@wayai/cli 0.3.151 → 0.3.153

package/dist/index.js

@@ -5369,7 +5369,7 @@ function refineHubAsCodeDelegation(config, ctx) {
     });
   });
 }
-var uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, MAX_AUDIO_FILE_BASE64_BYTES, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, PREVIOUS_CONVERSATIONS_MAX, previousConversationsCountField, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupTypeSchema, EVENT_RELATIVE_FOLLOWUP_TYPES, followupTimeUnitSchema, followupIdSchema, SELECTABLE_FOLLOWUP_TYPES, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS, followupSchema, MAX_OUTCOMES_PER_STATUS, kanbanOutcomeSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, MAX_EVAL_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_MAX_RUNS_PER_SCENARIO, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, ISO_UTC_RE, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, evalDateContextSchema, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, createEvalBody, updateEvalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, planKeySchema, billingStatusSchema, billingPlanTypeSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, MAX_RESOURCE_FILE_SIZE, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, baseDestructionConfirmBody, BASE_DESTRUCTION_GRACE_MS, BASE_DESTRUCTION_CONFIRM_TTL_MS, BASE_DESTRUCTION_ORG_QUERY_PARAM, baseDestructionQuery, baseDestructionParam, baseDestructionInitiateBody, baseDestructionStatus, baseDestructionRequest, baseDestructionListResponse, baseDestructionInitiateResponse, baseDestructionConfirmResponse, baseDestructionCancelResponse, rekorBaseChangeMessageSchema;
+var uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, MAX_AUDIO_FILE_BASE64_BYTES, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, PREVIOUS_CONVERSATIONS_MAX, previousConversationsCountField, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupTypeSchema, EVENT_RELATIVE_FOLLOWUP_TYPES, followupTimeUnitSchema, followupIdSchema, SELECTABLE_FOLLOWUP_TYPES, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS, followupSchema, MAX_OUTCOMES_PER_STATUS, kanbanOutcomeSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, MAX_EVAL_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_MAX_RUNS_PER_SCENARIO, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, ISO_UTC_RE, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, evalDateContextSchema, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, createEvalBody, updateEvalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, planKeySchema, billingStatusSchema, billingPlanTypeSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, MAX_RESOURCE_FILE_SIZE, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, META_ENTITY_ID_PATTERN, metaEntityId, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, baseDestructionConfirmBody, BASE_DESTRUCTION_GRACE_MS, BASE_DESTRUCTION_CONFIRM_TTL_MS, BASE_DESTRUCTION_ORG_QUERY_PARAM, baseDestructionQuery, baseDestructionParam, baseDestructionInitiateBody, baseDestructionStatus, baseDestructionRequest, baseDestructionListResponse, baseDestructionInitiateResponse, baseDestructionConfirmResponse, baseDestructionCancelResponse, rekorBaseChangeMessageSchema;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -8087,6 +8087,14 @@ var init_contracts = __esm({
        * accepts it; this exposes it on the route.
        */
       harness_enabled: external_exports.number().int().min(0).max(1).optional(),
+      /**
+       * The ConversationDO `runTurn` TurnState conversion gate (refactor #4 Tier 3,
+       * `turn/` Step A). 0 = off (the RETAINED pre-conversion turn body runs), 1 = on (the
+       * converted `TurnState` body runs). Default-deny, and the reader fails CLOSED — a
+       * platform-config read error also runs the retained body. Both bodies stay compiled in
+       * while this flag is live, so a change to either is a change to both.
+       */
+      turn_state_enabled: external_exports.number().int().min(0).max(1).optional(),
       /**
        * Default eval-session retention window in days, used by every hub that sets no
        * `eval_retention_days` override. `0` disables eval retention platform-wide.
@@ -8303,11 +8311,21 @@ var init_contracts = __esm({
       /** Sandbox wall-clock lifetime in ms (bounded). */
       timeout_ms: external_exports.number().int().min(1).max(SANDBOX_EXEC_MAX_TIMEOUT_MS).optional()
     });
+    META_ENTITY_ID_PATTERN = /^\d{1,32}$/;
+    metaEntityId = external_exports.string().regex(META_ENTITY_ID_PATTERN, "must be a numeric Meta entity id");
     whatsappCallbackBody = external_exports.object({
       state: external_exports.string().min(1, "state is required"),
       code: external_exports.string().optional(),
       access_token: external_exports.string().optional(),
-      user_id: external_exports.string().optional()
+      user_id: external_exports.string().optional(),
+      /**
+       * The phone number and WABA the operator actually picked in Meta's Embedded
+       * Signup popup (posted to the opener as `WA_EMBEDDED_SIGNUP`). Optional:
+       * older clients, and the redirect-based flow, never see that event and fall
+       * back to discovery.
+       */
+      phone_number_id: metaEntityId.optional(),
+      waba_id: metaEntityId.optional()
     }).refine(
       (data) => !!data.access_token || !!data.code,
       { message: "Missing required parameters: state and either access_token or code" }
@@ -8942,7 +8960,7 @@ var init_api_client = __esm({
     init_sentry();
     init_mask_secrets();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
-    delay = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+    delay = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
     ApiError = class extends Error {
       status;
       body;
@@ -9037,12 +9055,14 @@ var init_api_client = __esm({
       async adminRepairLegacyOrgGrants(body) {
         return this.request("POST", "/api/admin/organizations/repair-legacy-grants", body);
       }
-      // Read the platform config (platform-admin gated). Used by `wayai admin harness status`.
+      // Read the platform config (platform-admin gated). Used by every `wayai admin
+      // <gate> status` — `harness`, `turn-state`.
       async adminGetConfig() {
         return this.request("GET", "/api/admin/config");
       }
-      // Patch the platform config (platform-admin gated). Used by `wayai admin harness
-      // disable|enable` to flip `harness_enabled`.
+      // Patch the platform config (platform-admin gated). Used by every `wayai admin
+      // <gate> disable|enable` — `harness` flips `harness_enabled`, `turn-state` flips
+      // `turn_state_enabled`.
       async adminUpdateConfig(body) {
         return this.request("PATCH", "/api/admin/config", body);
       }
@@ -9607,7 +9627,7 @@ var init_api_client = __esm({
        * `dataErrorMessage` recovers the envelope's own message for display.
        *
        * `orgId` is the caller's org SELECTOR (the `--org` flag, else the repo's
-       * `.wayai.yaml`), not an authorization claim: the backend validates it against
+       * `wayai-ws/wayai.yaml`), not an authorization claim: the backend validates it against
        * the caller's grants and attests only the validated result. A multi-org user
        * needs it to pick; a single-org user can omit it.
        *
@@ -10608,7 +10628,7 @@ function findStepBoundaries(transcript) {
   }
   return out;
 }
-var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, REKOR_ACTOR_TYPE_HEADER2, REKOR_ACTOR_ID_HEADER2, REKOR_ACTOR_LABEL_HEADER2, REKOR_ACTOR_ORG_HEADER2, REKOR_ACTOR_ADMIN_HEADER2, REKOR_CLIENT_HEADER2, REKOR_TOOL_ID_HEADER2, REKOR_CLIENTS2, rekorClientSchema2, MAX_REKOR_TOOL_ID_LENGTH2, rekorToolIdSchema2, DATA_PROXY_MOUNT2, DATA_PROXY_PREFIX2, DATA_PROXY_ORG_QUERY_PARAM2, MAX_PROVISIONING_BODY_BYTES2, dataProxyQuery2, rekorAttestation2, REQUIRED_REKOR_ATTESTATION_HEADERS2, BASE_DESTRUCTION_MOUNT2, BASE_DESTRUCTION_PREFIX2, BASE_DESTRUCTION_CONFIRM_PATH2, baseDestructionConfirmBody2, BASE_DESTRUCTION_GRACE_MS2, BASE_DESTRUCTION_CONFIRM_TTL_MS2, BASE_DESTRUCTION_ORG_QUERY_PARAM2, baseDestructionQuery2, baseDestructionParam2, baseDestructionInitiateBody2, baseDestructionStatus2, baseDestructionRequest2, baseDestructionListResponse2, baseDestructionInitiateResponse2, baseDestructionConfirmResponse2, baseDestructionCancelResponse2, ENDPOINT_CONFIGS, AUTH_TYPE2, ORG_CREDENTIAL_AUTH_TYPES2, AUTH_TYPE_DISPLAY2, LEGACY_AUTH_TYPE_MAP2, VALID_AUTH_TYPES2, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, MAX_AUDIO_FILE_BASE64_BYTES2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, PREVIOUS_CONVERSATIONS_MAX2, previousConversationsCountField2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupTypeSchema2, EVENT_RELATIVE_FOLLOWUP_TYPES2, followupTimeUnitSchema2, followupIdSchema2, SELECTABLE_FOLLOWUP_TYPES2, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS2, followupSchema2, MAX_OUTCOMES_PER_STATUS2, kanbanOutcomeSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, MAX_EVAL_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, CONTEXT_BOUNDARIES2, contextBoundarySchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, ORG_TAG_NAME_REGEX2, ORG_TAG_NAME_MAX_LENGTH2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, BASE_CREDENTIAL_NAME_MAX2, baseCredentialNameSchema2, createBaseCredentialLinkBody2, baseCredentialLinkParams2, baseCredentialLinkQuery2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlTable2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_MAX_RUNS_PER_SCENARIO2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, ISO_UTC_RE2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, evalDateContextSchema2, EVAL_FIXTURE_NAME_MAX_LENGTH2, evalFixtureOverrideSchema2, runSessionQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, EVAL_INITIAL_STATE_SCOPES2, MAX_INITIAL_STATE_ENTRIES2, evalInitialStateEntry2, createEvalBody2, updateEvalBody2, EVAL_LIST_MAX_LIMIT2, evalListLimit2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, EVAL_MAX_SELECTED_SCENARIOS2, evalScenarioSelectionEntrySchema2, evalScenarioSelectionSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, EVAL_ATTACHMENT_HASH_REGEX2, evalAttachmentRef2, turnMayCarryAttachments2, ATTACHMENTS_USER_ONLY_MESSAGE2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, evalSessionConfigResponseSchema2, evalSessionResponseSchema2, evalSessionListConfigSchema2, evalSessionListItemSchema2, seedReleaseStatusSchema2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, apiChannelMessage2, apiChannelMessageBody2, appMessageBody2, appMessageResponse2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, deleteUserConversationsResponse2, sendMessageBody2, listConversationsQuery2, flagSourceSchema2, getConversationsResponse2, getConversationDetailParams2, getConversationDetailQuery2, getConversationDetailResponse2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, copilotSuggestBody2, copilotSuggestResponse2, CONSULT_THREAD_STATUSES2, consultThreadStatus2, CONSULT_THREAD_TITLE_MAX2, consultThreadTitle2, consultThreadSummary2, listConsultThreadsQuery2, listConsultThreadsResponse2, createConsultThreadBody2, createConsultThreadResponse2, consultThreadIdParam2, updateConsultThreadBody2, updateConsultThreadResponse2, CONSULT_AWAIT_TIMEOUT_MS2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, planKeySchema2, billingStatusSchema2, billingPlanTypeSchema2, REKOR_ENTITLEMENT_CONTRACT_VERSION2, entitlementProjectionSchema2, rekorEntitlementRefreshMessageSchema2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, MAX_RESOURCE_FILE_SIZE2, MAX_10MB_BASE64_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_CARRIERS2, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2, MAX_RESOURCE_ENCODED_BYTES2, MAX_HUB_AS_CODE_RESOURCES2, MAX_HUB_AS_CODE_RESOURCE_FILES2, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES2, MAX_CI_CONFIG_BODY_BYTES2, hubAsCodeStateSchema2, hubAsCodeResourceFileSchema2, hubAsCodeResourceSchema2, uuidPattern2, ciUuidSchema2, boundedHubAsCodeResourcesSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, CI_APPLY_ENTITY_KINDS2, CI_APPLY_OPERATIONS2, ciApplyErrorBaseSchema2, ciApplyErrorSchema2, ciSyncCountSchema2, ciSyncChangesSchema2, ciSyncWarningSchema2, ciSyncResponseSchema2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, PRICING_PLAN_ID_RE2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminScopedTargetBody2, adminRepairLegacyOrgGrantsBody2, adminRepairCompedPlansBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysBody2, dataExplorerKvKeyBody2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteBody2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, passwordLoginBody2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, reportMessageSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, reporterReportSummarySchema2, reporterListResponseSchema2, getReportResponseSchema2, reporterTransitionResponseSchema2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2, rekorBaseChangeMessageSchema2, WAYAI_WORKSPACE_LAYOUT;
+var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, REKOR_ACTOR_TYPE_HEADER2, REKOR_ACTOR_ID_HEADER2, REKOR_ACTOR_LABEL_HEADER2, REKOR_ACTOR_ORG_HEADER2, REKOR_ACTOR_ADMIN_HEADER2, REKOR_CLIENT_HEADER2, REKOR_TOOL_ID_HEADER2, REKOR_CLIENTS2, rekorClientSchema2, MAX_REKOR_TOOL_ID_LENGTH2, rekorToolIdSchema2, DATA_PROXY_MOUNT2, DATA_PROXY_PREFIX2, DATA_PROXY_ORG_QUERY_PARAM2, MAX_PROVISIONING_BODY_BYTES2, dataProxyQuery2, rekorAttestation2, REQUIRED_REKOR_ATTESTATION_HEADERS2, BASE_DESTRUCTION_MOUNT2, BASE_DESTRUCTION_PREFIX2, BASE_DESTRUCTION_CONFIRM_PATH2, baseDestructionConfirmBody2, BASE_DESTRUCTION_GRACE_MS2, BASE_DESTRUCTION_CONFIRM_TTL_MS2, BASE_DESTRUCTION_ORG_QUERY_PARAM2, baseDestructionQuery2, baseDestructionParam2, baseDestructionInitiateBody2, baseDestructionStatus2, baseDestructionRequest2, baseDestructionListResponse2, baseDestructionInitiateResponse2, baseDestructionConfirmResponse2, baseDestructionCancelResponse2, ENDPOINT_CONFIGS, AUTH_TYPE2, ORG_CREDENTIAL_AUTH_TYPES2, AUTH_TYPE_DISPLAY2, LEGACY_AUTH_TYPE_MAP2, VALID_AUTH_TYPES2, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, MAX_AUDIO_FILE_BASE64_BYTES2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, PREVIOUS_CONVERSATIONS_MAX2, previousConversationsCountField2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupTypeSchema2, EVENT_RELATIVE_FOLLOWUP_TYPES2, followupTimeUnitSchema2, followupIdSchema2, SELECTABLE_FOLLOWUP_TYPES2, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS2, followupSchema2, MAX_OUTCOMES_PER_STATUS2, kanbanOutcomeSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, MAX_EVAL_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, CONTEXT_BOUNDARIES2, contextBoundarySchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, ORG_TAG_NAME_REGEX2, ORG_TAG_NAME_MAX_LENGTH2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, BASE_CREDENTIAL_NAME_MAX2, baseCredentialNameSchema2, createBaseCredentialLinkBody2, baseCredentialLinkParams2, baseCredentialLinkQuery2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlTable2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_MAX_RUNS_PER_SCENARIO2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, ISO_UTC_RE2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, evalDateContextSchema2, EVAL_FIXTURE_NAME_MAX_LENGTH2, evalFixtureOverrideSchema2, runSessionQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, EVAL_INITIAL_STATE_SCOPES2, MAX_INITIAL_STATE_ENTRIES2, evalInitialStateEntry2, createEvalBody2, updateEvalBody2, EVAL_LIST_MAX_LIMIT2, evalListLimit2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, EVAL_MAX_SELECTED_SCENARIOS2, evalScenarioSelectionEntrySchema2, evalScenarioSelectionSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, EVAL_ATTACHMENT_HASH_REGEX2, evalAttachmentRef2, turnMayCarryAttachments2, ATTACHMENTS_USER_ONLY_MESSAGE2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, evalSessionConfigResponseSchema2, evalSessionResponseSchema2, evalSessionListConfigSchema2, evalSessionListItemSchema2, seedReleaseStatusSchema2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, apiChannelMessage2, apiChannelMessageBody2, appMessageBody2, appMessageResponse2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, deleteUserConversationsResponse2, sendMessageBody2, listConversationsQuery2, flagSourceSchema2, getConversationsResponse2, getConversationDetailParams2, getConversationDetailQuery2, getConversationDetailResponse2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, copilotSuggestBody2, copilotSuggestResponse2, CONSULT_THREAD_STATUSES2, consultThreadStatus2, CONSULT_THREAD_TITLE_MAX2, consultThreadTitle2, consultThreadSummary2, listConsultThreadsQuery2, listConsultThreadsResponse2, createConsultThreadBody2, createConsultThreadResponse2, consultThreadIdParam2, updateConsultThreadBody2, updateConsultThreadResponse2, CONSULT_AWAIT_TIMEOUT_MS2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, planKeySchema2, billingStatusSchema2, billingPlanTypeSchema2, REKOR_ENTITLEMENT_CONTRACT_VERSION2, entitlementProjectionSchema2, rekorEntitlementRefreshMessageSchema2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, MAX_RESOURCE_FILE_SIZE2, MAX_10MB_BASE64_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_ENCODED_BYTES2, MAX_EVAL_ATTACHMENT_CARRIERS2, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES2, MAX_RESOURCE_ENCODED_BYTES2, MAX_HUB_AS_CODE_RESOURCES2, MAX_HUB_AS_CODE_RESOURCE_FILES2, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES2, MAX_CI_CONFIG_BODY_BYTES2, hubAsCodeStateSchema2, hubAsCodeResourceFileSchema2, hubAsCodeResourceSchema2, uuidPattern2, ciUuidSchema2, boundedHubAsCodeResourcesSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, CI_APPLY_ENTITY_KINDS2, CI_APPLY_OPERATIONS2, ciApplyErrorBaseSchema2, ciApplyErrorSchema2, ciSyncCountSchema2, ciSyncChangesSchema2, ciSyncWarningSchema2, ciSyncResponseSchema2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, PRICING_PLAN_ID_RE2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminScopedTargetBody2, adminRepairLegacyOrgGrantsBody2, adminRepairCompedPlansBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysBody2, dataExplorerKvKeyBody2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteBody2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, META_ENTITY_ID_PATTERN2, metaEntityId2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, passwordLoginBody2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, reportMessageSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, reporterReportSummarySchema2, reporterListResponseSchema2, getReportResponseSchema2, reporterTransitionResponseSchema2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2, rekorBaseChangeMessageSchema2, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
@@ -13767,6 +13787,14 @@ var init_dist = __esm({
        * accepts it; this exposes it on the route.
        */
       harness_enabled: external_exports.number().int().min(0).max(1).optional(),
+      /**
+       * The ConversationDO `runTurn` TurnState conversion gate (refactor #4 Tier 3,
+       * `turn/` Step A). 0 = off (the RETAINED pre-conversion turn body runs), 1 = on (the
+       * converted `TurnState` body runs). Default-deny, and the reader fails CLOSED — a
+       * platform-config read error also runs the retained body. Both bodies stay compiled in
+       * while this flag is live, so a change to either is a change to both.
+       */
+      turn_state_enabled: external_exports.number().int().min(0).max(1).optional(),
       /**
        * Default eval-session retention window in days, used by every hub that sets no
        * `eval_retention_days` override. `0` disables eval retention platform-wide.
@@ -13983,11 +14011,21 @@ var init_dist = __esm({
       /** Sandbox wall-clock lifetime in ms (bounded). */
       timeout_ms: external_exports.number().int().min(1).max(SANDBOX_EXEC_MAX_TIMEOUT_MS2).optional()
     });
+    META_ENTITY_ID_PATTERN2 = /^\d{1,32}$/;
+    metaEntityId2 = external_exports.string().regex(META_ENTITY_ID_PATTERN2, "must be a numeric Meta entity id");
     whatsappCallbackBody2 = external_exports.object({
       state: external_exports.string().min(1, "state is required"),
       code: external_exports.string().optional(),
       access_token: external_exports.string().optional(),
-      user_id: external_exports.string().optional()
+      user_id: external_exports.string().optional(),
+      /**
+       * The phone number and WABA the operator actually picked in Meta's Embedded
+       * Signup popup (posted to the opener as `WA_EMBEDDED_SIGNUP`). Optional:
+       * older clients, and the redirect-based flow, never see that event and fall
+       * back to discovery.
+       */
+      phone_number_id: metaEntityId2.optional(),
+      waba_id: metaEntityId2.optional()
     }).refine(
       (data) => !!data.access_token || !!data.code,
       { message: "Missing required parameters: state and either access_token or code" }
@@ -14516,34 +14554,15 @@ function resolveLayout(gitRoot, layout = WAYAI_LAYOUT) {
   const newWs = path.join(gitRoot, layout.wsDir);
   const legacyWs = path.join(gitRoot, layout.legacy.wsDir);
   const legacyOrg = path.join(gitRoot, layout.legacy.orgAtRoot);
-  const newExists = isDirectory(newWs);
   const legacyExists = isDirectory(legacyWs) || isDirectory(legacyOrg);
   const basesDir = path.join(newWs, layout.basesSubdir);
-  if (newExists) {
-    return {
-      hubsDir: path.join(newWs, layout.hubsSubdir),
-      orgDir: path.join(newWs, layout.orgSubdir),
-      basesDir,
-      isLegacy: false,
-      legacyAlsoPresent: legacyExists
-    };
+  const hubsDir = path.join(newWs, layout.hubsSubdir);
+  const orgDir = path.join(newWs, layout.orgSubdir);
+  const newDisplacesLegacy = () => isDirectory(hubsDir) || isDirectory(orgDir) || isDirectory(basesDir);
+  if (legacyExists && !newDisplacesLegacy()) {
+    return { hubsDir: legacyWs, orgDir: legacyOrg, basesDir, isLegacy: true, legacyAlsoPresent: false };
   }
-  if (legacyExists) {
-    return {
-      hubsDir: legacyWs,
-      orgDir: legacyOrg,
-      basesDir,
-      isLegacy: true,
-      legacyAlsoPresent: false
-    };
-  }
-  return {
-    hubsDir: path.join(newWs, layout.hubsSubdir),
-    orgDir: path.join(newWs, layout.orgSubdir),
-    basesDir,
-    isLegacy: false,
-    legacyAlsoPresent: false
-  };
+  return { hubsDir, orgDir, basesDir, isLegacy: false, legacyAlsoPresent: legacyExists };
 }
 function resolveBasesDir(gitRoot) {
   return resolveLayout(gitRoot).basesDir;
@@ -14960,111 +14979,344 @@ var init_workspace = __esm({
   }
 });
 
