@wayai/cli 0.3.137 → 0.3.139

package/dist/index.js

@@ -447,11 +447,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path31) {
+function addApiBreadcrumb(method, path36) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path31}`,
+    message: `${method} ${path36}`,
     level: "info"
   });
 }
@@ -905,8 +905,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path31, errorMaps, issueData } = params;
-      const fullPath = [...path31, ...issueData.path || []];
+      const { data, path: path36, errorMaps, issueData } = params;
+      const fullPath = [...path36, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1217,11 +1217,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path31, key) {
+      constructor(parent, value, path36, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path31;
+        this._path = path36;
         this._key = key;
       }
       get path() {
@@ -4634,12 +4634,12 @@ function validateFollowupLinks(followups, label, ctx) {
   const linkTargets = /* @__PURE__ */ new Set();
   followups.forEach((followup, i) => {
     const ref = followup?.after_followup_id;
-    const path31 = ["followups", i, "after_followup_id"];
+    const path36 = ["followups", i, "after_followup_id"];
     if (followup?.type !== "inactivity_after_before_event") {
       if (ref !== void 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path31,
+          path: path36,
           message: `kanban status ${label}: after_followup_id is only valid on inactivity_after_before_event followups (this one is ${followup?.type})`
         });
       }
@@ -4648,7 +4648,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (ref === void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path31,
+        path: path36,
         message: `kanban status ${label}: inactivity_after_before_event requires after_followup_id naming the id of a before_event followup in the same status`
       });
       return;
@@ -4658,7 +4658,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (matches.length > 1) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path31,
+        path: path36,
         message: `kanban status ${label}: after_followup_id "${ref}" matches ${matches.length} followups \u2014 a link must name exactly one`
       });
       return;
@@ -4670,7 +4670,7 @@ function validateFollowupLinks(followups, label, ctx) {
       );
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path31,
+        path: path36,
         message: hasIdlessBeforeEvent ? `kanban status ${label}: after_followup_id "${ref}" matches no followup \u2014 a link target must declare an explicit id, and this status has before_event followups without one` : `kanban status ${label}: after_followup_id "${ref}" matches no followup in this status`
       });
       return;
@@ -4678,7 +4678,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (target.type !== "before_event") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path31,
+        path: path36,
         message: `kanban status ${label}: after_followup_id "${ref}" points at a ${target.type} followup \u2014 only before_event followups can anchor a chain`
       });
     }
@@ -4754,12 +4754,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path31, errors, opts = {}) {
+function validateSchema(schema, path36, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path31 || "<root>",
+      path: path36 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -4767,7 +4767,7 @@ function validateSchema(schema, path31, errors, opts = {}) {
   }
   if (!isRecord(schema)) {
     errors.push({
-      path: path31,
+      path: path36,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -4775,14 +4775,14 @@ function validateSchema(schema, path31, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path31 ? `${path31}.type` : "type",
+        path: path36 ? `${path36}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path31}.type`,
+      path: `${path36}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -4792,25 +4792,25 @@ function validateSchema(schema, path31, errors, opts = {}) {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       const isOutcomePlaceholder = e === "[KANBAN_OUTCOME_VALUES]";
       errors.push({
-        path: `${path31}.enum`,
+        path: `${path36}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isOutcomePlaceholder ? "Declare `outcomes` on the hub's terminal kanban status so the platform can render the placeholder into a valid array; with none configured the platform drops the parameter instead." : isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path31}.enum`,
+        path: `${path36}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path31}.enum`,
+        path: `${path36}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path31}.enum[${i}]`,
+            path: `${path36}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -4820,7 +4820,7 @@ function validateSchema(schema, path31, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path31}.${key}`,
+        path: `${path36}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -4829,45 +4829,45 @@ function validateSchema(schema, path31, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord(schema.properties)) {
       errors.push({
-        path: `${path31}.properties`,
+        path: `${path36}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path31}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path36}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path31}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path36}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path31}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path36}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord(schema[key])) {
-      validateSchema(schema[key], `${path31}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path36}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path31}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path36}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path31}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path36}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path31}.${k}`;
+    const fieldPath = `${path36}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -5012,8 +5012,8 @@ function evalInitialStateError(input) {
     const parsed = evalInitialStateEntry.safeParse(entries[i]);
     if (!parsed.success) {
       const issue = parsed.error.issues[0];
-      const path31 = issue?.path.join(".") || "?";
-      return `initial_state[${i}].${path31} is invalid: ${issue?.message ?? "malformed"}`;
+      const path36 = issue?.path.join(".") || "?";
+      return `initial_state[${i}].${path36} is invalid: ${issue?.message ?? "malformed"}`;
     }
     if (seenSlugs.has(parsed.data.slug)) {
       return `initial_state[${i}].slug "${parsed.data.slug}" is declared more than once`;
@@ -5201,10 +5201,10 @@ function refineHubAsCodeEvals(config, ctx) {
 function refineHubAsCodeEvalAttachments(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path31, turn, name) => {
+  const addTurnIssue = (path36, turn, name) => {
     const error = evalTurnAttachmentsError(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path31, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path36, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes(turn)) referencedHashes.add(hash);
@@ -5350,11 +5350,11 @@ function refineHubAsCodeDelegation(config, ctx) {
         }
       }
       if (del.context_boundary === void 0) return;
-      const path31 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
+      const path36 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
       if (del.type !== "hub") {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path31,
+          path: path36,
           message: `context_boundary applies only to \`type: hub\` delegations (got type "${String(del.type)}")`
         });
         return;
@@ -5362,14 +5362,14 @@ function refineHubAsCodeDelegation(config, ctx) {
       if (!CONTEXT_BOUNDARIES.includes(del.context_boundary)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path31,
+          path: path36,
           message: `context_boundary must be one of: ${CONTEXT_BOUNDARIES.join(", ")}`
         });
       }
     });
   });
 }
-var uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, MAX_AUDIO_FILE_BASE64_BYTES, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, PREVIOUS_CONVERSATIONS_MAX, previousConversationsCountField, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupTypeSchema, EVENT_RELATIVE_FOLLOWUP_TYPES, followupTimeUnitSchema, followupIdSchema, SELECTABLE_FOLLOWUP_TYPES, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS, followupSchema, MAX_OUTCOMES_PER_STATUS, kanbanOutcomeSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, MAX_EVAL_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_MAX_RUNS_PER_SCENARIO, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, ISO_UTC_RE, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, evalDateContextSchema, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, createEvalBody, updateEvalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, planKeySchema, billingStatusSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, MAX_RESOURCE_FILE_SIZE, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS;
+var uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, MAX_AUDIO_FILE_BASE64_BYTES, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, PREVIOUS_CONVERSATIONS_MAX, previousConversationsCountField, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupTypeSchema, EVENT_RELATIVE_FOLLOWUP_TYPES, followupTimeUnitSchema, followupIdSchema, SELECTABLE_FOLLOWUP_TYPES, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS, followupSchema, MAX_OUTCOMES_PER_STATUS, kanbanOutcomeSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, MAX_EVAL_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_MAX_RUNS_PER_SCENARIO, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, ISO_UTC_RE, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, evalDateContextSchema, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, createEvalBody, updateEvalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, planKeySchema, billingStatusSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, MAX_RESOURCE_FILE_SIZE, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetBody, adminRepairLegacyOrgGrantsBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -7973,13 +7973,20 @@ var init_contracts = __esm({
     });
     adminOrgAdminIdParam = external_exports.object({
       orgId: uuidSchema,
-      adminId: uuidSchema
+      // `adminId` is a `member_grant.user_id`, which for a logged-in user is the
+      // WorkOS `sub` (`user_01…`), not a UUID. Matches `orgAdminIdParam` on the
+      // org-facing route.
+      adminId: external_exports.string().min(1)
     });
     adminUserIdParam = external_exports.object({
       userId: uuidSchema
     });
+    PRICING_PLAN_ID_RE = /^pp-[a-z0-9]+(-[a-z0-9]+)*$/;
     adminPlanIdParam = external_exports.object({
-      planId: uuidSchema
+      planId: external_exports.string().refine(
+        (value) => PRICING_PLAN_ID_RE.test(value) || uuidSchema.safeParse(value).success,
+        { message: 'planId must be a pricing plan id such as "pp-free", or a UUID' }
+      )
     });
     adminOrganizationsQuery = external_exports.object({
       page: external_exports.coerce.number().int().min(1).default(1),
@@ -7998,8 +8005,33 @@ var init_contracts = __esm({
       value: external_exports.number().int().min(0, "value must be a non-negative number")
     });
     updatePlanBody = external_exports.object({
-      plan_type: external_exports.enum(["free", "paid"])
-    });
+      plan_type: external_exports.enum(["free", "paid"]).optional(),
+      /**
+       * Move the start of the org's free-plan window. The operator lever for a window that
+       * must be backdated — `free_plan_started_at` is otherwise only ever stamped to *now*
+       * (org creation, `cancelBilling`, the lazy rollover), so an elapsed free window is
+       * unreachable without it.
+       *
+       * Canonical form only (AGENTS.md › Timestamps): `timestampSchema` already refuses a
+       * non-UTC offset and `isIsoTimestamp` pins the millisecond precision, because this
+       * value is stored as-is and read back by `freePlanWindowStart()` / `freePlanWindowEnd()`
+       * and by the Rekor projection's `window_start`.
+       *
+       * Past-or-now only. A future start freezes the org's window permanently:
+       * `maybeRolloverFreePlanWindow` derives a NEGATIVE elapsed and so never archives the
+       * metrics nor restamps the column, while the §2.6 trigger-5 sweep selects only windows
+       * that have already passed — so nothing rolls the org over, its consumed operations
+       * never reset, and past quota every AI turn is refused until a human re-patches.
+       */
+      free_plan_started_at: timestampSchema.refine(isIsoTimestamp, {
+        message: "free_plan_started_at must be ISO-8601 UTC with millisecond precision (e.g. 2026-07-01T00:00:00.000Z)"
+      }).refine((value) => Date.parse(value) <= Date.now(), {
+        message: "free_plan_started_at must not be in the future"
+      }).optional()
+    }).strip().refine(
+      (data) => Object.keys(data).length > 0,
+      { message: "No fields to update" }
+    );
     addAdminUserBody = external_exports.object({
       user_email: external_exports.string().email("user_email must be a valid email address")
     });
@@ -8058,6 +8090,18 @@ var init_contracts = __esm({
         }
       }
     });
+    adminRepairLegacyOrgGrantsBody = external_exports.object({
+      scope: external_exports.enum(["all", "org"]),
+      org_id: external_exports.string().uuid().optional(),
+      dry_run: external_exports.boolean().optional().default(false)
+    }).strict().superRefine((data, ctx) => {
+      if (data.scope === "org" && !data.org_id) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "scope=org requires org_id", path: ["org_id"] });
+      }
+      if (data.scope === "all" && data.org_id) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "scope=all must not include org_id", path: ["org_id"] });
+      }
+    });
     updatePricingPlanBody = external_exports.object({
       display_name: external_exports.string().min(1).optional(),
       stripe_product_id: external_exports.string().optional(),
@@ -8698,6 +8742,7 @@ var init_contracts = __esm({
     DATA_PROXY_PREFIX = `/api${DATA_PROXY_MOUNT}`;
     REKOR_V1_PREFIX = "/v1";
     DATA_PROXY_ORG_QUERY_PARAM = "org_id";
+    MAX_PROVISIONING_BODY_BYTES = 256 * 1024;
     dataProxyQuery = external_exports.object({
       [DATA_PROXY_ORG_QUERY_PARAM]: external_exports.string().uuid().optional()
     });
@@ -8737,10 +8782,10 @@ function toDataProxyPath(v1Path) {
   }
   return `${DATA_PROXY_PREFIX}${v1Path.slice(REKOR_V1_PREFIX.length)}`;
 }
-function withOrgSelector(path31, orgId) {
-  if (!orgId) return path31;
-  const separator = path31.includes("?") ? "&" : "?";
-  return `${path31}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
+function withOrgSelector(path36, orgId) {
+  if (!orgId) return path36;
+  const separator = path36.includes("?") ? "&" : "?";
+  return `${path36}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
 }
 function dataErrorMessage(err) {
   if (!(err instanceof ApiError)) return null;
@@ -8764,7 +8809,7 @@ var init_api_client = __esm({
     init_sentry();
     init_mask_secrets();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
-    delay = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+    delay = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
     ApiError = class extends Error {
       status;
       body;
@@ -8774,13 +8819,13 @@ var init_api_client = __esm({
        * telling them apart by body shape misreads one for the other.
        */
       path;
-      constructor(method, path31, status, body) {
+      constructor(method, path36, status, body) {
         const safeBody = maskSecretsInMessage(body);
-        super(`API request failed: ${method} ${path31} (${status}): ${safeBody}`);
+        super(`API request failed: ${method} ${path36} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
-        this.path = path31;
+        this.path = path36;
       }
       /** True when the status code is a 4xx client error (expected user-facing condition, not a bug). */
       get isExpected() {
@@ -8853,6 +8898,12 @@ var init_api_client = __esm({
       async adminRepairTeamOrphans(body) {
         return this.request("POST", "/api/admin/hubs/repair-team-orphans", body);
       }
+      // Repair the roster rows the pre-#3922 platform-admin add wrote (email in the
+      // `user_id` column, `user_email` NULL) — each one an inert phantom seat.
+      // Used by `wayai admin orgs repair-legacy-grants` (platform-admin gated).
+      async adminRepairLegacyOrgGrants(body) {
+        return this.request("POST", "/api/admin/organizations/repair-legacy-grants", body);
+      }
       // Read the platform config (platform-admin gated). Used by `wayai admin harness status`.
       async adminGetConfig() {
         return this.request("GET", "/api/admin/config");
@@ -8876,8 +8927,8 @@ var init_api_client = __esm({
           ...opts?.check && { check: true }
         });
       }
-      async lookup(path31, opts) {
-        const params = new URLSearchParams({ path: path31 });
+      async lookup(path36, opts) {
+        const params = new URLSearchParams({ path: path36 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -9298,9 +9349,9 @@ var init_api_client = __esm({
        * sandbox for this conversation, or the blob was purged).
        */
       async downloadArchiveSandboxFs(hubId, conversationId) {
-        const path31 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
-        addApiBreadcrumb("GET", path31);
-        const url = `${this.apiUrl}${path31}`;
+        const path36 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
+        addApiBreadcrumb("GET", path36);
+        const url = `${this.apiUrl}${path36}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -9314,7 +9365,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path31, response.status, await response.text());
+          throw new ApiError("GET", path36, response.status, await response.text());
         }
         return new Uint8Array(await response.arrayBuffer());
       }
@@ -9354,9 +9405,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path31, body, extraHeaders, contentType) {
-        addApiBreadcrumb(method, path31);
-        const url = `${this.apiUrl}${path31}`;
+      async request(method, path36, body, extraHeaders, contentType) {
+        addApiBreadcrumb(method, path36);
+        const url = `${this.apiUrl}${path36}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body, extraHeaders, contentType);
@@ -9381,7 +9432,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path31, response.status, errorBody);
+          throw new ApiError(method, path36, response.status, errorBody);
         }
       }
       /**
@@ -9443,9 +9494,9 @@ var init_api_client = __esm({
        * transient-retry loop — re-streaming a blob is not worth a cold-start probe.
        */
       async dataDownload(v1Path, orgId) {
-        const path31 = withOrgSelector(toDataProxyPath(v1Path), orgId);
-        addApiBreadcrumb("GET", path31);
-        const url = `${this.apiUrl}${path31}`;
+        const path36 = withOrgSelector(toDataProxyPath(v1Path), orgId);
+        addApiBreadcrumb("GET", path36);
+        const url = `${this.apiUrl}${path36}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -9459,7 +9510,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path31, response.status, await response.text());
+          throw new ApiError("GET", path36, response.status, await response.text());
         }
         return {
           bytes: new Uint8Array(await response.arrayBuffer()),
@@ -9611,12 +9662,12 @@ function validateFollowupLinks2(followups, label, ctx) {
   const linkTargets = /* @__PURE__ */ new Set();
   followups.forEach((followup, i) => {
     const ref = followup?.after_followup_id;
-    const path31 = ["followups", i, "after_followup_id"];
+    const path36 = ["followups", i, "after_followup_id"];
     if (followup?.type !== "inactivity_after_before_event") {
       if (ref !== void 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path31,
+          path: path36,
           message: `kanban status ${label}: after_followup_id is only valid on inactivity_after_before_event followups (this one is ${followup?.type})`
         });
       }
@@ -9625,7 +9676,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (ref === void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path31,
+        path: path36,
         message: `kanban status ${label}: inactivity_after_before_event requires after_followup_id naming the id of a before_event followup in the same status`
       });
       return;
@@ -9635,7 +9686,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (matches.length > 1) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path31,
+        path: path36,
         message: `kanban status ${label}: after_followup_id "${ref}" matches ${matches.length} followups \u2014 a link must name exactly one`
       });
       return;
@@ -9647,7 +9698,7 @@ function validateFollowupLinks2(followups, label, ctx) {
       );
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path31,
+        path: path36,
         message: hasIdlessBeforeEvent ? `kanban status ${label}: after_followup_id "${ref}" matches no followup \u2014 a link target must declare an explicit id, and this status has before_event followups without one` : `kanban status ${label}: after_followup_id "${ref}" matches no followup in this status`
       });
       return;
@@ -9655,7 +9706,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (target.type !== "before_event") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path31,
+        path: path36,
         message: `kanban status ${label}: after_followup_id "${ref}" points at a ${target.type} followup \u2014 only before_event followups can anchor a chain`
       });
     }
@@ -9731,12 +9782,12 @@ function typeMatches2(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema2(schema, path31, errors, opts = {}) {
+function validateSchema2(schema, path36, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH2) {
     errors.push({
-      path: path31 || "<root>",
+      path: path36 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH2} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -9744,7 +9795,7 @@ function validateSchema2(schema, path31, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path31,
+      path: path36,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -9752,14 +9803,14 @@ function validateSchema2(schema, path31, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path31 ? `${path31}.type` : "type",
+        path: path36 ? `${path36}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches2(schema.type, ALLOWED_TYPES2)) {
     errors.push({
-      path: `${path31}.type`,
+      path: `${path36}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES2].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -9769,25 +9820,25 @@ function validateSchema2(schema, path31, errors, opts = {}) {
       const isPlaceholder = PLACEHOLDER_TOKENS2.includes(e);
       const isOutcomePlaceholder = e === "[KANBAN_OUTCOME_VALUES]";
       errors.push({
-        path: `${path31}.enum`,
+        path: `${path36}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isOutcomePlaceholder ? "Declare `outcomes` on the hub's terminal kanban status so the platform can render the placeholder into a valid array; with none configured the platform drops the parameter instead." : isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path31}.enum`,
+        path: `${path36}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path31}.enum`,
+        path: `${path36}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive2(e[i])) {
           errors.push({
-            path: `${path31}.enum[${i}]`,
+            path: `${path36}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -9797,7 +9848,7 @@ function validateSchema2(schema, path31, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path31}.${key}`,
+        path: `${path36}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -9806,45 +9857,45 @@ function validateSchema2(schema, path31, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path31}.properties`,
+        path: `${path36}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema2(propSchema, `${path31}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema2(propSchema, `${path36}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes2(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema2(sub, `${path31}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema2(sub, `${path36}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema2(schema.items, `${path31}.items`, errors, { depth: depth + 1 });
+      validateSchema2(schema.items, `${path36}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS2) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema2(schema[key], `${path31}.${key}`, errors, { depth: depth + 1 });
+      validateSchema2(schema[key], `${path36}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS2) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema2(sub, `${path31}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema2(sub, `${path36}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS2) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema2(sub, `${path31}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema2(sub, `${path36}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path31}.${k}`;
+    const fieldPath = `${path36}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS2) {
       if (v === token) {
@@ -9989,8 +10040,8 @@ function evalInitialStateError2(input) {
     const parsed = evalInitialStateEntry2.safeParse(entries[i]);
     if (!parsed.success) {
       const issue = parsed.error.issues[0];
-      const path31 = issue?.path.join(".") || "?";
-      return `initial_state[${i}].${path31} is invalid: ${issue?.message ?? "malformed"}`;
+      const path36 = issue?.path.join(".") || "?";
+      return `initial_state[${i}].${path36} is invalid: ${issue?.message ?? "malformed"}`;
     }
     if (seenSlugs.has(parsed.data.slug)) {
       return `initial_state[${i}].slug "${parsed.data.slug}" is declared more than once`;
@@ -10195,10 +10246,10 @@ function refineHubAsCodeEvals2(config, ctx) {
 function refineHubAsCodeEvalAttachments2(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path31, turn, name) => {
+  const addTurnIssue = (path36, turn, name) => {
     const error = evalTurnAttachmentsError2(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path31, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path36, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes2(turn)) referencedHashes.add(hash);
@@ -10344,11 +10395,11 @@ function refineHubAsCodeDelegation2(config, ctx) {
         }
       }
       if (del.context_boundary === void 0) return;
-      const path31 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
+      const path36 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
       if (del.type !== "hub") {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path31,
+          path: path36,
           message: `context_boundary applies only to \`type: hub\` delegations (got type "${String(del.type)}")`
         });
         return;
@@ -10356,7 +10407,7 @@ function refineHubAsCodeDelegation2(config, ctx) {
       if (!CONTEXT_BOUNDARIES2.includes(del.context_boundary)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path31,
+          path: path36,
           message: `context_boundary must be one of: ${CONTEXT_BOUNDARIES2.join(", ")}`
         });
       }
@@ -10402,7 +10453,7 @@ function findStepBoundaries(transcript) {
   }
   return out;
 }
-var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, REKOR_ACTOR_TYPE_HEADER2, REKOR_ACTOR_ID_HEADER2, REKOR_ACTOR_LABEL_HEADER2, REKOR_ACTOR_ORG_HEADER2, REKOR_ACTOR_ADMIN_HEADER2, REKOR_CLIENT_HEADER2, REKOR_TOOL_ID_HEADER2, REKOR_CLIENTS2, rekorClientSchema2, MAX_REKOR_TOOL_ID_LENGTH2, rekorToolIdSchema2, DATA_PROXY_MOUNT2, DATA_PROXY_PREFIX2, DATA_PROXY_ORG_QUERY_PARAM2, dataProxyQuery2, rekorAttestation2, REQUIRED_REKOR_ATTESTATION_HEADERS2, ENDPOINT_CONFIGS, AUTH_TYPE2, ORG_CREDENTIAL_AUTH_TYPES2, AUTH_TYPE_DISPLAY2, LEGACY_AUTH_TYPE_MAP2, VALID_AUTH_TYPES2, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, MAX_AUDIO_FILE_BASE64_BYTES2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, PREVIOUS_CONVERSATIONS_MAX2, previousConversationsCountField2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupTypeSchema2, EVENT_RELATIVE_FOLLOWUP_TYPES2, followupTimeUnitSchema2, followupIdSchema2, SELECTABLE_FOLLOWUP_TYPES2, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS2, followupSchema2, MAX_OUTCOMES_PER_STATUS2, kanbanOutcomeSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, MAX_EVAL_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, CONTEXT_BOUNDARIES2, contextBoundarySchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlTable2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_MAX_RUNS_PER_SCENARIO2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, ISO_UTC_RE2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, evalDateContextSchema2, EVAL_FIXTURE_NAME_MAX_LENGTH2, evalFixtureOverrideSchema2, runSessionQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, EVAL_INITIAL_STATE_SCOPES2, MAX_INITIAL_STATE_ENTRIES2, evalInitialStateEntry2, createEvalBody2, updateEvalBody2, EVAL_LIST_MAX_LIMIT2, evalListLimit2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, EVAL_MAX_SELECTED_SCENARIOS2, evalScenarioSelectionEntrySchema2, evalScenarioSelectionSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, EVAL_ATTACHMENT_HASH_REGEX2, evalAttachmentRef2, turnMayCarryAttachments2, ATTACHMENTS_USER_ONLY_MESSAGE2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, evalSessionConfigResponseSchema2, evalSessionResponseSchema2, evalSessionListConfigSchema2, evalSessionListItemSchema2, seedReleaseStatusSchema2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, apiChannelMessage2, apiChannelMessageBody2, appMessageBody2, appMessageResponse2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, deleteUserConversationsResponse2, sendMessageBody2, listConversationsQuery2, flagSourceSchema2, getConversationsResponse2, getConversationDetailParams2, getConversationDetailQuery2, getConversationDetailResponse2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, copilotSuggestBody2, copilotSuggestResponse2, CONSULT_THREAD_STATUSES2, consultThreadStatus2, CONSULT_THREAD_TITLE_MAX2, consultThreadTitle2, consultThreadSummary2, listConsultThreadsQuery2, listConsultThreadsResponse2, createConsultThreadBody2, createConsultThreadResponse2, consultThreadIdParam2, updateConsultThreadBody2, updateConsultThreadResponse2, CONSULT_AWAIT_TIMEOUT_MS2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, planKeySchema2, billingStatusSchema2, REKOR_ENTITLEMENT_CONTRACT_VERSION2, entitlementProjectionSchema2, rekorEntitlementRefreshMessageSchema2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, MAX_RESOURCE_FILE_SIZE2, MAX_10MB_BASE64_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_CARRIERS2, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2, MAX_RESOURCE_ENCODED_BYTES2, MAX_HUB_AS_CODE_RESOURCES2, MAX_HUB_AS_CODE_RESOURCE_FILES2, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES2, MAX_CI_CONFIG_BODY_BYTES2, hubAsCodeStateSchema2, hubAsCodeResourceFileSchema2, hubAsCodeResourceSchema2, uuidPattern2, ciUuidSchema2, boundedHubAsCodeResourcesSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, CI_APPLY_ENTITY_KINDS2, CI_APPLY_OPERATIONS2, ciApplyErrorBaseSchema2, ciApplyErrorSchema2, ciSyncCountSchema2, ciSyncChangesSchema2, ciSyncWarningSchema2, ciSyncResponseSchema2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminScopedTargetBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysBody2, dataExplorerKvKeyBody2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteBody2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, passwordLoginBody2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, reportMessageSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, reporterReportSummarySchema2, reporterListResponseSchema2, getReportResponseSchema2, reporterTransitionResponseSchema2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2, WAYAI_WORKSPACE_LAYOUT;
+var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, REKOR_ACTOR_TYPE_HEADER2, REKOR_ACTOR_ID_HEADER2, REKOR_ACTOR_LABEL_HEADER2, REKOR_ACTOR_ORG_HEADER2, REKOR_ACTOR_ADMIN_HEADER2, REKOR_CLIENT_HEADER2, REKOR_TOOL_ID_HEADER2, REKOR_CLIENTS2, rekorClientSchema2, MAX_REKOR_TOOL_ID_LENGTH2, rekorToolIdSchema2, DATA_PROXY_MOUNT2, DATA_PROXY_PREFIX2, DATA_PROXY_ORG_QUERY_PARAM2, MAX_PROVISIONING_BODY_BYTES2, dataProxyQuery2, rekorAttestation2, REQUIRED_REKOR_ATTESTATION_HEADERS2, ENDPOINT_CONFIGS, AUTH_TYPE2, ORG_CREDENTIAL_AUTH_TYPES2, AUTH_TYPE_DISPLAY2, LEGACY_AUTH_TYPE_MAP2, VALID_AUTH_TYPES2, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, MAX_AUDIO_FILE_BASE64_BYTES2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, PREVIOUS_CONVERSATIONS_MAX2, previousConversationsCountField2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupTypeSchema2, EVENT_RELATIVE_FOLLOWUP_TYPES2, followupTimeUnitSchema2, followupIdSchema2, SELECTABLE_FOLLOWUP_TYPES2, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS2, followupSchema2, MAX_OUTCOMES_PER_STATUS2, kanbanOutcomeSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, MAX_EVAL_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, CONTEXT_BOUNDARIES2, contextBoundarySchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlTable2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_MAX_RUNS_PER_SCENARIO2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, ISO_UTC_RE2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, evalDateContextSchema2, EVAL_FIXTURE_NAME_MAX_LENGTH2, evalFixtureOverrideSchema2, runSessionQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, EVAL_INITIAL_STATE_SCOPES2, MAX_INITIAL_STATE_ENTRIES2, evalInitialStateEntry2, createEvalBody2, updateEvalBody2, EVAL_LIST_MAX_LIMIT2, evalListLimit2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, EVAL_MAX_SELECTED_SCENARIOS2, evalScenarioSelectionEntrySchema2, evalScenarioSelectionSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, EVAL_ATTACHMENT_HASH_REGEX2, evalAttachmentRef2, turnMayCarryAttachments2, ATTACHMENTS_USER_ONLY_MESSAGE2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, evalSessionConfigResponseSchema2, evalSessionResponseSchema2, evalSessionListConfigSchema2, evalSessionListItemSchema2, seedReleaseStatusSchema2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, apiChannelMessage2, apiChannelMessageBody2, appMessageBody2, appMessageResponse2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, deleteUserConversationsResponse2, sendMessageBody2, listConversationsQuery2, flagSourceSchema2, getConversationsResponse2, getConversationDetailParams2, getConversationDetailQuery2, getConversationDetailResponse2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, copilotSuggestBody2, copilotSuggestResponse2, CONSULT_THREAD_STATUSES2, consultThreadStatus2, CONSULT_THREAD_TITLE_MAX2, consultThreadTitle2, consultThreadSummary2, listConsultThreadsQuery2, listConsultThreadsResponse2, createConsultThreadBody2, createConsultThreadResponse2, consultThreadIdParam2, updateConsultThreadBody2, updateConsultThreadResponse2, CONSULT_AWAIT_TIMEOUT_MS2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, planKeySchema2, billingStatusSchema2, REKOR_ENTITLEMENT_CONTRACT_VERSION2, entitlementProjectionSchema2, rekorEntitlementRefreshMessageSchema2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, MAX_RESOURCE_FILE_SIZE2, MAX_10MB_BASE64_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_CARRIERS2, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2, MAX_RESOURCE_ENCODED_BYTES2, MAX_HUB_AS_CODE_RESOURCES2, MAX_HUB_AS_CODE_RESOURCE_FILES2, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES2, MAX_CI_CONFIG_BODY_BYTES2, hubAsCodeStateSchema2, hubAsCodeResourceFileSchema2, hubAsCodeResourceSchema2, uuidPattern2, ciUuidSchema2, boundedHubAsCodeResourcesSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, CI_APPLY_ENTITY_KINDS2, CI_APPLY_OPERATIONS2, ciApplyErrorBaseSchema2, ciApplyErrorSchema2, ciSyncCountSchema2, ciSyncChangesSchema2, ciSyncWarningSchema2, ciSyncResponseSchema2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, PRICING_PLAN_ID_RE2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminScopedTargetBody2, adminRepairLegacyOrgGrantsBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysBody2, dataExplorerKvKeyBody2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteBody2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, passwordLoginBody2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, reportMessageSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, reporterReportSummarySchema2, reporterListResponseSchema2, getReportResponseSchema2, reporterTransitionResponseSchema2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
@@ -10626,6 +10677,7 @@ var init_dist = __esm({
     DATA_PROXY_MOUNT2 = "/data";
     DATA_PROXY_PREFIX2 = `/api${DATA_PROXY_MOUNT2}`;
     DATA_PROXY_ORG_QUERY_PARAM2 = "org_id";
+    MAX_PROVISIONING_BODY_BYTES2 = 256 * 1024;
     dataProxyQuery2 = external_exports.object({
       [DATA_PROXY_ORG_QUERY_PARAM2]: external_exports.string().uuid().optional()
     });
@@ -13364,13 +13416,20 @@ var init_dist = __esm({
     });
     adminOrgAdminIdParam2 = external_exports.object({
       orgId: uuidSchema2,
-      adminId: uuidSchema2
+      // `adminId` is a `member_grant.user_id`, which for a logged-in user is the
+      // WorkOS `sub` (`user_01…`), not a UUID. Matches `orgAdminIdParam` on the
+      // org-facing route.
+      adminId: external_exports.string().min(1)
     });
     adminUserIdParam2 = external_exports.object({
       userId: uuidSchema2
     });
+    PRICING_PLAN_ID_RE2 = /^pp-[a-z0-9]+(-[a-z0-9]+)*$/;
     adminPlanIdParam2 = external_exports.object({
-      planId: uuidSchema2
+      planId: external_exports.string().refine(
+        (value) => PRICING_PLAN_ID_RE2.test(value) || uuidSchema2.safeParse(value).success,
+        { message: 'planId must be a pricing plan id such as "pp-free", or a UUID' }
+      )
     });
     adminOrganizationsQuery2 = external_exports.object({
       page: external_exports.coerce.number().int().min(1).default(1),
@@ -13389,8 +13448,33 @@ var init_dist = __esm({
       value: external_exports.number().int().min(0, "value must be a non-negative number")
     });
     updatePlanBody2 = external_exports.object({
-      plan_type: external_exports.enum(["free", "paid"])
-    });
+      plan_type: external_exports.enum(["free", "paid"]).optional(),
+      /**
+       * Move the start of the org's free-plan window. The operator lever for a window that
+       * must be backdated — `free_plan_started_at` is otherwise only ever stamped to *now*
+       * (org creation, `cancelBilling`, the lazy rollover), so an elapsed free window is
+       * unreachable without it.
+       *
+       * Canonical form only (AGENTS.md › Timestamps): `timestampSchema` already refuses a
+       * non-UTC offset and `isIsoTimestamp` pins the millisecond precision, because this
+       * value is stored as-is and read back by `freePlanWindowStart()` / `freePlanWindowEnd()`
+       * and by the Rekor projection's `window_start`.
+       *
+       * Past-or-now only. A future start freezes the org's window permanently:
+       * `maybeRolloverFreePlanWindow` derives a NEGATIVE elapsed and so never archives the
+       * metrics nor restamps the column, while the §2.6 trigger-5 sweep selects only windows
+       * that have already passed — so nothing rolls the org over, its consumed operations
+       * never reset, and past quota every AI turn is refused until a human re-patches.
+       */
+      free_plan_started_at: timestampSchema2.refine(isIsoTimestamp2, {
+        message: "free_plan_started_at must be ISO-8601 UTC with millisecond precision (e.g. 2026-07-01T00:00:00.000Z)"
+      }).refine((value) => Date.parse(value) <= Date.now(), {
+        message: "free_plan_started_at must not be in the future"
+      }).optional()
+    }).strip().refine(
+      (data) => Object.keys(data).length > 0,
+      { message: "No fields to update" }
+    );
     addAdminUserBody2 = external_exports.object({
       user_email: external_exports.string().email("user_email must be a valid email address")
     });
@@ -13449,6 +13533,18 @@ var init_dist = __esm({
         }
       }
     });
+    adminRepairLegacyOrgGrantsBody2 = external_exports.object({
+      scope: external_exports.enum(["all", "org"]),
+      org_id: external_exports.string().uuid().optional(),
+      dry_run: external_exports.boolean().optional().default(false)
+    }).strict().superRefine((data, ctx) => {
+      if (data.scope === "org" && !data.org_id) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "scope=org requires org_id", path: ["org_id"] });
+      }
+      if (data.scope === "all" && data.org_id) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "scope=all must not include org_id", path: ["org_id"] });
+      }
+    });
     updatePricingPlanBody2 = external_exports.object({
       display_name: external_exports.string().min(1).optional(),
       stripe_product_id: external_exports.string().optional(),
@@ -14149,6 +14245,10 @@ function hubsDirLabel(gitRoot) {
   if (!gitRoot) return path.join(WAYAI_LAYOUT.wsDir, WAYAI_LAYOUT.hubsSubdir);
   return path.relative(gitRoot, resolveLayout(gitRoot).hubsDir);
 }
+function basesDirLabel(gitRoot) {
+  if (!gitRoot) return path.join(WAYAI_LAYOUT.wsDir, WAYAI_LAYOUT.basesSubdir);
+  return path.relative(gitRoot, resolveLayout(gitRoot).basesDir);
+}
 function warnLayoutOnce(gitRoot) {
   const r = resolveLayout(gitRoot);
   if (r.legacyAlsoPresent) {
@@ -14640,24 +14740,24 @@ import * as path4 from "path";
 import * as readline from "readline";
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve5(answer.trim());
+      resolve7(answer.trim());
     });
   });
 }
 function confirm(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
-      resolve5(answer.trim().toLowerCase() === "y");
+      resolve7(answer.trim().toLowerCase() === "y");
     });
   });
 }
 function promptSecret(question) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const originalWrite = rl._writeToOutput;
     let firstWrite = true;
@@ -14673,18 +14773,18 @@ function promptSecret(question) {
       rl._writeToOutput = originalWrite;
       process.stdout.write("\n");
       rl.close();
-      resolve5(answer);
+      resolve7(answer);
     });
   });
 }
 function readStdin() {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve7, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
-    process.stdin.on("end", () => resolve5(data.trim()));
+    process.stdin.on("end", () => resolve7(data.trim()));
     process.stdin.on("error", reject);
   });
 }
@@ -15123,7 +15223,7 @@ var init_registry = __esm({
         disposition: "routed",
         surviving: "pull",
         clause: null,
-        shipped: false,
+        shipped: true,
         reason: "One verb, workspace-relative, routing by subtree: `hubs/` targets preview hubs, `bases/` targets preview bases. An invocation spanning both is refused, never merged."
       },
       {
@@ -15131,7 +15231,7 @@ var init_registry = __esm({
         disposition: "routed",
         surviving: "push",
         clause: null,
-        shipped: false,
+        shipped: true,
         reason: "Same as `pull`."
       }
     ];
@@ -15150,9 +15250,9 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path31 = getVersionCachePath(filename);
-    if (!existsSync4(path31)) return null;
-    const parsed = JSON.parse(readFileSync5(path31, "utf-8"));
+    const path36 = getVersionCachePath(filename);
+    if (!existsSync4(path36)) return null;
+    const parsed = JSON.parse(readFileSync5(path36, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -15172,10 +15272,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path31 = getVersionCachePath(filename);
-  const dir = dirname3(path31);
+  const path36 = getVersionCachePath(filename);
+  const dir = dirname3(path36);
   if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(path31, JSON.stringify(cache));
+  writeFileSync2(path36, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -15214,14 +15314,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path31 = join7(projectRoot, rel);
-    if (!existsSync5(path31)) continue;
+    const path36 = join7(projectRoot, rel);
+    if (!existsSync5(path36)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path31, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path36, "utf-8"));
     } catch {
     }
-    found.push({ path: path31, version });
+    found.push({ path: path36, version });
   }
   return found;
 }
@@ -15682,7 +15782,7 @@ async function validateToken(apiUrl, token) {
   }
 }
 function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve7, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
       if (url.pathname === "/callback") {
@@ -15708,7 +15808,7 @@ function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login successful!</h2><p>You can close this tab and return to your terminal.</p></body></html>");
           server.close();
-          resolve5({ code, port });
+          resolve7({ code, port });
         } else {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login failed</h2><p>No authorization code received</p></body></html>");
@@ -15919,10 +16019,10 @@ import * as readline2 from "readline";
 function prompt2(question, defaultValue) {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     rl.question(display, (answer) => {
       rl.close();
-      resolve5(answer.trim() || defaultValue || "");
+      resolve7(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -16040,8 +16140,8 @@ async function tryOpenBrowser(url) {
       cmd = "xdg-open";
       args2 = [url];
     }
-    return new Promise((resolve5) => {
-      execFile(cmd, args2, (err) => resolve5(!err));
+    return new Promise((resolve7) => {
+      execFile(cmd, args2, (err) => resolve7(!err));
     });
   } catch {
     return false;
@@ -16801,6 +16901,15 @@ function ensureRealSubdirNoSymlink(root, target, create) {
   }
   return true;
 }
+function readFileNoFollow(root, abs) {
+  if (!ensureRealSubdirNoSymlink(root, path11.dirname(abs), false)) return null;
+  try {
+    if (!fs9.lstatSync(abs).isFile()) return null;
+    return fs9.readFileSync(abs);
+  } catch {
+    return null;
+  }
+}
 function writeFileNoFollow(root, abs, data) {
   const parent = path11.dirname(abs);
   if (!ensureRealSubdirNoSymlink(root, parent, true)) return false;
@@ -18051,155 +18160,1367 @@ var init_hub_materializer = __esm({
   }
 });
 
