@wayai/cli 0.3.198 → 0.3.200

package/dist/index.js

@@ -2476,6 +2476,24 @@ var init_chunk_SNA2DXAC = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-MIWZOSPI.js
+function toIso(epochMs) {
+  return new Date(epochMs).toISOString();
+}
+function fromIso(iso) {
+  return new Date(iso).getTime();
+}
+function isIsoTimestamp(value) {
+  return typeof value === "string" && ISO_UTC_RE.test(value);
+}
+var ISO_UTC_RE;
+var init_chunk_MIWZOSPI = __esm({
+  "../../packages/core/dist/chunk-MIWZOSPI.js"() {
+    "use strict";
+    ISO_UTC_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+  }
+});
+
 // ../../packages/core/dist/chunk-IBL7FANV.js
 var SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX;
 var init_chunk_IBL7FANV = __esm({
@@ -2486,6 +2504,20 @@ var init_chunk_IBL7FANV = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-2ISUBJG7.js
+var EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_MAX_RUNS_PER_SCENARIO, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS;
+var init_chunk_2ISUBJG7 = __esm({
+  "../../packages/core/dist/chunk-2ISUBJG7.js"() {
+    "use strict";
+    EVAL_PACING_PRESET_NAMES = ["conservative", "balanced", "fast", "custom"];
+    PACING_INTERVAL_MIN_MS = 50;
+    PACING_INTERVAL_MAX_MS = 6e4;
+    EVAL_MAX_RUNS_PER_SCENARIO = 100;
+    EVAL_RUN_DEADLINE_MIN_MS = 1e3;
+    EVAL_RUN_DEADLINE_MAX_MS = 18e5;
+  }
+});
+
 // ../../packages/core/dist/chunk-C2UEA2KW.js
 var FLAG_CONDITION_OPERATORS;
 var init_chunk_C2UEA2KW = __esm({
@@ -6652,24 +6684,6 @@ var init_chunk_3NS3HULK = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-MIWZOSPI.js
-function toIso(epochMs) {
-  return new Date(epochMs).toISOString();
-}
-function fromIso(iso) {
-  return new Date(iso).getTime();
-}
-function isIsoTimestamp(value) {
-  return typeof value === "string" && ISO_UTC_RE.test(value);
-}
-var ISO_UTC_RE;
-var init_chunk_MIWZOSPI = __esm({
-  "../../packages/core/dist/chunk-MIWZOSPI.js"() {
-    "use strict";
-    ISO_UTC_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
-  }
-});
-
 // ../../packages/core/dist/chunk-JWPRTSIB.js
 function normalizeAuthType(raw) {
   if (VALID_AUTH_TYPES.has(raw)) return raw;
@@ -6906,21 +6920,7 @@ var init_chunk_T7KQKDET = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-2ISUBJG7.js
-var EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_MAX_RUNS_PER_SCENARIO, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS;
-var init_chunk_2ISUBJG7 = __esm({
-  "../../packages/core/dist/chunk-2ISUBJG7.js"() {
-    "use strict";
-    EVAL_PACING_PRESET_NAMES = ["conservative", "balanced", "fast", "custom"];
-    PACING_INTERVAL_MIN_MS = 50;
-    PACING_INTERVAL_MAX_MS = 6e4;
-    EVAL_MAX_RUNS_PER_SCENARIO = 100;
-    EVAL_RUN_DEADLINE_MIN_MS = 1e3;
-    EVAL_RUN_DEADLINE_MAX_MS = 18e5;
-  }
-});
-
-// ../../packages/core/dist/chunk-YEYIDIR6.js
+// ../../packages/core/dist/chunk-T2RKGBYS.js
 function containsKanbanPlaceholders(value) {
   if (value == null) return false;
   const serialized = typeof value === "string" ? value : JSON.stringify(value);
@@ -7236,13 +7236,33 @@ function refineToolConfig(value, ctx) {
     }
   }
 }
+function byLocale(entry) {
+  const shape = Object.fromEntries(SUPPORTED_LOCALES.map((locale) => [locale, entry.optional()]));
+  return external_exports.object(shape).strict();
+}
+function writeField(map) {
+  return map.nullable().optional().transform(
+    (value) => value && Object.keys(value).length === 0 ? null : value
+  );
+}
+function refineLaneReferences(val, ctx) {
+  const lanes = val.lanes;
+  const statuses = val.kanban_statuses;
+  if (lanes == null || statuses == null) return;
+  for (const issue of validateLaneReferences(lanes, statuses)) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["kanban_statuses", ...issue.path], message: issue.message });
+  }
+}
 function resolveMonitorTrigger(monitorConfig) {
   if (!monitorConfig || typeof monitorConfig !== "object") return "idle";
   const raw = monitorConfig.trigger;
