {
+  const expiresAt = resolveExpiresAt(opts);
+  if (expiresAt) body.expires_at = expiresAt;
+  if (opts.description) body.description = opts.description;
+}
+function listAllTokens(client) {
+  return client.collectPages(
+    (cursor) => `/v1/tokens?limit=${TOKEN_LIST_PAGE_LIMIT}${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`
+  );
+}
+function pruneRow(t, reason) {
+  return {
+    token_id: t.token_id,
+    name: t.name,
+    reason,
+    last_used: t.last_used_at ?? "never"
+  };
+}
+function buildBasesTokensCommand() {
+  const tokens = new Command9("tokens").description("Manage API tokens");
+  addTokenLifecycleOptions(
+    tokens.command("create").description("Create a scoped API token").requiredOption("--name <name>", "Token name").requiredOption("--grants <json>", "Grant definitions as JSON array").option(
+      "--token-only",
+      "Print only the raw rec_ token for secure command substitution (shown once)"
+    )
+  ).action(async function(opts) {
+    const grants = parseData(opts.grants, "--grants");
+    const body = { name: opts.name, grants };
+    applyTokenLifecycleOpts(body, opts);
+    const client = await createDataClient();
+    const data = await client.request("POST", "/v1/tokens", body);
+    printCreatedToken(data, tokenCreationOutput(this, opts));
+  });
+  addTokenLifecycleOptions(
+    // The only token verb that addresses a base, so it alone declares `--base`.
+    // Putting it on the `tokens` group would advertise a flag that does nothing
+    // on `list`, `revoke` and `prune` — the defect `withBaseOption` exists to
+    // avoid.
+    withBaseOption(tokens.command("create-for-toolset <slug>")).description(
+      "Create a toolset-bound (consumer) token whose authorization IS the toolset tool surface \u2014 it can call exactly the tools that toolset exposes (those record types + operations, relationships, batch, and sql only if enabled) and nothing else. Binds to the configured --base."
+    ).option("--name <name>", 'Token name (default: "<slug> consumer")').option(
+      "--token-only",
+      "Print only the raw rec_ token for secure command substitution (shown once)"
+    )
+  ).action(async function(slug, opts) {
+    const base = requireBase(this);
+    const body = {
+      name: opts.name ?? `${slug} consumer`,
+      toolset_binding: { base_id: base, toolset_id: slug }
+    };
+    applyTokenLifecycleOpts(body, opts);
+    const client = await createDataClient();
+    const data = await client.request("POST", "/v1/tokens", body);
+    const output = tokenCreationOutput(this, opts);
+    printCreatedToken(data, output);
+    if (output === "table") {
+      console.log(`
+MCP URL: ${toolsetMcpUrl(slug)}`);
+    }
+  });
+  tokens.command("list").description("List API tokens (status, last_used_at, expires_at, description)").action(async function() {
+    const client = await createDataClient();
+    printOutput(await listAllTokens(client), outputFormat(this));
+  });
+  tokens.command("revoke <token_id>").description(
+    "Revoke an API token (permanent). A recently-used or toolset-bound token requires --force."
+  ).option("--force", "Revoke even if the token appears to be in live use").action(async function(tokenId, opts) {
+    const client = await createDataClient();
+    const id = pathSegment(tokenId, "token id");
+    const path31 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
+    const format = outputFormat(this);
+    const revoked = (forced) => printOutput({ token_id: tokenId, revoked: true, forced }, format);
+    if (opts.force) {
+      await client.request("DELETE", path31(true));
+      revoked(true);
+      return;
+    }
+    try {
+      await client.request("DELETE", path31(false));
+      revoked(false);
+    } catch (err) {
+      if (!(err instanceof ApiError) || err.status !== 409 || dataErrorDetails(err)?.requires_force !== true) {
+        throw err;
+      }
+      console.error(err.message);
+      if (!isInteractive()) {
+        console.error("\nRe-run with --force to revoke anyway.");
+        return process.exit(1);
+      }
+      if (!await confirm("Revoke anyway?")) {
+        console.error("Aborted.");
+        return process.exit(1);
+      }
+      await client.request("DELETE", path31(true));
+      revoked(true);
+    }
+  });
+  tokens.command("prune").description(
+    "Revoke stale tokens, selected by staleness only (expired, or unused past --unused-since) \u2014 never by name. Previews by default; revoking requires --yes or an interactive confirmation."