-// src/commands/push.ts
-var push_exports = {};
-__export(push_exports, {
-  autoRenameAgentFiles: () => autoRenameAgentFiles,
-  createAndPushNewHub: () => createAndPushNewHub,
-  printErrors: () => printErrors,
-  printLocalFileChanges: () => printLocalFileChanges,
-  printSyncResult: () => printSyncResult,
-  printWarnings: () => printWarnings,
-  pushCommand: () => pushCommand,
-  reportUnresolvedPushTarget: () => reportUnresolvedPushTarget,
-  selectExistingHub: () => selectExistingHub,
-  shouldWarnIgnoredPreviewLabel: () => shouldWarnIgnoredPreviewLabel,
-  syncAfterPush: () => syncAfterPush
+// src/lib/terminal-output.ts
+import { stripVTControlCharacters } from "util";
+function sanitizeTerminalText(value) {
+  const normalizedNewlines = value.replace(/\r\n?/g, "\n");
+  return stripVTControlCharacters(normalizedNewlines).replace(
+    /[\u0000-\u0009\u000b-\u001f\u007f-\u009f]/g,
+    ""
+  );
+}
+var init_terminal_output = __esm({
+  "src/lib/terminal-output.ts"() {
+    "use strict";
+  }
+});
+
+// src/lib/base-id.ts
+function isValidBaseId(id) {
+  return BASE_ID_RE.test(id);
+}
+var BASE_ID_RE;
+var init_base_id = __esm({
+  "src/lib/base-id.ts"() {
+    "use strict";
+    BASE_ID_RE = /^(?!\.\.?$)[A-Za-z0-9._-]{1,256}$/;
+  }
 });
+
+// src/lib/base-workspace.ts
 import * as fs14 from "fs";
 import * as path17 from "path";
 import * as yaml6 from "js-yaml";
-function parseArgs4(args2) {
-  let autoConfirm = false;
-  let hubSelector;
-  let label;
-  for (let i = 0; i < args2.length; i++) {
-    const arg = args2[i];
-    if (arg === "--yes" || arg === "-y") {
-      autoConfirm = true;
-    } else if (arg === "--hub" && args2[i + 1]) {
-      hubSelector = args2[++i];
-    } else if (arg === "--label" && args2[i + 1]) {
-      label = args2[++i];
-    }
+function readBaseMeta(folder) {
+  const bytes = readFileNoFollow(folder, path17.join(folder, BASE_META_FILE));
+  if (bytes === null) return null;
+  let doc;
+  try {
+    doc = yaml6.load(bytes.toString("utf-8"));
+  } catch {
+    return null;
   }
-  return { autoConfirm, hubSelector, label };
-}
-function shouldWarnIgnoredPreviewLabel(localLabel, serverLabel) {
-  return Boolean(localLabel) && serverLabel !== void 0 && localLabel !== serverLabel;
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return null;
+  return doc;
 }
-function printSyncResult(result) {
-  const applyErrors = result.apply_errors ?? result.errors;
-  if (applyErrors && applyErrors.length > 0) {
-    printErrors(applyErrors);
-    throw expected(`Sync failed with ${applyErrors.length} error(s). No completion was reported; inspect the errors above.`);
+function listBaseFolders(basesDir) {
+  let entries;
+  try {
+    entries = fs14.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
+  } catch {
+    return [];
   }
-  console.log(`
-Sync complete. Preview hub: ${result.preview_hub_id}`);
-  const c = result.changes;
-  const parts = [];
-  if (c.hub_updated) parts.push("hub updated");
-  if (c.connections_created > 0) parts.push(`${c.connections_created} connection(s) created`);
-  if (c.connections_updated > 0) parts.push(`${c.connections_updated} connection(s) updated`);
-  if (c.connections_deleted > 0) parts.push(`${c.connections_deleted} connection(s) deleted`);
-  if (c.agents_created > 0) parts.push(`${c.agents_created} agent(s) created`);
-  if (c.agents_updated > 0) parts.push(`${c.agents_updated} agent(s) updated`);
-  if (c.agents_deleted > 0) parts.push(`${c.agents_deleted} agent(s) deleted`);
-  if (c.tools_created > 0) parts.push(`${c.tools_created} tool(s) created`);
-  if (c.tools_updated > 0) parts.push(`${c.tools_updated} tool(s) updated`);
-  if (c.tools_deleted > 0) parts.push(`${c.tools_deleted} tool(s) deleted`);
-  if (c.states_created > 0) parts.push(`${c.states_created} state(s) created`);
-  if (c.states_updated > 0) parts.push(`${c.states_updated} state(s) updated`);
-  if (c.states_deleted > 0) parts.push(`${c.states_deleted} state(s) deleted`);
-  if (c.evals_created > 0) parts.push(`${c.evals_created} eval(s) created`);
-  if (c.evals_updated > 0) parts.push(`${c.evals_updated} eval(s) updated`);
-  if (c.evals_deleted > 0) parts.push(`${c.evals_deleted} eval(s) deleted`);
-  if (c.journeys_created > 0) parts.push(`${c.journeys_created} journey(s) created`);
-  if (c.journeys_updated > 0) parts.push(`${c.journeys_updated} journey(s) updated`);
-  if (c.journeys_deleted > 0) parts.push(`${c.journeys_deleted} journey(s) deleted`);
-  if (c.teams_created > 0) parts.push(`${c.teams_created} team(s) created`);
-  if (c.teams_updated > 0) parts.push(`${c.teams_updated} team(s) updated`);
-  if (c.teams_deleted > 0) parts.push(`${c.teams_deleted} team(s) deleted`);
-  if (c.resources_created > 0) parts.push(`${c.resources_created} resource(s) created`);
-  if (c.resources_updated > 0) parts.push(`${c.resources_updated} resource(s) updated`);
-  if (c.resources_deleted > 0) parts.push(`${c.resources_deleted} resource(s) deleted`);
-  if (c.resource_files_uploaded > 0) parts.push(`${c.resource_files_uploaded} resource file(s) uploaded`);
-  if (c.resource_files_deleted > 0) parts.push(`${c.resource_files_deleted} resource file(s) deleted`);
-  if (c.resource_links_created > 0) parts.push(`${c.resource_links_created} resource link(s) created`);
-  if (c.resource_links_updated > 0) parts.push(`${c.resource_links_updated} resource link(s) updated`);
-  if (c.resource_links_deleted > 0) parts.push(`${c.resource_links_deleted} resource link(s) deleted`);
-  if (c.outbound_contacts_created > 0) parts.push(`${c.outbound_contacts_created} outbound contact(s) created`);
-  if (c.outbound_contacts_updated > 0) parts.push(`${c.outbound_contacts_updated} outbound contact(s) updated`);
-  if (c.outbound_contacts_deleted > 0) parts.push(`${c.outbound_contacts_deleted} outbound contact(s) deleted`);
-  if (c.outbound_lists_created > 0) parts.push(`${c.outbound_lists_created} outbound list(s) created`);
-  if (c.outbound_lists_updated > 0) parts.push(`${c.outbound_lists_updated} outbound list(s) updated`);
-  if (c.outbound_lists_deleted > 0) parts.push(`${c.outbound_lists_deleted} outbound list(s) deleted`);
-  if (c.outbound_schedules_created > 0) parts.push(`${c.outbound_schedules_created} outbound schedule(s) created`);
-  if (c.outbound_schedules_updated > 0) parts.push(`${c.outbound_schedules_updated} outbound schedule(s) updated`);
-  if (c.outbound_schedules_deleted > 0) parts.push(`${c.outbound_schedules_deleted} outbound schedule(s) deleted`);
-  if (parts.length > 0) {
-    console.log(`Changes: ${parts.join(", ")}`);
+  const out = [];
+  for (const name of entries.sort()) {
+    const folder = path17.join(basesDir, name);
+    if (!isDirectory(folder)) continue;
+    const meta = readBaseMeta(folder);
+    if (meta) out.push({ folder, meta });
   }
-  if (result.warnings && result.warnings.length > 0) {
-    printWarnings(result.warnings.map((w) => w.message));
+  return out;
+}
+function isProductionFolder(meta) {
+  return meta.environment === "production";
+}
+function filterEditableBases(bases) {
+  return bases.filter((b) => !isProductionFolder(b.meta));
+}
+function isUnder(parent, child) {
+  const rel = path17.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path17.isAbsolute(rel);
+}
+function findEnclosingBaseFolder(basesDir, cwd) {
+  let dir = path17.resolve(cwd);
+  const stop = path17.resolve(basesDir);
+  while (isUnder(stop, dir)) {
+    const meta = readBaseMeta(dir);
+    if (meta) return { folder: dir, meta };
+    const parent = path17.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
+  return null;
 }
-function printWarnings(warnings) {
-  if (warnings.length === 0) return;
-  console.log(`
-\x1B[33mWarnings (${warnings.length}):\x1B[0m`);
-  for (const w of warnings) {
-    console.log(`  \x1B[33m! ${w}\x1B[0m`);
+function folderForSelector(basesDir, selector) {
+  assertValidBaseSelector(selector);
+  return path17.join(basesDir, selector);
+}
+function assertValidBaseSelector(selector, source = "base") {
+  if (!isValidBaseId(selector)) {
+    throw expected(
+      `Invalid ${source} "${selector}". Base ids are slugs \u2014 letters, digits, dot, dash and underscore only, with no path separators.`
+    );
   }
 }
-function printErrors(errors) {
-  if (errors.length === 0) return;
-  console.error(`
-\x1B[31mErrors (${errors.length}):\x1B[0m`);
-  for (const error of errors) {
-    const message = typeof error === "string" ? error : error.message;
-    console.error(`  \x1B[31m! ${message}\x1B[0m`);
+function resolveBaseTarget(gitRoot, selector, cwd = process.cwd()) {
+  const basesDir = resolveBasesDir(gitRoot);
+  if (selector) {
+    const folder = folderForSelector(basesDir, selector);
+    if (!isUnder(basesDir, folder)) {
+      throw expected(`Refusing to target ${folder}: it is outside ${basesDir}.`);
+    }
+    return { folder, exists: hasBaseMetaFile(folder), meta: readBaseMeta(folder) };
   }
+  const enclosing = findEnclosingBaseFolder(basesDir, cwd);
+  if (enclosing) return { folder: enclosing.folder, exists: true, meta: enclosing.meta };
+  const editable = filterEditableBases(listBaseFolders(basesDir));
+  if (editable.length === 1) {
+    return { folder: editable[0].folder, exists: true, meta: editable[0].meta };
+  }
+  const label = basesDirLabel(gitRoot);
+  if (editable.length === 0) {
+    throw expected(
+      `No base folders found in ${label}/. Pass a base id to fetch one for the first time (e.g. \`wayai pull bases/<base>\`).`
+    );
+  }
+  throw expected(
+    [
+      `Multiple bases found in ${label}/. Pass --base <id|folder-name> to choose, or run from inside a base folder:`,
+      ...editable.map((b) => `  ${path17.basename(b.folder)} (${b.meta.base_id ?? "not created yet"})`)
+    ].join("\n")
+  );
 }
-function printLocalFileChanges(delta) {
-  if (delta.changed.length === 0 && delta.removed.length === 0) {
-    console.log("Local files already in sync.");
-    return;
+function targetBaseId(target, selector) {
+  if (target.meta?.base_id) return target.meta.base_id;
+  if (selector && !selector.includes("/") && !selector.includes(path17.sep)) return selector;
+  return target.exists ? null : path17.basename(target.folder);
+}
+function hasBaseMetaFile(folder) {
+  try {
+    return fs14.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
+  } catch {
+    return false;
   }
-  console.log("Local files updated from server:");
-  const emit = (paths, sigil) => {
-    const sorted = [...paths].sort();
-    for (const p of sorted.slice(0, LOCAL_CHANGE_LIST_CAP)) console.log(`  ${sigil} ${p}`);
-    if (sorted.length > LOCAL_CHANGE_LIST_CAP) {
-      console.log(`  \u2026and ${sorted.length - LOCAL_CHANGE_LIST_CAP} more ${sigil === "-" ? "removed" : "changed"}`);
+}
+var BASE_META_FILE;
+var init_base_workspace = __esm({
+  "src/lib/base-workspace.ts"() {
+    "use strict";
+    init_layout();
+    init_expected();
+    init_base_id();
+    init_fs_safety();
+    BASE_META_FILE = "base.yaml";
+  }
+});
+
+// src/lib/subtree-routing.ts
+import * as fs15 from "fs";
+import * as path18 from "path";
+import * as yaml7 from "js-yaml";
+function readRepoDefaults(gitRoot) {
+  const file = path18.join(gitRoot, WAYAI_LAYOUT.wsDir, REPO_DEFAULTS_FILE);
+  let doc;
+  try {
+    doc = yaml7.load(fs15.readFileSync(file, "utf-8"));
+  } catch {
+    return {};
+  }
+  if (!doc || typeof doc !== "object") return {};
+  const raw = doc;
+  const str = (v) => {
+    if (typeof v !== "string" || !v.trim()) return void 0;
+    const value = v.trim();
+    if (value.includes("/") || value.includes(path18.sep) || value === "." || value === "..") {
+      console.warn(
+        `Warning: ignoring ${JSON.stringify(value)} in ${WAYAI_LAYOUT.wsDir}/${REPO_DEFAULTS_FILE} \u2014 a default names a hub or base, not a path.`
+      );
+      return void 0;
     }
+    return value;
   };
-  emit(delta.removed, "-");
-  emit(delta.changed, "~");
+  return { default_hub: str(raw.default_hub), default_base: str(raw.default_base) };
 }
-async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, remoteConfig) {
-  const agentsDir = path17.join(hubFolder, "agents");
-  let agentsWithIds = [];
-  if (fs14.existsSync(agentsDir)) {
-    const yamlFiles = fs14.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml"));
-    for (const file of yamlFiles) {
-      try {
-        const content = fs14.readFileSync(path17.join(agentsDir, file), "utf-8");
-        const agent = yaml6.load(content);
-        if (agent?.id && agent.name) {
-          agentsWithIds.push({ id: agent.id, name: agent.name });
-        }
-      } catch {
-        console.warn(`  Warning: could not parse agents/${file}, skipping`);
+function parseRoutingTokens(args2) {
+  const tokens = {};
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    const eq = arg.indexOf("=");
+    const name = eq === -1 ? arg : arg.slice(0, eq);
+    if (VALUE_FLAGS.has(name)) {
+      const value = eq === -1 ? args2[i + 1] : arg.slice(eq + 1);
+      if (value !== void 0) {
+        if (name === "--hub") tokens.hubFlag ??= value;
+        if (name === "--base") tokens.baseFlag ??= value;
+        if (name === "--org") tokens.orgFlag ??= value;
+        if (eq === -1) i++;
       }
+      continue;
     }
+    if (arg.startsWith("-")) continue;
+    tokens.positional ??= arg;
   }
-  if (agentsWithIds.length === 0) {
-    const yamlPath = resolveHubYamlPath(hubFolder);
-    if (!yamlPath) return;
-    const yamlContent = fs14.readFileSync(yamlPath, "utf-8");
-    const config = yaml6.load(yamlContent);
-    agentsWithIds = (config.agents || []).filter((a) => !!a.id && !!a.name);
+  return tokens;
+}
+function firstSegment(p) {
+  const normalized = p.split(path18.sep).join("/");
+  const [head] = normalized.split("/").filter(Boolean);
+  return head ?? p;
+}
+function selectorSubtree(layout, selector, cwd) {
+  const parts = selector.split(path18.sep).join("/").split("/").filter(Boolean);
+  const qualified = parts[0] === WAYAI_LAYOUT.wsDir ? parts.slice(1) : parts;
+  if (qualified.length > 1) {
+    if (qualified[0] === WAYAI_LAYOUT.hubsSubdir) return { kind: "hubs", target: qualified[1] };
+    if (qualified[0] === WAYAI_LAYOUT.basesSubdir) return { kind: "bases", target: qualified[1] };
+  }
+  if (!layout) return { kind: "unknown" };
+  const { hubsDir, basesDir } = layout;
+  if (selector.includes("/") || selector.includes(path18.sep)) {
+    const abs = path18.resolve(cwd, selector);
+    if (isUnder(hubsDir, abs)) return { kind: "hubs", target: firstSegment(path18.relative(hubsDir, abs)) };
+    if (isUnder(basesDir, abs)) return { kind: "bases", target: firstSegment(path18.relative(basesDir, abs)) };
+    return { kind: "unknown" };
+  }
+  const inHubs = isDirectory(path18.join(hubsDir, selector));
+  const inBases = isDirectory(path18.join(basesDir, selector));
+  if (inHubs && inBases) return { kind: "both", target: selector };
+  if (inHubs) return { kind: "hubs", target: selector };
+  if (inBases) return { kind: "bases", target: selector };
+  return { kind: "unknown" };
+}
+function listCandidates(layout) {
+  const hubs = [
+    ...filterPreviewHubs(scanWorkspaceHubs(layout.hubsDir)).map((h) => h.hubFolder),
+    ...scanNewHubs(layout.hubsDir).map((h) => h.hubFolder)
+  ];
+  const bases = filterEditableBases(listBaseFolders(layout.basesDir)).map((b) => b.folder);
+  return [
+    ...hubs.map((folder) => ({ subtree: "hubs", name: path18.basename(folder) })),
+    ...bases.map((folder) => ({ subtree: "bases", name: path18.basename(folder) }))
+  ];
+}
+function mixedInvocationRefusal(verb, hubTarget, baseTarget) {
+  const hub = sanitizeTerminalText(hubTarget);
+  const base = sanitizeTerminalText(baseTarget);
+  return [
+    `Refusing a mixed ${verb}: this invocation spans both subtrees.`,
+    `  ${WAYAI_LAYOUT.hubsSubdir}/  -> ${hub}`,
+    `  ${WAYAI_LAYOUT.basesSubdir}/ -> ${base}`,
+    "",
+    "Run one at a time:",
+    `  wayai ${verb} ${WAYAI_LAYOUT.hubsSubdir}/${hub}`,
+    `  wayai ${verb} ${WAYAI_LAYOUT.basesSubdir}/${base}`
+  ].join("\n");
+}
+function routeSubtree(options) {
+  const { verb, args: args2, gitRoot } = options;
+  const cwd = options.cwd ?? process.cwd();
+  const { hubFlag, baseFlag, positional, orgFlag } = parseRoutingTokens(args2);
+  if (orgFlag !== void 0) {
+    return {
+      ok: false,
+      refusal: [
+        `\`wayai ${verb}\` does not take --org: it operates on the organization named by .wayai.yaml at the repo root.`,
+        "",
+        "To act on another organization:",
+        "  wayai bases <command> --org <uuid>   # the Data surface honors it",
+        "  # or run from a checkout whose .wayai.yaml names that organization"
+      ].join("\n")
+    };
+  }
+  const layout = gitRoot ? resolveLayout(gitRoot) : null;
+  if (hubFlag !== void 0 && baseFlag !== void 0) {
+    return { ok: false, refusal: mixedInvocationRefusal(verb, hubFlag, baseFlag) };
+  }
+  const fromPositional = positional !== void 0 ? selectorSubtree(layout, positional, cwd) : void 0;
+  if (fromPositional?.kind === "both") {
+    return {
+      ok: false,
+      refusal: mixedInvocationRefusal(verb, fromPositional.target, fromPositional.target)
+    };
+  }
+  if (hubFlag !== void 0) {
+    if (fromPositional?.kind === "bases") {
+      return { ok: false, refusal: mixedInvocationRefusal(verb, hubFlag, fromPositional.target) };
+    }
+    return { ok: true, subtree: "hubs", selector: hubFlag };
+  }
+  if (baseFlag !== void 0) {
+    if (fromPositional?.kind === "hubs") {
+      return { ok: false, refusal: mixedInvocationRefusal(verb, fromPositional.target, baseFlag) };
+    }
+    return { ok: true, subtree: "bases", selector: baseFlag };
+  }
+  if (fromPositional?.kind === "hubs" || fromPositional?.kind === "bases") {
+    return { ok: true, subtree: fromPositional.kind, selector: fromPositional.target };
+  }
+  const carried = positional;
+  if (!gitRoot || !layout) return { ok: true, subtree: "hubs", selector: carried };
+  const { hubsDir, basesDir } = layout;
+  if (isUnder(hubsDir, cwd)) return { ok: true, subtree: "hubs", selector: carried };
+  if (isUnder(basesDir, cwd)) return { ok: true, subtree: "bases", selector: carried };
+  const defaults = readRepoDefaults(gitRoot);
+  if (defaults.default_hub && defaults.default_base) {
+    return {
+      ok: false,
+      refusal: mixedInvocationRefusal(verb, defaults.default_hub, defaults.default_base)
+    };
+  }
+  if (defaults.default_hub) return { ok: true, subtree: "hubs", selector: carried ?? defaults.default_hub };
+  if (defaults.default_base) return { ok: true, subtree: "bases", selector: carried ?? defaults.default_base };
+  const candidates = listCandidates(layout);
+  if (candidates.length === 1) {
+    return { ok: true, subtree: candidates[0].subtree, selector: carried };
+  }
+  const hubCandidates = candidates.filter((c) => c.subtree === "hubs");
+  const baseCandidates = candidates.filter((c) => c.subtree === "bases");
+  if (hubCandidates.length > 0 && baseCandidates.length > 0) {
+    return {
+      ok: false,
+      refusal: mixedInvocationRefusal(verb, hubCandidates[0].name, baseCandidates[0].name)
+    };
+  }
+  if (baseCandidates.length > 0) return { ok: true, subtree: "bases", selector: carried };
+  return { ok: true, subtree: "hubs", selector: carried };
+}
+function requireSubtree(verb, args2, gitRoot) {
+  const result = routeSubtree({ verb, args: args2, gitRoot });
+  if (!result.ok) {
+    console.error(result.refusal);
+    process.exit(1);
+  }
+  return { subtree: result.subtree, selector: result.selector };
+}
+var REPO_DEFAULTS_FILE, VALUE_FLAGS;
+var init_subtree_routing = __esm({
+  "src/lib/subtree-routing.ts"() {
+    "use strict";
+    init_layout();
+    init_terminal_output();
+    init_workspace();
+    init_base_workspace();
+    REPO_DEFAULTS_FILE = "wayai.yaml";
+    VALUE_FLAGS = /* @__PURE__ */ new Set(["--hub", "--base", "--label", "--org"]);
+  }
+});
+
+// src/data/org-context.ts
+function setDataOrgOverride(orgId) {
+  override = orgId;
+}
+function getDataOrgOverride() {
+  return override;
+}
+var override;
+var init_org_context = __esm({
+  "src/data/org-context.ts"() {
+    "use strict";
+  }
+});
+
+// src/data/client.ts
+async function createDataClient(orgId) {
+  const { config, accessToken } = await requireAuth();
+  const api = new ApiClient({ apiUrl: config.api_url, accessToken });
+  const selected = orgId ?? getDataOrgOverride();
+  if (selected !== void 0 && !UUID_RE2.test(selected)) {
+    throw expected(`Invalid --org: ${JSON.stringify(selected)}. Expected an organization UUID.`);
+  }
+  const org = selected ?? readRepoConfig()?.organization_id;
+  return {
+    async request(method, path36, body) {
+      const envelope = await api.dataRequest(method, path36, body, org);
+      return envelope.data;
+    },
+    async requestRaw(method, path36, body) {
+      const body_ = await api.dataRequest(method, path36, body, org);
+      return body_;
+    },
+    async collectPages(makePath) {
+      const all = [];
+      const seen = /* @__PURE__ */ new Set();
+      let cursor;
+      for (let page = 0; page < MAX_PAGES; page++) {
+        const { data, meta } = await api.dataRequest("GET", makePath(cursor), void 0, org);
+        for (const row of data ?? []) all.push(row);
+        cursor = meta?.has_more ? meta.cursor : void 0;
+        if (cursor === void 0) break;
+        if (seen.has(cursor)) break;
+        seen.add(cursor);
+      }
+      return all;
+    },
+    async upload(v1Path, bytes, contentType, headers) {
+      const envelope = await api.dataUpload(v1Path, bytes, contentType, org, headers);
+      return envelope.data;
+    },
+    download(v1Path) {
+      return api.dataDownload(v1Path, org);
+    },
+    url(v1Path) {
+      return api.dataUrl(v1Path, org);
+    }
+  };
+}
+function dataErrorEnvelope(err) {
+  if (!(err instanceof ApiError)) return null;
+  try {
+    const parsed = JSON.parse(err.body);
+    return parsed?.error ?? null;
+  } catch {
+    return null;
+  }
+}
+function dataErrorCode(err) {
+  const code = dataErrorEnvelope(err)?.code;
+  return typeof code === "string" && code ? code : null;
+}
+function dataErrorDetails(err) {
+  const details = dataErrorEnvelope(err)?.details;
+  return details && typeof details === "object" ? details : void 0;
+}
+var MAX_PAGES;
+var init_client = __esm({
+  "src/data/client.ts"() {
+    "use strict";
+    init_auth();
+    init_api_client();
+    init_repo_config();
+    init_utils();
+    init_expected();
+    init_org_context();
+    MAX_PAGES = 1e3;
+  }
+});
+
+// src/lib/base-binding.ts
+var binding2, getBaseBindingPath, readBaseBinding, writeBaseBinding, clearBaseBinding, autoBindBaseIfUnbound, assertBaseMatchesBinding, assertNoBindingBlocksBaseCreation;
+var init_base_binding = __esm({
+  "src/lib/base-binding.ts"() {
+    "use strict";
+    init_base_id();
+    init_worktree_binding();
+    binding2 = createWorktreeBinding({
+      filename: "wayai-base-binding",
+      isValidId: isValidBaseId,
+      noun: "base",
+      idLabel: "base id (must be a slug)",
+      unbindCommand: "wayai bases unbind",
+      useCommand: "wayai bases use"
+    });
+    getBaseBindingPath = binding2.getBindingPath;
+    readBaseBinding = binding2.readBinding;
+    writeBaseBinding = binding2.writeBinding;
+    clearBaseBinding = binding2.clearBinding;
+    autoBindBaseIfUnbound = binding2.autoBindIfUnbound;
+    assertBaseMatchesBinding = binding2.assertMatchesBinding;
+    assertNoBindingBlocksBaseCreation = binding2.assertNoBindingBlocksCreation;
+  }
+});
+
+// src/data/helpers.ts
+import { readFileSync as readFileSync16 } from "fs";
+function pathSegment(id, label = "id") {
+  if (!isValidBaseId(id)) {
+    throw expected(
+      `Invalid ${label}: ${JSON.stringify(id)}. Ids are slugs \u2014 letters, digits, dot, dash and underscore only.`
+    );
+  }
+  return encodeURIComponent(id);
+}
+function foreignSegment(value, label = "id") {
+  if (value === "." || value === "..") {
+    throw expected(`Invalid ${label}: ${JSON.stringify(value)} is a path traversal segment.`);
+  }
+  return encodeURIComponent(value);
+}
+function pathSegments(value, label = "path") {
+  return value.split("/").map((segment) => foreignSegment(segment, label)).join("/");
+}
+function parseData(data, flag) {
+  const prefix = flag ? `${flag}: ` : "";
+  const source = data.startsWith("@") ? data.slice(1) : void 0;
+  let text = data;
+  if (source !== void 0) {
+    try {
+      text = readFileSync16(source, "utf-8");
+    } catch (e) {
+      throw expected(`${prefix}${source}: ${e instanceof Error ? e.message : "could not be read"}`);
+    }
+  }
+  try {
+    return JSON.parse(text);
+  } catch (e) {
+    const where = source !== void 0 ? ` in ${source}` : "";
+    throw expected(`${prefix}invalid JSON${where}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+function toolsetMcpUrl(slug) {
+  return `https://data-mcp.wayai.pro/t/${slug}/mcp`;
+}
+function globals(cmd) {
+  let namespace = cmd;
+  while (namespace.parent?.parent) namespace = namespace.parent;
+  return namespace.opts();
+}
+function withBaseOption(command2) {
+  return command2.option("--base <id>", "Base id (or set WAYAI_BASE)");
+}
+function baseOptionHolder(cmd) {
+  for (let c = cmd; c; c = c.parent ?? void 0) {
+    if (c.options.some((o) => o.long === "--base")) return c;
+  }
+  return void 0;
+}
+function findBase(cmd) {
+  return baseOptionHolder(cmd)?.opts()?.base;
+}
+function requireBase(cmd) {
+  const base = findBase(cmd) ?? process.env.WAYAI_BASE ?? "";
+  if (base) return base;
+  console.error("Error: --base is required (or set WAYAI_BASE)");
+  return process.exit(1);
+}
+function outputFormat(cmd) {
+  const opts = globals(cmd);
+  return opts.json || opts.output === "json" ? "json" : "table";
+}
+function historyQuery(opts) {
+  const qs = new URLSearchParams();
+  if (opts.limit) qs.set("limit", opts.limit);
+  if (opts.offset) qs.set("offset", opts.offset);
+  if (opts.diff) qs.set("diff", "true");
+  const q = qs.toString();
+  return q ? `?${q}` : "";
+}
+function splitList(value) {
+  return value.split(",").map((v) => v.trim()).filter((v) => v.length > 0);
+}
+function parseByteCount(flag, value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 0) {
+    throw expected(`${flag} must be a whole number of bytes (0 = unlimited), not ${JSON.stringify(value)}.`);
+  }
+  return n;
+}
+async function readSecret(source, label) {
+  const value = resolveSecretSource(source) === "stdin" ? (await readStdin()).trim() : (await promptSecret(`${label}: `)).trim();
+  if (!value) throw expected(`${label} is required.`);
+  return value;
+}
+function isInteractive() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+function parseDuration(input, flag = "duration") {
+  const match = DURATION_RE.exec(input.trim());
+  const value = Number(match?.[1] ?? 0);
+  const unit = match?.[2];
+  const unitMs = unit ? DURATION_UNIT_MS[unit] : void 0;
+  if (!unitMs || value <= 0) {
+    throw expected(
+      `Invalid ${flag} ${JSON.stringify(input)} \u2014 use <number><unit> with unit s/m/h/d (e.g. 10m, 2h, 30d).`
+    );
+  }
+  return value * unitMs;
+}
+var DURATION_RE, DURATION_UNIT_MS;
+var init_helpers = __esm({
+  "src/data/helpers.ts"() {
+    "use strict";
+    init_base_id();
+    init_expected();
+    init_utils();
+    DURATION_RE = /^(\d+)([smhd])$/;
+    DURATION_UNIT_MS = {
+      s: 1e3,
+      m: 6e4,
+      h: 36e5,
+      d: 864e5
+    };
+  }
+});
+
+// src/data/config-as-code/types.ts
+var ENTITY_KINDS, ENTITY_DIRS, DEPRECATED_ENTITY_DIRS;
+var init_types2 = __esm({
+  "src/data/config-as-code/types.ts"() {
+    "use strict";
+    ENTITY_KINDS = [
+      "record_types",
+      "relationship_types",
+      "inbound_webhooks",
+      "triggers",
+      "toolsets",
+      "actions",
+      "seeds"
+    ];
+    ENTITY_DIRS = {
+      record_types: "record-types",
+      relationship_types: "relationship-types",
+      inbound_webhooks: "inbound-webhooks",
+      triggers: "triggers",
+      toolsets: "toolsets",
+      actions: "actions",
+      seeds: "seeds"
+    };
+    DEPRECATED_ENTITY_DIRS = ["endpoints", "collections", "tools"];
+  }
+});
+
+// src/data/config-as-code/config-writer.ts
+import * as fs16 from "fs";
+import * as path19 from "path";
+import * as yaml8 from "js-yaml";
+function dump4(value) {
+  return yaml8.dump(value, YAML_DUMP_OPTIONS);
+}
+function omitUndefined(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function stripRecordTypeSources(sources) {
+  if (!Array.isArray(sources)) return void 0;
+  return sources.map((raw) => {
+    const source = raw;
+    const auth = source.auth;
+    if (!auth) return source;
+    const { secret: _secret, ...restAuth } = auth;
+    return { ...source, auth: restAuth };
+  });
+}
+function toFileObject(kind, entity) {
+  const out = {};
+  for (const key of ENTITY_FIELD_ORDER[kind]) {
+    const value = kind === "record_types" && key === "sources" ? stripRecordTypeSources(entity.sources) : entity[key];
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function pruneOrphans(folder, dir, keep, log) {
+  if (!ensureRealSubdirNoSymlink(folder, dir, false)) return;
+  let entries;
+  try {
+    entries = fs16.readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const file of entries) {
+    if (!file.endsWith(".yaml") || keep.has(file)) continue;
+    const abs = path19.join(dir, file);
+    fs16.rmSync(abs);
+    log.removed.push(path19.relative(folder, abs));
+  }
+}
+function metaFileObject(meta) {
+  const out = {};
+  for (const key of META_ORDER) {
+    if (meta[key] !== void 0) out[key] = meta[key];
+  }
+  return out;
+}
+function writeBaseFolder(folder, meta, config) {
+  const delta = { changed: [], removed: [] };
+  const parent = path19.dirname(folder);
+  fs16.mkdirSync(parent, { recursive: true });
+  if (!ensureRealSubdirNoSymlink(parent, folder, true)) {
+    throw expected(
+      `Refusing to write ${folder}: the path crosses a symlink. Remove it and pull again.`
+    );
+  }
+  writeFileIfChanged(folder, path19.join(folder, BASE_META_FILE), dump4(metaFileObject(meta)), delta);
+  for (const kind of ENTITY_KINDS) {
+    const dir = path19.join(folder, ENTITY_DIRS[kind]);
+    const entities = config[kind] ?? [];
+    const keep = /* @__PURE__ */ new Set();
+    for (const raw of entities) {
+      const entity = raw;
+      const id = String(entity.id);
+      if (!isValidBaseId(id)) {
+        console.warn(`  Warning: skipping ${kind} entity with unusable id ${JSON.stringify(id)}.`);
+        continue;
+      }
+      const file = `${id}.yaml`;
+      keep.add(file);
+      writeFileIfChanged(folder, path19.join(dir, file), dump4(toFileObject(kind, entity)), delta);
+    }
+    pruneOrphans(folder, dir, keep, delta);
+  }
+  for (const deprecated of DEPRECATED_ENTITY_DIRS) {
+    const dir = path19.join(folder, deprecated);
+    if (ensureRealSubdirNoSymlink(folder, dir, false)) {
+      fs16.rmSync(dir, { recursive: true, force: true });
+    }
+  }
+  return delta;
+}
+function markProductionMirror(folder, baseId) {
+  const file = path19.join(folder, BASE_META_FILE);
+  try {
+    const body = readFileNoFollow(folder, file)?.toString("utf-8");
+    if (body === void 0 || body.startsWith(MIRROR_MARKER_PREFIX)) return;
+    const banner = `${MIRROR_MARKER_PREFIX} "${baseId}". Edits are ignored; \`wayai push\` refuses it. Edit the linked preview instead.
+`;
+    writeFileNoFollow(folder, file, Buffer.from(banner + body, "utf-8"));
+  } catch {
+  }
+}
+function ensureMirrorIgnored(folder) {
+  try {
+    writeFileNoFollow(folder, path19.join(folder, ".gitignore"), Buffer.from(MIRROR_GITIGNORE, "utf-8"));
+  } catch {
+  }
+}
+var ENTITY_FIELD_ORDER, META_ORDER, MIRROR_MARKER_PREFIX, MIRROR_GITIGNORE;
+var init_config_writer = __esm({
+  "src/data/config-as-code/config-writer.ts"() {
+    "use strict";
+    init_expected();
+    init_yaml_writer();
+    init_fs_safety();
+    init_base_workspace();
+    init_base_id();
+    init_types2();
+    ENTITY_FIELD_ORDER = {
+      record_types: ["id", "name", "description", "icon", "color", "json_schema", "ui", "sources"],
+      relationship_types: [
+        "id",
+        "description",
+        "data_schema",
+        "source_record_types",
+        "target_record_types",
+        "cascade"
+      ],
+      inbound_webhooks: [
+        "id",
+        "name",
+        "record_type_scope",
+        "field_mapping",
+        "source_binding",
+        "ingest_auth",
+        "hydration",
+        "enabled"
+      ],
+      triggers: [
+        "id",
+        "name",
+        "action",
+        "url",
+        "events",
+        "record_type_scope",
+        "filter",
+        "skip_inbound_webhook_writes",
+        "skip_cascade_writes",
+        "enabled"
+      ],
+      toolsets: ["id", "name", "description", "actions", "relationships", "batch", "sql_query"],
+      actions: [
+        "id",
+        "record_type",
+        "operation",
+        "steps",
+        "description",
+        "external_source",
+        "writable_fields",
+        "precondition",
+        "binding",
+        "filterable_fields",
+        "expose_filter",
+        "expose_sort",
+        "default_sort",
+        "expose_limit",
+        "default_limit",
+        "expose_offset",
+        "expose_fields",
+        "default_fields",
+        "agent_minimal",
+        "base_filter"
+      ],
+      seeds: ["id", "description", "records", "relationships", "exclusive_record_types"]
+    };
+    META_ORDER = [
+      "base_id",
+      "origin_base_id",
+      "name",
+      "description",
+      "environment",
+      "integrations",
+      "analytics"
+    ];
+    MIRROR_MARKER_PREFIX = "# Read-only mirror of production base";
+    MIRROR_GITIGNORE = "*\n";
+  }
+});
+
+// src/data/config-as-code/api.ts
+function metaFromRecord(record, fallbackId) {
+  return omitUndefined({
+    base_id: record.id ?? fallbackId,
+    origin_base_id: record.origin_base_id ?? void 0,
+    name: record.name,
+    description: record.description,
+    environment: record.environment,
+    integrations: record.integrations,
+    analytics: record.analytics
+  });
+}
+function getBaseRecord(client, id) {
+  return client.request("GET", `/v1/bases/${pathSegment(id, "base id")}`);
+}
+function getConfig(client, id) {
+  return client.request("GET", `/v1/${pathSegment(id, "base id")}/config`);
+}
+function diffConfig(client, id, local) {
+  return client.request("POST", `/v1/${pathSegment(id, "base id")}/config/diff`, local);
+}
+function applyConfig(client, id, local) {
+  return client.request("PUT", `/v1/${pathSegment(id, "base id")}/config`, local);
+}
+function createPreview(client, originId, opts) {
+  return client.requestRaw("POST", `/v1/${pathSegment(originId, "origin base id")}/preview`, {
+    name: opts.name,
+    ...opts.description ? { description: opts.description } : {},
+    // The tier is create-only, so this call is the ONLY chance to honor a tier
+    // the folder declares. Omitted when absent so the clone default applies.
+    ...opts.analytics ? { analytics: opts.analytics } : {}
+  });
+}
+function deleteEntity(client, baseId, kind, id) {
+  return client.request(
+    "DELETE",
+    `/v1/${pathSegment(baseId, "base id")}/${ENTITY_DIRS[kind]}/${pathSegment(id, `${kind} id`)}`
+  );
+}
+var init_api = __esm({
+  "src/data/config-as-code/api.ts"() {
+    "use strict";
+    init_helpers();
+    init_config_writer();
+    init_types2();
+  }
+});
+
+// src/data/config-as-code/config-parser.ts
+import * as fs17 from "fs";
+import * as path20 from "path";
+import * as yaml9 from "js-yaml";
+function readEntityDir(folder, dir) {
+  if (!ensureRealSubdirNoSymlink(folder, dir, false)) {
+    throw expected(`Refusing to read ${dir}: it is a symlink, not a config directory.`);
+  }