   return MONITOR_TRIGGERS.includes(raw) ? raw : "idle";
 }
+function isAutomationGateTrigger(trigger) {
+  return AUTOMATION_GATE_TRIGGERS.includes(trigger);
+}
 function isFiringTrigger(trigger) {
-  return trigger !== "manual";
+  return !NON_FIRING_TRIGGERS.includes(trigger);
 }
 function monitorConfigNeedsDelay(monitorConfig) {
   if (!monitorConfig || typeof monitorConfig !== "object") return false;
@@ -7342,10 +7362,24 @@ function decodedMonitorConfig(value) {
 function monitorRuleActionKinds(trigger) {
   if (trigger === "assistant_reply") return MONITOR_ASSISTANT_REPLY_ACTION_KINDS;
   if (trigger === "call_utterance") return MONITOR_CALL_UTTERANCE_ACTION_KINDS;
+  if (trigger === "automation_fire") return MONITOR_AUTOMATION_FIRE_ACTION_KINDS;
+  if (trigger === "automation_item") return MONITOR_AUTOMATION_ITEM_ACTION_KINDS;
   return MONITOR_USER_MESSAGE_ACTION_KINDS;
 }
+function isGateActionKind(kind) {
+  return AUTOMATION_GATE_TRIGGERS.some((trigger) => monitorRuleActionKinds(trigger).includes(kind));
+}
 function monitorActionKindMessage(kind, trigger) {
   const allowed = monitorRuleActionKinds(trigger).join(", ");
+  if (trigger === "automation_fire") {
+    return `an automation_fire rule cannot select "${kind}": a fire gate runs before any conversation exists, so it only decides whether the fire runs. Use one of: ${allowed}.`;
+  }
+  if (trigger === "automation_item") {
+    return `an automation_item rule cannot select "${kind}": an item gate runs before anything is started for the contact, so it only decides whether its work starts. Use one of: ${allowed}.`;
+  }
+  if (isGateActionKind(kind)) {
+    return `a monitor rule cannot select "${kind}": it decides an automation's fire or one contact of it, so only an automation_fire or automation_item monitor can select it. Use one of: ${allowed}.`;
+  }
   if (trigger === "assistant_reply") {
     return `an assistant_reply rule cannot select "${kind}". Use one of: ${allowed}.`;
   }
@@ -7400,12 +7434,27 @@ function monitorRuleActions(monitorConfig) {
   visit(config.fallback, ["fallback"]);
   return found;
 }
+function automationGateIssues(monitorConfig) {
+  if (!monitorConfig || typeof monitorConfig !== "object") return [];
+  const trigger = resolveMonitorTrigger(monitorConfig);
+  if (!isAutomationGateTrigger(trigger)) return [];
+  const messages = AUTOMATION_GATE_KEY_MESSAGES[trigger];
+  const config = monitorConfig;
+  const issues = [];
+  if (Array.isArray(config.flag_conditions) && config.flag_conditions.length > 0) {
+    issues.push({ path: ["flag_conditions"], message: messages.flagConditions });
+  }
+  for (const key of MONITOR_INPUT_SHAPING_KEYS) {
+    if (config[key] !== void 0) issues.push({ path: [key], message: messages.inputShaping });
+  }
+  return issues;
+}
 function collectMonitorRuleIssues(monitorConfig) {
   const offTrigger = monitorRuleKeysOffTrigger(monitorConfig).map((key) => ({ path: [key], message: MONITOR_RULE_TRIGGER_MESSAGE }));
   if (offTrigger.length > 0) return offTrigger;
   const trigger = resolveMonitorTrigger(monitorConfig);
   const kinds = monitorRuleActionKinds(trigger);
-  const issues = callUtteranceRuleIssues(monitorConfig);
+  const issues = [...callUtteranceRuleIssues(monitorConfig), ...automationGateIssues(monitorConfig)];
   for (const { action, path: path36 } of monitorRuleActions(monitorConfig)) {
     if (trigger === "call_utterance" && path36[0] === "fallback") continue;
     const kind = action.kind;
@@ -7761,6 +7810,20 @@ function refineHubAsCodeLanes(config, ctx) {
     }
   }
 }
+function refineHubAsCodePresentation(config, ctx) {
+  const hub = config.hub;
+  if (hub == null) return;
+  for (const field of HUB_PRESENTATION_FIELDS) {
+    const value = hub[field];
+    if (value == null) continue;
+    const result = HUB_PRESENTATION_SCHEMAS[field].safeParse(value);
+    if (!result.success) {