+  ).option(
+    "--unused-since <duration>",
+    "Also prune tokens with no activity for this long (e.g. 30d). Skips toolset-bound and legacy usage-untracked tokens."
+  ).option("--include-bound", "Allow pruning stale toolset-bound (consumer) tokens").option("-y, --yes", "Revoke without prompting (required when non-interactive)").action(async function(opts) {
+    const staleMs = opts.unusedSince ? parseDuration(opts.unusedSince, "--unused-since") : void 0;
+    const client = await createDataClient();
+    const allTokens = await listAllTokens(client);
+    const now = Date.now();
+    const targets = [];
+    const skipped = [];
+    for (const t of allTokens) {
+      const expired = t.status ? t.status === "expired" : !!t.expires_at && Date.parse(t.expires_at) <= now;
+      if (expired) {
+        targets.push(pruneRow(t, "expired"));
+        continue;
+      }
+      if (staleMs === void 0) continue;
+      const lastActivity = Date.parse(t.last_used_at ?? t.created_at);
+      if (!(now - lastActivity > staleMs)) continue;
+      if (t.usage_tracked !== true) {
+        skipped.push(
+          pruneRow(
+            t,
+            "usage untracked (legacy token) \u2014 revoke individually if truly unused"
+          )
+        );
+      } else if (t.toolset_binding && !opts.includeBound) {
+        skipped.push(
+          pruneRow(
+            t,
+            `toolset-bound ('${t.toolset_binding.toolset_id}') \u2014 pass --include-bound to prune`
+          )
+        );
+      } else {
+        targets.push(pruneRow(t, `unused for over ${opts.unusedSince}`));
+      }
+    }
+    const format = outputFormat(this);
+    const json = format === "json";
+    const note = (line) => json ? console.error(line) : console.log(line);
+    const printPreview = () => {
+      if (targets.length === 0) {
+        note("Nothing to prune.");
+      } else {
+        note(`Would revoke ${targets.length} token(s):`);
+        if (!json) printOutput(targets, format);
+      }
+      if (skipped.length === 0) return;
+      note(`
+Skipped ${skipped.length} stale token(s):`);
+      if (!json) printOutput(skipped, format);
+    };
+    printPreview();
+    if (targets.length === 0) {
+      if (json) printOutput({ revoked: 0, failed: 0, targets, skipped }, format);
+      return;
+    }
+    if (!opts.yes) {
+      if (!isInteractive()) {
+        console.error("\nPreview only \u2014 re-run with --yes to revoke these tokens.");
+        if (json) printOutput({ preview: true, revoked: 0, failed: 0, targets, skipped }, format);
+        return process.exit(1);
+      }
+      if (!await confirm(`
+Revoke ${targets.length} token(s)?`)) {
+        console.error("Aborted.");
+        return process.exit(1);
+      }
+    }
+    let revoked = 0;
+    let failed = 0;
+    for (const t of targets) {
+      try {
+        await client.request(
+          "DELETE",
+          `/v1/tokens/${pathSegment(t.token_id, "token id")}?force=true`
+        );
+        revoked++;
+      } catch (err) {
+        failed++;
+        console.error(
+          `Failed to revoke ${t.token_id} ('${sanitizeTerminalText(t.name)}'): ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    if (json) printOutput({ revoked, failed, targets, skipped }, format);
+    else console.log(`Revoked ${revoked} token(s)${failed > 0 ? `, ${failed} failed` : ""}.`);
+    if (failed > 0) return process.exit(1);
+  });
+  return tokens;
+}
+var RAW_TOKEN_PATTERN, TOKEN_OUTPUT_HELP, TOKEN_LIST_PAGE_LIMIT;
+var init_tokens = __esm({
+  "src/data/commands/tokens.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_api_client();
+    init_terminal_output();
+    init_utils();
+    init_expected();
+    RAW_TOKEN_PATTERN = /^rec_[A-Za-z0-9_-]{43}$/;
+    TOKEN_OUTPUT_HELP = `
+Output:
+  --json prints the unwrapped response object; the secret is at top-level .token, never .data.token.
+  --token-only prints only a validated rec_ token and overrides table/JSON formatting.
+  The raw token is shown once. Capture it securely and do not log it.
+`;
+    TOKEN_LIST_PAGE_LIMIT = 250;
+  }
+});
+
 // src/lib/base-binding.ts
 var binding2, getBaseBindingPath, readBaseBinding, writeBaseBinding, clearBaseBinding, autoBindBaseIfUnbound, assertBaseMatchesBinding, assertNoBindingBlocksBaseCreation;
 var init_base_binding = __esm({
@@ -25389,7 +26511,7 @@ var init_base_binding = __esm({
 });
 