+  if (!isDirectory(dir)) return [];
+  const out = [];
+  for (const file of fs17.readdirSync(dir).sort()) {
+    if (!file.endsWith(".yaml")) continue;
+    const abs = path20.join(dir, file);
+    const bytes = readFileNoFollow(folder, abs);
+    if (bytes === null) {
+      throw expected(`Refusing to read ${abs}: it is a symlink, not a config file.`);
+    }
+    let parsed;
+    try {
+      parsed = yaml9.load(bytes.toString("utf-8"));
+    } catch (err) {
+      throw expected(`Failed to parse ${abs}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw expected(`${abs} is empty or not a YAML object`);
+    }
+    const entity = parsed;
+    const stem = path20.basename(file, ".yaml");
+    if (entity.id === void 0) entity.id = stem;
+    else if (String(entity.id) !== stem) {
+      throw expected(`${abs}: id "${String(entity.id)}" does not match filename "${stem}.yaml"`);
+    }
+    out.push(entity);
+  }
+  return out;
+}
+function parseBaseFolder(folder) {
+  const meta = readBaseMeta(folder);
+  if (!meta) {
+    throw expected(
+      hasBaseMetaFile(folder) ? `${path20.join(folder, BASE_META_FILE)} could not be parsed as a YAML mapping. Fix it, or delete it and pull again.` : `No ${BASE_META_FILE} found in ${folder}`
+    );
+  }
+  const read = (kind) => readEntityDir(folder, path20.join(folder, ENTITY_DIRS[kind]));
+  const config = {
+    record_types: read("record_types"),
+    relationship_types: read("relationship_types"),
+    inbound_webhooks: read("inbound_webhooks"),
+    triggers: read("triggers"),
+    toolsets: read("toolsets"),
+    actions: read("actions"),
+    seeds: read("seeds")
+  };
+  return { meta, config };
+}
+var init_config_parser = __esm({
+  "src/data/config-as-code/config-parser.ts"() {
+    "use strict";
+    init_expected();
+    init_layout();
+    init_fs_safety();
+    init_base_workspace();
+    init_types2();
+  }
+});
+
+// src/data/config-as-code/diff-format.ts
+function bucket(diff, kind) {
+  return diff[kind];
+}
+function isEmptyBucket(b) {
+  return !b || b.added.length === 0 && b.modified.length === 0 && b.removed.length === 0;
+}
+function isDiffEmpty(diff) {
+  return ENTITY_KINDS.every((kind) => isEmptyBucket(bucket(diff, kind)));
+}
+function collectRemovals(diff) {
+  const out = [];
+  for (const kind of ENTITY_KINDS) {
+    for (const entity of bucket(diff, kind)?.removed ?? []) out.push({ kind, id: entity.id });
+  }
+  return out;
+}
+function countChanges(diff) {
+  let added = 0;
+  let modified = 0;
+  let removed = 0;
+  for (const kind of ENTITY_KINDS) {
+    const b = bucket(diff, kind);
+    if (!b) continue;
+    added += b.added.length;
+    modified += b.modified.length;
+    removed += b.removed.length;
+  }
+  return { added, modified, removed };
+}
+function renderDiff(diff) {
+  const lines = [];
+  for (const kind of ENTITY_KINDS) {
+    const b = bucket(diff, kind);
+    if (!b || isEmptyBucket(b)) continue;
+    lines.push(`${BOLD}${LABELS[kind]}s${RESET}`);
+    for (const e of b.added) lines.push(`${GREEN}  + ${sanitizeTerminalText(e.id)}${RESET}`);
+    for (const m of b.modified) lines.push(`${YELLOW}  ~ ${sanitizeTerminalText(m.after.id)}${RESET}`);
+    for (const e of b.removed) lines.push(`${RED}  - ${sanitizeTerminalText(e.id)}${RESET}`);
+  }
+  const { added, modified, removed } = countChanges(diff);
+  lines.push("");
+  lines.push(
+    `${GREEN}${added} added${RESET}, ${YELLOW}${modified} modified${RESET}, ${RED}${removed} removed${RESET}`
+  );
+  if (removed > 0) {
+    lines.push(
+      `${RED}  ${removed} entit${removed === 1 ? "y" : "ies"} exist on the base but not in your files \u2014 re-run with --prune to delete (record types cascade to their records).${RESET}`
+    );
+  }
+  return lines.join("\n");
+}
+var LABELS, GREEN, YELLOW, RED, BOLD, RESET;
+var init_diff_format = __esm({
+  "src/data/config-as-code/diff-format.ts"() {
+    "use strict";
+    init_terminal_output();
+    init_types2();
+    LABELS = {
+      record_types: "record type",
+      relationship_types: "relationship type",
+      inbound_webhooks: "inbound webhook",
+      triggers: "trigger",
+      toolsets: "toolset",
+      actions: "action",
+      seeds: "seed"
+    };
+    GREEN = "\x1B[32m";
+    YELLOW = "\x1B[33m";
+    RED = "\x1B[31m";
+    BOLD = "\x1B[1m";
+    RESET = "\x1B[0m";
+  }
+});
+
+// src/data/config-as-code/sync.ts
+var sync_exports = {};
+__export(sync_exports, {
+  pullBase: () => pullBase,
+  pushBase: () => pushBase
+});
+import * as path21 from "path";
+function parseArgs4(args2) {
+  return {
+    autoConfirm: args2.includes("--yes") || args2.includes("-y"),
+    dryRun: args2.includes("--dry-run"),
+    prune: args2.includes("--prune")
+  };
+}
+function requireGitRoot(gitRoot) {
+  if (!gitRoot) throw expected("Not inside a git repository.");
+  return gitRoot;
+}
+async function writeProductionMirror(client, basesDir, prodId, record) {
+  if (!isValidBaseId(prodId)) {
+    throw expected(`Refusing to mirror base ${JSON.stringify(prodId)}: not a usable base id.`);
+  }
+  const config = await getConfig(client, prodId);
+  const folder = path21.join(basesDir, prodId);
+  writeBaseFolder(folder, { ...metaFromRecord(record, prodId), environment: "production" }, config);
+  markProductionMirror(folder, prodId);
+  ensureMirrorIgnored(folder);
+  return folder;
+}
+async function mirrorLinkedProduction(client, basesDir, originId) {
+  try {
+    const record = await getBaseRecord(client, originId);
+    if (record.environment !== "production") return;
+    const folder = await writeProductionMirror(client, basesDir, originId, record);
+    console.log(`Mirrored production base \u2192 ${folder} (read-only, git-ignored)`);
+  } catch (err) {
+    console.warn(
+      `Warning: could not mirror the production base (${err instanceof Error ? err.message : String(err)}). The preview pull is unaffected.`
+    );
+  }
+}
+async function pullBase(gitRootOrNull, selector, args2) {
+  const { autoConfirm } = parseArgs4(args2);
+  const gitRoot = requireGitRoot(gitRootOrNull);
+  const target = resolveBaseTarget(gitRoot, selector);
+  const basesDir = resolveBasesDir(gitRoot);
+  const baseId = targetBaseId(target, selector);
+  if (!baseId) {
+    throw expected(
+      `Could not determine the base id for ${target.folder}. Pass the base id explicitly.`
+    );
+  }
+  const client = await createDataClient();
+  console.log("Fetching base configuration...");
+  const record = await getBaseRecord(client, baseId);
+  if (record.environment === "production") {
+    const folder = await writeProductionMirror(client, basesDir, record.id ?? baseId, record);
+    console.log(`Production base mirrored (read-only) \u2192 ${folder}`);
+    return;
+  }
+  assertBaseMatchesBinding(baseId);
+  if (target.exists && !autoConfirm) {
+    const ok = await confirm(
+      `Overwrite local files in ${path21.relative(gitRoot, target.folder)} with the server config for "${sanitizeTerminalText(baseId)}"?`
+    );
+    if (!ok) {
+      console.log("Cancelled.");
+      return;
+    }
+  }
+  const config = await getConfig(client, baseId);
+  const isFirstPull = !target.exists;
+  const delta = writeBaseFolder(target.folder, metaFromRecord(record, baseId), config);
+  console.log(`Base configuration written to ${target.folder}`);
+  console.log(
+    `  ${ENTITY_KINDS.map((kind) => `${(config[kind] ?? []).length} ${kind}`).join(", ")}`
+  );
+  if (!isFirstPull) printLocalFileChanges(delta);
+  console.log("  Secrets are not written. Manage them with `wayai bases secrets`.");
+  autoBindBaseIfUnbound(baseId);
+  if (record.origin_base_id) {
+    await mirrorLinkedProduction(client, basesDir, record.origin_base_id);
+  }
+}
+function printLintWarnings(warnings) {
+  if (!warnings || warnings.length === 0) return;
+  const word = warnings.length === 1 ? "suggestion" : "suggestions";
+  console.error(`
+${YELLOW}Tool design \u2014 ${warnings.length} ${word} (advisory, not blocking):${RESET}`);
+  for (const w of warnings) {
+    console.error(
+      `  ${sanitizeTerminalText(w.action)} [${sanitizeTerminalText(w.rule)}]
+    ${sanitizeTerminalText(w.message)}`
+    );
+  }
+}
+async function createDeclaredPreview(client, target, parsed, autoConfirm) {
+  const { meta, config } = parsed;
+  if (!meta.origin_base_id) {
+    throw expected(
+      "base.yaml needs a base_id (an existing preview) or an origin_base_id (to create one)."
+    );
+  }
+  const name = meta.name ?? path21.basename(target.folder);
+  assertNoBindingBlocksBaseCreation(name);
+  if (!autoConfirm) {
+    const ok = await confirm(
+      `Create a new preview "${sanitizeTerminalText(name)}" from "${sanitizeTerminalText(meta.origin_base_id)}"?`
+    );
+    if (!ok) {
+      console.log("Cancelled.");
+      return null;
+    }
+  }
+  const record = await createPreview(client, meta.origin_base_id, {
+    name,
+    description: meta.description,
+    analytics: meta.analytics
+  });
+  const id = record.id;
+  writeBaseFolder(target.folder, { ...meta, ...metaFromRecord(record, id) }, config);
+  console.log(`Created preview "${sanitizeTerminalText(id)}".`);
+  printWarnings((record.warnings ?? []).map((w) => sanitizeTerminalText(w.message)));
+  autoBindBaseIfUnbound(id);
+  return id;
+}
+async function pushBase(gitRootOrNull, selector, args2) {
+  const { autoConfirm, dryRun, prune } = parseArgs4(args2);
+  const gitRoot = requireGitRoot(gitRootOrNull);
+  const target = resolveBaseTarget(gitRoot, selector);
+  if (!target.exists) {
+    throw expected(
+      `No base.yaml in ${target.folder}. Pull an existing preview, or scaffold a folder with origin_base_id set to create one.`
+    );
+  }
+  const parsed = parseBaseFolder(target.folder);
+  const { meta, config } = parsed;
+  if (isProductionFolder(meta)) {
+    throw expected(
+      `${path21.relative(gitRoot, target.folder)} is a read-only production mirror. Push operates on previews \u2014 edit the linked preview and promote with \`wayai bases promote\`.`
+    );
+  }
+  if (!meta.base_id && dryRun) {
+    console.log(
+      `Dry run \u2014 nothing applied. ${path21.relative(gitRoot, target.folder)} has no base_id yet, so a real push would first create a preview from "${sanitizeTerminalText(meta.origin_base_id ?? "<origin_base_id>")}".`
+    );
+    return;
+  }
+  const client = await createDataClient();
+  let baseId = meta.base_id;
+  if (!baseId) {
+    const created = await createDeclaredPreview(client, target, parsed, autoConfirm);
+    if (!created) return;
+    baseId = created;
+  } else {
+    const record = await getBaseRecord(client, baseId);
+    if (record.environment && record.environment !== "preview") {
+      throw expected(
+        `"${sanitizeTerminalText(baseId)}" is a ${sanitizeTerminalText(record.environment)} base. Push operates on previews \u2014 promote with \`wayai bases promote\`.`
+      );
+    }
+    assertBaseMatchesBinding(baseId);
+  }
+  const diff = await diffConfig(client, baseId, config);
+  printLintWarnings(diff.warnings);
+  if (isDiffEmpty(diff)) {
+    console.log(`No changes \u2014 preview "${sanitizeTerminalText(baseId)}" already matches your files.`);
+    if (!dryRun) autoBindBaseIfUnbound(baseId);
+    return;
+  }
+  console.log(renderDiff(diff));
+  if (dryRun) {
+    console.log("\nDry run \u2014 nothing applied.");
+    return;
+  }
+  if (!autoConfirm) {
+    const ok = await confirm(`
+Apply these changes to preview "${sanitizeTerminalText(baseId)}"?`);
+    if (!ok) {
+      console.log("Cancelled.");
+      return;
+    }
+  }
+  const result = await applyConfig(client, baseId, config);
+  const secretGroups = [
+    ["trigger", result.new_trigger_secrets],
+    ["inbound webhook", result.new_inbound_webhook_secrets]
+  ];
+  if (secretGroups.some(([, map]) => map && Object.keys(map).length > 0)) {
+    console.log(`
+${YELLOW}New secrets (shown once \u2014 save them now):${RESET}`);
+    for (const [kind, map] of secretGroups) {
+      for (const [id, secret] of Object.entries(map ?? {})) {
+        console.log(`  ${kind} ${sanitizeTerminalText(id)}: ${secret}`);
+      }
+    }
+  }
+  const removals = collectRemovals(diff);
+  if (removals.length > 0) {
+    const word = removals.length === 1 ? "entity" : "entities";
+    if (!prune) {
+      console.log(
+        `
+${RED}${removals.length} ${word} not in your files were left on the base. Re-run with --prune to delete.${RESET}`
+      );
+    } else if (autoConfirm || await confirm(
+      `
+Delete ${removals.length} server ${word} not in your files? Record types cascade to their records.`
+    )) {
+      for (const removal of removals) {
+        await deleteEntity(client, baseId, removal.kind, removal.id);
+        console.log(`  - deleted ${removal.kind} ${sanitizeTerminalText(removal.id)}`);
+      }
+    } else {
+      console.log("Skipped deletions.");
+    }
+  }
+  console.log(`
+Pushed to preview "${sanitizeTerminalText(baseId)}".`);
+  autoBindBaseIfUnbound(baseId);
+}
+var init_sync = __esm({
+  "src/data/config-as-code/sync.ts"() {
+    "use strict";
+    init_client();
+    init_utils();
+    init_expected();
+    init_layout();
+    init_terminal_output();
+    init_base_id();
+    init_push();
+    init_base_binding();
+    init_api();
+    init_config_parser();
+    init_config_writer();
+    init_diff_format();
+    init_base_workspace();
+    init_types2();
+  }
+});
+
+// src/commands/push.ts
+var push_exports = {};
+__export(push_exports, {
+  autoRenameAgentFiles: () => autoRenameAgentFiles,
+  createAndPushNewHub: () => createAndPushNewHub,
+  printErrors: () => printErrors,
+  printLocalFileChanges: () => printLocalFileChanges,
+  printSyncResult: () => printSyncResult,
+  printWarnings: () => printWarnings,
+  pushCommand: () => pushCommand,
+  reportUnresolvedPushTarget: () => reportUnresolvedPushTarget,
+  selectExistingHub: () => selectExistingHub,
+  shouldWarnIgnoredPreviewLabel: () => shouldWarnIgnoredPreviewLabel,
+  syncAfterPush: () => syncAfterPush
+});
+import * as fs18 from "fs";
+import * as path22 from "path";
+import * as yaml10 from "js-yaml";
+function parseArgs5(args2) {
+  let autoConfirm = false;
+  let label;
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--yes" || arg === "-y") {
+      autoConfirm = true;
+    } else if (arg === "--label" && args2[i + 1]) {
+      label = args2[++i];
+    }
+  }
+  return { autoConfirm, label };
+}
+function shouldWarnIgnoredPreviewLabel(localLabel, serverLabel) {
+  return Boolean(localLabel) && serverLabel !== void 0 && localLabel !== serverLabel;
+}
+function printSyncResult(result) {
+  const applyErrors = result.apply_errors ?? result.errors;
+  if (applyErrors && applyErrors.length > 0) {
+    printErrors(applyErrors);
+    throw expected(`Sync failed with ${applyErrors.length} error(s). No completion was reported; inspect the errors above.`);
+  }
+  console.log(`
+Sync complete. Preview hub: ${result.preview_hub_id}`);
+  const c = result.changes;
+  const parts = [];
+  if (c.hub_updated) parts.push("hub updated");
+  if (c.connections_created > 0) parts.push(`${c.connections_created} connection(s) created`);
+  if (c.connections_updated > 0) parts.push(`${c.connections_updated} connection(s) updated`);
+  if (c.connections_deleted > 0) parts.push(`${c.connections_deleted} connection(s) deleted`);
+  if (c.agents_created > 0) parts.push(`${c.agents_created} agent(s) created`);
+  if (c.agents_updated > 0) parts.push(`${c.agents_updated} agent(s) updated`);
+  if (c.agents_deleted > 0) parts.push(`${c.agents_deleted} agent(s) deleted`);
+  if (c.tools_created > 0) parts.push(`${c.tools_created} tool(s) created`);
+  if (c.tools_updated > 0) parts.push(`${c.tools_updated} tool(s) updated`);
+  if (c.tools_deleted > 0) parts.push(`${c.tools_deleted} tool(s) deleted`);
+  if (c.states_created > 0) parts.push(`${c.states_created} state(s) created`);
+  if (c.states_updated > 0) parts.push(`${c.states_updated} state(s) updated`);
+  if (c.states_deleted > 0) parts.push(`${c.states_deleted} state(s) deleted`);
+  if (c.evals_created > 0) parts.push(`${c.evals_created} eval(s) created`);
+  if (c.evals_updated > 0) parts.push(`${c.evals_updated} eval(s) updated`);
+  if (c.evals_deleted > 0) parts.push(`${c.evals_deleted} eval(s) deleted`);
+  if (c.journeys_created > 0) parts.push(`${c.journeys_created} journey(s) created`);
+  if (c.journeys_updated > 0) parts.push(`${c.journeys_updated} journey(s) updated`);
+  if (c.journeys_deleted > 0) parts.push(`${c.journeys_deleted} journey(s) deleted`);
+  if (c.teams_created > 0) parts.push(`${c.teams_created} team(s) created`);
+  if (c.teams_updated > 0) parts.push(`${c.teams_updated} team(s) updated`);
+  if (c.teams_deleted > 0) parts.push(`${c.teams_deleted} team(s) deleted`);
+  if (c.resources_created > 0) parts.push(`${c.resources_created} resource(s) created`);
+  if (c.resources_updated > 0) parts.push(`${c.resources_updated} resource(s) updated`);
+  if (c.resources_deleted > 0) parts.push(`${c.resources_deleted} resource(s) deleted`);
+  if (c.resource_files_uploaded > 0) parts.push(`${c.resource_files_uploaded} resource file(s) uploaded`);
+  if (c.resource_files_deleted > 0) parts.push(`${c.resource_files_deleted} resource file(s) deleted`);
+  if (c.resource_links_created > 0) parts.push(`${c.resource_links_created} resource link(s) created`);
+  if (c.resource_links_updated > 0) parts.push(`${c.resource_links_updated} resource link(s) updated`);
+  if (c.resource_links_deleted > 0) parts.push(`${c.resource_links_deleted} resource link(s) deleted`);
+  if (c.outbound_contacts_created > 0) parts.push(`${c.outbound_contacts_created} outbound contact(s) created`);
+  if (c.outbound_contacts_updated > 0) parts.push(`${c.outbound_contacts_updated} outbound contact(s) updated`);
+  if (c.outbound_contacts_deleted > 0) parts.push(`${c.outbound_contacts_deleted} outbound contact(s) deleted`);
+  if (c.outbound_lists_created > 0) parts.push(`${c.outbound_lists_created} outbound list(s) created`);
+  if (c.outbound_lists_updated > 0) parts.push(`${c.outbound_lists_updated} outbound list(s) updated`);
+  if (c.outbound_lists_deleted > 0) parts.push(`${c.outbound_lists_deleted} outbound list(s) deleted`);
+  if (c.outbound_schedules_created > 0) parts.push(`${c.outbound_schedules_created} outbound schedule(s) created`);
+  if (c.outbound_schedules_updated > 0) parts.push(`${c.outbound_schedules_updated} outbound schedule(s) updated`);
+  if (c.outbound_schedules_deleted > 0) parts.push(`${c.outbound_schedules_deleted} outbound schedule(s) deleted`);
+  if (parts.length > 0) {
+    console.log(`Changes: ${parts.join(", ")}`);
+  }
+  if (result.warnings && result.warnings.length > 0) {
+    printWarnings(result.warnings.map((w) => w.message));
+  }
+}
+function printWarnings(warnings) {
+  if (warnings.length === 0) return;
+  console.log(`
+\x1B[33mWarnings (${warnings.length}):\x1B[0m`);
+  for (const w of warnings) {
+    console.log(`  \x1B[33m! ${w}\x1B[0m`);
+  }
+}
+function printErrors(errors) {
+  if (errors.length === 0) return;
+  console.error(`
+\x1B[31mErrors (${errors.length}):\x1B[0m`);
+  for (const error of errors) {
+    const message = typeof error === "string" ? error : error.message;
+    console.error(`  \x1B[31m! ${message}\x1B[0m`);
+  }
+}
+function printLocalFileChanges(delta) {
+  if (delta.changed.length === 0 && delta.removed.length === 0) {
+    console.log("Local files already in sync.");
+    return;
+  }
+  console.log("Local files updated from server:");
+  const emit = (paths, sigil) => {
+    const sorted = [...paths].sort();
+    for (const p of sorted.slice(0, LOCAL_CHANGE_LIST_CAP)) console.log(`  ${sigil} ${p}`);
+    if (sorted.length > LOCAL_CHANGE_LIST_CAP) {
+      console.log(`  \u2026and ${sorted.length - LOCAL_CHANGE_LIST_CAP} more ${sigil === "-" ? "removed" : "changed"}`);
+    }
+  };
+  emit(delta.removed, "-");
+  emit(delta.changed, "~");
+}
+async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, remoteConfig) {
+  const agentsDir = path22.join(hubFolder, "agents");
+  let agentsWithIds = [];
+  if (fs18.existsSync(agentsDir)) {
+    const yamlFiles = fs18.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml"));
+    for (const file of yamlFiles) {
+      try {
+        const content = fs18.readFileSync(path22.join(agentsDir, file), "utf-8");
+        const agent = yaml10.load(content);
+        if (agent?.id && agent.name) {
+          agentsWithIds.push({ id: agent.id, name: agent.name });
+        }
+      } catch {
+        console.warn(`  Warning: could not parse agents/${file}, skipping`);
+      }
+    }
+  }
+  if (agentsWithIds.length === 0) {
+    const yamlPath = resolveHubYamlPath(hubFolder);
+    if (!yamlPath) return;
+    const yamlContent = fs18.readFileSync(yamlPath, "utf-8");
+    const config = yaml10.load(yamlContent);
+    agentsWithIds = (config.agents || []).filter((a) => !!a.id && !!a.name);
   }
   if (agentsWithIds.length === 0) return;
   console.log("Checking for agent renames...");
@@ -18229,18 +19550,18 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     }
   }
   if (renames.length === 0) return;
-  if (!fs14.existsSync(agentsDir)) return;
-  for (const file of fs14.readdirSync(agentsDir)) {
+  if (!fs18.existsSync(agentsDir)) return;
+  for (const file of fs18.readdirSync(agentsDir)) {
     if (file.startsWith("__rename_temp_") && (file.endsWith(".md") || file.endsWith(".yaml"))) {
       console.warn(`  Warning: removing orphaned temp file agents/${file}`);
-      fs14.unlinkSync(path17.join(agentsDir, file));
+      fs18.unlinkSync(path22.join(agentsDir, file));
     }
   }
   const renameFileIfExists = (dir, oldName, newName) => {
-    const oldPath = path17.join(dir, oldName);
-    const newPath = path17.join(dir, newName);
-    if (!fs14.existsSync(oldPath)) return false;
-    fs14.renameSync(oldPath, newPath);
+    const oldPath = path22.join(dir, oldName);
+    const newPath = path22.join(dir, newName);
+    if (!fs18.existsSync(oldPath)) return false;
+    fs18.renameSync(oldPath, newPath);
     return true;
   };
   const oldSlugs = new Set(renames.map((r) => r.oldSlug));
@@ -18273,9 +19594,9 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     }
   } else {
     for (const { oldSlug, newSlug } of renames) {
-      const hasOldFile = extensions.some((ext) => fs14.existsSync(path17.join(agentsDir, `${oldSlug}${ext}`)));
+      const hasOldFile = extensions.some((ext) => fs18.existsSync(path22.join(agentsDir, `${oldSlug}${ext}`)));
       if (!hasOldFile) continue;
-      const hasNewFile = extensions.some((ext) => fs14.existsSync(path17.join(agentsDir, `${newSlug}${ext}`)));
+      const hasNewFile = extensions.some((ext) => fs18.existsSync(path22.join(agentsDir, `${newSlug}${ext}`)));
       if (hasNewFile) {
         console.warn(`  Warning: skipping rename agents/${oldSlug}.* \u2192 agents/${newSlug}.* (target already exists)`);
         continue;
@@ -18290,7 +19611,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
   if (completedRenames.length === 0) return;
   const mainYamlPath = resolveHubYamlPath(hubFolder);
   if (mainYamlPath) {
-    const mainYamlContent = fs14.readFileSync(mainYamlPath, "utf-8");
+    const mainYamlContent = fs18.readFileSync(mainYamlPath, "utf-8");
     const substitutionMap = /* @__PURE__ */ new Map();
     for (const { oldSlug, newSlug } of completedRenames) {
       substitutionMap.set(`agents/${oldSlug}.md`, `agents/${newSlug}.md`);
@@ -18301,8 +19622,8 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
       (_match, prefix, pathMatch) => `${prefix}${substitutionMap.get(pathMatch) ?? pathMatch}`
     );
     if (updatedYaml !== mainYamlContent) {
-      fs14.writeFileSync(mainYamlPath, updatedYaml, "utf-8");
-      console.log(`  Updated instructions paths in ${path17.basename(mainYamlPath)}`);
+      fs18.writeFileSync(mainYamlPath, updatedYaml, "utf-8");
+      console.log(`  Updated instructions paths in ${path22.basename(mainYamlPath)}`);
     }
   }
 }
@@ -18370,7 +19691,7 @@ async function pushSingleHub(client, hubId, hubFolder, autoConfirm, organization
 function selectExistingHub(workspaceDir, allHubs, selector, wsLabel) {
   if (selector) {
     const match = allHubs.find(
-      (h) => h.hubId === selector || path17.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path22.basename(h.hubFolder) === selector
     );
     if (!match) {
       console.error(`No hub matching --hub ${selector} found in ${wsLabel}/.`);
@@ -18413,7 +19734,7 @@ New hub: "${newHub.hubName}" (${hubType})`);
     process.exit(1);
   }
   console.log(`Hub created: ${createdHub.hub_name} (${hubId})`);
-  const content = fs14.readFileSync(hubYamlPath, "utf-8");
+  const content = fs18.readFileSync(hubYamlPath, "utf-8");
   const hasVersion = content.match(/^version:\s/m);
   let updated;
   if (hasVersion) {
@@ -18429,7 +19750,7 @@ hub_id: "${hubId}"
 hub_environment: preview
 ${content}`;
   }
-  fs14.writeFileSync(hubYamlPath, updated, "utf-8");
+  fs18.writeFileSync(hubYamlPath, updated, "utf-8");
   autoBindIfUnbound(hubId);
   await pushSingleHub(client, hubId, newHub.hubFolder, opts.autoConfirm, opts.organizationId, { skipAgentRename: true });
 }
@@ -18438,7 +19759,7 @@ function reportUnresolvedPushTarget(reason, existingHubs, newHubs, selector, wsL
     if (existingHubs.length > 0) {
       console.error(`No pushable hub found in ${wsLabel}/ \u2014 only read-only production mirror folder(s). Edit the linked preview hub, pull one, or create a new hub with \`wayai create\`:`);
       for (const h of existingHubs) {
-        console.error(`  ${path17.basename(h.hubFolder)} (${h.hubId}, production mirror)`);
+        console.error(`  ${path22.basename(h.hubFolder)} (${h.hubId}, production mirror)`);
       }
     } else {
       console.error(`No hub folders found. Create hub files in ${wsLabel}/<hub>/hub.yaml with \`hub: { name: ... }\` and run \`wayai push\` (or \`wayai create\`).`);
@@ -18446,34 +19767,41 @@ function reportUnresolvedPushTarget(reason, existingHubs, newHubs, selector, wsL
     process.exit(1);
   }
   if (reason === "selector_miss") {
-    console.error(`No hub matching --hub ${selector} found in ${wsLabel}/. Available:`);
+    console.error(`No hub matching "${selector}" found in ${wsLabel}/. Available:`);
   } else {
     console.error(`Multiple hub folders found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
   }
   for (const h of existingHubs) {
-    console.error(`  ${path17.basename(h.hubFolder)} (${h.hubId})`);
+    console.error(`  ${path22.basename(h.hubFolder)} (${h.hubId})`);
   }
   for (const h of newHubs) {
-    console.error(`  ${path17.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
+    console.error(`  ${path22.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
   }
   process.exit(1);
 }
 async function pushCommand(args2) {
-  const { autoConfirm, hubSelector, label } = parseArgs4(args2);
+  const gitRoot = findGitRoot();
+  const route = requireSubtree("push", args2, gitRoot);
+  if (gitRoot) warnLayoutOnce(gitRoot);
+  if (route.subtree === "bases") {
+    const { pushBase: pushBase2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
+    await pushBase2(gitRoot, route.selector, args2);
+    return;
+  }
+  const { autoConfirm, label } = parseArgs5(args2);
+  const hubSelector = route.selector;
   const repoConfig = requireRepoConfig();
   const { organization_id: organizationId } = repoConfig;
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   const workspaceDir = resolveWorkspaceDir();
-  const gitRoot = findGitRoot();
   const wsLabel = hubsDirLabel(gitRoot);
-  if (gitRoot) warnLayoutOnce(gitRoot);
   if (gitRoot) {
     for (const file of ensureWorkspaceFiles(gitRoot)) {
       console.error(`Created ${file}`);
     }
   }
-  if (!fs14.existsSync(workspaceDir)) {
+  if (!fs18.existsSync(workspaceDir)) {
     console.error(`No ${wsLabel}/ directory found. Run \`wayai pull\` first or create hub files in ${wsLabel}/<hub>/hub.yaml.`);
     process.exit(1);
   }
@@ -18492,8 +19820,8 @@ async function pushCommand(args2) {
     if (label) {
       console.warn("Note: --label is only used when creating a new hub. To change an existing hub's label, use `wayai relabel`.");
     }
-    console.log(`Target hub: ${path17.basename(existing.hubFolder)} (${existing.hubId})`);
-    assertHubMatchesBinding(existing.hubId, path17.basename(existing.hubFolder));
+    console.log(`Target hub: ${path22.basename(existing.hubFolder)} (${existing.hubId})`);
+    assertHubMatchesBinding(existing.hubId, path22.basename(existing.hubFolder));
     await pushSingleHub(client, existing.hubId, existing.hubFolder, autoConfirm, organizationId);
     return;
   }
@@ -18517,6 +19845,7 @@ var init_push = __esm({
     init_workspace_files();
     init_repo_config();
     init_hub_binding();
+    init_subtree_routing();
     LOCAL_CHANGE_LIST_CAP = 20;
   }
 });
@@ -18527,33 +19856,23 @@ __export(pull_exports, {
   connectionsEqual: () => connectionsEqual,
   pullCommand: () => pullCommand,
   resolveHubTarget: () => resolveHubTarget,
-  writeProductionMirror: () => writeProductionMirror
+  writeProductionMirror: () => writeProductionMirror2
 });
-import * as fs15 from "fs";
-import * as path18 from "path";
-function parseArgs5(args2) {
-  let autoConfirm = false;
-  let hubSelector;
-  for (let i = 0; i < args2.length; i++) {
-    const arg = args2[i];
-    if (arg === "--yes" || arg === "-y") {
-      autoConfirm = true;
-    } else if (arg === "--hub" && args2[i + 1]) {
-      hubSelector = args2[++i];
-    }
-  }
-  return { autoConfirm, hubSelector };
+import * as fs19 from "fs";
+import * as path23 from "path";
+function parseArgs6(args2) {
+  return { autoConfirm: args2.includes("--yes") || args2.includes("-y") };
 }
 function resolveHubTarget(workspaceDir, selector) {
   const wsLabel = hubsDirLabel(findGitRoot());
   const allHubs = scanWorkspaceHubs(workspaceDir);
   if (selector) {
     const match = allHubs.find(
-      (h) => h.hubId === selector || path18.basename(h.hubFolder) === selector
+      (h) => h.hubId === selector || path23.basename(h.hubFolder) === selector
     );
     if (match) return { hubId: match.hubId, hubFolder: match.hubFolder };
     if (UUID_RE2.test(selector)) return { hubId: selector, hubFolder: null };
-    console.error(`No hub matching --hub ${selector} found in ${wsLabel}/. Pass a UUID for first-time pulls.`);
+    console.error(`No hub matching "${selector}" found in ${wsLabel}/. Pass a UUID for first-time pulls.`);
     process.exit(1);
   }
   const enclosing = findEnclosingHubFolder(workspaceDir);
@@ -18566,19 +19885,26 @@ function resolveHubTarget(workspaceDir, selector) {
   }
   console.error(`Multiple hubs found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
   for (const h of previewHubs) {
-    console.error(`  ${path18.basename(h.hubFolder)} (${h.hubId})`);
+    console.error(`  ${path23.basename(h.hubFolder)} (${h.hubId})`);
   }
   process.exit(1);
 }
 async function pullCommand(args2) {
-  const { autoConfirm, hubSelector } = parseArgs5(args2);
+  const gitRoot = findGitRoot();
+  const route = requireSubtree("pull", args2, gitRoot);
+  if (gitRoot) warnLayoutOnce(gitRoot);
+  if (route.subtree === "bases") {
+    const { pullBase: pullBase2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
+    await pullBase2(gitRoot, route.selector, args2);
+    return;
+  }
+  const { autoConfirm } = parseArgs6(args2);
+  const hubSelector = route.selector;
   const repoConfig = requireRepoConfig();
   const { organization_id: organizationId } = repoConfig;
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   const workspaceDir = resolveWorkspaceDir();
-  const gitRoot = findGitRoot();
-  if (gitRoot) warnLayoutOnce(gitRoot);
   if (gitRoot) {
     for (const file of ensureWorkspaceFiles(gitRoot)) {
       console.error(`Created ${file}`);
@@ -18588,7 +19914,7 @@ async function pullCommand(args2) {
   console.log("Fetching hub configuration...");
   const payload = await client.pull(hubId, organizationId);
   if (payload.hub_environment === "production") {
-    const folder = await writeProductionMirror(workspaceDir, payload);
+    const folder = await writeProductionMirror2(workspaceDir, payload);
     console.log(`Production hub mirrored (read-only) \u2192 ${folder}`);
     return;
   }
@@ -18604,7 +19930,7 @@ async function pullCommand(args2) {
       payload.preview_label,
       payload.branch_name
     );
-    fs15.mkdirSync(path18.dirname(hubFolder), { recursive: true });
+    fs19.mkdirSync(path23.dirname(hubFolder), { recursive: true });
     console.log("Writing hub configuration...");
     await materializeHubFolder(hubFolder, payload);
     const finalFolder = autoRenameHubFolder(hubFolder, payload.hub.name, payload.hub_environment, payload.hub_id, payload.preview_label, payload.branch_name);
@@ -18653,34 +19979,34 @@ async function pullCommand(args2) {
   }
   if (wroteFiles) autoBindIfUnbound(hubId);
   if (payload.production_hub_id) {
-    await mirrorLinkedProduction(client, workspaceDir, payload.production_hub_id, organizationId);
+    await mirrorLinkedProduction2(client, workspaceDir, payload.production_hub_id, organizationId);
   }
 }
-async function writeProductionMirror(workspaceDir, prodPayload) {
+async function writeProductionMirror2(workspaceDir, prodPayload) {
   const folder = resolveHubFolder(workspaceDir, prodPayload.hub_id, prodPayload.hub.name, "production", null, null);
-  fs15.mkdirSync(path18.dirname(folder), { recursive: true });
+  fs19.mkdirSync(path23.dirname(folder), { recursive: true });
   await materializeHubFolder(folder, prodPayload, { seedAgentContext: false });
   const finalFolder = autoRenameHubFolder(folder, prodPayload.hub.name, "production", prodPayload.hub_id, null, null);
   prependMirrorMarker(finalFolder, prodPayload.hub_id);
   return finalFolder;
 }
-async function mirrorLinkedProduction(client, workspaceDir, productionHubId, organizationId) {
+async function mirrorLinkedProduction2(client, workspaceDir, productionHubId, organizationId) {
   try {
     const prodPayload = await client.pull(productionHubId, organizationId);
-    const folder = await writeProductionMirror(workspaceDir, prodPayload);
+    const folder = await writeProductionMirror2(workspaceDir, prodPayload);
     console.log(`Mirrored production hub \u2192 ${folder} (read-only)`);
   } catch (err) {
     console.warn(`Warning: could not mirror production hub (${err instanceof Error ? err.message : String(err)}). Preview pull is unaffected.`);
   }
 }
 function prependMirrorMarker(hubFolder, productionHubId) {
-  const hubYaml = path18.join(hubFolder, "hub.yaml");
+  const hubYaml = path23.join(hubFolder, "hub.yaml");
   try {
-    const content = fs15.readFileSync(hubYaml, "utf-8");
-    if (content.startsWith(MIRROR_MARKER_PREFIX)) return;
-    const marker = `${MIRROR_MARKER_PREFIX} ${productionHubId}. Edits are ignored; push is blocked. Edit the linked preview hub instead.
+    const content = fs19.readFileSync(hubYaml, "utf-8");
+    if (content.startsWith(MIRROR_MARKER_PREFIX2)) return;
+    const marker = `${MIRROR_MARKER_PREFIX2} ${productionHubId}. Edits are ignored; push is blocked. Edit the linked preview hub instead.
 `;
-    fs15.writeFileSync(hubYaml, marker + content, "utf-8");
+    fs19.writeFileSync(hubYaml, marker + content, "utf-8");
   } catch {
   }
 }
@@ -18697,7 +20023,7 @@ function connectionsEqual(a, b) {
   }
   return true;
 }
-var MIRROR_MARKER_PREFIX;
+var MIRROR_MARKER_PREFIX2;
 var init_pull = __esm({
   "src/commands/pull.ts"() {
     "use strict";
@@ -18714,7 +20040,8 @@ var init_pull = __esm({
     init_workspace_files();
     init_repo_config();
     init_hub_binding();
-    MIRROR_MARKER_PREFIX = "# Read-only mirror of production hub";
+    init_subtree_routing();
+    MIRROR_MARKER_PREFIX2 = "# Read-only mirror of production hub";
   }
 });
 