+// src/lib/workspace-manifest.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+import * as yaml2 from "js-yaml";
+function workspaceManifestPath(gitRoot) {
+  return path3.join(gitRoot, WAYAI_LAYOUT.wsDir, WORKSPACE_MANIFEST_FILE);
+}
+function rootConfigPath(gitRoot) {
+  return path3.join(gitRoot, ROOT_CONFIG_FILE);
+}
+function loadYamlMapping(file) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(file, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "absent" };
+    return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  let doc;
+  try {
+    doc = yaml2.load(raw);
+  } catch (err) {
+    return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  if (doc === void 0 || doc === null) return { kind: "ok", doc: {} };
+  if (typeof doc !== "object" || Array.isArray(doc)) {
+    return { kind: "malformed", reason: "expected a YAML mapping of settings" };
+  }
+  return { kind: "ok", doc };
+}
+function loadWorkspaceManifest(gitRoot) {
+  return loadYamlMapping(workspaceManifestPath(gitRoot));
+}
+var WORKSPACE_MANIFEST_FILE, WORKSPACE_MANIFEST_LABEL, ROOT_CONFIG_FILE;
+var init_workspace_manifest = __esm({
+  "src/lib/workspace-manifest.ts"() {
+    "use strict";
+    init_layout();
+    WORKSPACE_MANIFEST_FILE = "wayai.yaml";
+    WORKSPACE_MANIFEST_LABEL = `${WAYAI_LAYOUT.wsDir}/${WORKSPACE_MANIFEST_FILE}`;
+    ROOT_CONFIG_FILE = ".wayai.yaml";
+  }
+});
+
 // src/lib/repo-config.ts
 var repo_config_exports = {};
 __export(repo_config_exports, {
+  _resetRepoConfigNotices: () => _resetRepoConfigNotices,
+  planOrgMigration: () => planOrgMigration,
   readRepoConfig: () => readRepoConfig,
+  readRepoConfigUnlessBlocked: () => readRepoConfigUnlessBlocked,
+  readRepoScopeBlocker: () => readRepoScopeBlocker,
   requireRepoConfig: () => requireRepoConfig,
+  resolveRepoConfig: () => resolveRepoConfig,
   writeRepoConfig: () => writeRepoConfig
 });
-import * as fs3 from "fs";
-import * as path3 from "path";
-import * as yaml2 from "js-yaml";
-function warnAboutLegacyFields(found) {
-  if (legacyFieldsWarned || found.length === 0) return;
-  legacyFieldsWarned = true;
-  console.warn(
-    `Note: .wayai.yaml contains deprecated field(s) ${found.join(", ")}. These are ignored \u2014 only organization_id is used now. You can remove them.`
-  );
+import * as fs4 from "fs";
+import * as path4 from "path";
+import * as yaml3 from "js-yaml";
+function noticeOnce(key, emit) {
+  if (noticed.has(key)) return;
+  noticed.add(key);
+  emit();
+}
+function _resetRepoConfigNotices() {
+  noticed.clear();
+}
+function readOrgFields(doc) {
+  const raw = doc.organization_id;
+  if (raw === void 0 || raw === null) {
+    if (typeof doc.organization === "string") {
+      return {
+        kind: "invalid",
+        detail: "it uses the old format (organization: <name>) \u2014 replace it with organization_id: <uuid>"
+      };
+    }
+    return { kind: "none" };
+  }
+  if (typeof raw !== "string" || !UUID_RE2.test(raw.trim())) {
+    return { kind: "invalid", detail: "organization_id must be a UUID" };
+  }
+  const name = typeof doc.organization_name === "string" && doc.organization_name.trim() ? doc.organization_name.trim() : void 0;
+  const config = { organization_id: raw.trim() };
+  if (name) config.organization_name = name;
+  return { kind: "declared", config };
+}
+function declarationFrom(load11) {
+  if (load11.kind === "absent") return { kind: "none" };
+  if (load11.kind === "malformed") return { kind: "invalid", detail: `it does not parse (${load11.reason})` };
+  return readOrgFields(load11.doc);
+}
+function legacyFieldsIn(load11) {
+  if (load11.kind !== "ok") return [];
+  return LEGACY_FIELDS.filter((f) => load11.doc[f] !== void 0);
+}
+function resolve2(gitRoot) {
+  const manifestFile = workspaceManifestPath(gitRoot);
+  const manifest = declarationFrom(loadWorkspaceManifest(gitRoot));
+  if (manifest.kind === "invalid") {
+    return { kind: "invalid", source: "manifest", file: manifestFile, detail: manifest.detail };
+  }
+  const rootFile = rootConfigPath(gitRoot);
+  const rootLoad = loadYamlMapping(rootFile);
+  const root = declarationFrom(rootLoad);
+  if (manifest.kind === "declared") {
+    if (root.kind === "declared" && root.config.organization_id !== manifest.config.organization_id) {
+      return {
+        kind: "conflict",
+        manifestOrg: manifest.config.organization_id,
+        rootOrg: root.config.organization_id
+      };
+    }
+    return {
+      kind: "ok",
+      resolved: { config: manifest.config, source: "manifest", path: manifestFile },
+      legacyRootFields: []
+    };
+  }
+  if (root.kind === "declared") {
+    return {
+      kind: "ok",
+      resolved: { config: root.config, source: "root", path: rootFile },
+      legacyRootFields: legacyFieldsIn(rootLoad)
+    };
+  }
+  if (root.kind === "invalid") {
+    return { kind: "invalid", source: "root", file: rootFile, detail: root.detail };
+  }
+  return { kind: "none" };
+}
+function conflictMessage(manifestOrg, rootOrg, remedy = RECONCILE_REMEDY) {
+  return [
+    "Refusing to guess the organization: two files in this repo name different ones.",
+    `  ${WORKSPACE_MANIFEST_LABEL} -> ${manifestOrg}   (the workspace manifest)`,
+    `  ${ROOT_CONFIG_FILE} -> ${rootOrg}   (deprecated fallback)`,
+    "",
+    ...remedy
+  ].join("\n");
+}
+function rebindRefusal(requestedOrg, rootOrg) {
+  return [
+    `Refusing to re-bind the organization: ${ROOT_CONFIG_FILE} still names a different one, and it is read as a fallback.`,
+    `  requested        -> ${requestedOrg}`,
+    `  ${ROOT_CONFIG_FILE}      -> ${rootOrg}   (deprecated fallback)`,
+    "",
+    `Delete ${ROOT_CONFIG_FILE} (or set its organization_id to ${requestedOrg}), then re-run.`,
+    "Nothing was written \u2014 this repo still resolves to the organization it had."
+  ].join("\n");
+}
+function invalidMessage(file, detail) {
+  return [
+    `Invalid organization binding in ${file}: ${detail}.`,
+    "",
+    "  organization_id: <your-org-uuid>",
+    "",
+    "Run `wayai init` to set up the workspace."
+  ].join("\n");
+}
+function missingMessage() {
+  return [
+    "This repository is not scoped to an organization.",
+    `Declare it in ${WORKSPACE_MANIFEST_LABEL}:`,
+    "",
+    "  organization_id: <your-org-uuid>",
+    "",
+    "Run `wayai init` to set up the workspace."
+  ].join("\n");
+}
+function report(r, posture) {
+  switch (r.kind) {
+    case "ok":
+      if (r.resolved.source !== "root") return;
+      noticeOnce(
+        "root-fallback",
+        () => console.warn(
+          `Note: this repo's organization binding is still in ${ROOT_CONFIG_FILE} at the repository root. It belongs in the workspace manifest ${WORKSPACE_MANIFEST_LABEL} \u2014 run \`wayai migrate\` to copy it there.`
+        )
+      );
+      if (r.legacyRootFields.length > 0) {
+        noticeOnce(
+          "legacy-fields",
+          () => console.warn(
+            `Note: ${ROOT_CONFIG_FILE} contains deprecated field(s) ${r.legacyRootFields.join(", ")}. These are ignored \u2014 only organization_id is used now. You can remove them.`
+          )
+        );
+      }
+      return;
+    case "invalid": {
+      const emit = () => console.error(invalidMessage(r.file, r.detail));
+      if (posture === "hard") emit();
+      else noticeOnce(`invalid:${r.source}`, emit);
+      return;
+    }
+    case "conflict":
+      console.error(conflictMessage(r.manifestOrg, r.rootOrg));
+      return;
+    case "none":
+      if (posture === "hard") console.error(missingMessage());
+      return;
+  }
+}
+function resolveRepoConfig(root) {
+  const gitRoot = root ?? findGitRoot();
+  if (!gitRoot) return null;
+  const r = resolve2(gitRoot);
+  report(r, "soft");
+  return r.kind === "ok" ? r.resolved : null;
 }
 function readRepoConfig(root) {
+  return resolveRepoConfig(root)?.config ?? null;
+}
+function readRepoConfigUnlessBlocked(root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) return null;
-  const configPath3 = path3.join(gitRoot, ".wayai.yaml");
-  if (!fs3.existsSync(configPath3)) return null;
-  try {
-    const content = fs3.readFileSync(configPath3, "utf-8");
-    const config = yaml2.load(content);
-    if (!config?.organization_id || typeof config.organization_id !== "string") {
-      if (config?.organization && typeof config.organization === "string") {
-        console.error(
-          ".wayai.yaml uses the old format (organization: name). Replace it with organization_id: <uuid>."
-        );
-      }
+  const r = resolve2(gitRoot);
+  switch (r.kind) {
+    case "ok":
+      report(r, "soft");
+      return r.resolved.config;
+    case "none":
       return null;
-    }
-    if (!UUID_RE2.test(config.organization_id)) return null;
-    const presentLegacy = LEGACY_FIELDS.filter((f) => config[f] !== void 0);
-    warnAboutLegacyFields(presentLegacy);
-    const organizationName = typeof config.organization_name === "string" && config.organization_name.trim() ? config.organization_name.trim() : void 0;
+    case "conflict":
+      throw expected(conflictMessage(r.manifestOrg, r.rootOrg));
+    case "invalid":
+      throw expected(invalidMessage(r.file, r.detail));
+  }
+}
+function requireRepoConfig(root) {
+  const gitRoot = root ?? findGitRoot();
+  const r = gitRoot ? resolve2(gitRoot) : { kind: "none" };
+  report(r, "hard");
+  if (r.kind === "ok") return r.resolved.config;
+  return process.exit(1);
+}
+function readRepoScopeBlocker(root) {
+  const gitRoot = root ?? findGitRoot();
+  if (!gitRoot) return null;
+  const r = resolve2(gitRoot);
+  if (r.kind === "conflict") {
     return {
-      organization_id: config.organization_id,
-      organization_name: organizationName
+      kind: "conflict",
+      manifest_organization_id: r.manifestOrg,
+      root_organization_id: r.rootOrg
     };
-  } catch {
-    return null;
   }
+  if (r.kind === "invalid") return { kind: "invalid", path: r.file, detail: r.detail };
+  return null;
 }
-function requireRepoConfig(root) {
-  const config = readRepoConfig(root);
-  if (!config) {
-    console.error("Missing or invalid .wayai.yaml at the repository root.");
-    console.error("The file must contain organization_id:");
-    console.error("");
-    console.error("  organization_id: <your-org-uuid>");
-    console.error("");
-    console.error("Run `wayai init` to set up the workspace.");
-    process.exit(1);
+function planOrgMigration(gitRoot) {
+  const manifest = declarationFrom(loadWorkspaceManifest(gitRoot));
+  const root = declarationFrom(loadYamlMapping(rootConfigPath(gitRoot)));
+  if (root.kind !== "declared") return { kind: "nothing" };
+  if (manifest.kind === "declared") {
+    if (manifest.config.organization_id === root.config.organization_id) return { kind: "nothing" };
+    return {
+      kind: "refuse",
+      message: conflictMessage(manifest.config.organization_id, root.config.organization_id, [
+        "Reconcile them by hand \u2014 migrate cannot know which one you meant."
+      ])
+    };
   }
-  return config;
+  if (manifest.kind === "invalid") {
+    return {
+      kind: "refuse",
+      message: `Cannot copy the organization binding: ${WORKSPACE_MANIFEST_LABEL} is unusable \u2014 ${manifest.detail}. Fix or delete it, then re-run \`wayai migrate\`.`
+    };
+  }
+  return { kind: "copy", config: root.config };
 }
 function writeRepoConfig(config, root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) {
     throw new Error("Not inside a git repository. Run `git init` first.");
   }
-  const configPath3 = path3.join(gitRoot, ".wayai.yaml");
+  const stale = declarationFrom(loadYamlMapping(rootConfigPath(gitRoot)));
+  if (stale.kind === "declared" && stale.config.organization_id !== config.organization_id) {
+    throw expected(rebindRefusal(config.organization_id, stale.config.organization_id));
+  }
+  const load11 = loadWorkspaceManifest(gitRoot);
+  if (load11.kind === "malformed") {
+    throw expected(
+      `Cannot write the organization binding: ${WORKSPACE_MANIFEST_LABEL} does not parse (${load11.reason}). Fix or delete it, then re-run.`
+    );
+  }
+  const { organization_id: _id, organization_name: _name, ...rest } = load11.kind === "ok" ? load11.doc : {};
   const doc = { organization_id: config.organization_id };
   if (config.organization_name?.trim()) doc.organization_name = config.organization_name.trim();
-  const content = yaml2.dump(doc, { quotingType: '"', forceQuotes: false });
-  fs3.writeFileSync(configPath3, content, "utf-8");
-  return configPath3;
+  Object.assign(doc, rest);
+  const file = workspaceManifestPath(gitRoot);
+  fs4.mkdirSync(path4.dirname(file), { recursive: true });
+  fs4.writeFileSync(
+    file,
+    yaml3.dump(doc, { lineWidth: -1, quotingType: '"', forceQuotes: false }),
+    "utf-8"
+  );
+  return file;
 }
-var LEGACY_FIELDS, legacyFieldsWarned;
+var LEGACY_FIELDS, noticed, RECONCILE_REMEDY;
 var init_repo_config = __esm({
   "src/lib/repo-config.ts"() {
     "use strict";
+    init_expected();
     init_workspace();
     init_utils();
+    init_workspace_manifest();
     LEGACY_FIELDS = ["project_id", "project_name", "hub_id", "hub_name"];
-    legacyFieldsWarned = false;
+    noticed = /* @__PURE__ */ new Set();
+    RECONCILE_REMEDY = [
+      "Keep the organization_id you actually work in and delete the other declaration.",
+      `\`wayai init\` rewrites ${WORKSPACE_MANIFEST_LABEL}; the root file is yours to remove.`
+    ];
   }
 });
 