 // src/data/commands/bases.ts
-import { Command as Command3 } from "commander";
+import { Command as Command10 } from "commander";
 import * as fs24 from "fs";
 import * as path30 from "path";
 import * as yaml9 from "js-yaml";
@@ -25405,7 +26527,7 @@ function parseEnum(flag, value, allowed) {
   return value;
 }
 function buildBasesCommand() {
-  const bases = new Command3("bases").description("Manage bases");
+  const bases = new Command10("bases").description("Manage bases");
   bases.command("list").description("List all bases").option("--tag <tag>", "Filter by tag").action(async function(opts) {
     const client = await createDataClient();
     const qs = opts.tag ? `?tag=${encodeURIComponent(opts.tag)}` : "";
@@ -25612,6 +26734,13 @@ function buildBasesCommand() {
       previous ? `Worktree unbound from base (was: ${previous}).` : "No base binding to clear."
     );
   });
+  bases.addCommand(buildBasesTokensCommand());
+  bases.addCommand(buildBasesSecretsCommand());
+  bases.addCommand(buildBasesSqlCommand());
+  bases.addCommand(buildBasesImportCommand());
+  bases.addCommand(buildBasesBatchCommand());
+  bases.addCommand(buildBasesProvidersCommand());
+  bases.addCommand(buildBasesReportCommand());
   return bases;
 }
 function resolveSelectorToBaseId(selector) {
@@ -25632,6 +26761,13 @@ var BASE_META_FILE, BASE_ID_FIELD;
 var init_bases = __esm({
   "src/data/commands/bases.ts"() {
     "use strict";
+    init_batch();
+    init_import();
+    init_providers();
+    init_report2();
+    init_secrets();
+    init_sql();
+    init_tokens();
     init_client();
     init_output();
     init_helpers();
@@ -25648,9 +26784,9 @@ var init_bases = __esm({
 });
 