@@ -18723,9 +20050,9 @@ var create_exports = {};
 __export(create_exports, {
   createCommand: () => createCommand
 });
-import * as path19 from "path";
-import * as fs16 from "fs";
-function parseArgs6(args2) {
+import * as path24 from "path";
+import * as fs20 from "fs";
+function parseArgs7(args2) {
   let autoConfirm = false;
   let folderSelector;
   let label;
@@ -18742,7 +20069,7 @@ function parseArgs6(args2) {
   return { autoConfirm, folderSelector, label };
 }
 async function createCommand(args2) {
-  const { autoConfirm, folderSelector, label } = parseArgs6(args2);
+  const { autoConfirm, folderSelector, label } = parseArgs7(args2);
   const repoConfig = requireRepoConfig();
   const { organization_id: organizationId } = repoConfig;
   const { config, accessToken } = await requireAuth();
@@ -18751,7 +20078,7 @@ async function createCommand(args2) {
   const gitRoot = findGitRoot();
   const wsLabel = hubsDirLabel(gitRoot);
   if (gitRoot) warnLayoutOnce(gitRoot);
-  if (!fs16.existsSync(workspaceDir)) {
+  if (!fs20.existsSync(workspaceDir)) {
     console.error(`No ${wsLabel}/ directory found. Create hub files in ${wsLabel}/<hub>/hub.yaml with \`hub: { name: ... }\` first.`);
     process.exit(1);
   }
@@ -18760,7 +20087,7 @@ async function createCommand(args2) {
   const resolution = resolveNewHubForCreate(workspaceDir, existingHubs, newHubs, folderSelector);
   if (!resolution.ok) {
     if (resolution.reason === "exists") {
-      const folder = path19.basename(resolution.existing.hubFolder);
+      const folder = path24.basename(resolution.existing.hubFolder);
       console.error(`Hub "${folder}" already exists (${resolution.existing.hubId}). Use \`wayai push --hub ${folder}\` to update it.`);
       process.exit(1);
     }
@@ -18774,7 +20101,7 @@ async function createCommand(args2) {
     }
     console.error(`Multiple new hub folders found in ${wsLabel}/. Pass the folder name (\`wayai create <folder>\`) or run from inside one:`);
     for (const h of newHubs) {
-      console.error(`  ${path19.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
+      console.error(`  ${path24.basename(h.hubFolder)} (new \u2014 "${h.hubName}")`);
     }
     process.exit(1);
   }
@@ -18798,9 +20125,9 @@ var init_create = __esm({
 var diff_exports = {};
 __export(diff_exports, {
   diffCommand: () => diffCommand,
-  parseArgs: () => parseArgs7
+  parseArgs: () => parseArgs8
 });
-function parseArgs7(args2) {
+function parseArgs8(args2) {
   let production = false;
   let hubSelector;
   for (let i = 0; i < args2.length; i++) {
@@ -18814,7 +20141,7 @@ function parseArgs7(args2) {
   return { production, hubSelector };
 }
 async function diffCommand(args2) {
-  const { production, hubSelector } = parseArgs7(args2);
+  const { production, hubSelector } = parseArgs8(args2);
   const repoConfig = requireRepoConfig();
   const { organization_id: organizationId } = repoConfig;
   const { config, accessToken } = await requireAuth();
@@ -18885,9 +20212,9 @@ var replicate_exports = {};
 __export(replicate_exports, {
   replicateCommand: () => replicateCommand
 });
-import * as fs17 from "fs";
-import * as path20 from "path";
-function parseArgs8(args2) {
+import * as fs21 from "fs";
+import * as path25 from "path";
+function parseArgs9(args2) {
   let label;
   let hubSelector;
   for (let i = 0; i < args2.length; i++) {
@@ -18903,7 +20230,7 @@ function parseArgs8(args2) {
   return { label, hubSelector };
 }
 async function replicateCommand(args2) {
-  const { label, hubSelector } = parseArgs8(args2);
+  const { label, hubSelector } = parseArgs9(args2);
   const normalizedLabel = label?.trim() || void 0;
   if (normalizedLabel && normalizedLabel.length > PREVIEW_LABEL_MAX_LENGTH) {
     console.error(`--label must be ${PREVIEW_LABEL_MAX_LENGTH} characters or fewer.`);
@@ -18932,8 +20259,8 @@ async function replicateCommand(args2) {
     payload.preview_label,
     payload.branch_name
   );
-  const folderPreExisted = fs17.existsSync(hubFolder);
-  fs17.mkdirSync(path20.dirname(hubFolder), { recursive: true });
+  const folderPreExisted = fs21.existsSync(hubFolder);
+  fs21.mkdirSync(path25.dirname(hubFolder), { recursive: true });
   const delta = await materializeHubFolder(hubFolder, payload);
   hubFolder = autoRenameHubFolder(
     hubFolder,
@@ -18945,8 +20272,8 @@ async function replicateCommand(args2) {
   );
   autoBindIfUnbound(previewHubId);
   if (folderPreExisted) printLocalFileChanges(delta);
-  console.log(`Preview written to ${path20.basename(hubFolder)}`);
-  console.log(`  Switch to it with: wayai use ${path20.basename(hubFolder)}`);
+  console.log(`Preview written to ${path25.basename(hubFolder)}`);
+  console.log(`  Switch to it with: wayai use ${path25.basename(hubFolder)}`);
 }
 var init_replicate = __esm({
   "src/commands/replicate.ts"() {
@@ -18969,8 +20296,8 @@ var relabel_exports = {};
 __export(relabel_exports, {
   relabelCommand: () => relabelCommand
 });
-import * as path21 from "path";
-function parseArgs9(args2) {
+import * as path26 from "path";
+function parseArgs10(args2) {
   let label;
   let clear = false;
   let hubSelector;
@@ -18987,7 +20314,7 @@ function parseArgs9(args2) {
   return { label, clear, hubSelector };
 }
 async function relabelCommand(args2) {
-  const { label, clear, hubSelector } = parseArgs9(args2);
+  const { label, clear, hubSelector } = parseArgs10(args2);
   if (!clear && (label === void 0 || label.trim() === "")) {
     console.error("Usage: wayai relabel <label> [--hub <uuid|folder>]   (or --clear to remove the label)");
     process.exit(1);
@@ -19013,7 +20340,7 @@ async function relabelCommand(args2) {
     } else {
       console.error(`Multiple hubs found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
       for (const h of previewHubs) {
-        console.error(`  ${path21.basename(h.hubFolder)} (${h.hubId})`);
+        console.error(`  ${path26.basename(h.hubFolder)} (${h.hubId})`);
       }
     }
     process.exit(1);
@@ -19022,7 +20349,7 @@ async function relabelCommand(args2) {
     console.log("This is a read-only production mirror \u2014 production hubs have no preview label. Relabel the linked preview hub instead.");
     return;
   }
-  assertHubMatchesBinding(target.hubId, path21.basename(target.hubFolder));
+  assertHubMatchesBinding(target.hubId, path26.basename(target.hubFolder));
   console.log(normalizedLabel ? `Setting preview label to "${normalizedLabel}"...` : "Clearing preview label...");
   const { data } = await client.relabelPreview(target.hubId, normalizedLabel);
   const row = data[0];
@@ -19038,7 +20365,7 @@ async function relabelCommand(args2) {
   );
   console.log(serverLabel ? `Preview label set to "${serverLabel}".` : "Preview label cleared.");
   if (finalFolder !== target.hubFolder) {
-    console.log(`Hub folder is now ${path21.basename(finalFolder)}`);
+    console.log(`Hub folder is now ${path26.basename(finalFolder)}`);
   }
 }
 var init_relabel = __esm({
@@ -19059,13 +20386,13 @@ var init_relabel = __esm({
 // src/commands/publish.ts
 var publish_exports = {};
 __export(publish_exports, {
-  parseArgs: () => parseArgs10,
+  parseArgs: () => parseArgs11,
   publishCommand: () => publishCommand,
   renderHubDiff: () => renderHubDiff,
   runPublish: () => runPublish
 });
-import * as path22 from "path";
-function parseArgs10(args2) {
+import * as path27 from "path";
+function parseArgs11(args2) {
   let autoConfirm = false;
   let hubSelector;
   for (let i = 0; i < args2.length; i++) {
@@ -19159,7 +20486,7 @@ Published. Production hub: ${data.production_hub_id}`);
   return "synced";
 }
 async function publishCommand(args2) {
-  const { autoConfirm, hubSelector } = parseArgs10(args2);
+  const { autoConfirm, hubSelector } = parseArgs11(args2);
   const repoConfig = requireRepoConfig();
   const { organization_id: organizationId } = repoConfig;
   const { config, accessToken } = await requireAuth();
@@ -19178,7 +20505,7 @@ async function publishCommand(args2) {
       return;
     }
   }
-  assertHubMatchesBinding(hubId, hubFolder ? path22.basename(hubFolder) : void 0);
+  assertHubMatchesBinding(hubId, hubFolder ? path27.basename(hubFolder) : void 0);
   await runPublish(client, { hubId, localConfig, organizationId, autoConfirm });
 }
 var STATUS_STYLE;
@@ -19211,7 +20538,7 @@ var use_exports = {};
 __export(use_exports, {
   useCommand: () => useCommand
 });
-import * as path23 from "path";
+import * as path28 from "path";
 async function useCommand(args2) {
   const target = args2[0];
   if (!target || target.startsWith("-")) {
@@ -19233,7 +20560,7 @@ async function useCommand(args2) {
     const match = findHubByFolderName(workspaceDir, target);
     if (!match) {
       const newHubs = scanNewHubs(workspaceDir);
-      const pending = newHubs.find((h) => path23.basename(h.hubFolder) === target);
+      const pending = newHubs.find((h) => path28.basename(h.hubFolder) === target);
       if (pending) {
         console.error(
           `"${target}" is a new hub that hasn't been created on the platform yet, so it has no id to bind to.
@@ -19244,10 +20571,10 @@ Create it first \u2014 the worktree binds automatically afterward:
       }
       console.error(`No hub matching "${target}" found in ${wsLabel}/. Pass a UUID or a folder name from:`);
       for (const h of scanWorkspaceHubs(workspaceDir)) {
-        console.error(`  ${path23.basename(h.hubFolder)} (${h.hubId})`);
+        console.error(`  ${path28.basename(h.hubFolder)} (${h.hubId})`);
       }
       for (const h of newHubs) {
-        console.error(`  ${path23.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path23.basename(h.hubFolder)}\`)`);
+        console.error(`  ${path28.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path28.basename(h.hubFolder)}\`)`);
       }
       process.exit(1);
     }
@@ -19286,11 +20613,11 @@ __export(migrate_exports, {
   migrateCommand: () => migrateCommand
 });
 import { execFileSync as execFileSync3 } from "child_process";
-import * as fs18 from "fs";
-import * as path24 from "path";
+import * as fs22 from "fs";
+import * as path29 from "path";
 function isTracked(gitRoot, p) {
   try {
-    execFileSync3("git", ["ls-files", "--error-unmatch", "--", path24.relative(gitRoot, p)], {
+    execFileSync3("git", ["ls-files", "--error-unmatch", "--", path29.relative(gitRoot, p)], {
       cwd: gitRoot,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -19300,10 +20627,10 @@ function isTracked(gitRoot, p) {
   }
 }
 function moveDir(gitRoot, from, to) {
-  fs18.mkdirSync(path24.dirname(to), { recursive: true });
+  fs22.mkdirSync(path29.dirname(to), { recursive: true });
   if (isTracked(gitRoot, from)) {
     try {
-      execFileSync3("git", ["mv", path24.relative(gitRoot, from), path24.relative(gitRoot, to)], {
+      execFileSync3("git", ["mv", path29.relative(gitRoot, from), path29.relative(gitRoot, to)], {
         cwd: gitRoot,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -19311,7 +20638,7 @@ function moveDir(gitRoot, from, to) {
     } catch {
     }
   }
-  fs18.renameSync(from, to);
+  fs22.renameSync(from, to);
   return "fs";
 }
 async function migrateCommand(_args) {
@@ -19320,12 +20647,12 @@ async function migrateCommand(_args) {
     console.error("Not inside a git repository.");
     process.exit(1);
   }
-  const rel = (p) => path24.relative(gitRoot, p);
-  const newWs = path24.join(gitRoot, WAYAI_LAYOUT.wsDir);
-  const legacyWs = path24.join(gitRoot, WAYAI_LAYOUT.legacy.wsDir);
-  const legacyOrg = path24.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
-  const newHubs = path24.join(newWs, WAYAI_LAYOUT.hubsSubdir);
-  const newOrg = path24.join(newWs, WAYAI_LAYOUT.orgSubdir);
+  const rel = (p) => path29.relative(gitRoot, p);
+  const newWs = path29.join(gitRoot, WAYAI_LAYOUT.wsDir);
+  const legacyWs = path29.join(gitRoot, WAYAI_LAYOUT.legacy.wsDir);
+  const legacyOrg = path29.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
+  const newHubs = path29.join(newWs, WAYAI_LAYOUT.hubsSubdir);
+  const newOrg = path29.join(newWs, WAYAI_LAYOUT.orgSubdir);
   const hasLegacyWs = isDirectory(legacyWs);
   const hasLegacyOrg = isDirectory(legacyOrg);
   if (!hasLegacyWs && !hasLegacyOrg) {
@@ -19399,12 +20726,12 @@ var send_message_exports = {};
 __export(send_message_exports, {
   sendMessageCommand: () => sendMessageCommand
 });
-import * as fs19 from "fs";
-import * as path25 from "path";
+import * as fs23 from "fs";
+import * as path30 from "path";
 function statAttachment(filePath) {
   let stat2;
   try {
-    stat2 = fs19.statSync(filePath);
+    stat2 = fs23.statSync(filePath);
   } catch {
     console.error(`Error: file not found: ${filePath}`);
     process.exit(1);
@@ -19416,11 +20743,11 @@ function statAttachment(filePath) {
   return { filePath, size: stat2.size };
 }
 function readAttachment(filePath, size) {
-  const fileName = path25.basename(filePath);
-  const ext = path25.extname(fileName).replace(/^\./, "");
+  const fileName = path30.basename(filePath);
+  const ext = path30.extname(fileName).replace(/^\./, "");
   return {
     file_name: fileName,
-    file_binary: fs19.readFileSync(filePath).toString("base64"),
+    file_binary: fs23.readFileSync(filePath).toString("base64"),
     file_size: size,
     ...ext && { file_extension: ext }
   };
@@ -19467,7 +20794,7 @@ async function sendMessageCommand(args2) {
   }
   const stats = filePaths.map(statAttachment);
   const filesTotal = stats.reduce((sum, s) => sum + base64Length(s.size), 0);
-  const fileDetail = () => stats.map((s) => `${path25.basename(s.filePath)} ${asMb(s.size)} MB`).join(", ");
+  const fileDetail = () => stats.map((s) => `${path30.basename(s.filePath)} ${asMb(s.size)} MB`).join(", ");
   if (filesTotal > MAX_MESSAGE_BODY_BYTES) {
     console.error(
       `Error: ${fileDetail()} encode to ~${asMb(filesTotal)} MB, over the ${asMb(MAX_MESSAGE_BODY_BYTES)} MB per-request limit.`
@@ -19475,10 +20802,10 @@ async function sendMessageCommand(args2) {
     console.error("Base64 inflates a file by about a third, so ~7 MB of files is the practical ceiling.");
     process.exit(1);
   }
-  const audioStats = stats.filter((s) => isAudioAttachmentFileName(path25.basename(s.filePath)));
+  const audioStats = stats.filter((s) => isAudioAttachmentFileName(path30.basename(s.filePath)));
   if (audioStats.length > 1) {
     console.error(
-      `Error: at most one audio file per message (got ${audioStats.length}: ${audioStats.map((s) => path25.basename(s.filePath)).join(", ")}).`
+      `Error: at most one audio file per message (got ${audioStats.length}: ${audioStats.map((s) => path30.basename(s.filePath)).join(", ")}).`
     );
     console.error("Audio is transcribed via the hub's STT connection, and only one file per message is transcribed.");
     process.exit(1);
@@ -19486,7 +20813,7 @@ async function sendMessageCommand(args2) {
   const oversizeAudio = audioStats.find((s) => base64Length(s.size) > MAX_AUDIO_FILE_BASE64_BYTES);
   if (oversizeAudio) {
     console.error(
-      `Error: ${path25.basename(oversizeAudio.filePath)} (${asMb(oversizeAudio.size)} MB) is over the ~${asMb(MAX_AUDIO_FILE_BASE64_BYTES * 3 / 4)} MB audio limit for transcription.`
+      `Error: ${path30.basename(oversizeAudio.filePath)} (${asMb(oversizeAudio.size)} MB) is over the ~${asMb(MAX_AUDIO_FILE_BASE64_BYTES * 3 / 4)} MB audio limit for transcription.`
     );
     process.exit(1);
   }
@@ -20363,10 +21690,10 @@ var init_delete_history = __esm({
 // src/commands/sync-skills.ts
 var sync_skills_exports = {};
 __export(sync_skills_exports, {
-  parseArgs: () => parseArgs11,
+  parseArgs: () => parseArgs12,
   syncSkillsCommand: () => syncSkillsCommand
 });
-function parseArgs11(args2) {
+function parseArgs12(args2) {
   let connectionId;
   const idx = args2.indexOf("--connection-id");
   if (idx !== -1 && args2[idx + 1]) {
@@ -20389,7 +21716,7 @@ function printSyncResults(response) {
 }
 async function syncSkillsCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const { connectionId } = parseArgs11(args2);
+  const { connectionId } = parseArgs12(args2);
   requireRepoConfig();
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -20414,10 +21741,10 @@ var init_sync_skills = __esm({
 // src/commands/sync-mcp.ts
 var sync_mcp_exports = {};
 __export(sync_mcp_exports, {
-  parseArgs: () => parseArgs12,
+  parseArgs: () => parseArgs13,
   syncMcpCommand: () => syncMcpCommand
 });
-function parseArgs12(args2) {
+function parseArgs13(args2) {
   let connection;
   let check = false;
   for (let i = 0; i < args2.length; i++) {
@@ -20432,7 +21759,7 @@ function parseArgs12(args2) {
 }
 async function syncMcpCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const { connection, check } = parseArgs12(args2);
+  const { connection, check } = parseArgs13(args2);
   if (!connection) {
     console.error("Usage: wayai sync-mcp --connection <name> [--hub <uuid|folder-name>] [--check]");
     console.error("");
@@ -20711,8 +22038,8 @@ function installEvalSignalHandlers(input) {
   let signalCount = 0;
   let disposed = false;
   let settle;
-  const settled = new Promise((resolve5) => {
-    settle = resolve5;
+  const settled = new Promise((resolve7) => {
+    settle = resolve7;
   });
   const listeners = /* @__PURE__ */ new Map();
   const dispose = () => {
@@ -21062,7 +22389,7 @@ Timeout after ${timeoutSeconds}s${queuedSeconds > 0 ? ` (${queuedSeconds}s of it
   process.exit(1);
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function parseRunNumbers(raw) {
   if (!raw || raw.startsWith("--")) {
@@ -21332,15 +22659,15 @@ var eval_capture_exports = {};
 __export(eval_capture_exports, {
   evalCaptureCommand: () => evalCaptureCommand
 });
-import * as fs20 from "fs";
-import * as path26 from "path";
-import * as yaml7 from "js-yaml";
+import * as fs24 from "fs";
+import * as path31 from "path";
+import * as yaml11 from "js-yaml";
 function isValidSetName(name) {
   if (name.length === 0 || name === "." || name === "..") return false;
   if (name.startsWith(".")) return false;
   return !/[\/\\\0]/.test(name);
 }
-function parseArgs13(args2) {
+function parseArgs14(args2) {
   if (args2.length === 0 || args2[0].startsWith("-")) {
     console.error("Usage: wayai eval capture <conversation_id> [--set <name>] [--name <eval_name>] [--instructions <text>]");
     process.exit(1);
@@ -21386,7 +22713,7 @@ function parseArgs13(args2) {
 }
 async function evalCaptureCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const parsed = parseArgs13(args2);
+  const parsed = parseArgs14(args2);
   const { config, accessToken } = await requireAuth();
   requireRepoConfig();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -21399,15 +22726,15 @@ async function evalCaptureCommand(args2) {
   const setFolderName = targetSetName;
   const scenarioName = parsed.evalName ?? `Capture ${parsed.conversationId.slice(0, 8)}`;
   const slug = slugify(scenarioName);
-  const evalsDir = path26.join(hubFolder, "evals");
-  const targetDir = path26.join(evalsDir, setFolderName);
-  const targetPath = path26.join(targetDir, `${slug}.yaml`);
-  if (!targetPath.startsWith(evalsDir + path26.sep)) {
-    console.error(`Resolved path "${path26.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
+  const evalsDir = path31.join(hubFolder, "evals");
+  const targetDir = path31.join(evalsDir, setFolderName);
+  const targetPath = path31.join(targetDir, `${slug}.yaml`);
+  if (!targetPath.startsWith(evalsDir + path31.sep)) {
+    console.error(`Resolved path "${path31.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
     process.exit(1);
   }
-  if (fs20.existsSync(targetPath)) {
-    console.error(`File already exists: ${path26.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
+  if (fs24.existsSync(targetPath)) {
+    console.error(`File already exists: ${path31.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
     process.exit(1);
   }
   console.log("Resolving scenario set...");
@@ -21439,9 +22766,9 @@ async function evalCaptureCommand(args2) {
     ...captured.evaluator_instructions ? { evaluator_instructions: captured.evaluator_instructions } : {}
   };
   const yamlObj = buildEvalYamlObject(evalEntry, slug);
-  fs20.mkdirSync(targetDir, { recursive: true });
-  fs20.writeFileSync(targetPath, yaml7.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
-  const relPath = path26.relative(process.cwd(), targetPath);
+  fs24.mkdirSync(targetDir, { recursive: true });
+  fs24.writeFileSync(targetPath, yaml11.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
+  const relPath = path31.relative(process.cwd(), targetPath);
   console.log(`
 Wrote ${relPath}`);
   console.log("Run `wayai pull` to refresh the agent display name, then commit. The scenario is already on the platform.");
@@ -21463,7 +22790,7 @@ var journey_capture_exports = {};
 __export(journey_capture_exports, {
   journeyCaptureCommand: () => journeyCaptureCommand
 });
-function parseArgs14(args2) {
+function parseArgs15(args2) {
   if (args2.length === 0 || args2[0].startsWith("-")) {
     console.error("Usage: wayai eval journey capture <conversation_id> [--name <journey_name>] [--instructions <text>]");
     process.exit(1);
@@ -21498,7 +22825,7 @@ function parseArgs14(args2) {
 }
 async function journeyCaptureCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const parsed = parseArgs14(args2);
+  const parsed = parseArgs15(args2);
   const { config, accessToken } = await requireAuth();
   requireRepoConfig();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -22426,9 +23753,9 @@ var init_credential_utils = __esm({
 var create_credential_exports = {};
 __export(create_credential_exports, {
   createCredentialCommand: () => createCredentialCommand,
-  parseArgs: () => parseArgs15
+  parseArgs: () => parseArgs16
 });
-function parseArgs15(args2) {
+function parseArgs16(args2) {
   let name;
   let type;
   let orgId;
@@ -22456,7 +23783,7 @@ function parseArgs15(args2) {
   return { name, type, orgId, description, tags: splitTagRefs(tags), environment, stdin };
 }
 async function createCredentialCommand(args2) {
-  const parsed = parseArgs15(args2);
+  const parsed = parseArgs16(args2);
   if (!parsed.name) {
     console.error("Missing required flag: --name <credential-name>");
     console.error('Usage: wayai create-credential --name "openai-key" --type "Bearer Token"');
@@ -22563,10 +23890,10 @@ var init_create_credential = __esm({
 // src/commands/update-credential.ts
 var update_credential_exports = {};
 __export(update_credential_exports, {
-  parseArgs: () => parseArgs16,
+  parseArgs: () => parseArgs17,
   updateCredentialCommand: () => updateCredentialCommand
 });
-function parseArgs16(args2) {
+function parseArgs17(args2) {
   let name;
   let rename;
   let orgId;
@@ -22599,7 +23926,7 @@ function parseArgs16(args2) {
   return { name, rename, orgId, description, tags: splitTagRefs(tags), hasTagFlag, environment, stdin, secretPrompt };
 }
 async function updateCredentialCommand(args2) {
-  const parsed = parseArgs16(args2);
+  const parsed = parseArgs17(args2);
   if (!parsed.name) {
     console.error("Missing required flag: --name <credential-name>");
     console.error('Usage: wayai update-credential --name "my-key" --stdin');
@@ -22712,10 +24039,10 @@ var init_update_credential = __esm({
 // src/commands/set-connection-credential.ts
 var set_connection_credential_exports = {};
 __export(set_connection_credential_exports, {
-  parseArgs: () => parseArgs17,
+  parseArgs: () => parseArgs18,
   setConnectionCredentialCommand: () => setConnectionCredentialCommand
 });
-function parseArgs17(args2) {
+function parseArgs18(args2) {
   let connection;
   let orgCredential;
   let field;
@@ -22738,7 +24065,7 @@ function usage2(msg) {
 }
 async function setConnectionCredentialCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const parsed = parseArgs17(args2);
+  const parsed = parseArgs18(args2);
   if (!parsed.connection) usage2("Missing required flag: --connection <name|id>");
   const orgMode = !!parsed.orgCredential;
   const directMode = !!parsed.field;
@@ -22807,23 +24134,23 @@ var init_set_connection_credential = __esm({
 });
 