 // src/lib/utils.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as path5 from "path";
 import * as readline from "readline";
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve7(answer.trim());
+      resolve8(answer.trim());
     });
   });
 }
 function confirm(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
-      resolve7(answer.trim().toLowerCase() === "y");
+      resolve8(answer.trim().toLowerCase() === "y");
     });
   });
 }
 function promptSecret(question) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const originalWrite = rl._writeToOutput;
     let firstWrite = true;
@@ -15080,25 +15332,25 @@ function promptSecret(question) {
       rl._writeToOutput = originalWrite;
       process.stdout.write("\n");
       rl.close();
-      resolve7(answer);
+      resolve8(answer);
     });
   });
 }
 function readStdin() {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
-    process.stdin.on("end", () => resolve7(data.trim()));
+    process.stdin.on("end", () => resolve8(data.trim()));
     process.stdin.on("error", reject);
   });
 }
 function resolveHubYamlPath(hubFolder) {
   for (const filename of ["hub.yaml", "wayai.yaml"]) {
-    const yamlPath = path4.join(hubFolder, filename);
-    if (fs4.existsSync(yamlPath)) return yamlPath;
+    const yamlPath = path5.join(hubFolder, filename);
+    if (fs5.existsSync(yamlPath)) return yamlPath;
   }
   return null;
 }
@@ -15175,8 +15427,8 @@ async function resolveOrganizationId(client, orgIdFlag) {
     }
     return { organizationId: orgIdFlag };
   }
-  const { readRepoConfig: readRepoConfig2 } = await Promise.resolve().then(() => (init_repo_config(), repo_config_exports));
-  const repoConfig = readRepoConfig2();
+  const { readRepoConfigUnlessBlocked: readRepoConfigUnlessBlocked2 } = await Promise.resolve().then(() => (init_repo_config(), repo_config_exports));
+  const repoConfig = readRepoConfigUnlessBlocked2();
   if (repoConfig) {
     return { organizationId: repoConfig.organization_id, organizationName: repoConfig.organization_name };
   }
@@ -15312,7 +15564,7 @@ var init_registry = __esm({
         surviving: null,
         clause: 1,
         shipped: true,
-        reason: "One root org binding (`.wayai.yaml`), so one `init`."
+        reason: "One org binding per repo (`wayai-ws/wayai.yaml`), so one `init`."
       },
       {
         original: "update",
@@ -15563,8 +15815,8 @@ var init_registry = __esm({
 });
 
 // src/lib/version-cache.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync } from "fs";
-import { dirname as dirname3, join as join6 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
 import { homedir as homedir2 } from "os";
 function getVersionCachePath(filename = CLI_CACHE_FILE) {
   return join6(homedir2(), ".wayai", filename);
@@ -15572,7 +15824,7 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
     const path35 = getVersionCachePath(filename);
-    if (!existsSync4(path35)) return null;
+    if (!existsSync3(path35)) return null;
     const parsed = JSON.parse(readFileSync5(path35, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
@@ -15594,8 +15846,8 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
 }
 function writeVersionCache(filename, cache) {
   const path35 = getVersionCachePath(filename);
-  const dir = dirname3(path35);
-  if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
+  const dir = dirname4(path35);
+  if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
   writeFileSync2(path35, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
@@ -15613,9 +15865,9 @@ var init_version_cache = __esm({
 });
 
 // src/lib/skill-version.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
 import { join as join7 } from "path";
-import * as yaml3 from "js-yaml";
+import * as yaml4 from "js-yaml";
 function skillInstallPaths(skillName) {
   return HARNESS_SKILL_DIRS.map((dir) => `${dir}/skills/${skillName}/${SKILL_FILENAME}`);
 }
@@ -15624,7 +15876,7 @@ function parseFrontmatterVersion(content) {
   if (!match) return null;
   let parsed;
   try {
-    parsed = yaml3.load(match[1]);
+    parsed = yaml4.load(match[1]);
   } catch {
     return null;
   }
@@ -15636,7 +15888,7 @@ function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
     const path35 = join7(projectRoot, rel);
-    if (!existsSync5(path35)) continue;
+    if (!existsSync4(path35)) continue;
     let version = null;
     try {
       version = parseFrontmatterVersion(readFileSync6(path35, "utf-8"));
@@ -15673,22 +15925,22 @@ __export(config_exports, {
   readConfig: () => readConfig,
   writeConfig: () => writeConfig
 });
-import * as fs5 from "fs";
-import * as path5 from "path";
+import * as fs6 from "fs";
+import * as path6 from "path";
 import * as os from "os";
 function configDir() {
-  return path5.join(os.homedir(), ".wayai");
+  return path6.join(os.homedir(), ".wayai");
 }
 function configPath() {
-  return path5.join(configDir(), "config.json");
+  return path6.join(configDir(), "config.json");
 }
 function getConfigPath() {
   return configPath();
 }
 function readConfig() {
-  if (!fs5.existsSync(configPath())) return null;
+  if (!fs6.existsSync(configPath())) return null;
   try {
-    const content = fs5.readFileSync(configPath(), "utf-8");
+    const content = fs6.readFileSync(configPath(), "utf-8");
     const parsed = JSON.parse(content);
     if (!parsed.api_url) return null;
     return {
@@ -15701,13 +15953,13 @@ function readConfig() {
   }
 }
 function writeConfig(config) {
-  if (!fs5.existsSync(configDir())) {
-    fs5.mkdirSync(configDir(), { recursive: true });
+  if (!fs6.existsSync(configDir())) {
+    fs6.mkdirSync(configDir(), { recursive: true });
   }
   let existing = {};
-  if (fs5.existsSync(configPath())) {
+  if (fs6.existsSync(configPath())) {
     try {
-      existing = JSON.parse(fs5.readFileSync(configPath(), "utf-8"));
+      existing = JSON.parse(fs6.readFileSync(configPath(), "utf-8"));
     } catch {
     }
   }
@@ -15715,14 +15967,14 @@ function writeConfig(config) {
   delete existing.access_token;
   delete existing.refresh_token;
   Object.assign(existing, config);
-  fs5.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + "\n", {
+  fs6.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + "\n", {
     mode: 384
     // owner-only read/write
   });
 }
 function deleteConfig() {
-  if (fs5.existsSync(configPath())) {
-    fs5.unlinkSync(configPath());
+  if (fs6.existsSync(configPath())) {
+    fs6.unlinkSync(configPath());
   }
 }
 var init_config = __esm({
@@ -15732,14 +15984,14 @@ var init_config = __esm({
 });
 