 // src/data/commands/file-types.ts
-import { Command as Command4 } from "commander";
+import { Command as Command11 } from "commander";
 function buildFileTypesCommand() {
-  const fileTypes = new Command4("file-types").description(
+  const fileTypes = new Command11("file-types").description(
     "Manage file types (Buckets) \u2014 storage policy + optional metadata schema for files"
   );
   fileTypes.command("list").description("List all file types in a base").action(async function() {
@@ -25706,8 +26842,8 @@ var init_file_types = __esm({
 });
 
 // src/data/commands/files.ts
-import { Command as Command5 } from "commander";
-import { readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "fs";
+import { Command as Command12 } from "commander";
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync16 } from "fs";
 import { basename as basename14 } from "path";
 function renderFileDiff(fileType, filePath, from, to, d) {
   console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
@@ -25749,14 +26885,14 @@ function downloadTarget(remotePath, to) {
   return derived;
 }
 function buildFilesCommand() {
-  const files = new Command5("files").description(
+  const files = new Command12("files").description(
     "Manage files (path-addressed, versioned content) within a file type"
   );
   files.command("put <file_type> <path>").description(
     "Upload a local file to a path (e.g. wayai files put reports q3/summary.pdf --file ./summary.pdf)"
   ).requiredOption("--file <local>", "Local file to upload").option("--content-type <type>", "MIME type", "application/octet-stream").action(async function(fileType, filePath, opts) {
     const base = pathSegment(requireBase(this), "--base");
-    const body = readFileSync22(opts.file);
+    const body = readFileSync25(opts.file);
     const client = await createDataClient();
     printOutput(
       await client.upload(
@@ -25787,7 +26923,7 @@ function buildFilesCommand() {
     const { bytes } = await client.download(
       `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${encoded}${versionQs ? `?${versionQs}` : ""}`
     );
-    writeFileSync15(out, bytes);
+    writeFileSync16(out, bytes);
     console.log(`Downloaded to ${out}`);
   });
   files.command("history <file_type> <path>").description("List the content versions of a file (newest first)").option("--limit <n>", "Max versions to return").option("--offset <n>", "Pagination offset").action(async function(fileType, filePath, opts) {
@@ -25908,10 +27044,10 @@ var init_files = __esm({
 });
 
 // src/data/commands/inbound-webhooks.ts
-import { randomUUID } from "crypto";
-import { Command as Command6 } from "commander";
+import { randomUUID as randomUUID2 } from "crypto";
+import { Command as Command13 } from "commander";
 function buildInboundWebhooksCommand() {
-  const inboundWebhooks = new Command6("inbound-webhooks").description(
+  const inboundWebhooks = new Command13("inbound-webhooks").description(
     "Manage inbound webhook endpoints"
   );
   inboundWebhooks.command("create").description("Create a new inbound webhook").requiredOption("--name <name>", "Inbound webhook name").option("--secret-stdin", "Read the HMAC shared secret from stdin (recommended for CI)").option("--id <id>", "Inbound webhook ID (auto-generated if omitted)").option("--record-type-scope <record_types>", "Comma-separated record_type scope").option(
@@ -25949,7 +27085,7 @@ function buildInboundWebhooksCommand() {
     if (opts.hydration) body.hydration = parseData(opts.hydration);
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const inboundWebhookId = opts.id ?? randomUUID();
+    const inboundWebhookId = opts.id ?? randomUUID2();
     printOutput(
       await client.request(
         "PUT",
@@ -26009,9 +27145,9 @@ var init_inbound_webhooks = __esm({
 });
 
 // src/data/commands/query-relationships.ts
-import { Command as Command7 } from "commander";
+import { Command as Command14 } from "commander";
 function buildQueryRelationshipsCommand() {
-  return new Command7("query-relationships").description("Query related records").argument("<record_type>", "RecordType of the source record").argument("<id>", "Source record ID").option("--type <type>", "Filter by relationship type").option("--direction <dir>", "Direction: outgoing, incoming, or both", "both").option("--limit <n>", "Max results", "50").option("--offset <n>", "Skip results", "0").action(async function(recordType2, id, opts) {
+  return new Command14("query-relationships").description("Query related records").argument("<record_type>", "RecordType of the source record").argument("<id>", "Source record ID").option("--type <type>", "Filter by relationship type").option("--direction <dir>", "Direction: outgoing, incoming, or both", "both").option("--limit <n>", "Max results", "50").option("--offset <n>", "Skip results", "0").action(async function(recordType2, id, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
     const params = new URLSearchParams();
@@ -26044,9 +27180,9 @@ var init_query_relationships = __esm({
 });
 
 // src/data/commands/record-types.ts
-import { Command as Command8 } from "commander";
+import { Command as Command15 } from "commander";
 function buildRecordTypesCommand() {
-  const recordTypes = new Command8("record-types").description("Manage record_types");
+  const recordTypes = new Command15("record-types").description("Manage record_types");
   recordTypes.command("list").description("List all record_types in a base").action(async function() {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
@@ -26104,12 +27240,12 @@ var init_record_types = __esm({
 });
 