+      for (const issue of result.error.issues) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["hub", field, ...issue.path], message: issue.message });
+      }
+    }
+  }
+}
 function refineHubAsCodeEvals(config, ctx) {
   const evals = config.evals;
   if (!Array.isArray(evals)) return;
@@ -8166,19 +8229,22 @@ function refineHubAsCodeMonitorRulesOutput(config, ctx) {
     }
   });
 }
-var PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, uuidSchema, USER_ID_REGEX, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, MESSAGE_ENVELOPE_HEADROOM_BYTES, MAX_AUDIO_FILE_BASE64_BYTES, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupTypeSchema, EVENT_RELATIVE_FOLLOWUP_TYPES, followupTimeUnitSchema, followupIdSchema, SELECTABLE_FOLLOWUP_TYPES, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS, followupSchema, MAX_OUTCOMES_PER_STATUS, kanbanOutcomeSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, PREVIOUS_CONVERSATIONS_MAX, NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, evalDateContextSchema, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, runJourneyQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, evalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT, MAX_RESOURCE_FILE_SIZE, CALL_OPENING_LANGUAGES, callOpeningLanguage, CALL_OPENING_MAX_DURATION_MS, CALL_OPENING_MAX_BYTES, CALL_OPENING_CAPTION_MAX_CHARS, CALL_OPENING_CONTENT_TYPES, callOpeningContentType, CALL_OPENING_HASH_REGEX, callOpeningHash, callOpeningCaption, storedCallOpening, MAX_CALL_OPENING_ENCODED_BYTES, MAX_CALL_OPENING_BODY_BYTES, agentCallOpeningParams, putAgentCallOpeningBody, deleteAgentCallOpeningQuery, callOpeningParam, callOpeningQuery, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
-var init_chunk_YEYIDIR6 = __esm({
-  "../../packages/core/dist/chunk-YEYIDIR6.js"() {
+var PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, uuidSchema, USER_ID_REGEX, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, MESSAGE_ENVELOPE_HEADROOM_BYTES, MAX_AUDIO_FILE_BASE64_BYTES, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupTypeSchema, EVENT_RELATIVE_FOLLOWUP_TYPES, followupTimeUnitSchema, followupIdSchema, SELECTABLE_FOLLOWUP_TYPES, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS, followupSchema, MAX_OUTCOMES_PER_STATUS, kanbanOutcomeSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, HUB_DISPLAY_NAME_MAX_CHARS, HUB_WELCOME_MESSAGE_MAX_CHARS, HUB_STARTER_QUESTIONS_MAX, HUB_STARTER_QUESTION_MAX_CHARS, displayName, welcomeMessage, starterQuestions, hubDisplayNamesSchema, hubWelcomeMessagesSchema, hubStarterQuestionsSchema, hubDisplayNamesField, hubWelcomeMessagesField, hubStarterQuestionsField, HUB_PRESENTATION_FIELDS, HUB_PRESENTATION_SCHEMAS, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, HUB_USERS_PAGE_SIZE_MAX, HUB_USERS_SEARCH_MAX, HUB_USERS_CHANNEL_TYPES, getHubUsersQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, MAX_EVAL_RETENTION_DAYS, MAX_END_USER_DAILY_MESSAGE_LIMIT, endUserDailyMessageLimitField, previewLabelField, hubTagsField, createHubBody, updateHubBody, HUB_TAG_CHANGE_REFUSED, hubTagChangeRefusalSchema, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, HUB_DIFF_SECTION_SET, HUB_DIFF_SECTIONS, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, PREVIOUS_CONVERSATIONS_MAX, NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, AUTOMATION_GATE_TRIGGERS, NON_FIRING_TRIGGERS, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, MONITOR_GATE_AGENT_NAME_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, MONITOR_AUTOMATION_FIRE_ACTION_KINDS, MONITOR_AUTOMATION_ITEM_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE, AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE, AUTOMATION_GATE_KEY_MESSAGES, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, evalDateContextSchema, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, runJourneyQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, evalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT, MAX_RESOURCE_FILE_SIZE, CALL_OPENING_LANGUAGES, callOpeningLanguage, CALL_OPENING_MAX_DURATION_MS, CALL_OPENING_MAX_BYTES, CALL_OPENING_CAPTION_MAX_CHARS, CALL_OPENING_CONTENT_TYPES, callOpeningContentType, CALL_OPENING_HASH_REGEX, callOpeningHash, callOpeningCaption, storedCallOpening, MAX_CALL_OPENING_ENCODED_BYTES, MAX_CALL_OPENING_BODY_BYTES, agentCallOpeningParams, putAgentCallOpeningBody, deleteAgentCallOpeningQuery, callOpeningParam, callOpeningQuery, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