 // src/lib/token-store.ts
-import * as fs6 from "fs";
-import * as path6 from "path";
+import * as fs7 from "fs";
+import * as path7 from "path";
 import * as os2 from "os";
 function configDir2() {
-  return path6.join(os2.homedir(), ".wayai");
+  return path7.join(os2.homedir(), ".wayai");
 }
 function configPath2() {
-  return path6.join(configDir2(), "config.json");
+  return path7.join(configDir2(), "config.json");
 }
 function manualCleanupCommand(account) {
   if (process.platform === "darwin") {
@@ -15791,9 +16043,9 @@ async function getKeyring() {
   return keyringCache;
 }
 function readLegacyConfigFile() {
-  if (!fs6.existsSync(configPath2())) return null;
+  if (!fs7.existsSync(configPath2())) return null;
   try {
-    return JSON.parse(fs6.readFileSync(configPath2(), "utf-8"));
+    return JSON.parse(fs7.readFileSync(configPath2(), "utf-8"));
   } catch {
     return null;
   }
@@ -15806,7 +16058,7 @@ function stripTokensFromFile() {
     if (k === "token" || k === "access_token" || k === "refresh_token") continue;
     cleaned[k] = v;
   }
-  fs6.writeFileSync(configPath2(), JSON.stringify(cleaned, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(cleaned, null, 2) + "\n", { mode: 384 });
 }
 async function migrateLegacyTokens() {
   const legacy = readLegacyConfigFile();
@@ -15957,8 +16209,8 @@ async function clearTokens() {
       }
     }
   }
-  if (fs6.existsSync(configPath2())) {
-    fs6.unlinkSync(configPath2());
+  if (fs7.existsSync(configPath2())) {
+    fs7.unlinkSync(configPath2());
   }
 }
 function readMetadataExpiresAt() {
@@ -15972,7 +16224,7 @@ function writeMetadataExpiresAt(expires_at) {
   delete existing.refresh_token;
   existing.token_expires_at = expires_at;
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 function clearMetadataExpiresAt() {
   const existing = readLegacyConfigFile();
@@ -15982,11 +16234,11 @@ function clearMetadataExpiresAt() {
   delete existing.refresh_token;
   delete existing.token_expires_at;
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 function ensureConfigDir() {
-  if (!fs6.existsSync(configDir2())) {
-    fs6.mkdirSync(configDir2(), { recursive: true });
+  if (!fs7.existsSync(configDir2())) {
+    fs7.mkdirSync(configDir2(), { recursive: true });
   }
 }
 function writeFileFallback(tokens) {
@@ -15997,7 +16249,7 @@ function writeFileFallback(tokens) {
   delete existing.token_expires_at;
   Object.assign(existing, tokens);
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 var KEYRING_SERVICE, KEY_WAY_TOKEN, KEY_OAUTH_ACCESS, KEY_OAUTH_REFRESH, keyringCache, StaleKeyringSlotError;
 var init_token_store = __esm({
@@ -16106,7 +16358,7 @@ async function validateToken(apiUrl, token) {
   }
 }
 function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
       if (url.pathname === "/callback") {
@@ -16132,7 +16384,7 @@ function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login successful!</h2><p>You can close this tab and return to your terminal.</p></body></html>");
           server.close();
-          resolve7({ code, port });
+          resolve8({ code, port });
         } else {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login failed</h2><p>No authorization code received</p></body></html>");
@@ -16239,14 +16491,14 @@ __export(skill_symlink_exports, {
   healClaudeSkillLink: () => healClaudeSkillLink,
   healSkillLinkForCommand: () => healSkillLinkForCommand
 });
-import { existsSync as existsSync8, lstatSync, mkdirSync as mkdirSync4, rmSync, symlinkSync } from "fs";
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync5, rmSync, symlinkSync } from "fs";
 import { join as join10 } from "path";
 function healClaudeSkillLink(root) {
   try {
     const source = join10(root, ".agents", "skills", SKILL_NAME);
-    if (!existsSync8(join10(source, SKILL_FILENAME))) return false;
+    if (!existsSync7(join10(source, SKILL_FILENAME))) return false;
     const link = join10(root, ".claude", "skills", SKILL_NAME);
-    if (existsSync8(join10(link, SKILL_FILENAME))) return false;
+    if (existsSync7(join10(link, SKILL_FILENAME))) return false;
     let entry = null;
     try {
       entry = lstatSync(link);
@@ -16257,7 +16509,7 @@ function healClaudeSkillLink(root) {
       if (!entry.isSymbolicLink()) return false;
       rmSync(link, { force: true });
     }
-    mkdirSync4(join10(root, ".claude", "skills"), { recursive: true });
+    mkdirSync5(join10(root, ".claude", "skills"), { recursive: true });
     symlinkSync(join10("..", "..", ".agents", "skills", SKILL_NAME), link, "dir");
     return true;
   } catch {
@@ -16344,10 +16596,10 @@ import * as readline2 from "readline";
 function prompt2(question, defaultValue) {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(display, (answer) => {
       rl.close();
-      resolve7(answer.trim() || defaultValue || "");
+      resolve8(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -16475,8 +16727,8 @@ async function tryOpenBrowser(url) {
       cmd = "xdg-open";
       args2 = [url];
     }
-    return new Promise((resolve7) => {
-      execFile(cmd, args2, (err) => resolve7(!err));
+    return new Promise((resolve8) => {
+      execFile(cmd, args2, (err) => resolve8(!err));
     });
   } catch {
     return false;
@@ -16541,9 +16793,9 @@ var init_base_id = __esm({
 
 // src/lib/worktree-scope.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import * as fs7 from "fs";
-import * as path7 from "path";
-import * as yaml4 from "js-yaml";
+import * as fs8 from "fs";
+import * as path8 from "path";
+import * as yaml5 from "js-yaml";
 function axisNoun(axis) {
   return AXES[axis].noun;
 }
@@ -16557,7 +16809,7 @@ function resolveGitDir() {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    gitDir = raw ? path7.resolve(cwd, raw) : null;
+    gitDir = raw ? path8.resolve(cwd, raw) : null;
   } catch {
     gitDir = null;
   }
@@ -16566,12 +16818,12 @@ function resolveGitDir() {
 }
 function getScopePath() {
   const gitDir = resolveGitDir();
-  return gitDir ? path7.join(gitDir, SCOPE_FILE) : null;
+  return gitDir ? path8.join(gitDir, SCOPE_FILE) : null;
 }
 function legacyPaths() {
   const gitDir = resolveGitDir();
   if (!gitDir) return [];
-  return AXIS_ORDER.flatMap((axis) => AXES[axis].legacyFiles).map((f) => path7.join(gitDir, f));
+  return AXIS_ORDER.flatMap((axis) => AXES[axis].legacyFiles).map((f) => path8.join(gitDir, f));
 }
 function emptyScope() {
   return { hubs: [], bases: [] };
@@ -16595,7 +16847,7 @@ function readLegacyAxis(axis) {
   for (const filename of legacyFiles) {
     let raw;
     try {
-      raw = fs7.readFileSync(path7.join(gitDir, filename), "utf-8");
+      raw = fs8.readFileSync(path8.join(gitDir, filename), "utf-8");
     } catch (err) {
       if (err.code === "ENOENT") continue;
       throw err;
@@ -16610,7 +16862,7 @@ function readScope() {
   if (!scopePath) return emptyScope();
   let raw;
   try {
-    raw = fs7.readFileSync(scopePath, "utf-8");
+    raw = fs8.readFileSync(scopePath, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { hubs: readLegacyAxis("hubs"), bases: readLegacyAxis("bases") };
@@ -16619,7 +16871,7 @@ function readScope() {
   }
   let doc;
   try {
-    doc = yaml4.load(raw);
+    doc = yaml5.load(raw);
   } catch {
     return emptyScope();
   }
@@ -16630,7 +16882,7 @@ function readScope() {
 function sweepLegacyFiles() {
   for (const legacyPath of legacyPaths()) {
     try {
-      fs7.unlinkSync(legacyPath);
+      fs8.unlinkSync(legacyPath);
     } catch {
     }
   }
@@ -16646,14 +16898,14 @@ function writeScope(scope) {
   if (!scopePath) {
     throw expected("Not inside a git repository \u2014 cannot write the worktree scope.");
   }
-  const body = yaml4.dump({ hubs: scope.hubs, bases: scope.bases }, { flowLevel: 1 });
+  const body = yaml5.dump({ hubs: scope.hubs, bases: scope.bases }, { flowLevel: 1 });
   const tmpPath = `${scopePath}.tmp-${process.pid}`;
   try {
-    fs7.writeFileSync(tmpPath, body, "utf-8");
-    fs7.renameSync(tmpPath, scopePath);
+    fs8.writeFileSync(tmpPath, body, "utf-8");
+    fs8.renameSync(tmpPath, scopePath);
   } catch (err) {
     try {
-      fs7.unlinkSync(tmpPath);
+      fs8.unlinkSync(tmpPath);
     } catch {
     }
     throw asExpectedEnvironmentError(err);
@@ -16689,7 +16941,7 @@ function clearScope() {
   let removed = false;
   for (const target of [...scopePath ? [scopePath] : [], ...legacyPaths()]) {
     try {
-      fs7.unlinkSync(target);
+      fs8.unlinkSync(target);
       removed = true;
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
@@ -16794,7 +17046,6 @@ __export(status_exports, {
   parseArgs: () => parseArgs,
   statusCommand: () => statusCommand
 });
-import * as path8 from "path";
 function parseArgs(args2) {
   return { json: args2.includes("--json") };
 }
@@ -16814,19 +17065,19 @@ function buildSkillState() {
     paths: installs.map((i) => i.path)
   };
 }
-function buildWorkspaceState(repoConfig) {
-  if (!repoConfig) return { scoped: false, path: null, hub_count: 0 };
+function buildWorkspaceState(resolved) {
+  if (!resolved) return { scoped: false, path: null, hub_count: 0 };
   const ws = detectWorkspace();
-  const gitRoot = ws?.gitRoot ?? findGitRoot();
   const hubCount = ws ? scanWorkspaceHubs(ws.workspaceDir).length : 0;
-  const yamlPath = gitRoot ? path8.join(gitRoot, ".wayai.yaml") : null;
-  return { scoped: true, path: yamlPath, hub_count: hubCount };
+  return { scoped: true, path: resolved.path, hub_count: hubCount };
 }
 async function statusCommand(args2, pkg2) {
   const { json } = parseArgs(args2);
   const config = readConfig();
-  const repoConfig = readRepoConfig();
-  const workspace = buildWorkspaceState(repoConfig);
+  const resolvedRepo = resolveRepoConfig();
+  const repoConfig = resolvedRepo?.config ?? null;
+  const workspace = buildWorkspaceState(resolvedRepo);
+  const repoScopeBlocker = resolvedRepo ? null : readRepoScopeBlocker();
   const cachedCliLatest = readCachedLatest(CLI_CACHE_FILE);
   const cliLatest = cachedCliLatest && isNewerVersion(cachedCliLatest, pkg2.version) ? cachedCliLatest : null;
   const skill = buildSkillState();
@@ -16849,6 +17100,7 @@ async function statusCommand(args2, pkg2) {
       orgs: [],
       active_org: null,
       workspace,
+      repo_scope_blocker: repoScopeBlocker,
       worktree_scope: scope,
       worktree_binding: { hub_id: boundHubId },
       worktree_lock: { hub_id: boundHubId }
@@ -16905,6 +17157,7 @@ async function statusCommand(args2, pkg2) {
     orgs,
     active_org: activeOrg,
     workspace,
+    repo_scope_blocker: repoScopeBlocker,
     worktree_scope: scope,
     worktree_binding: { hub_id: boundHubId },
     worktree_lock: { hub_id: boundHubId }
@@ -16934,8 +17187,17 @@ async function statusCommand(args2, pkg2) {
     console.log(`Repository scope:`);
     console.log(`  Organization: ${orgLine}`);
     console.log(`  Hubs: ${workspace.hub_count}`);
+  } else if (repoScopeBlocker?.kind === "conflict") {
+    console.log("Repository scope: UNRESOLVED \u2014 two files name different organizations:");
+    console.log(`  ${WORKSPACE_MANIFEST_LABEL} -> ${repoScopeBlocker.manifest_organization_id}`);
+    console.log(`  ${ROOT_CONFIG_FILE} -> ${repoScopeBlocker.root_organization_id}`);
+    console.log(`  Delete or correct ${ROOT_CONFIG_FILE}; until then every command refuses.`);
+  } else if (repoScopeBlocker?.kind === "invalid") {
+    console.log(`Repository scope: UNRESOLVED \u2014 ${repoScopeBlocker.path} is unusable (${repoScopeBlocker.detail}).`);
   } else {
-    console.log("No .wayai.yaml found \u2014 run `wayai init` to scope this repo to an organization.");
+    console.log(
+      `No organization binding found in ${WORKSPACE_MANIFEST_LABEL} \u2014 run \`wayai init\` to scope this repo to an organization.`
+    );
   }
   if (scope.hubs.length > 0 || scope.bases.length > 0) {
     console.log("Worktree scope: (run `wayai unbind` to clear)");
@@ -16952,6 +17214,7 @@ var init_status = __esm({
     init_config();
     init_auth();
     init_repo_config();
+    init_workspace_manifest();
     init_workspace();
     init_worktree_scope();
     init_api_client();
@@ -17035,7 +17298,7 @@ var init_constants = __esm({
 });
 