 // src/data/commands/records.ts
-import { Command as Command9 } from "commander";
+import { Command as Command16 } from "commander";
 function recordKey(id, externalSource) {
   return externalSource ? foreignSegment(id, "external id") : pathSegment(id, "record id");
 }
 function buildRecordsCommand() {
-  const records = new Command9("records").description("Manage records");
+  const records = new Command16("records").description("Manage records");
   records.command("upsert <record_type>").description("Create or update a record").requiredOption("--data <json>", "Record data (inline JSON or @filename)").option("--id <id>", "Internal record ID (UUID) to update a known record").option("--external-id <id>", "External/agent-supplied ID for idempotent upsert").option("--external-source <source>", "Source system for external_id (e.g. stripe)").action(async function(recordType2, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
@@ -26198,9 +27334,9 @@ var init_records = __esm({
 });
 
 // src/data/commands/relationship-types.ts
-import { Command as Command10 } from "commander";
+import { Command as Command17 } from "commander";
 function buildRelationshipTypesCommand() {
-  const relationshipTypes = new Command10("relationship-types").description(
+  const relationshipTypes = new Command17("relationship-types").description(
     "Manage relationship types (the schema for a relationship's metadata)"
   );
   relationshipTypes.command("list").description("List all relationship types in a base").action(async function() {
@@ -26277,7 +27413,7 @@ var init_relationship_types = __esm({
 });
 
 // src/data/commands/relationships.ts
-import { Command as Command11 } from "commander";
+import { Command as Command18 } from "commander";
 function relationshipKey(id, relType) {
   return relType ? foreignSegment(id, "external id") : pathSegment(id, "relationship id");
 }
@@ -26313,7 +27449,7 @@ function byKeyQuery(relType, externalSource) {
   return q ? `?${q}` : "";
 }
 function buildRelationshipsCommand() {
-  const relationships = new Command11("relationships").description(
+  const relationships = new Command18("relationships").description(
     "Manage relationships between records"
   );
   relationships.command("upsert").description("Create or update a relationship").option("--source <record_type/id>", "Source record by internal id").option(
@@ -26398,9 +27534,9 @@ var init_relationships = __esm({
 });
 
 // src/data/commands/seed.ts
-import { Command as Command12 } from "commander";
+import { Command as Command19 } from "commander";
 function buildSeedCommand() {
-  const seed = new Command12("seed").description(
+  const seed = new Command19("seed").description(
     "Apply, reset, or clear a seed fixture on a preview base (hermetic eval data)"
   );
   seed.command("apply <name>").description(
@@ -26492,7 +27628,7 @@ var init_seed = __esm({
 });
 
 // src/data/commands/toolsets.ts
-import { Command as Command13 } from "commander";
+import { Command as Command20 } from "commander";
 function collect(value, previous) {
   return [...previous, value];
 }
@@ -26515,7 +27651,7 @@ function parseRelSpec(spec) {
   return { rel_type: key, operations: ops };
 }
 function buildToolsetsCommand() {
-  const toolsets = new Command13("toolsets").description("Manage MCP toolsets");
+  const toolsets = new Command20("toolsets").description("Manage MCP toolsets");
   toolsets.command("upsert <slug>").description("Create or update an MCP toolset").option("--name <name>", "Toolset display name (required unless using --config)").option("--description <desc>", "Toolset description").option(
     "--action <ref>",
     "Reference an Action by id, optionally renamed: <action_id> or <action_id>=<surface_name> (repeatable). Create Actions first with `wayai actions upsert`.",
@@ -26606,10 +27742,10 @@ var init_toolsets = __esm({
 });
 