 // src/lib/org-workspace.ts
-import * as fs21 from "fs";
-import * as path27 from "path";
-import * as yaml8 from "js-yaml";
+import * as fs25 from "fs";
+import * as path32 from "path";
+import * as yaml12 from "js-yaml";
 function getOrgDir(gitRoot) {
   return resolveLayout(gitRoot).orgDir;
 }
 function orgManifestExists(orgDir) {
-  return fs21.existsSync(path27.join(orgDir, ORG_MANIFEST_NAME));
+  return fs25.existsSync(path32.join(orgDir, ORG_MANIFEST_NAME));
 }
 function parseOrgResources(orgDir) {
-  const manifestPath = path27.join(orgDir, ORG_MANIFEST_NAME);
+  const manifestPath = path32.join(orgDir, ORG_MANIFEST_NAME);
   let manifest = {};
-  if (fs21.existsSync(manifestPath)) {
-    manifest = yaml8.load(fs21.readFileSync(manifestPath, "utf-8")) ?? {};
+  if (fs25.existsSync(manifestPath)) {
+    manifest = yaml12.load(fs25.readFileSync(manifestPath, "utf-8")) ?? {};
   }
   const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
-  const resourcesDir = path27.join(orgDir, "resources");
+  const resourcesDir = path32.join(orgDir, "resources");
   const resources = rawResources.map((res) => {
     const resource = { name: res.name };
     if (res.id) resource.id = res.id;
@@ -22835,8 +24162,8 @@ function parseOrgResources(orgDir) {
     if (res.environment) resource.environment = res.environment;
     if (Array.isArray(res.tags)) resource.tags = res.tags;
     if (Array.isArray(res.folders)) resource.folders = res.folders;
-    const resDir = path27.join(resourcesDir, slugify(resource.name));
-    if (fs21.existsSync(resDir)) {
+    const resDir = path32.join(resourcesDir, slugify(resource.name));
+    if (fs25.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) resource.files = files;
     }
@@ -22845,28 +24172,28 @@ function parseOrgResources(orgDir) {
   return { version: 1, resources };
 }
 function writeOrgResources(orgDir, payload) {
-  fs21.mkdirSync(orgDir, { recursive: true });
+  fs25.mkdirSync(orgDir, { recursive: true });
   const resources = payload.resources ?? [];
   const manifestResources = resources.map((r) => {
     const { files: _files, ...rest } = r;
     return rest;
   });
-  fs21.writeFileSync(
-    path27.join(orgDir, ORG_MANIFEST_NAME),
-    yaml8.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
+  fs25.writeFileSync(
+    path32.join(orgDir, ORG_MANIFEST_NAME),
+    yaml12.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
     "utf-8"
   );
-  const resourcesDir = path27.join(orgDir, "resources");
+  const resourcesDir = path32.join(orgDir, "resources");
   const currentSlugs = /* @__PURE__ */ new Set();
   for (const resource of resources) {
     const resSlug = slugify(resource.name);
     currentSlugs.add(resSlug);
-    writeResourceFileTree(path27.join(resourcesDir, resSlug), resource.files || [], orgDir);
+    writeResourceFileTree(path32.join(resourcesDir, resSlug), resource.files || [], orgDir);
   }
-  if (fs21.existsSync(resourcesDir)) {
-    for (const entry of fs21.readdirSync(resourcesDir, { withFileTypes: true })) {
+  if (fs25.existsSync(resourcesDir)) {
+    for (const entry of fs25.readdirSync(resourcesDir, { withFileTypes: true })) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
-        fs21.rmSync(path27.join(resourcesDir, entry.name), { recursive: true, force: true });
+        fs25.rmSync(path32.join(resourcesDir, entry.name), { recursive: true, force: true });
       }
     }
   }
@@ -22875,7 +24202,7 @@ async function downloadOrgBinaryFiles(orgDir, payload) {
   let count = 0;
   for (const resource of payload.resources ?? []) {
     if (!resource.files) continue;
-    const resDir = path27.join(orgDir, "resources", slugify(resource.name));
+    const resDir = path32.join(orgDir, "resources", slugify(resource.name));
     count += await downloadBinaryFiles(resDir, resource.files, orgDir);
   }
   if (count > 0) console.log(`Downloaded ${count} binary resource file(s).`);
@@ -23063,9 +24390,9 @@ var init_org = __esm({
 var list_exports = {};
 __export(list_exports, {
   listCommand: () => listCommand,
-  parseArgs: () => parseArgs18
+  parseArgs: () => parseArgs19
 });
-function parseArgs18(args2) {
+function parseArgs19(args2) {
   let orgId;
   let json = false;
   for (let i = 0; i < args2.length; i++) {
@@ -23078,7 +24405,7 @@ function parseArgs18(args2) {
   return { orgId, json };
 }
 async function listCommand(args2) {
-  const { orgId, json } = parseArgs18(args2);
+  const { orgId, json } = parseArgs19(args2);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   const { organizations } = await client.organizations();
@@ -23171,8 +24498,8 @@ var init_report_edit_args = __esm({
 });
 