+var init_chunk_T2RKGBYS = __esm({
+  "../../packages/core/dist/chunk-T2RKGBYS.js"() {
     "use strict";
     init_chunk_SNA2DXAC();
+    init_chunk_MIWZOSPI();
     init_chunk_IBL7FANV();
+    init_chunk_2ISUBJG7();
     init_chunk_C2UEA2KW();
     init_chunk_3NS3HULK();
-    init_chunk_MIWZOSPI();
     init_chunk_JWPRTSIB();
     init_chunk_T7KQKDET();
     init_chunk_L5F7ZOUJ();
-    init_chunk_2ISUBJG7();
+    init_zod();
+    init_zod();
+    init_zod();
     init_zod();
     init_zod();
     init_zod();
@@ -8586,355 +8652,638 @@ var init_chunk_YEYIDIR6 = __esm({
         keep_in_history: external_exports.boolean().optional()
       }).nullable()
     });
-    PREVIOUS_CONVERSATIONS_MAX = 20;
-    NATIVE_TOOL_NAMES = new Set(NATIVE_TOOLS.map((t) => t.tool_name));
-    previousConversationsCountField = external_exports.number().int().min(0).max(PREVIOUS_CONVERSATIONS_MAX).nullable().optional();
-    summarizationThresholdField = external_exports.number().int().min(SUMMARIZATION_THRESHOLD_MIN).max(SUMMARIZATION_THRESHOLD_MAX).nullable().optional();
-    flagConditionSchema = external_exports.object({
-      variable: external_exports.string(),
-      operator: external_exports.enum(FLAG_CONDITION_OPERATORS),
-      // `boolean` is admitted for parity with the CI write path, whose refine gates the
-      // operator alone, so `value: false` on a boolean evaluation variable is storable
-      // config today and the evaluator honours it through `String()`. Narrowing here would
-      // reject on PATCH exactly what `wayai push` persists, so any REST caller that reads
-      // an agent and writes it back — the typed clients, the CLI's `ApiClient`, MCP — would
-      // fail on a hub configured through the other surface.
-      value: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])
-    });
-    MONITOR_TRIGGERS = ["idle", "user_message", "assistant_reply", "manual", "call_utterance"];
-    monitorTriggerSchema = external_exports.enum(MONITOR_TRIGGERS);
-    MONITOR_FIRING_TRIGGERS = MONITOR_TRIGGERS.filter(isFiringTrigger);
-    MONITOR_DELAY_SECONDS_MIN = 10;
-    MONITOR_IDLE_DELAY_REQUIRED_MESSAGE = "delay_seconds is required for an idle monitor (an absent trigger is idle)";
-    MONITOR_HISTORY_MESSAGES_MAX = 100;
-    monitorHistoryMessagesSchema = external_exports.number().int().min(1).max(MONITOR_HISTORY_MESSAGES_MAX);
-    monitorIncludeToolResultsSchema = external_exports.boolean();
-    MONITOR_INPUT_SHAPING_KEYS = ["history_messages", "include_tool_results"];
-    MONITOR_INPUT_SHAPING_SCHEMAS = {
-      history_messages: monitorHistoryMessagesSchema.optional(),
-      include_tool_results: monitorIncludeToolResultsSchema.optional()
-    };
-    MONITOR_INPUT_SHAPING_IDLE_MESSAGE = "only a user_message, assistant_reply, manual or call_utterance monitor reads this \u2014 an idle monitor runs as a full turn and takes the ordinary history window";
-    monitorArgumentSourceSchema = external_exports.union([
-      external_exports.object({ from_variable: external_exports.string().min(1) }).strict(),
-      external_exports.object({ const: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()]) }).strict()
+    primaryRegionSchema = external_exports.enum([
+      "wnam",
+      "enam",
+      "sam",
+      "weur",
+      "eeur",
+      "apac",
+      "oc",
+      "afr",
+      "me"
     ]);
-    MONITOR_NOTE_TEMPLATE_MAX = 2e3;
-    MONITOR_STEER_NOTE_MAX = 500;
-    monitorActionSchema = external_exports.discriminatedUnion("kind", [