 // src/data/commands/triggers.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { Command as Command14 } from "commander";
+import { randomUUID as randomUUID3 } from "crypto";
+import { Command as Command21 } from "commander";
 function buildTriggersCommand() {
-  const triggers = new Command14("triggers").description(
+  const triggers = new Command21("triggers").description(
     "Manage triggers (outbound webhooks, internal writes, external writes)"
   );
   triggers.command("create").description(
@@ -26652,7 +27788,7 @@ function buildTriggersCommand() {
     }
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const triggerId = opts.id ?? randomUUID2();
+    const triggerId = opts.id ?? randomUUID3();
     printOutput(
       await client.request("PUT", `/v1/${base}/triggers/${pathSegment(triggerId, "--id")}`, body),
       outputFormat(this)
@@ -26708,26 +27844,37 @@ var program_exports = {};
 __export(program_exports, {
   DATA_NAMESPACES: () => DATA_NAMESPACES,
   buildDataProgram: () => buildDataProgram,
+  handleParserExit: () => handleParserExit,
   isDataNamespace: () => isDataNamespace,
+  routeErrorsToCli: () => routeErrorsToCli,
   runDataCommand: () => runDataCommand,
   withBaseOption: () => withBaseOption,
   withDataGlobals: () => withDataGlobals
 });
-import { Command as Command15 } from "commander";
+import { Command as Command22 } from "commander";
 function withDataGlobals(command2) {
   return command2.option("--org <uuid>", "Organization to operate against (overrides .wayai.yaml)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
 }
-function withBaseOption(command2) {
-  return command2.option("--base <id>", "Base id (or set WAYAI_BASE)");
-}
 function routeErrorsToCli(command2) {
   command2.exitOverride().configureOutput({ outputError: () => {
   } });
   for (const child of command2.commands) routeErrorsToCli(child);
   return command2;
 }
+function handleParserExit(err) {
+  const { code, exitCode } = err ?? {};
+  if (code === "commander.helpDisplayed" || code === "commander.version") return;
+  if (code === "commander.help") {
+    process.exitCode = exitCode || 1;
+    return;
+  }
+  if (typeof code === "string" && code.startsWith("commander.")) {
+    throw expected(err instanceof Error ? err.message : String(err));
+  }
+  throw err;
+}
 function buildDataProgram() {
-  const program = new Command15("wayai");
+  const program = new Command22("wayai");
   program.addCommand(withDataGlobals(buildBasesCommand()));
   for (const build of [
     buildRecordsCommand,
@@ -26759,16 +27906,7 @@ async function runDataCommand(namespace, args2) {
   try {
     await program.parseAsync(["node", "wayai", namespace, ...args2]);
   } catch (err) {
-    const { code, exitCode } = err ?? {};
-    if (code === "commander.helpDisplayed" || code === "commander.version") return;
-    if (code === "commander.help") {
-      process.exitCode = exitCode || 1;
-      return;
-    }
-    if (typeof code === "string" && code.startsWith("commander.")) {
-      throw expected(err instanceof Error ? err.message : String(err));
-    }
-    throw err;
+    handleParserExit(err);
   }
 }
 var init_program = __esm({
@@ -26793,6 +27931,7 @@ var init_program = __esm({
     init_org_context();
     init_registry();
     init_registry();
+    init_helpers();
   }
 });
 
@@ -26802,9 +27941,9 @@ init_errors2();
 init_mask_secrets();
 init_utils();
 init_registry();
-import { readFileSync as readFileSync23 } from "fs";
-import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname9, join as join28 } from "path";
+import { readFileSync as readFileSync26 } from "fs";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname10, join as join29 } from "path";
 
 // src/lib/version-refresh.ts
 init_version_cache();
@@ -26959,8 +28098,8 @@ Run \`wayai admin skill install\` to update.`);
 }
 
 // src/index.ts
-var __dirname = dirname9(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync23(join28(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname10(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync26(join29(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
@@ -27305,7 +28444,7 @@ async function runForeground() {
   try {
     await main();
     if (command && !SKIP_UPDATE_CHECK.includes(command) && !wantsHelp(args)) {
-      showUpdateNudges(pkg.version, fileURLToPath2(import.meta.url));
+      showUpdateNudges(pkg.version, fileURLToPath3(import.meta.url));
     }
     await closeSentry();
   } catch (err) {