 // src/lib/workspace-files.ts
-import * as fs8 from "fs";
+import * as fs9 from "fs";
 import * as path9 from "path";
 function perHubAgentsMd(hubFolderName) {
   return [
@@ -17052,12 +17315,13 @@ function perHubAgentsMd(hubFolderName) {
   ].join("\n");
 }
 function isWorkspace(gitRoot) {
-  if (fs8.existsSync(path9.join(gitRoot, ".wayai.yaml"))) return true;
+  if (fs9.existsSync(workspaceManifestPath(gitRoot))) return true;
+  if (fs9.existsSync(rootConfigPath(gitRoot))) return true;
   return isDirectory(resolveLayout(gitRoot).hubsDir);
 }
 function writeIfAbsent(filePath, content) {
-  if (fs8.existsSync(filePath)) return null;
-  fs8.writeFileSync(filePath, content, "utf-8");
+  if (fs9.existsSync(filePath)) return null;
+  fs9.writeFileSync(filePath, content, "utf-8");
   return path9.basename(filePath);
 }
 function ensureWorkspaceFiles(gitRoot) {
@@ -17075,6 +17339,7 @@ var init_workspace_files = __esm({
     "use strict";
     init_constants();
     init_layout();
+    init_workspace_manifest();
     CLAUDE_MD_SHIM = "@AGENTS.md\n";
     ROOT_AGENTS_MD = [
       "# Working with WayAI",
@@ -17112,12 +17377,12 @@ __export(init_exports, {
   initCommand: () => initCommand,
   parseArgs: () => parseArgs3
 });
-import { mkdirSync as mkdirSync5 } from "fs";
+import { mkdirSync as mkdirSync6 } from "fs";
 import path10 from "path";
 function ensureHubsDir(gitRoot) {
   const hubsDir = resolveLayout(gitRoot).hubsDir;
   if (isDirectory(hubsDir)) return null;
-  mkdirSync5(hubsDir, { recursive: true });
+  mkdirSync6(hubsDir, { recursive: true });
   return `${path10.relative(gitRoot, hubsDir)}/`;
 }
 function parseArgs3(args2) {
@@ -17252,18 +17517,18 @@ var init_init = __esm({
 });
 
 // src/lib/fs-safety.ts
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 import * as path11 from "path";
 function fileHasBytes(abs, data) {
   let st;
   try {
-    st = fs9.lstatSync(abs);
+    st = fs10.lstatSync(abs);
   } catch {
     return false;
   }
   if (!st.isFile() || st.isSymbolicLink()) return false;
   try {
-    return fs9.readFileSync(abs).equals(data);
+    return fs10.readFileSync(abs).equals(data);
   } catch {
     return false;
   }
@@ -17272,8 +17537,8 @@ function realpathContained(root, abs) {
   let realRoot;
   let realAbs;
   try {
-    realRoot = fs9.realpathSync(root);
-    realAbs = fs9.realpathSync(abs);
+    realRoot = fs10.realpathSync(root);
+    realAbs = fs10.realpathSync(abs);
   } catch {
     return false;
   }
@@ -17281,13 +17546,13 @@ function realpathContained(root, abs) {
 }
 function mkdirTolerateRace(dir) {
   try {
-    fs9.mkdirSync(dir);
+    fs10.mkdirSync(dir);
     return true;
   } catch (err) {
     if (err.code !== "EEXIST") throw err;
     let st;
     try {
-      st = fs9.lstatSync(dir);
+      st = fs10.lstatSync(dir);
     } catch {
       st = void 0;
     }
@@ -17299,7 +17564,7 @@ function ensureRealSubdirNoSymlink(root, target, create) {
   const targetResolved = path11.resolve(target);
   if (targetResolved !== rootResolved && !targetResolved.startsWith(rootResolved + path11.sep)) return false;
   try {
-    if (!fs9.lstatSync(rootResolved).isDirectory()) return false;
+    if (!fs10.lstatSync(rootResolved).isDirectory()) return false;
   } catch {
     return false;
   }
@@ -17310,7 +17575,7 @@ function ensureRealSubdirNoSymlink(root, target, create) {
     cur = path11.join(cur, segment);
     let st;
     try {
-      st = fs9.lstatSync(cur);
+      st = fs10.lstatSync(cur);
     } catch {
       st = void 0;
     }
@@ -17327,8 +17592,8 @@ function ensureRealSubdirNoSymlink(root, target, create) {
 function readFileNoFollow(root, abs) {
   if (!ensureRealSubdirNoSymlink(root, path11.dirname(abs), false)) return null;
   try {
-    if (!fs9.lstatSync(abs).isFile()) return null;
-    return fs9.readFileSync(abs);
+    if (!fs10.lstatSync(abs).isFile()) return null;
+    return fs10.readFileSync(abs);
   } catch {
     return null;
   }
@@ -17338,11 +17603,11 @@ function writeFileNoFollow(root, abs, data) {
   if (!ensureRealSubdirNoSymlink(root, parent, true)) return false;
   let st;
   try {
-    st = fs9.lstatSync(abs);
+    st = fs10.lstatSync(abs);
   } catch {
   }
-  if (st?.isSymbolicLink()) fs9.rmSync(abs);
-  fs9.writeFileSync(abs, data);
+  if (st?.isSymbolicLink()) fs10.rmSync(abs);
+  fs10.writeFileSync(abs, data);
   return true;
 }
 var init_fs_safety = __esm({
@@ -17352,7 +17617,7 @@ var init_fs_safety = __esm({
 });
 
 // src/lib/resource-files.ts
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import * as path12 from "path";
 import * as crypto3 from "crypto";
 function isBinaryFile(filename) {
@@ -17399,14 +17664,14 @@ function computeHash(data) {
 }
 function scanResourceFiles(dir, prefix = "") {
   const files = [];
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  const entries = fs11.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
     if (entry.isDirectory()) {
       files.push(...scanResourceFiles(path12.join(dir, entry.name), relPath));
     } else if (entry.isFile()) {
       const fullPath = path12.join(dir, entry.name);
-      const stat2 = fs10.statSync(fullPath);
+      const stat2 = fs11.statSync(fullPath);
       if (stat2.size > MAX_RESOURCE_FILE_SIZE3) {
         console.warn(`  Warning: skipping ${relPath} (${(stat2.size / 1024 / 1024).toFixed(1)}MB exceeds 10MB limit)`);
         continue;
@@ -17416,7 +17681,7 @@ function scanResourceFiles(dir, prefix = "") {
         mime_type: guessMimeType(entry.name),
         file_size: stat2.size
       };
-      const data = fs10.readFileSync(fullPath);
+      const data = fs11.readFileSync(fullPath);
       fileEntry.hash = computeHash(data);
       if (isBinaryFile(entry.name)) {
         fileEntry.content_base64 = data.toString("base64");
@@ -17476,7 +17741,7 @@ function writeResourceFileTree(resDir, files, root, log) {
     return;
   }
   if (files.length === 0) {
-    if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set(), root, log);
+    if (fs11.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set(), root, log);
     return;
   }
   const writtenPaths = /* @__PURE__ */ new Set();
@@ -17497,18 +17762,18 @@ function writeResourceFileTree(resDir, files, root, log) {
       writtenPaths.delete(file.path);
     }
   }
-  if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths, root, log);
+  if (fs11.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths, root, log);
 }
 function cleanOrphanFiles(dir, prefix, writtenPaths, root, log) {
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  const entries = fs11.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
     const fullPath = path12.join(dir, entry.name);
     if (entry.isDirectory()) {
       cleanOrphanFiles(fullPath, relPath, writtenPaths, root, log);
-      if (fs10.readdirSync(fullPath).length === 0) fs10.rmdirSync(fullPath);
+      if (fs11.readdirSync(fullPath).length === 0) fs11.rmdirSync(fullPath);
     } else if (!writtenPaths.has(relPath)) {
-      fs10.unlinkSync(fullPath);
+      fs11.unlinkSync(fullPath);
       if (log && root) log.removed.push(path12.relative(root, fullPath));
     }
   }
@@ -17529,8 +17794,8 @@ async function downloadBinaryFiles(resDir, files, root, log) {
       }
       if (file.hash) {
         try {
-          const st = fs10.lstatSync(filePath);
-          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs10.readFileSync(filePath)) === file.hash) continue;
+          const st = fs11.lstatSync(filePath);
+          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs11.readFileSync(filePath)) === file.hash) continue;
         } catch {
         }
       }
@@ -17584,7 +17849,7 @@ var init_resource_files = __esm({
 });
 
 // src/lib/eval-attachments.ts
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as path13 from "path";
 function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
   const raw = turn.attachments;
@@ -17608,7 +17873,7 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
     }
     let stat2;
     try {
-      stat2 = fs11.statSync(abs);
+      stat2 = fs12.statSync(abs);
     } catch {
     }
     if (!stat2?.isFile()) {
@@ -17622,7 +17887,7 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
         `${label}: attachment "${entry}" is ${(stat2.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
       );
     }
-    const data = fs11.readFileSync(abs);
+    const data = fs12.readFileSync(abs);
     const hash = computeHash(data);
     const fileName = path13.basename(abs);
     const mimeType = guessMimeType(fileName) ?? "application/octet-stream";
@@ -17730,16 +17995,16 @@ async function downloadEvalAttachments(hubFolder, downloads) {
     console.warn(`  Warning: ${ATTACHMENTS_DIR}/ is not reachable inside the hub folder without a symlink; skipping attachment sync.`);
     return result;
   }
-  if (!fs11.existsSync(attachDir)) return result;
+  if (!fs12.existsSync(attachDir)) return result;
   for (const dl of downloads) {
     const abs = path13.resolve(hubFolder, dl.relPath);
     if (abs !== attachDir && !abs.startsWith(attachDir + path13.sep)) continue;
     let existing;
     try {
-      existing = fs11.lstatSync(abs);
+      existing = fs12.lstatSync(abs);
     } catch {
     }
-    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs11.readFileSync(abs)) === dl.hash) {
+    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs12.readFileSync(abs)) === dl.hash) {
       continue;
     }
     try {
@@ -17757,11 +18022,11 @@ async function downloadEvalAttachments(hubFolder, downloads) {
     }
   }
   const keep = new Set(downloads.map((d) => path13.resolve(hubFolder, d.relPath)));
-  for (const name of fs11.readdirSync(attachDir)) {
+  for (const name of fs12.readdirSync(attachDir)) {
     const abs = path13.join(attachDir, name);
-    const st = fs11.lstatSync(abs);
+    const st = fs12.lstatSync(abs);
     if ((st.isFile() || st.isSymbolicLink()) && !keep.has(abs)) {
-      fs11.rmSync(abs);
+      fs12.rmSync(abs);
       result.removed.push(path13.relative(hubFolder, abs));
     }
   }
@@ -17779,20 +18044,20 @@ var init_eval_attachments = __esm({
 });
 
 // src/lib/parser.ts
-import * as fs12 from "fs";
+import * as fs13 from "fs";
 import * as path14 from "path";
-import * as yaml5 from "js-yaml";
+import * as yaml6 from "js-yaml";
 function parseHubFolder(hubFolder, opts) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) {
     throw expected(`hub.yaml not found in ${hubFolder}`);
   }
-  const yamlContent = fs12.readFileSync(yamlPath, "utf-8");
+  const yamlContent = fs13.readFileSync(yamlPath, "utf-8");
   let config;
   try {
-    config = yaml5.load(yamlContent);
+    config = yaml6.load(yamlContent);
   } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${yamlPath}: ${err.message}`);
     }
     throw err;
@@ -17815,8 +18080,8 @@ function parseHubFolder(hubFolder, opts) {
     if (typeof resolved.instructions === "string" && resolved.instructions.endsWith(".md")) {
       const instrValue = resolved.instructions;
       const instructionsPath = instrValue.startsWith("agents/") ? path14.join(hubFolder, instrValue) : path14.join(hubFolder, "agents", instrValue);
-      if (fs12.existsSync(instructionsPath)) {
-        resolved.instructions = fs12.readFileSync(instructionsPath, "utf-8");
+      if (fs13.existsSync(instructionsPath)) {
+        resolved.instructions = fs13.readFileSync(instructionsPath, "utf-8");
       } else {
         throw expected(
           `Agent instructions file not found: ${instructionsPath} (referenced by agent "${agent.name}")`
@@ -17824,8 +18089,8 @@ function parseHubFolder(hubFolder, opts) {
       }
     } else if (resolved.instructions === void 0 && typeof agent.name === "string") {
       const conventionPath = path14.join(hubFolder, "agents", `${slugify(agent.name)}.md`);
-      if (fs12.existsSync(conventionPath)) {
-        resolved.instructions = fs12.readFileSync(conventionPath, "utf-8");
+      if (fs13.existsSync(conventionPath)) {
+        resolved.instructions = fs13.readFileSync(conventionPath, "utf-8");
       }
     }
     return resolved;
@@ -17880,17 +18145,17 @@ function parseHubFolder(hubFolder, opts) {
 }
 function scanEvalYamlFiles(hubFolder, bytesByHash) {
   const evalsDir = path14.join(hubFolder, "evals");
-  if (!fs12.existsSync(evalsDir)) return [];
+  if (!fs13.existsSync(evalsDir)) return [];
   const evals = [];
   const seen = /* @__PURE__ */ new Set();
-  const topEntries = fs12.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const topEntries = fs13.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of topEntries) {
     if (entry.isFile() && entry.name.endsWith(".yaml")) {
       collectEval(evals, seen, path14.join(evalsDir, entry.name), `evals/${entry.name}`, null, hubFolder, bytesByHash);
     } else if (entry.isDirectory()) {
       const setName = entry.name;
       const setDir = path14.join(evalsDir, setName);
-      const setEntries = fs12.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      const setEntries = fs13.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
       for (const sub of setEntries) {
         if (sub.isDirectory()) {
           throw expected(
@@ -17919,12 +18184,12 @@ function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesBy
   evals.push(evalEntry);
 }
 function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
-  const content = fs12.readFileSync(filePath, "utf-8");
+  const content = fs13.readFileSync(filePath, "utf-8");
   let raw;
   try {
-    raw = yaml5.load(content);
+    raw = yaml6.load(content);
   } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
     throw err;
@@ -18022,10 +18287,10 @@ function parseFixtureField(raw, label, key) {
 }
 function scanJourneyYamlFiles(hubFolder, bytesByHash) {
   const journeysDir = path14.join(hubFolder, "journeys");
-  if (!fs12.existsSync(journeysDir)) return [];
+  if (!fs13.existsSync(journeysDir)) return [];
   const journeys = [];
   const seen = /* @__PURE__ */ new Set();
-  const entries = fs12.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
       throw expected(
@@ -18046,12 +18311,12 @@ function scanJourneyYamlFiles(hubFolder, bytesByHash) {
   return journeys;
 }
 function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
-  const content = fs12.readFileSync(filePath, "utf-8");
+  const content = fs13.readFileSync(filePath, "utf-8");
   let raw;
   try {
-    raw = yaml5.load(content);
+    raw = yaml6.load(content);
   } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
     throw err;
@@ -18102,18 +18367,18 @@ function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
 }
 function scanAgentYamlFiles(hubFolder) {
   const agentsDir = path14.join(hubFolder, "agents");
-  if (!fs12.existsSync(agentsDir)) return [];
-  const yamlFiles = fs12.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
+  if (!fs13.existsSync(agentsDir)) return [];
+  const yamlFiles = fs13.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
   if (yamlFiles.length === 0) return [];
   const agents = [];
   for (const file of yamlFiles) {
     const filePath = path14.join(agentsDir, file);
-    const content = fs12.readFileSync(filePath, "utf-8");
+    const content = fs13.readFileSync(filePath, "utf-8");
     let agent;
     try {
-      agent = yaml5.load(content);
+      agent = yaml6.load(content);
     } catch (err) {
-      if (err instanceof yaml5.YAMLException) {
+      if (err instanceof yaml6.YAMLException) {
         throw expected(`Invalid YAML in agents/${file}: ${err.message}`);
       }
       throw err;
@@ -18143,7 +18408,7 @@ function parseResources(hubFolder, configResources) {
     if (res.skill_name) resource.skill_name = res.skill_name;
     const resSlug = slugify(resource.name);
     const resDir = path14.join(resourcesDir, resSlug);
-    if (fs12.existsSync(resDir)) {
+    if (fs13.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) {
         resource.files = files;
@@ -18191,9 +18456,9 @@ var init_diff_display = __esm({
 });
 