 // src/lib/file-map.ts
-import * as fs22 from "fs";
-import * as path28 from "path";
+import * as fs26 from "fs";
+import * as path33 from "path";
 function isSafeRelPath(rel) {
   if (rel.length === 0 || rel.length > 300) return false;
   if (rel.startsWith("/") || rel.includes("\\")) return false;
@@ -23187,9 +24514,9 @@ function writeFileMap(targetDir, files) {
     if (!isSafeRelPath(rel)) {
       throw new Error(`Refusing to write unsafe path: ${rel}`);
     }
-    const abs = path28.join(targetDir, rel);
-    fs22.mkdirSync(path28.dirname(abs), { recursive: true });
-    fs22.writeFileSync(abs, body, "utf-8");
+    const abs = path33.join(targetDir, rel);
+    fs26.mkdirSync(path33.dirname(abs), { recursive: true });
+    fs26.writeFileSync(abs, body, "utf-8");
     written.push(rel);
   }
   return written;
@@ -23205,8 +24532,8 @@ var admin_exports = {};
 __export(admin_exports, {
   adminCommand: () => adminCommand
 });
-import * as fs23 from "fs";
-import * as path29 from "path";
+import * as fs27 from "fs";
+import * as path34 from "path";
 async function adminCommand(args2) {
   const [group, ...afterGroup] = args2;
   if (!group) {
@@ -23363,6 +24690,20 @@ async function adminCommand(args2) {
         process.exit(1);
     }
   }
+  if (group === "orgs") {
+    if (!sub) {
+      printHelp2();
+      process.exit(1);
+    }
+    switch (sub) {
+      case "repair-legacy-grants":
+        await runRepairLegacyOrgGrants(flagArgs);
+        return;
+      default:
+        printHelp2();
+        process.exit(1);
+    }
+  }
   if (group === "harness") {
     if (!sub) {
       printHelp2();
@@ -23507,7 +24848,7 @@ async function runArchiveRead(positional, flagArgs) {
       exitOnApiError(err);
       throw err;
     }
-    fs23.writeFileSync(outPath, zip);
+    fs27.writeFileSync(outPath, zip);
     console.log(`Wrote ${zip.byteLength} bytes to ${outPath}`);
     return;
   }
@@ -23649,13 +24990,13 @@ async function runSkillInstall(positional) {
     throw err;
   }
   const root = findGitRoot() ?? process.cwd();
-  const present = HARNESS_SKILL_DIRS.filter((dir) => fs23.existsSync(path29.join(root, dir)));
+  const present = HARNESS_SKILL_DIRS.filter((dir) => fs27.existsSync(path34.join(root, dir)));
   const targets = present.length > 0 ? present : HARNESS_SKILL_DIRS;
   const fileCount = Object.keys(res.files).length;
   const relDirs = targets.map((harness) => {
-    const targetDir = path29.join(root, harness, "skills", name);
+    const targetDir = path34.join(root, harness, "skills", name);
     writeFileMap(targetDir, res.files);
-    return `${path29.relative(root, targetDir)}/`;
+    return `${path34.relative(root, targetDir)}/`;
   });
   console.log(`Installed skill "${name}" (${fileCount} file${fileCount === 1 ? "" : "s"}) \u2192 ${relDirs.join(", ")}`);
   console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
@@ -23766,13 +25107,18 @@ async function runSandboxExec(positional, flagArgs) {
     process.exit(data.exit_code);
   }
 }
-function parseScopedTargetFlags(flagArgs, usage3) {
+function parseScopedTargetFlags(flagArgs, usage3, opts = {}) {
+  const scopes = opts.scopes ?? ["all", "org", "hub"];
   let all = false;
   let orgId;
   let hubId;
   let dryRun = false;
   let yes = false;
   let jsonOutput = false;
+  const rejectUnknown = (arg) => {
+    console.error(`Unknown flag: ${arg}`);
+    process.exit(1);
+  };
   for (let i = 0; i < flagArgs.length; i++) {
     const arg = flagArgs[i];
     switch (arg) {
@@ -23792,20 +25138,23 @@ function parseScopedTargetFlags(flagArgs, usage3) {
         orgId = requireFlagValue(flagArgs, ++i, "--org");
         break;
       case "--hub":
+        if (!scopes.includes("hub")) rejectUnknown(arg);
         hubId = requireFlagValue(flagArgs, ++i, "--hub");
         break;
       default:
-        console.error(`Unknown flag: ${arg}`);
-        process.exit(1);
+        rejectUnknown(arg);
     }
   }
   if ((all ? 1 : 0) + (orgId ? 1 : 0) + (hubId ? 1 : 0) !== 1) {
-    console.error("Provide exactly ONE of --all, --org <org_id>, or --hub <hub_id>.");
+    const forms = scopes.map((s) => s === "all" ? "--all" : s === "org" ? "--org <org_id>" : "--hub <hub_id>");
+    const oneOf = forms.length === 2 ? forms.join(" or ") : `${forms.slice(0, -1).join(", ")}, or ${forms[forms.length - 1]}`;
+    console.error(`Provide exactly ONE of ${oneOf}.`);
     console.error(usage3);
     process.exit(1);
   }
   if (all) {
-    return { body: { scope: "all", dry_run: dryRun }, targetLabel: "ALL hubs (platform-wide)", dryRun, yes, jsonOutput };
+    const label = opts.allLabel ?? "ALL hubs (platform-wide)";
+    return { body: { scope: "all", dry_run: dryRun }, targetLabel: label, dryRun, yes, jsonOutput };
   }
   if (orgId) {
     return { body: { scope: "org", org_id: orgId, dry_run: dryRun }, targetLabel: `org ${orgId}`, dryRun, yes, jsonOutput };
@@ -23859,6 +25208,59 @@ async function runRepairTeamOrphans(flagArgs) {
     console.log(`${d.hub_id} | ${d.dangling_team_ids.join(",")} | ${d.team_users_removed}`);
   }
 }
+async function runRepairLegacyOrgGrants(flagArgs) {
+  const USAGE = "wayai admin orgs repair-legacy-grants --all | --org <org_id> [--dry-run] [--yes] [--json]";
+  const scoped = parseScopedTargetFlags(flagArgs, USAGE, {
+    scopes: ["all", "org"],
+    allLabel: "ALL organizations (platform-wide)"
+  });
+  const { targetLabel, dryRun, yes, jsonOutput } = scoped;
+  const body = scoped.body.scope === "org" ? { scope: "org", org_id: scoped.body.org_id, dry_run: dryRun } : { scope: "all", dry_run: dryRun };
+  if (!dryRun && !yes && !jsonOutput) {
+    console.log(`About to REPAIR legacy org-admin roster rows in: ${targetLabel}.`);
+    console.log("A row whose email resolves to a real user BECOMES REAL ACCESS (OrgDO roster + UserDO membership);");
+    console.log("a row whose email matches no account is deleted. Neither sends the user an email.");
+    console.log("Run with --dry-run first to see what would change.");
+    const ok = await confirm("Proceed?");
+    if (!ok) {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let response;
+  try {
+    response = await client.adminRepairLegacyOrgGrants(body);
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  const data = response.data;
+  if (jsonOutput) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  const mode = data.dry_run ? "DRY RUN \u2014 nothing written" : "repaired";
+  console.log(
+    `repair-legacy-grants (${data.scope}) \u2014 ${mode}: orgs_scanned=${data.orgs_scanned} rows_found=${data.rows_found} repaired=${data.rows_repaired} dropped=${data.rows_dropped} skipped=${data.rows_skipped}`
+  );
+  if (data.rows_errored > 0 || data.orgs_errored > 0) {
+    console.log(
+      `WARNING: ${data.orgs_errored} org(s) and ${data.rows_errored} row(s) errored and were SKIPPED \u2014 re-run to cover them.`
+    );
+  }
+  if (data.details.length === 0) {
+    console.log("(no legacy email-keyed roster rows in scope)");
+    return;
+  }
+  console.log("");
+  console.log("org_id | user_email | action | user_id | reason");
+  console.log("-------+------------+--------+---------+-------");
+  for (const d of data.details) {
+    console.log(`${d.org_id} | ${d.user_email} | ${d.action} | ${d.user_id ?? "-"} | ${d.reason ?? "-"}`);
+  }
+}
 async function runHarnessMassDestroy(flagArgs) {
   const USAGE = "wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
   const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE);
@@ -24382,6 +25784,9 @@ Usage:
   wayai admin hubs repair-team-orphans --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]
                                                    Purge hub_team_id references left dangling by a pre-cascade team deletion (silently empties a support agent's queue). Idempotent \u2014 run --dry-run first
 