-      external_exports.object({ kind: external_exports.literal("none") }).strict(),
-      external_exports.object({
-        kind: external_exports.literal("call_tool"),
-        tool_name: external_exports.string().min(1),
-        args: external_exports.record(monitorArgumentSourceSchema).optional()
-      }).strict(),
-      external_exports.object({ kind: external_exports.literal("hold") }).strict(),
-      external_exports.object({ kind: external_exports.literal("rewrite"), note: external_exports.string().min(1).max(MONITOR_NOTE_TEMPLATE_MAX) }).strict(),
-      external_exports.object({ kind: external_exports.literal("steer"), note: external_exports.string().min(1).max(MONITOR_STEER_NOTE_MAX) }).strict()
+    placementSourceSchema = external_exports.enum([
+      "hub_config",
+      "org_config",
+      "parent_cascade",
+      "cf_colo",
+      "country",
+      "fallback"
     ]);
-    monitorRuleSchema = external_exports.object({
-      when: external_exports.array(flagConditionSchema).min(1),
-      action: monitorActionSchema
-    }).strict();
-    MONITOR_RULE_KEYS = ["rules", "fallback"];
-    MONITOR_RULE_SCHEMAS = {
-      rules: external_exports.array(monitorRuleSchema).optional(),
-      fallback: monitorActionSchema.optional()
-    };
-    MONITOR_RULE_TRIGGERS = ["user_message", "assistant_reply", "manual", "call_utterance"];
-    MONITOR_RULE_TRIGGER_MESSAGE = "only a user_message, assistant_reply, manual or call_utterance monitor acts on rules \u2014 set one of those triggers, or remove this key. A manual monitor acts on its rules when another monitor runs it.";
-    CALL_UTTERANCE_SPEAKERS = ["caller", "voice", "both"];
-    callUtteranceSpeakerSchema = external_exports.enum(CALL_UTTERANCE_SPEAKERS);
-    MONITOR_CALL_KEYS = ["speaker"];
-    MONITOR_CALL_SCHEMAS = {
-      speaker: callUtteranceSpeakerSchema.optional()
-    };
-    MONITOR_CALL_KEY_MESSAGE = "only a call_utterance monitor reads this: it names whose speech on a live call a check waits for";
-    CALL_STEERING_MIN_CONFIDENCE = 0.9;
-    CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE = `a call_utterance rule acts on a live call from a transcript that can be misheard, so it must be high-confidence: give it a condition on one of this monitor's "\u2026${CONFIDENCE_VARIABLE_SUFFIX}" variables with ">= ${CALL_STEERING_MIN_CONFIDENCE}" or a higher bar, up to 1.`;
-    CALL_UTTERANCE_FALLBACK_MESSAGE = "a call_utterance monitor acts only when a high-confidence rule matches \u2014 a fallback would act on every check of the call. Remove it.";
-    CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE = "a call_utterance monitor checks a live call every few seconds and does not flag the conversation. Remove its flag_conditions, or flag from a monitor on another trigger.";
-    CALL_STEER_NOTE_BLANK_MESSAGE = "a steer's note is what the voice is told \u2014 write the instruction it should follow.";
-    MONITOR_USER_MESSAGE_ACTION_KINDS = ["none", "call_tool"];
-    MONITOR_ASSISTANT_REPLY_ACTION_KINDS = ["none", "call_tool", "hold", "rewrite"];
-    MONITOR_CALL_UTTERANCE_ACTION_KINDS = ["none", "call_tool", "steer"];
-    INSERT_NOTE_TOOL_NAME = "insert_note";
-    RUN_MONITOR_TOOL_NAME = "run_monitor";
-    MONITOR_RULE_ALLOWED_NATIVE_TOOLS = [
-      "update_state",
-      "schedule_followup",
-      "transfer_to_agent",
-      "transfer_to_team",
-      INSERT_NOTE_TOOL_NAME,
-      RUN_MONITOR_TOOL_NAME
-    ];
-    MONITOR_RULE_REENTRY_TOOLS = {
-      transfer_to_agent: "agent",
-      transfer_to_team: "team"
-    };
-    MONITOR_RULE_REENTRY_TRACKS = new Map(Object.entries(MONITOR_RULE_REENTRY_TOOLS));
-    monitorConfigField = external_exports.object({
-      delay_seconds: external_exports.number().int().min(MONITOR_DELAY_SECONDS_MIN).optional(),
-      trigger: monitorTriggerSchema.optional(),
-      ...MONITOR_INPUT_SHAPING_SCHEMAS,
-      ...MONITOR_RULE_SCHEMAS,
-      ...MONITOR_CALL_SCHEMAS,