 // src/lib/yaml-writer.ts
-import * as fs13 from "fs";
+import * as fs14 from "fs";
 import * as path15 from "path";
-import * as yaml6 from "js-yaml";
+import * as yaml7 from "js-yaml";
 function writeFileIfChanged(hubFolder, absPath, content, log) {
   const buf = Buffer.from(content, "utf-8");
   if (fileHasBytes(absPath, buf)) return;
@@ -18242,15 +18507,15 @@ function buildEvalYamlObject(evalEntry, slug) {
 function writeHubFolder(hubFolder, payload, options = {}) {
   const log = { changed: [], removed: [] };
   const agentsDir = path15.join(hubFolder, "agents");
-  if (!fs13.existsSync(hubFolder)) {
-    fs13.mkdirSync(hubFolder, { recursive: true });
+  if (!fs14.existsSync(hubFolder)) {
+    fs14.mkdirSync(hubFolder, { recursive: true });
   }
-  if (!fs13.existsSync(agentsDir)) {
-    fs13.mkdirSync(agentsDir, { recursive: true });
+  if (!fs14.existsSync(agentsDir)) {
+    fs14.mkdirSync(agentsDir, { recursive: true });
   }
   const yamlPayload = buildYamlPayload(payload);
   const agentFiles = extractAgentFiles(payload);
-  const yamlContent = yaml6.dump(yamlPayload, YAML_DUMP_OPTIONS);
+  const yamlContent = yaml7.dump(yamlPayload, YAML_DUMP_OPTIONS);
   writeFileIfChanged(hubFolder, path15.join(hubFolder, "hub.yaml"), yamlContent, log);
   if (options.seedAgentContext ?? true) {
     for (const seeded of [
@@ -18261,8 +18526,8 @@ function writeHubFolder(hubFolder, payload, options = {}) {
     }
   }
   const oldYamlPath = path15.join(hubFolder, "wayai.yaml");
-  if (fs13.existsSync(oldYamlPath)) {
-    fs13.unlinkSync(oldYamlPath);
+  if (fs14.existsSync(oldYamlPath)) {
+    fs14.unlinkSync(oldYamlPath);
     log.removed.push(path15.relative(hubFolder, oldYamlPath));
   }
   const yamlSlugs = writeAgentYamlFiles(hubFolder, agentsDir, payload.agents || [], log);
@@ -18271,20 +18536,20 @@ function writeHubFolder(hubFolder, payload, options = {}) {
     mdSlugs.add(slug);
     writeFileIfChanged(hubFolder, path15.join(agentsDir, `${slug}.md`), content, log);
   }
-  const existingFiles = fs13.readdirSync(agentsDir);
+  const existingFiles = fs14.readdirSync(agentsDir);
   for (const file of existingFiles) {
     if (file.endsWith(".yaml")) {
       const slug = file.slice(0, -5);
       if (!yamlSlugs.has(slug)) {
         const orphan = path15.join(agentsDir, file);
-        fs13.unlinkSync(orphan);
+        fs14.unlinkSync(orphan);
         log.removed.push(path15.relative(hubFolder, orphan));
       }
     } else if (file.endsWith(".md")) {
       const slug = file.slice(0, -3);
       if (!mdSlugs.has(slug)) {
         const orphan = path15.join(agentsDir, file);
-        fs13.unlinkSync(orphan);
+        fs14.unlinkSync(orphan);
         log.removed.push(path15.relative(hubFolder, orphan));
       }
     }
@@ -18297,10 +18562,10 @@ function writeHubFolder(hubFolder, payload, options = {}) {
 function setPreviewLabelInHubYaml(hubFolder, label) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) return;
-  const obj = yaml6.load(fs13.readFileSync(yamlPath, "utf-8")) ?? {};
+  const obj = yaml7.load(fs14.readFileSync(yamlPath, "utf-8")) ?? {};
   if (label) obj.preview_label = label;
   else delete obj.preview_label;
-  fs13.writeFileSync(yamlPath, yaml6.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
+  fs14.writeFileSync(yamlPath, yaml7.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
 }
 function buildYamlPayload(payload) {
   const result = {
@@ -18345,7 +18610,7 @@ function writeAgentYamlFiles(hubFolder, agentsDir, agents, log) {
     slugs.add(slug);
     const entry = { ...agent };
     delete entry.instructions;
-    const yamlContent = yaml6.dump(entry, YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(entry, YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, path15.join(agentsDir, `${slug}.yaml`), yamlContent, log);
   }
   return slugs;
@@ -18365,17 +18630,17 @@ function extractAgentFiles(payload) {
 function writeEvalYamlFiles(hubFolder, evals, log) {
   const evalsDir = path15.join(hubFolder, "evals");
   if (evals.length === 0) {
-    if (fs13.existsSync(evalsDir)) {
+    if (fs14.existsSync(evalsDir)) {
       cleanEvalOrphans(hubFolder, evalsDir, /* @__PURE__ */ new Set(), log);
       try {
-        if (fs13.readdirSync(evalsDir).length === 0) fs13.rmdirSync(evalsDir);
+        if (fs14.readdirSync(evalsDir).length === 0) fs14.rmdirSync(evalsDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs13.existsSync(evalsDir)) {
-    fs13.mkdirSync(evalsDir, { recursive: true });
+  if (!fs14.existsSync(evalsDir)) {
+    fs14.mkdirSync(evalsDir, { recursive: true });
   }
   const writtenRelPaths = /* @__PURE__ */ new Set();
   for (const evalEntry of evals) {
@@ -18389,42 +18654,42 @@ function writeEvalYamlFiles(hubFolder, evals, log) {
     }
     if (setName) {
       const setDir = path15.join(evalsDir, setName);
-      if (!fs13.existsSync(setDir)) {
-        fs13.mkdirSync(setDir, { recursive: true });
+      if (!fs14.existsSync(setDir)) {
+        fs14.mkdirSync(setDir, { recursive: true });
       }
     }
-    const yamlContent = yaml6.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, targetPath, yamlContent, log);
     writtenRelPaths.add(relPath);
   }
   cleanEvalOrphans(hubFolder, evalsDir, writtenRelPaths, log);
 }
 function cleanEvalOrphans(hubFolder, evalsDir, writtenRelPaths, log) {
-  const entries = fs13.readdirSync(evalsDir, { withFileTypes: true });
+  const entries = fs14.readdirSync(evalsDir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = path15.join(evalsDir, entry.name);
     if (entry.isFile()) {
       if (entry.name.endsWith(".yaml") && !writtenRelPaths.has(entry.name)) {
-        fs13.unlinkSync(fullPath);
+        fs14.unlinkSync(fullPath);
         log.removed.push(path15.relative(hubFolder, fullPath));
       }
       continue;
     }
     if (entry.isDirectory()) {
       const setName = entry.name;
-      const subEntries = fs13.readdirSync(fullPath, { withFileTypes: true });
+      const subEntries = fs14.readdirSync(fullPath, { withFileTypes: true });
       for (const sub of subEntries) {
         if (sub.isFile() && sub.name.endsWith(".yaml")) {
           const relPath = `${setName}/${sub.name}`;
           if (!writtenRelPaths.has(relPath)) {
             const orphan = path15.join(fullPath, sub.name);
-            fs13.unlinkSync(orphan);
+            fs14.unlinkSync(orphan);
             log.removed.push(path15.relative(hubFolder, orphan));
           }
         }
       }
       try {
-        if (fs13.readdirSync(fullPath).length === 0) fs13.rmdirSync(fullPath);
+        if (fs14.readdirSync(fullPath).length === 0) fs14.rmdirSync(fullPath);
       } catch {
       }
     }
@@ -18463,35 +18728,35 @@ function buildJourneyYamlObject(journeyEntry, slug) {
 function writeJourneyYamlFiles(hubFolder, journeys, log) {
   const journeysDir = path15.join(hubFolder, "journeys");
   if (journeys.length === 0) {
-    if (fs13.existsSync(journeysDir)) {
+    if (fs14.existsSync(journeysDir)) {
       cleanJourneyOrphans(hubFolder, journeysDir, /* @__PURE__ */ new Set(), log);
       try {
-        if (fs13.readdirSync(journeysDir).length === 0) fs13.rmdirSync(journeysDir);
+        if (fs14.readdirSync(journeysDir).length === 0) fs14.rmdirSync(journeysDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs13.existsSync(journeysDir)) {
-    fs13.mkdirSync(journeysDir, { recursive: true });
+  if (!fs14.existsSync(journeysDir)) {
+    fs14.mkdirSync(journeysDir, { recursive: true });
   }
   const writtenFiles = /* @__PURE__ */ new Set();
   const usedSlugs = /* @__PURE__ */ new Set();
   for (const journeyEntry of journeys) {
     const slug = ensureUniqueSlug(slugify(journeyEntry.name), usedSlugs);
     const fileName = `${slug}.yaml`;
-    const yamlContent = yaml6.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, path15.join(journeysDir, fileName), yamlContent, log);
     writtenFiles.add(fileName);
   }
   cleanJourneyOrphans(hubFolder, journeysDir, writtenFiles, log);
 }
 function cleanJourneyOrphans(hubFolder, journeysDir, writtenFiles, log) {
-  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true });
+  const entries = fs14.readdirSync(journeysDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && entry.name.endsWith(".yaml") && !writtenFiles.has(entry.name)) {
       const orphan = path15.join(journeysDir, entry.name);
-      fs13.unlinkSync(orphan);
+      fs14.unlinkSync(orphan);
       log.removed.push(path15.relative(hubFolder, orphan));
     }
   }
@@ -18505,12 +18770,12 @@ function writeResourceFiles(hubFolder, resources, log) {
     const resDir = path15.join(resourcesDir, resSlug);
     writeResourceFileTree(resDir, resource.files || [], hubFolder, log);
   }
-  if (fs13.existsSync(resourcesDir)) {
-    const existingDirs = fs13.readdirSync(resourcesDir, { withFileTypes: true });
+  if (fs14.existsSync(resourcesDir)) {
+    const existingDirs = fs14.readdirSync(resourcesDir, { withFileTypes: true });
     for (const entry of existingDirs) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
         const orphanDir = path15.join(resourcesDir, entry.name);
-        fs13.rmSync(orphanDir, { recursive: true, force: true });
+        fs14.rmSync(orphanDir, { recursive: true, force: true });
         log.removed.push(`${path15.relative(hubFolder, orphanDir)}/`);
       }
     }
@@ -18599,15 +18864,15 @@ var init_terminal_output = __esm({
 });
 
 // src/lib/base-workspace.ts
-import * as fs14 from "fs";
+import * as fs15 from "fs";
 import * as path17 from "path";
-import * as yaml7 from "js-yaml";
+import * as yaml8 from "js-yaml";
 function readBaseMeta(folder) {
   const bytes = readFileNoFollow(folder, path17.join(folder, BASE_META_FILE));
   if (bytes === null) return null;
   let doc;
   try {
-    doc = yaml7.load(bytes.toString("utf-8"));
+    doc = yaml8.load(bytes.toString("utf-8"));
   } catch {
     return null;
   }
@@ -18617,7 +18882,7 @@ function readBaseMeta(folder) {
 function listBaseFolders(basesDir) {
   let entries;
   try {
-    entries = fs14.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
+    entries = fs15.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
   } catch {
     return [];
   }
@@ -18704,7 +18969,7 @@ function resolveBaseSelectorToId(gitRoot, selector) {
 }
 function hasBaseMetaFile(folder) {
   try {
-    return fs14.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
+    return fs15.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
   } catch {
     return false;
   }
@@ -18722,25 +18987,17 @@ var init_base_workspace = __esm({
 });
 