+  wayai admin orgs repair-legacy-grants --all | --org <org_id> [--dry-run] [--yes] [--json]
+                                                   Repair org-admin roster rows keyed by email with a NULL user_email (pre-#3922 platform-admin adds): grant the real access they never conferred, or drop the phantom seat. Idempotent \u2014 run --dry-run first
+
   wayai admin harness disable                      Flip the platform harness_enabled flag OFF (break-glass: blocks harness-agent writes and the per-turn kill switch aborts each harness turn on its next invocation)
   wayai admin harness enable                       Flip the platform harness_enabled flag ON
   wayai admin harness status                       Print the platform harness_enabled flag
@@ -24420,6 +25825,18 @@ Sources:
                  its owner's Support list silently goes blank; a conversation pinned to a
                  deleted team goes invisible to everyone. Idempotent \u2014 a healthy hub writes
                  nothing, so re-running and --all are both safe.
+  orgs           Org roster repair. \`repair-legacy-grants\` fixes member_grant rows the
+                 platform-admin org-admin add wrote before #3922: the email landed in the
+                 user_id column with user_email NULL. Auth reads UserDO, never member_grant,
+                 so the row grants NOTHING \u2014 while still counting as a seat, which refuses
+                 the org's next legitimate admin add with SEAT_QUOTA_EXCEEDED. It cannot
+                 self-heal (resolveGrantByEmail matches on user_email, and NULL = 'x@y.com'
+                 is NULL). Each row is resolved to a real user and granted both halves of
+                 access, or dropped when no account matches. A repaired row is a REAL grant
+                 to a real person and sends no email, so read --dry-run output as the list of
+                 people about to get access. Idempotent. See
+                 docs/runbooks/legacy-org-grant-repair.md.
+
   sandbox        Run arbitrary code in a fresh E2B sandbox (harness-agents isolation surface).
                  \`exec\` provisions a sandbox from a named Sandbox connection, runs one
                  command, and destroys it. Egress omitted \u21D2 deny-all (fail-closed); opt up
@@ -24456,6 +25873,8 @@ Examples:
   wayai admin observability <hub-id> <conv-id> --message-id <msg-id> --json
   wayai admin sandbox exec "echo hi" --hub <hub-id> --connection <conn-id>
   wayai admin sandbox exec --cmd "curl -s https://api.github.com" --hub <hub-id> --connection <conn-id> --egress allowlist --allow api.github.com
+  wayai admin orgs repair-legacy-grants --all --dry-run
+  wayai admin orgs repair-legacy-grants --org <org-id> --yes
   wayai admin harness disable
   wayai admin harness mass-destroy --all --dry-run
   wayai admin harness mass-destroy --hub <hub-id> --yes
@@ -24480,24 +25899,9 @@ var init_admin = __esm({
     init_skill_version();
     init_file_map();
     init_contracts();
-    VALID_TYPES = dataExplorerDebugDoType.options;
-    VALID_ANALYTICS_TABLES = dataExplorerDebugAnalyticsTable.options;
-    VALID_NOTICE_SEVERITIES = ["critical", "warn", "info"];
-  }
-});
-
-// src/lib/terminal-output.ts
-import { stripVTControlCharacters } from "util";
-function sanitizeTerminalText(value) {
-  const normalizedNewlines = value.replace(/\r\n?/g, "\n");
-  return stripVTControlCharacters(normalizedNewlines).replace(
-    /[\u0000-\u0009\u000b-\u001f\u007f-\u009f]/g,
-    ""
-  );
-}
-var init_terminal_output = __esm({
-  "src/lib/terminal-output.ts"() {
-    "use strict";
+    VALID_TYPES = dataExplorerDebugDoType.options;
+    VALID_ANALYTICS_TABLES = dataExplorerDebugAnalyticsTable.options;
+    VALID_NOTICE_SEVERITIES = ["critical", "warn", "info"];
   }
 });
 