-      flag_conditions: external_exports.array(flagConditionSchema).optional()
-    }).passthrough().superRefine((config, ctx) => {
-      if (monitorConfigNeedsDelay(config)) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["delay_seconds"],
-          message: MONITOR_IDLE_DELAY_REQUIRED_MESSAGE
-        });
-      }
-      for (const key of monitorInputShapingKeysOnIdle(config)) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: [key],
-          message: MONITOR_INPUT_SHAPING_IDLE_MESSAGE
-        });
-      }
-      for (const key of monitorCallKeysOffTrigger(config)) {
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [key], message: MONITOR_CALL_KEY_MESSAGE });
-      }
-      for (const issue of collectMonitorRuleIssues(config)) {
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: issue.path, message: issue.message });
-      }
-    }).nullable().optional();
-    flagConditionsField = external_exports.array(flagConditionSchema).nullable().optional();
-    agentIdParam = external_exports.object({
+    orgIdParam = external_exports.object({
       id: uuidSchema
     });
-    listAgentsQuery = external_exports.object({
-      hub_id: uuidSchema
+    orgAdminIdParam = external_exports.object({
+      id: uuidSchema,
+      adminId: external_exports.string().min(1)
     });
-    agentConnectionsQuery = external_exports.object({
-      hub_id: uuidSchema
+    createOrganizationBody = external_exports.object({
+      organization_name: external_exports.string().min(1, "organization_name is required"),
+      // Write-once at creation; updateOrganizationBody does not accept this.
+      primary_region: primaryRegionSchema.optional()
     });
-    createAgentBody = external_exports.object({
-      agent_name: external_exports.string().min(1),
-      hub_id: uuidSchema,
-      agent_role: external_exports.enum(AGENT_ROLES),
-      additional_context_template: external_exports.string().max(2e4).optional(),
-      summarization_threshold_tokens: summarizationThresholdField,
-      previous_conversations_count: previousConversationsCountField,
-      monitor_config: monitorConfigField,
-      flag_conditions: flagConditionsField
-    }).passthrough().superRefine((body, ctx) => {
-      refineDecisionsModelBinding(body, ctx);
-      refineMonitorRulesStructuredOutput(body, ctx);
-    });
-    updateAgentBody = external_exports.object({
-      additional_context_template: external_exports.string().max(2e4).optional(),
-      summarization_threshold_tokens: summarizationThresholdField,
-      previous_conversations_count: previousConversationsCountField,
-      monitor_config: monitorConfigField,
-      flag_conditions: flagConditionsField
+    updateOrganizationBody = external_exports.object({
+      organization_name: external_exports.string().min(1).optional(),
+      organization_avatar_url: external_exports.string().url().nullable().optional(),
+      timezone: external_exports.string().optional(),
+      business_hours: external_exports.unknown().optional()
     }).passthrough();
-    AGENT_PARAMETER_TYPES = ["string", "number", "boolean", "integer", "enum"];
-    AGENT_PARAMETER_NAME_REGEX = /^[a-zA-Z_][a-zA-Z0-9_]{0,63}$/;
-    agentParameterCreateSchema = external_exports.object({
-      parameter_name: external_exports.string().regex(
-        AGENT_PARAMETER_NAME_REGEX,
-        "parameter_name must start with a letter or underscore and contain only letters, digits, and underscores (max 64 chars)"
-      ),
-      parameter_type: external_exports.enum(AGENT_PARAMETER_TYPES).optional(),
-      // No length caps on the free-text fields below: the agent_parameter columns are
-      // unbounded TEXT and pre-PR rows were never length-validated, so a cap would 422
-      // an unrelated GET→edit→re-save of legitimately-long existing data. The name
-      // regex (above) and the batch cap (below) are the load-bearing guards; total
-      // payload size belongs in a global /api/* body limit, not per field here.