 // src/lib/subtree-routing.ts
-import * as fs15 from "fs";
 import * as path18 from "path";
-import * as yaml8 from "js-yaml";
 function readRepoDefaults(gitRoot) {
-  const file = path18.join(gitRoot, WAYAI_LAYOUT.wsDir, REPO_DEFAULTS_FILE);
-  let doc;
-  try {
-    doc = yaml8.load(fs15.readFileSync(file, "utf-8"));
-  } catch {
-    return {};
-  }
-  if (!doc || typeof doc !== "object") return {};
-  const raw = doc;
+  const load11 = loadWorkspaceManifest(gitRoot);
+  if (load11.kind !== "ok") return {};
+  const raw = load11.doc;
   const str = (v) => {
     if (typeof v !== "string" || !v.trim()) return void 0;
     const value = v.trim();
     if (value.includes("/") || value.includes(path18.sep) || value === "." || value === "..") {
       console.warn(
-        `Warning: ignoring ${JSON.stringify(value)} in ${WAYAI_LAYOUT.wsDir}/${REPO_DEFAULTS_FILE} \u2014 a default names a hub or base, not a path.`
+        `Warning: ignoring ${JSON.stringify(value)} in ${WORKSPACE_MANIFEST_LABEL} \u2014 a default names a hub or base, not a path.`
       );
       return void 0;
     }
@@ -18828,11 +19085,11 @@ function routeSubtree(options) {
     return {
       ok: false,
       refusal: [
-        `\`wayai ${verb}\` does not take --org: it operates on the organization named by .wayai.yaml at the repo root.`,
+        `\`wayai ${verb}\` does not take --org: it operates on the organization named by ${WORKSPACE_MANIFEST_LABEL}.`,
         "",
         "To act on another organization:",
         "  wayai bases <command> --org <uuid>   # the Data surface honors it",
-        "  # or run from a checkout whose .wayai.yaml names that organization"
+        "  # or run from a checkout whose workspace manifest names that organization"
       ].join("\n")
     };
   }
@@ -18899,15 +19156,15 @@ function requireSubtree(verb, args2, gitRoot) {
   }
   return { subtree: result.subtree, selector: result.selector };
 }
-var REPO_DEFAULTS_FILE, VALUE_FLAGS;
+var VALUE_FLAGS;
 var init_subtree_routing = __esm({
   "src/lib/subtree-routing.ts"() {
     "use strict";
     init_layout();
     init_terminal_output();
+    init_workspace_manifest();
     init_workspace();
     init_base_workspace();
-    REPO_DEFAULTS_FILE = "wayai.yaml";
     VALUE_FLAGS = /* @__PURE__ */ new Set(["--hub", "--base", "--label", "--org"]);
   }
 });
@@ -18934,12 +19191,12 @@ async function createDataClient(orgId) {
   if (selected !== void 0 && !UUID_RE2.test(selected)) {
     throw expected(`Invalid --org: ${JSON.stringify(selected)}. Expected an organization UUID.`);
   }
-  const org = selected ?? readRepoConfig()?.organization_id;
+  const org = selected ?? readRepoConfigUnlessBlocked()?.organization_id;
   async function requireOrgForSetupRoute(what) {
     const orgId2 = org ?? (await api.me()).org_id;
     if (!orgId2) {
       throw expected(
-        `No organization to ${what} against. Pass --org <uuid>, or run this from a repo with .wayai.yaml.`
+        `No organization to ${what} against. Pass --org <uuid>, or run this from a repo scoped by \`wayai init\`.`
       );
     }
     return orgId2;
@@ -19025,7 +19282,7 @@ var init_client = __esm({
 });
 
 // src/data/helpers.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 function pathSegment(id, label = "id") {
   if (!isPathSafeId(id)) {
     throw expected(`Invalid ${label}: ${JSON.stringify(id)}. An id may use ${PATH_SAFE_ID_RULE}.`);
@@ -19053,7 +19310,7 @@ function parseData(data, flag) {
   let text = data;
   if (source !== void 0) {
     try {
-      text = readFileSync16(source, "utf-8");
+      text = readFileSync15(source, "utf-8");
     } catch (e) {
       throw expected(`${prefix}${source}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -21148,9 +21405,10 @@ async function migrateCommand(_args) {
   const newOrg = path29.join(newWs, WAYAI_LAYOUT.orgSubdir);
   const hasLegacyWs = isDirectory(legacyWs);
   const hasLegacyOrg = isDirectory(legacyOrg);
-  if (!hasLegacyWs && !hasLegacyOrg) {
-    console.log(`Already migrated \u2014 no legacy ${WAYAI_LAYOUT.legacy.wsDir}/ or ${WAYAI_LAYOUT.legacy.orgAtRoot}/ to move.`);
-    return;
+  const orgPlan = planOrgMigration(gitRoot);
+  if (orgPlan.kind === "refuse") {
+    console.error(orgPlan.message);
+    process.exit(1);
   }
   if (hasLegacyWs && isDirectory(newHubs)) {
     console.error(
@@ -21176,10 +21434,30 @@ async function migrateCommand(_args) {
     usedFsFallback ||= how === "fs";
     moved.push(`${WAYAI_LAYOUT.legacy.orgAtRoot}/ \u2192 ${rel(newOrg)}/`);
   }
-  console.log(`Migrated to the ${WAYAI_LAYOUT.wsDir}/ layout:`);
-  for (const m of moved) console.log(`  ${m}`);
-  if (usedFsFallback) {
-    console.log("\n(Some dirs were moved on disk, not via git \u2014 they will show as untracked.)");
+  if (moved.length > 0) {
+    console.log(`Migrated to the ${WAYAI_LAYOUT.wsDir}/ layout:`);
+    for (const m of moved) console.log(`  ${m}`);
+    if (usedFsFallback) {
+      console.log("\n(Some dirs were moved on disk, not via git \u2014 they will show as untracked.)");
+    }
+  }
+  const copiedOrg = orgPlan.kind === "copy";
+  if (copiedOrg) {
+    writeRepoConfig(orgPlan.config, gitRoot);
+    console.log(`${moved.length > 0 ? "\n" : ""}Copied the organization binding into ${WORKSPACE_MANIFEST_LABEL}.`);
+    console.log(
+      `  ${ROOT_CONFIG_FILE} is KEPT on purpose \u2014 an older CLI in a teammate's environment or in CI still requires it.`
+    );
+    console.log(
+      "  It stays a supported fallback until the next major, which removes both the fallback and the file."
+    );
+    console.log("  Delete it once every environment that runs this repo reads the manifest.");
+  }
+  if (moved.length === 0 && !copiedOrg) {
+    console.log(
+      `Already migrated \u2014 no legacy ${WAYAI_LAYOUT.legacy.wsDir}/ or ${WAYAI_LAYOUT.legacy.orgAtRoot}/ to move, and no organization binding to copy into ${WORKSPACE_MANIFEST_LABEL}.`
+    );
+    return;
   }
   console.log("\nNext steps:");
   console.log('  git add -A && git commit -m "chore: migrate to wayai-ws layout"');
@@ -21190,6 +21468,8 @@ var init_migrate = __esm({
     "use strict";
     init_workspace();
     init_layout();
+    init_repo_config();
+    init_workspace_manifest();
   }
 });
 
@@ -22583,8 +22863,8 @@ function installEvalSignalHandlers(input) {
   let signalCount = 0;
   let disposed = false;
   let settle;
-  const settled = new Promise((resolve7) => {
-    settle = resolve7;
+  const settled = new Promise((resolve8) => {
+    settle = resolve8;
   });
   const listeners = /* @__PURE__ */ new Map();
   const dispose = () => {
@@ -22934,7 +23214,7 @@ Timeout after ${timeoutSeconds}s${queuedSeconds > 0 ? ` (${queuedSeconds}s of it
   process.exit(1);
 }
 function sleep(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 function parseRunNumbers(raw) {
   if (!raw || raw.startsWith("--")) {
@@ -25269,7 +25549,27 @@ async function adminCommand(args2) {
         await runHarnessToggle(true, flagArgs);
         return;
       case "status":
-        await runHarnessStatus(flagArgs);
+        await runPlatformGateStatus(HARNESS_GATE, flagArgs);
+        return;
+      default:
+        printHelp2();
+        process.exit(1);
+    }
+  }
+  if (group === "turn-state") {
+    if (!sub) {
+      printHelp2();
+      process.exit(1);
+    }
+    switch (sub) {
+      case "disable":
+        await runTurnStateToggle(false, flagArgs);
+        return;
+      case "enable":
+        await runTurnStateToggle(true, flagArgs);
+        return;
+      case "status":
+        await runPlatformGateStatus(TURN_STATE_GATE, flagArgs);
         return;
       default:
         printHelp2();
@@ -25858,49 +26158,71 @@ async function runHarnessMassDestroy(flagArgs) {
     );
   }
 }
-function rejectHarnessFlags(flagArgs, usage3) {
+function rejectPlatformGateFlags(gate, sub, flagArgs) {
   if (flagArgs.length === 0) return;
   console.error(`Unknown flag: ${flagArgs[0]}`);
-  console.error("The harness rollout gate is platform-wide; there is no --org/--hub layer.");
-  console.error(usage3);
+  console.error(`The ${gate.label} is platform-wide; there is no --org/--hub layer.`);
+  console.error(`wayai admin ${gate.group} ${sub}`);
   process.exit(1);
 }
-async function runHarnessToggle(enable, flagArgs) {
-  const USAGE2 = "wayai admin harness enable|disable";
-  rejectHarnessFlags(flagArgs, USAGE2);
+function readGateValue(data, key) {
+  const value = data[key];
+  return typeof value === "number" ? value : void 0;
+}
+async function patchPlatformGate(gate, enable) {
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-  let value;
   try {
-    const res = await client.adminUpdateConfig({ harness_enabled: enable ? 1 : 0 });
-    value = res.data.harness_enabled;
+    const res = await client.adminUpdateConfig({ [gate.key]: enable ? 1 : 0 });
+    return readGateValue(res.data, gate.key);
   } catch (err) {
     exitOnApiError(err);
     throw err;
   }
-  const state = enable ? "ENABLED" : "DISABLED";
-  console.log(`Harness ${state} platform-wide (harness_enabled=${value ?? (enable ? 1 : 0)}).`);
-  if (enable) {
-    console.log("Harness agents may be created again and new harness turns may run.");
-  } else {
-    console.log("The per-turn kill switch now aborts every harness turn on its next invocation.");
-    console.log("Next: run `wayai admin harness mass-destroy --all --dry-run` to see what is still live, then reap it.");
-  }
 }
-async function runHarnessStatus(flagArgs) {
-  const USAGE2 = "wayai admin harness status";
-  rejectHarnessFlags(flagArgs, USAGE2);
+async function runPlatformGateStatus(gate, flagArgs) {
+  rejectPlatformGateFlags(gate, "status", flagArgs);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   let value = 0;
   try {
     const res = await client.adminGetConfig();
-    value = res.data.harness_enabled ?? 0;
+    value = readGateValue(res.data, gate.key) ?? 0;
   } catch (err) {
     exitOnApiError(err);
     throw err;
   }
-  console.log(`harness_enabled (platform): ${value} (${value ? "ENABLED" : "DISABLED"})`);
+  console.log(`${gate.key} (platform): ${value} (${value ? "ENABLED" : "DISABLED"})`);
+}
+async function runHarnessToggle(enable, flagArgs) {
+  rejectPlatformGateFlags(HARNESS_GATE, "enable|disable", flagArgs);
+  const value = await patchPlatformGate(HARNESS_GATE, enable);
+  const state = enable ? "ENABLED" : "DISABLED";
+  console.log(`Harness ${state} platform-wide (harness_enabled=${value ?? (enable ? 1 : 0)}).`);
+  if (enable) {
+    console.log("Harness agents may be created again and new harness turns may run.");
+  } else {
+    console.log("The per-turn kill switch now aborts every harness turn on its next invocation.");
+    console.log("Next: run `wayai admin harness mass-destroy --all --dry-run` to see what is still live, then reap it.");
+  }
+}
+async function runTurnStateToggle(enable, flagArgs) {
+  rejectPlatformGateFlags(TURN_STATE_GATE, "enable|disable", flagArgs);
+  const value = await patchPlatformGate(TURN_STATE_GATE, enable);
+  if (value === void 0) {
+    console.error("PATCH /api/admin/config returned no turn_state_enabled value \u2014 the flag state is UNKNOWN.");
+    console.error("Run `wayai admin turn-state status` to read what the platform config now holds.");
+    process.exit(1);
+  }
+  const state = value ? "ENABLED" : "DISABLED";
+  console.log(`TurnState conversion ${state} platform-wide (turn_state_enabled=${value}).`);
+  if (value) {
+    console.log("New turns run the converted TurnState body (runTurnWithState) once the platform-config cache clears \u2014 up to ~60s.");
+    console.log("Roll back with `wayai admin turn-state disable` \u2014 the retained body stays compiled in while this flag is live.");
+  } else {
+    console.log("New turns run the RETAINED pre-conversion body (runTurnRetained) \u2014 the fail-closed default \u2014 once the platform-config cache clears, up to ~60s.");
+  }
+  console.log("Turns already in flight finish on the body they picked at entry.");
 }
 function requireFlagValue(flagArgs, index, flag) {
   const v = flagArgs[index];
@@ -26342,6 +26664,10 @@ Usage:
   wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]
                                                    Reap every live harness sandbox/token/slot in scope (run --dry-run first to see the blast radius)
 
+  wayai admin turn-state disable                   Flip the platform turn_state_enabled flag OFF (new turns run the RETAINED pre-conversion body \u2014 the fail-closed default)
+  wayai admin turn-state enable                    Flip the platform turn_state_enabled flag ON (new turns run the converted TurnState body)
+  wayai admin turn-state status                    Print the platform turn_state_enabled flag
+
 Sources:
   do             Live DO SQLite (existing conversation, hub config, etc.).
   analytics      ClickHouse projections (conversation, message, schedule_event).
@@ -26399,6 +26725,15 @@ Sources:
                  sandbox/token/slot that is live NOW (scope: --hub < --org < --all, prefer
                  the narrowest). Run \`mass-destroy --dry-run\` first to see the blast
                  radius. See docs/runbooks/harness-incident-response.md.
+  turn-state     The ConversationDO TurnState conversion gate. \`disable\`/\`enable\` flip the
+                 single PLATFORM-wide turn_state_enabled flag; \`status\` prints it. That one
+                 flag picks which turn body runs: OFF (default-deny, fail-closed \u2014 a
+                 platform-config read error lands here too) runs the RETAINED pre-conversion
+                 body, ON runs the converted TurnState body. Both stay compiled in while the
+                 flag is live, so \`disable\` is the rollback. The turn reads the flag at
+                 entry through the platform-config KV cache this write invalidates, so a
+                 flip propagates in up to ~60s, and a turn already in flight finishes on the
+                 body it picked.
 
