@wayai/cli 0.3.161 → 0.3.162

package/dist/index.js

@@ -9642,7 +9642,7 @@ var init_api_client = __esm({
        * `toDataProxyPath` knows how WayAI mounts that surface. Identity is the
        * caller's ordinary WayAI session — there is one keyring login, and the
        * backend attests the org over its service binding rather than forwarding a
-       * credential (docs/reference/rekor-platform-contracts.md §1).
+       * credential.
        *
        * Returns the surface's `{ data, meta }` envelope rather than unwrapping, so
        * cursor-paginated lists can follow `meta.has_more`. A failure throws the same
@@ -9740,11 +9740,11 @@ var init_api_client = __esm({
             // unlabelled body should fall back rather than announce nothing.
             "Content-Type": body instanceof Uint8Array ? contentType || "application/octet-stream" : "application/json",
             // Names the calling surface for the Data Worker's audit rows, which
-            // record `cli` vs `api` vs `mcp` (contracts §1.4). A HINT, not an
+            // record `cli` vs `api` vs `mcp`. A HINT, not an
             // authorization input: any client can send it, so the backend must
             // normalize it against what it knows about its own ingress rather than
             // trust it. Nothing is granted or denied on its value; the Data Worker's
-            // audit rows are its consumer (contracts §1.4).
+            // audit rows are its consumer.
             "X-WayAI-Client": "cli"
           },
           // Bytes go on the wire verbatim (file content, attachments); everything
@@ -15775,7 +15775,7 @@ var init_registry = __esm({
         // The organization vault this word named is retired: nothing resolves a value stored
         // there any more, so the surviving surface is `bases credentials` below — per-base
         // rows, which is what a `credential:<name>` reference actually reads. The row stays
-        // (this table records how every original word was dispositioned, and §3.2's semantic
+        // (this table records how every original word was dispositioned, and the semantic
         // collision list is checked independently of it) with `shipped: false`, which
         // `registry.test.ts` enforces by asserting the invocation is NOT reachable.
         original: "secrets",
@@ -26948,8 +26948,7 @@ Sources:
                  is NULL). Each row is resolved to a real user and granted both halves of
                  access, or dropped when no account matches. A repaired row is a REAL grant
                  to a real person and sends no email, so read --dry-run output as the list of
-                 people about to get access. Idempotent. See
-                 docs/runbooks/legacy-org-grant-repair.md.
+                 people about to get access. Idempotent.
 
   sandbox        Run arbitrary code in a fresh E2B sandbox (harness-agents isolation surface).
                  \`exec\` provisions a sandbox from a named Sandbox connection, runs one
@@ -26963,7 +26962,7 @@ Sources:
                  turn aborts on its next invocation. \`mass-destroy\` reaps every harness
                  sandbox/token/slot that is live NOW (scope: --hub < --org < --all, prefer
                  the narrowest). Run \`mass-destroy --dry-run\` first to see the blast
-                 radius. See docs/runbooks/harness-incident-response.md.
+                 radius.
 
 Types (do): ${VALID_TYPES.join(" | ")}
 Tables (analytics): ${VALID_ANALYTICS_TABLES.join(" | ")}