@@ -24963,91 +26367,6 @@ var init_update = __esm({
   }
 });
 
-// src/data/org-context.ts
-function setDataOrgOverride(orgId) {
-  override = orgId;
-}
-function getDataOrgOverride() {
-  return override;
-}
-var override;
-var init_org_context = __esm({
-  "src/data/org-context.ts"() {
-    "use strict";
-  }
-});
-
-// src/data/client.ts
-async function createDataClient(orgId) {
-  const { config, accessToken } = await requireAuth();
-  const api = new ApiClient({ apiUrl: config.api_url, accessToken });
-  const selected = orgId ?? getDataOrgOverride();
-  if (selected !== void 0 && !UUID_RE2.test(selected)) {
-    throw expected(`Invalid --org: ${JSON.stringify(selected)}. Expected an organization UUID.`);
-  }
-  const org = selected ?? readRepoConfig()?.organization_id;
-  return {
-    async request(method, path31, body) {
-      const envelope = await api.dataRequest(method, path31, body, org);
-      return envelope.data;
-    },
-    async collectPages(makePath) {
-      const all = [];
-      const seen = /* @__PURE__ */ new Set();
-      let cursor;
-      for (let page = 0; page < MAX_PAGES; page++) {
-        const { data, meta } = await api.dataRequest("GET", makePath(cursor), void 0, org);
-        for (const row of data ?? []) all.push(row);
-        cursor = meta?.has_more ? meta.cursor : void 0;
-        if (cursor === void 0) break;
-        if (seen.has(cursor)) break;
-        seen.add(cursor);
-      }
-      return all;
-    },
-    async upload(v1Path, bytes, contentType, headers) {
-      const envelope = await api.dataUpload(v1Path, bytes, contentType, org, headers);
-      return envelope.data;
-    },
-    download(v1Path) {
-      return api.dataDownload(v1Path, org);
-    },
-    url(v1Path) {
-      return api.dataUrl(v1Path, org);
-    }
-  };
-}
-function dataErrorEnvelope(err) {
-  if (!(err instanceof ApiError)) return null;
-  try {
-    const parsed = JSON.parse(err.body);
-    return parsed?.error ?? null;
-  } catch {
-    return null;
-  }
-}
-function dataErrorCode(err) {
-  const code = dataErrorEnvelope(err)?.code;
-  return typeof code === "string" && code ? code : null;
-}
-function dataErrorDetails(err) {
-  const details = dataErrorEnvelope(err)?.details;
-  return details && typeof details === "object" ? details : void 0;
-}
-var MAX_PAGES;
-var init_client = __esm({
-  "src/data/client.ts"() {
-    "use strict";
-    init_auth();
-    init_api_client();
-    init_repo_config();
-    init_utils();
-    init_expected();
-    init_org_context();
-    MAX_PAGES = 1e3;
-  }
-});
-
 // src/data/output.ts
 function printOutput(data, format) {
   if (format === "json") {
@@ -25148,140 +26467,6 @@ var init_output = __esm({
   }
 });
 
-// src/lib/base-id.ts
-function isValidBaseId(id) {
-  return BASE_ID_RE.test(id);
-}
-var BASE_ID_RE;
-var init_base_id = __esm({
-  "src/lib/base-id.ts"() {
-    "use strict";
-    BASE_ID_RE = /^(?!\.\.?$)[A-Za-z0-9._-]{1,256}$/;
-  }
-});
-
-// src/data/helpers.ts
-import { readFileSync as readFileSync19 } from "fs";
-function pathSegment(id, label = "id") {
-  if (!isValidBaseId(id)) {
-    throw expected(
-      `Invalid ${label}: ${JSON.stringify(id)}. Ids are slugs \u2014 letters, digits, dot, dash and underscore only.`
-    );
-  }
-  return encodeURIComponent(id);
-}
-function foreignSegment(value, label = "id") {
-  if (value === "." || value === "..") {
-    throw expected(`Invalid ${label}: ${JSON.stringify(value)} is a path traversal segment.`);
-  }
-  return encodeURIComponent(value);
-}
-function pathSegments(value, label = "path") {
-  return value.split("/").map((segment) => foreignSegment(segment, label)).join("/");
-}
-function parseData(data, flag) {
-  const prefix = flag ? `${flag}: ` : "";
-  const source = data.startsWith("@") ? data.slice(1) : void 0;
-  let text = data;
-  if (source !== void 0) {
-    try {
-      text = readFileSync19(source, "utf-8");
-    } catch (e) {
-      throw expected(`${prefix}${source}: ${e instanceof Error ? e.message : "could not be read"}`);
-    }
-  }
-  try {
-    return JSON.parse(text);
-  } catch (e) {
-    const where = source !== void 0 ? ` in ${source}` : "";
-    throw expected(`${prefix}invalid JSON${where}: ${e instanceof Error ? e.message : String(e)}`);
-  }
-}
-function toolsetMcpUrl(slug) {
-  return `https://data-mcp.wayai.pro/t/${slug}/mcp`;
-}
-function globals(cmd) {
-  let namespace = cmd;
-  while (namespace.parent?.parent) namespace = namespace.parent;
-  return namespace.opts();
-}
-function withBaseOption(command2) {
-  return command2.option("--base <id>", "Base id (or set WAYAI_BASE)");
-}
-function baseOptionHolder(cmd) {
-  for (let c = cmd; c; c = c.parent ?? void 0) {
-    if (c.options.some((o) => o.long === "--base")) return c;
-  }
-  return void 0;
-}
-function findBase(cmd) {
-  return baseOptionHolder(cmd)?.opts()?.base;
-}
-function requireBase(cmd) {
-  const base = findBase(cmd) ?? process.env.WAYAI_BASE ?? "";
-  if (base) return base;
-  console.error("Error: --base is required (or set WAYAI_BASE)");
-  return process.exit(1);
-}
-function outputFormat(cmd) {
-  const opts = globals(cmd);
-  return opts.json || opts.output === "json" ? "json" : "table";
-}
-function historyQuery(opts) {
-  const qs = new URLSearchParams();
-  if (opts.limit) qs.set("limit", opts.limit);
-  if (opts.offset) qs.set("offset", opts.offset);
-  if (opts.diff) qs.set("diff", "true");
-  const q = qs.toString();
-  return q ? `?${q}` : "";
-}
-function splitList(value) {
-  return value.split(",").map((v) => v.trim()).filter((v) => v.length > 0);
-}
-function parseByteCount(flag, value) {
-  const n = Number(value);
-  if (!Number.isInteger(n) || n < 0) {
-    throw expected(`${flag} must be a whole number of bytes (0 = unlimited), not ${JSON.stringify(value)}.`);
-  }
-  return n;
-}
-async function readSecret(source, label) {
-  const value = resolveSecretSource(source) === "stdin" ? (await readStdin()).trim() : (await promptSecret(`${label}: `)).trim();
-  if (!value) throw expected(`${label} is required.`);
-  return value;
-}
-function isInteractive() {
-  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
-}
-function parseDuration(input, flag = "duration") {
-  const match = DURATION_RE.exec(input.trim());
-  const value = Number(match?.[1] ?? 0);
-  const unit = match?.[2];
-  const unitMs = unit ? DURATION_UNIT_MS[unit] : void 0;
-  if (!unitMs || value <= 0) {
-    throw expected(
-      `Invalid ${flag} ${JSON.stringify(input)} \u2014 use <number><unit> with unit s/m/h/d (e.g. 10m, 2h, 30d).`
-    );
-  }
-  return value * unitMs;
-}
-var DURATION_RE, DURATION_UNIT_MS;
-var init_helpers = __esm({
-  "src/data/helpers.ts"() {
-    "use strict";
-    init_base_id();
-    init_expected();
-    init_utils();
-    DURATION_RE = /^(\d+)([smhd])$/;
-    DURATION_UNIT_MS = {
-      s: 1e3,
-      m: 6e4,
-      h: 36e5,
-      d: 864e5
-    };
-  }
-});
-
 // src/data/commands/actions.ts
 import { Command } from "commander";
 function buildActionsCommand() {
@@ -25355,7 +26540,7 @@ var init_actions = __esm({
 
 // src/data/commands/attachments.ts
 import { Command as Command2 } from "commander";
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 function findAttachmentByFilename(attachments, filename) {
   return attachments.find((a) => a.key.endsWith(`/${filename}`)) ?? null;
 }
@@ -25396,7 +26581,7 @@ function buildAttachmentsCommand() {
       printOutput(data, outputFormat(this));
       return;
     }
-    const body = readFileSync20(opts.file);
+    const body = readFileSync21(opts.file);
     await client.upload(uploadPathFrom(data?.upload_url), body, opts.contentType);
     printOutput({ ...data, uploaded: true }, outputFormat(this));
   });
@@ -25876,16 +27061,16 @@ var init_providers = __esm({
 
 // src/data/commands/report.ts
 import { Command as Command6 } from "commander";
-import { readFileSync as readFileSync21 } from "fs";
-import { dirname as dirname9, join as join27 } from "path";
+import { readFileSync as readFileSync22 } from "fs";
+import { dirname as dirname11, join as join32 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolveCliVersion() {
   for (const candidate of [
-    join27(here, "..", "package.json"),
-    join27(here, "..", "..", "..", "package.json")
+    join32(here, "..", "package.json"),
+    join32(here, "..", "..", "..", "package.json")
   ]) {
     try {
-      const version = JSON.parse(readFileSync21(candidate, "utf-8")).version;
+      const version = JSON.parse(readFileSync22(candidate, "utf-8")).version;
       if (typeof version === "string" && version) return version;
     } catch {
     }
@@ -26081,13 +27266,13 @@ var init_report2 = __esm({
     init_terminal_output();
     init_workspace();
     init_skill_version();
-    here = dirname9(fileURLToPath2(import.meta.url));
+    here = dirname11(fileURLToPath2(import.meta.url));
   }
 });
 
 // src/data/commands/secrets.ts
 import { Command as Command7 } from "commander";
-import { readFileSync as readFileSync22 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 function withValueSourceOptions(cmd, what) {
   return cmd.option(
     "--file <path>",
@@ -26100,7 +27285,7 @@ async function resolveValue(opts, label) {
       throw expected("--file cannot be combined with --value-stdin or --value-prompt \u2014 pass one.");
     }
     try {
-      return readFileSync22(opts.file).toString("base64");
+      return readFileSync23(opts.file).toString("base64");
     } catch (e) {
       throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -26197,7 +27382,7 @@ var init_secrets = __esm({
 
 // src/data/commands/sql.ts
 import { Command as Command8 } from "commander";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync24 } from "fs";
 function buildBasesSqlCommand() {
   return withBaseOption(new Command8("sql")).description("Execute a read-only SQL query against base data").argument("[query]", "SQL query (SELECT only)").option("--file <path>", "Read SQL from a file instead of the argument").option(
     "--param <kv...>",
@@ -26207,7 +27392,7 @@ function buildBasesSqlCommand() {
     let query;
     if (opts.file) {
       try {
-        query = readFileSync23(opts.file, "utf-8").trim();
+        query = readFileSync24(opts.file, "utf-8").trim();
       } catch (e) {
         throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
       }
@@ -26342,16 +27527,16 @@ MCP URL: ${toolsetMcpUrl(slug)}`);
   ).option("--force", "Revoke even if the token appears to be in live use").action(async function(tokenId, opts) {
     const client = await createDataClient();
     const id = pathSegment(tokenId, "token id");
-    const path31 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
+    const path36 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
     const format = outputFormat(this);
     const revoked = (forced) => printOutput({ token_id: tokenId, revoked: true, forced }, format);
     if (opts.force) {
-      await client.request("DELETE", path31(true));
+      await client.request("DELETE", path36(true));
       revoked(true);
       return;
     }
     try {
-      await client.request("DELETE", path31(false));
+      await client.request("DELETE", path36(false));
       revoked(false);
     } catch (err) {
       if (!(err instanceof ApiError) || err.status !== 409 || dataErrorDetails(err)?.requires_force !== true) {
@@ -26366,7 +27551,7 @@ MCP URL: ${toolsetMcpUrl(slug)}`);
         console.error("Aborted.");
         return process.exit(1);
       }
-      await client.request("DELETE", path31(true));
+      await client.request("DELETE", path36(true));
       revoked(true);
     }
   });
@@ -26485,39 +27670,12 @@ Output:
   }
 });
 
-// src/lib/base-binding.ts
-var binding2, getBaseBindingPath, readBaseBinding, writeBaseBinding, clearBaseBinding, autoBindBaseIfUnbound, assertBaseMatchesBinding, assertNoBindingBlocksBaseCreation;
-var init_base_binding = __esm({
-  "src/lib/base-binding.ts"() {
-    "use strict";
-    init_base_id();
-    init_worktree_binding();
-    binding2 = createWorktreeBinding({
-      filename: "wayai-base-binding",
-      isValidId: isValidBaseId,
-      noun: "base",
-      idLabel: "base id (must be a slug)",
-      unbindCommand: "wayai bases unbind",
-      useCommand: "wayai bases use"
-    });
-    getBaseBindingPath = binding2.getBindingPath;
-    readBaseBinding = binding2.readBinding;
-    writeBaseBinding = binding2.writeBinding;
-    clearBaseBinding = binding2.clearBinding;
-    autoBindBaseIfUnbound = binding2.autoBindIfUnbound;
-    assertBaseMatchesBinding = binding2.assertMatchesBinding;
-    assertNoBindingBlocksBaseCreation = binding2.assertNoBindingBlocksCreation;
-  }
-});
-
 // src/data/commands/bases.ts
 import { Command as Command10 } from "commander";
-import * as fs24 from "fs";
-import * as path30 from "path";
-import * as yaml9 from "js-yaml";
-function pageOf(path31, cursor) {
-  if (!cursor) return path31;
-  return `${path31}${path31.includes("?") ? "&" : "?"}cursor=${encodeURIComponent(cursor)}`;
+import * as path35 from "path";
+function pageOf(path36, cursor) {
+  if (!cursor) return path36;
+  return `${path36}${path36.includes("?") ? "&" : "?"}cursor=${encodeURIComponent(cursor)}`;
 }
 function parseEnum(flag, value, allowed) {
   if (value === void 0) return void 0;
@@ -26658,9 +27816,9 @@ function buildBasesCommand() {
   });
   bases.command("list-previews <origin-id>").description("List preview bases cloned from a base (production or preview)").action(async function(originId) {
     const client = await createDataClient();
-    const path31 = `/v1/${pathSegment(originId, "origin base id")}/previews`;
+    const path36 = `/v1/${pathSegment(originId, "origin base id")}/previews`;
     printOutput(
-      await client.collectPages((cursor) => pageOf(path31, cursor)),
+      await client.collectPages((cursor) => pageOf(path36, cursor)),
       outputFormat(this)
     );
   });
@@ -26693,9 +27851,9 @@ function buildBasesCommand() {
   });
   bases.command("promotions <production-id>").description("List promotion history for a production base").action(async function(productionId) {
     const client = await createDataClient();
-    const path31 = `/v1/${pathSegment(productionId, "production base id")}/promotions`;
+    const path36 = `/v1/${pathSegment(productionId, "production base id")}/promotions`;
     printOutput(
-      await client.collectPages((cursor) => pageOf(path31, cursor)),
+      await client.collectPages((cursor) => pageOf(path36, cursor)),
       outputFormat(this)
     );
   });
@@ -26745,19 +27903,11 @@ function buildBasesCommand() {
 }
 function resolveSelectorToBaseId(selector) {
   const gitRoot = findGitRoot();
-  if (!gitRoot || selector.includes("/") || selector.includes(path30.sep)) return selector;
+  if (!gitRoot || selector.includes("/") || selector.includes(path35.sep)) return selector;
   if (!isValidBaseId(selector)) return selector;
-  const metaPath = path30.join(resolveBasesDir(gitRoot), selector, BASE_META_FILE);
-  let meta;
-  try {
-    meta = yaml9.load(fs24.readFileSync(metaPath, "utf-8"));
-  } catch {
-    return selector;
-  }
-  const id = meta?.[BASE_ID_FIELD];
+  const id = readBaseMeta(path35.join(resolveBasesDir(gitRoot), selector))?.base_id;
   return typeof id === "string" && isValidBaseId(id) ? id : selector;
 }
-var BASE_META_FILE, BASE_ID_FIELD;
 var init_bases = __esm({
   "src/data/commands/bases.ts"() {
     "use strict";
@@ -26775,11 +27925,10 @@ var init_bases = __esm({
     init_terminal_output();
     init_workspace();
     init_layout();
+    init_base_workspace();
     init_base_binding();
     init_base_id();
     init_expected();
-    BASE_META_FILE = "base.yaml";
-    BASE_ID_FIELD = "base_id";
   }
 });
 
@@ -26844,7 +27993,7 @@ var init_file_types = __esm({
 // src/data/commands/files.ts
 import { Command as Command12 } from "commander";
 import { readFileSync as readFileSync25, writeFileSync as writeFileSync16 } from "fs";
-import { basename as basename14 } from "path";
+import { basename as basename18 } from "path";
 function renderFileDiff(fileType, filePath, from, to, d) {
   console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
   const md = d.metadata_delta;
@@ -26876,7 +28025,7 @@ function renderFileDiff(fileType, filePath, from, to, d) {
 }
 function downloadTarget(remotePath, to) {
   if (to) return to;
-  const derived = basename14(remotePath);
+  const derived = basename18(remotePath);
   if (derived === "" || derived === "." || derived === "..") {
     throw expected(
       `Cannot derive a local filename from "${remotePath}" \u2014 pass --to <local> to name it.`
@@ -27252,8 +28401,8 @@ function buildRecordsCommand() {
     const body = { data: parseData(opts.data) };
     if (opts.externalId) body.external_id = opts.externalId;
     if (opts.externalSource) body.external_source = opts.externalSource;
-    const path31 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
-    printOutput(await client.request("PUT", path31, body), outputFormat(this));
+    const path36 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
+    printOutput(await client.request("PUT", path36, body), outputFormat(this));
   });
   records.command("query <record_type>").description("List/search records: exact filters + fuzzy `search`, sorting, pagination").option(
     "--external-source <source>",
@@ -27288,9 +28437,9 @@ function buildRecordsCommand() {
   ).action(async function(recordType2, id, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    let path31 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
-    if (opts.externalSource) path31 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
-    printOutput(await client.request("GET", path31), outputFormat(this));
+    let path36 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    if (opts.externalSource) path36 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
+    printOutput(await client.request("GET", path36), outputFormat(this));
   });
   records.command("delete <record_type> <id>").description(
     "Delete a record by internal ID, or by external_id (pass --external-source to scope it)"
@@ -27304,11 +28453,11 @@ function buildRecordsCommand() {
     }
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    let path31 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    let path36 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
     if (opts.externalSource) {
-      path31 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
+      path36 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
     }
-    await client.request("DELETE", path31);
+    await client.request("DELETE", path36);
     console.log("Deleted");
   });
   records.command("history <id>").description(
@@ -27473,8 +28622,8 @@ function buildRelationshipsCommand() {
     if (opts.data) body.data = parseData(opts.data);
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const path31 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
-    printOutput(await client.request("PUT", path31, body), outputFormat(this));
+    const path36 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
+    printOutput(await client.request("PUT", path36, body), outputFormat(this));
   });
   relationships.command("get <id>").description(
     "Get a relationship by ID (or by its external key: pass the external_id with --rel-type)"
@@ -27707,8 +28856,8 @@ function buildToolsetsCommand() {
   toolsets.command("get <slug>").description("Get a toolset").option("--resolved", "Include resolved record_type schemas").action(async function(slug, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const path31 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
-    printOutput(await client.request("GET", path31), outputFormat(this));
+    const path36 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
+    printOutput(await client.request("GET", path36), outputFormat(this));
   });
   toolsets.command("list").description("List all toolsets").action(async function() {
     const base = pathSegment(requireBase(this), "--base");
@@ -27943,7 +29092,7 @@ init_utils();
 init_registry();
 import { readFileSync as readFileSync26 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname10, join as join29 } from "path";
+import { dirname as dirname12, join as join34 } from "path";
 
 // src/lib/version-refresh.ts
 init_version_cache();
@@ -27951,7 +29100,7 @@ init_skill_version();
 import { exec } from "child_process";
 var REFRESH_TIMEOUT_MS = 1e4;
 function refreshCliCache() {
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     exec("npm view @wayai/cli version", { timeout: REFRESH_TIMEOUT_MS }, (err, stdout) => {
       if (!err) {
         const latest = stdout.trim();
@@ -27962,7 +29111,7 @@ function refreshCliCache() {
           }
         }
       }
-      resolve5();
+      resolve7();
     });
   });
 }
@@ -27988,8 +29137,8 @@ async function refreshSkillCache() {
 }
 async function refreshAdminSkillCache() {
   let timer;
-  const deadline = new Promise((resolve5) => {
-    timer = setTimeout(resolve5, REFRESH_TIMEOUT_MS);
+  const deadline = new Promise((resolve7) => {
+    timer = setTimeout(resolve7, REFRESH_TIMEOUT_MS);
   });
   await Promise.race([deadline, fetchAndCacheAdminSkillVersion().catch(() => {
   })]);
@@ -28098,8 +29247,8 @@ Run \`wayai admin skill install\` to update.`);
 }
 
 // src/index.ts
-var __dirname = dirname10(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync26(join29(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname12(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync26(join34(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
@@ -28338,8 +29487,8 @@ Commands:
   create-credential  Create an organization credential (API key, token, etc.)
   update-credential  Update / rotate an organization credential (by name)
   set-connection-credential  Set a connection's credential directly (org link or --field/--stdin), preview or production
-  pull               Fetch hub config and write local files (also mirrors the linked production hub read-only)
-  push               Parse local files, show diff, sync to preview (creates hub if new)
+  pull               Fetch config and write local files \u2014 \`hubs/<hub>\` or \`bases/<base>\` (also mirrors the linked production hub/base read-only)
+  push               Parse local files, show diff, sync to preview \u2014 \`hubs/<hub>\` or \`bases/<base>\` (creates the hub/base if new)
   create [folder]    Explicitly create a new hub from an idless folder, then push (--label to name the preview)
   diff               Dry-run diff of local files vs the platform (--production diffs vs the linked production hub)
   replicate          Clone a hub into a new sibling preview (--label to name it)
@@ -28378,6 +29527,7 @@ ${await dataHelpBlock()}
 Flags:
   --yes, -y              Skip confirmation prompts (useful for CI and scripting)
   --hub <uuid|name>      Target hub when the workspace has more than one (push, pull, diff, replicate, relabel, publish)
+  --base <id|name>       Target base for pull/push \u2014 routes the invocation to the \`bases/\` subtree (never combined with --hub)
   --production           Diff local preview files against the linked production hub (diff)
   --label <name>         Preview label \u2014 for the new sibling (replicate) or a brand-new hub (create, or push on create)
   --clear                Remove the preview label (relabel)