 Types (do): ${VALID_TYPES.join(" | ")}
 Tables (analytics): ${VALID_ANALYTICS_TABLES.join(" | ")}
@@ -26428,6 +26763,9 @@ Examples:
   wayai admin harness mass-destroy --all --dry-run
   wayai admin harness mass-destroy --hub <hub-id> --yes
   wayai admin harness enable
+  wayai admin turn-state status
+  wayai admin turn-state enable
+  wayai admin turn-state disable
 
 Audit + rate limit:
   Every successful read is logged as admin_debug_read (queryable in Grafana
@@ -26435,7 +26773,7 @@ Audit + rate limit:
   across all sources. Platform-admin grant required.
 `.trim());
 }
-var VALID_TYPES, VALID_ANALYTICS_TABLES, VALID_NOTICE_SEVERITIES;
+var VALID_TYPES, VALID_ANALYTICS_TABLES, HARNESS_GATE, TURN_STATE_GATE, VALID_NOTICE_SEVERITIES;
 var init_admin = __esm({
   "src/commands/admin.ts"() {
     "use strict";
@@ -26450,6 +26788,16 @@ var init_admin = __esm({
     init_contracts();
     VALID_TYPES = dataExplorerDebugDoType.options;
     VALID_ANALYTICS_TABLES = dataExplorerDebugAnalyticsTable.options;
+    HARNESS_GATE = {
+      group: "harness",
+      key: "harness_enabled",
+      label: "harness rollout gate"
+    };
+    TURN_STATE_GATE = {
+      group: "turn-state",
+      key: "turn_state_enabled",
+      label: "TurnState conversion gate"
+    };
     VALID_NOTICE_SEVERITIES = ["critical", "warn", "info"];
   }
 });
@@ -26790,26 +27138,26 @@ async function reportGetCommand(args2) {
       console.log(JSON.stringify(result, null, 2));
       return;
     }
-    const { report, messages } = result;
-    const title = sanitizeTerminalText(report.title);
-    const description = sanitizeTerminalText(report.description);
-    console.log(`Report ${report.report_id}`);
+    const { report: report2, messages } = result;
+    const title = sanitizeTerminalText(report2.title);
+    const description = sanitizeTerminalText(report2.description);
+    console.log(`Report ${report2.report_id}`);
     console.log(`  title:          ${title}`);
     console.log(`  description:    ${description.replace(/\n/g, "\n                  ")}`);
-    console.log(`  status:         ${report.status}`);
-    console.log(`  classification: ${report.classification}`);
-    if (report.contest_count > 0) console.log(`  contests:       ${report.contest_count}`);
-    if (report.dismissal_final) console.log("  dismissal:      final (non-contestable)");
+    console.log(`  status:         ${report2.status}`);
+    console.log(`  classification: ${report2.classification}`);
+    if (report2.contest_count > 0) console.log(`  contests:       ${report2.contest_count}`);
+    if (report2.dismissal_final) console.log("  dismissal:      final (non-contestable)");
     if (messages.length > 0) {
       console.log("\n  Thread:");
       for (const m of messages) {
         console.log(`    [${m.author_role}] ${sanitizeTerminalText(m.body)}`);
       }
     }
-    if (report.status === "shipped") {
+    if (report2.status === "shipped") {
       console.log(`
-  This fix is shipped. Run \`wayai report accept ${report.report_id}\` if it works,`);
-      console.log(`  or \`wayai report contest ${report.report_id} --reason "..."\` if it does not.`);
+  This fix is shipped. Run \`wayai report accept ${report2.report_id}\` if it works,`);
+      console.log(`  or \`wayai report contest ${report2.report_id} --reason "..."\` if it does not.`);
     }
   } catch (err) {
     reportActionError(err);
@@ -27089,7 +27437,7 @@ var init_actions = __esm({
 
 // src/data/commands/attachments.ts
 import { Command as Command2 } from "commander";
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 function findAttachmentByFilename(attachments, filename) {
   return attachments.find((a) => a.key.endsWith(`/${filename}`)) ?? null;
 }
@@ -27130,7 +27478,7 @@ function buildAttachmentsCommand() {
       printOutput(data, outputFormat(this));
       return;
     }
-    const body = readFileSync21(opts.file);
+    const body = readFileSync20(opts.file);
     await client.upload(uploadPathFrom(data?.upload_url), body, opts.contentType);
     printOutput({ ...data, uploaded: true }, outputFormat(this));
   });
@@ -27610,16 +27958,16 @@ var init_providers = __esm({
 
 // src/data/commands/report.ts
 import { Command as Command6 } from "commander";
-import { readFileSync as readFileSync22 } from "fs";
-import { dirname as dirname11, join as join32 } from "path";
+import { readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname12, join as join31 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolveCliVersion() {
   for (const candidate of [
-    join32(here, "..", "package.json"),
-    join32(here, "..", "..", "..", "package.json")
+    join31(here, "..", "package.json"),
+    join31(here, "..", "..", "..", "package.json")
   ]) {
     try {
-      const version = JSON.parse(readFileSync22(candidate, "utf-8")).version;
+      const version = JSON.parse(readFileSync21(candidate, "utf-8")).version;
       if (typeof version === "string" && version) return version;
     } catch {
     }
@@ -27653,10 +28001,10 @@ function reportActionError2(err) {
   throw err;
 }
 function buildBasesReportCommand() {
-  const report = new Command6("report").description(
+  const report2 = new Command6("report").description(
     "File a report to the Data triage queue and verify the outcome"
   );
-  report.command("create").description("Submit a report to the Data triage queue (deduplicated)").requiredOption("--title <title>", "Short summary").requiredOption("--description <text>", "What happened").option("--source <source>", "Origin: cli_report (default) | review | security_audit").option("--classification <c>", "Nature: bug (default) | flaky_test | security | enhancement").option(
+  report2.command("create").description("Submit a report to the Data triage queue (deduplicated)").requiredOption("--title <title>", "Short summary").requiredOption("--description <text>", "What happened").option("--source <source>", "Origin: cli_report (default) | review | security_audit").option("--classification <c>", "Nature: bug (default) | flaky_test | security | enhancement").option(
     "--dedup-key <key>",
     'Stable dedup key (e.g. "<file>::<test>"); collapses repeat occurrences'
   ).option("--severity <level>", "low | medium | high | critical").option("--steps <text>", "Steps to reproduce").option("--error-message <text>", "Exact error text if any").option("--context <text>", "Additional context (logs, request ids)").option("--locale <code>", "Notification locale (en | pt | es)", "en").option("--reporter-email <addr>", "Override reporter email (defaults to session email)").option("--base-id <id>", "Base the error relates to (defaults to the configured base)").option("--record-type <name>", "Record type the error relates to").option("--record-id <id>", "Record id (UUID) the error relates to").option("--external-id <id>", "External id of the related record").option("--external-source <src>", "External source of the related record").option("--relationship-id <id>", "Relationship id the error relates to").action(async function(opts) {
@@ -27707,7 +28055,7 @@ function buildBasesReportCommand() {
       );
     }
   });
-  report.command("list").description("List your reports, newest first").option("--status <s>", "Filter by status (e.g. shipped \u2014 awaiting your verification)").action(async function(opts) {
+  report2.command("list").description("List your reports, newest first").option("--status <s>", "Filter by status (e.g. shipped \u2014 awaiting your verification)").action(async function(opts) {
     const client = await createDataClient();
     const qs = opts.status ? `?status=${encodeURIComponent(opts.status)}` : "";
     try {
@@ -27730,7 +28078,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("get <report_id>").description("Show one of your reports: status + the message thread").action(async function(reportId) {
+  report2.command("get <report_id>").description("Show one of your reports: status + the message thread").action(async function(reportId) {
     const client = await createDataClient();
     try {
       const data = await client.request("GET", `/v1/reports/${pathSegment(reportId, "report id")}`);
@@ -27767,7 +28115,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("accept <report_id>").description("Accept a shipped fix (\u2192 addressed)").action(async function(reportId) {
+  report2.command("accept <report_id>").description("Accept a shipped fix (\u2192 addressed)").action(async function(reportId) {
     const client = await createDataClient();
     try {
       const data = await client.request(
@@ -27783,7 +28131,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {
+  report2.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {
     const client = await createDataClient();
     try {
       const data = await client.request(
@@ -27802,7 +28150,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  return report;
+  return report2;
 }
 var here;
 var init_report2 = __esm({
@@ -27815,13 +28163,13 @@ var init_report2 = __esm({
     init_terminal_output();
     init_workspace();
     init_skill_version();
-    here = dirname11(fileURLToPath2(import.meta.url));
+    here = dirname12(fileURLToPath2(import.meta.url));
   }
 });
 
 // src/data/commands/credentials.ts
 import { Command as Command7 } from "commander";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 function withValueSourceOptions(cmd, what) {
   return cmd.option(
     "--file <path>",
@@ -27834,7 +28182,7 @@ async function resolveValue(opts, label) {
       throw expected("--file cannot be combined with --value-stdin or --value-prompt \u2014 pass one.");
     }
     try {
-      return readFileSync23(opts.file).toString("base64");
+      return readFileSync22(opts.file).toString("base64");
     } catch (e) {
       throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -27983,7 +28331,7 @@ var init_credentials = __esm({
 
 // src/data/commands/sql.ts
 import { Command as Command8 } from "commander";
-import { readFileSync as readFileSync24 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 function buildBasesSqlCommand() {
   return withBaseOption(new Command8("sql")).description("Execute a read-only SQL query against base data").argument("[query]", "SQL query (SELECT only)").option("--file <path>", "Read SQL from a file instead of the argument").option(
     "--param <kv...>",
@@ -27993,7 +28341,7 @@ function buildBasesSqlCommand() {
     let query;
     if (opts.file) {
       try {
-        query = readFileSync24(opts.file, "utf-8").trim();
+        query = readFileSync23(opts.file, "utf-8").trim();
       } catch (e) {
         throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
       }
@@ -28648,7 +28996,7 @@ var init_file_types = __esm({
 
 // src/data/commands/files.ts
 import { Command as Command12 } from "commander";
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync16 } from "fs";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "fs";
 import { basename as basename18 } from "path";
 function renderFileDiff(fileType, filePath, from, to, d) {
   console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
@@ -28697,7 +29045,7 @@ function buildFilesCommand() {
     "Upload a local file to a path (e.g. wayai files put reports q3/summary.pdf --file ./summary.pdf)"
   ).requiredOption("--file <local>", "Local file to upload").option("--content-type <type>", "MIME type", "application/octet-stream").action(async function(fileType, filePath, opts) {
     const base = pathSegment(requireBase(this), "--base");
-    const body = readFileSync25(opts.file);
+    const body = readFileSync24(opts.file);
     const client = await createDataClient();
     printOutput(
       await client.upload(
@@ -29658,7 +30006,7 @@ __export(program_exports, {
 });
 import { Command as Command22 } from "commander";
 function withDataGlobals(command2) {
-  return command2.option("--org <uuid>", "Organization to operate against (overrides .wayai.yaml)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
+  return command2.option("--org <uuid>", "Organization to operate against (overrides the repo's org binding)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
 }
 function routeErrorsToCli(command2) {
   command2.exitOverride().configureOutput({ outputError: () => {
@@ -29746,9 +30094,9 @@ init_errors2();
 init_mask_secrets();
 init_utils();
 init_registry();
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync25 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname12, join as join33 } from "path";
+import { dirname as dirname13, join as join32 } from "path";
 
 // src/lib/version-refresh.ts
 init_version_cache();
@@ -29756,7 +30104,7 @@ init_skill_version();
 import { exec } from "child_process";
 var REFRESH_TIMEOUT_MS = 1e4;
 function refreshCliCache() {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     exec("npm view @wayai/cli version", { timeout: REFRESH_TIMEOUT_MS }, (err, stdout) => {
       if (!err) {
         const latest = stdout.trim();
@@ -29767,7 +30115,7 @@ function refreshCliCache() {
           }
         }
       }
-      resolve7();
+      resolve8();
     });
   });
 }
@@ -29793,8 +30141,8 @@ async function refreshSkillCache() {
 }
 async function refreshAdminSkillCache() {
   let timer;
-  const deadline = new Promise((resolve7) => {
-    timer = setTimeout(resolve7, REFRESH_TIMEOUT_MS);
+  const deadline = new Promise((resolve8) => {
+    timer = setTimeout(resolve8, REFRESH_TIMEOUT_MS);
   });
   await Promise.race([deadline, fetchAndCacheAdminSkillVersion().catch(() => {
   })]);
@@ -29903,8 +30251,8 @@ Run \`wayai admin skill install\` to update.`);
 }
 
 // src/index.ts
-var __dirname = dirname12(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync26(join33(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname13(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync25(join32(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
@@ -30139,7 +30487,7 @@ Commands:
   logout             Clear stored credentials
   status             Show current auth and config status
   whoami             Show the authenticated identity (supports --json)
-  init               Set up .wayai.yaml (pick organization)
+  init               Scope this repo to an organization (pick one)
   create-credential  Create an organization credential (API key, token, etc.)
   update-credential  Update / rotate an organization credential (by name)
   set-connection-credential  Set a connection's credential directly (org link or --field/--stdin), preview or production
@@ -30222,7 +30570,7 @@ Flags:
   --version, -v          Show CLI version
 
 Org-scoped mode:
-  Each repository is scoped to a single organization via .wayai.yaml
+  Each repository is scoped to a single organization via wayai-ws/wayai.yaml
   (only \`organization_id\` is required). Hubs self-identify via \`hub.yaml\`
   inside their folder under \`workspace/\`.