-      parameter_description: external_exports.string().nullable().optional(),
-      parameter_label: external_exports.string().nullable().optional(),
-      parameter_enum: external_exports.array(external_exports.string()).nullable().optional(),
-      parameter_required: external_exports.boolean().optional(),
-      // Free-form analytics grouping label — no DB CHECK and the CI path persists
-      // arbitrary strings, so keep this permissive (not the 4-value UI dropdown enum).
-      variable_category: external_exports.string().nullable().optional(),
-      is_summary: external_exports.boolean().optional()
-    }).strict();
-    MAX_AGENT_PARAMETERS_PER_REQUEST = 100;
-    createAgentParametersBody = external_exports.union([
-      agentParameterCreateSchema,
-      external_exports.array(agentParameterCreateSchema).max(MAX_AGENT_PARAMETERS_PER_REQUEST, `too many parameters (max ${MAX_AGENT_PARAMETERS_PER_REQUEST})`)
-    ]);
-    evalIdParam = external_exports.object({
-      id: external_exports.string().uuid()
-    });
-    sessionIdParam = external_exports.object({
-      id: external_exports.string().uuid()
+    addOrgAdminBody = external_exports.object({
+      user_email: external_exports.string().email("valid email is required")
     });
-    scenarioSetIdParam = external_exports.object({
-      id: external_exports.string().uuid()
+    HUB_DISPLAY_NAME_MAX_CHARS = 120;
+    HUB_WELCOME_MESSAGE_MAX_CHARS = 1e3;
+    HUB_STARTER_QUESTIONS_MAX = 4;
+    HUB_STARTER_QUESTION_MAX_CHARS = 120;
+    displayName = external_exports.string().trim().min(1).max(HUB_DISPLAY_NAME_MAX_CHARS);
+    welcomeMessage = external_exports.string().trim().min(1).max(HUB_WELCOME_MESSAGE_MAX_CHARS);
+    starterQuestions = external_exports.array(external_exports.string().trim().min(1).max(HUB_STARTER_QUESTION_MAX_CHARS)).min(1).max(HUB_STARTER_QUESTIONS_MAX);
+    hubDisplayNamesSchema = byLocale(displayName);
+    hubWelcomeMessagesSchema = byLocale(welcomeMessage);
+    hubStarterQuestionsSchema = byLocale(starterQuestions);
+    hubDisplayNamesField = writeField(hubDisplayNamesSchema);
+    hubWelcomeMessagesField = writeField(hubWelcomeMessagesSchema);
+    hubStarterQuestionsField = writeField(hubStarterQuestionsSchema);
+    HUB_PRESENTATION_FIELDS = ["display_names", "welcome_messages", "starter_questions"];
+    HUB_PRESENTATION_SCHEMAS = {
+      display_names: hubDisplayNamesSchema,
+      welcome_messages: hubWelcomeMessagesSchema,
+      starter_questions: hubStarterQuestionsSchema
+    };
+    hubIdParam = external_exports.object({ id: uuidSchema });
+    hubAdminIdParam = external_exports.object({ id: uuidSchema, adminId: uuidSchema });
+    hubUserIdParam = external_exports.object({ id: uuidSchema, hubUserId: uuidSchema });
+    hubIdentityIdParam = external_exports.object({ id: uuidSchema, identityId: uuidSchema });
+    hubTeamIdParam = external_exports.object({ id: uuidSchema, teamId: uuidSchema });
+    hubTeamUserDeleteParam = external_exports.object({ id: uuidSchema, teamUserId: uuidSchema });
+    hubSchemaQuery = external_exports.object({ hub_id: uuidSchema });
+    HUB_USERS_PAGE_SIZE_MAX = 200;
+    HUB_USERS_SEARCH_MAX = 200;
+    HUB_USERS_CHANNEL_TYPES = ["app", "whatsapp", "instagram", "telegram"];
+    getHubUsersQuery = external_exports.object({
+      cursor: external_exports.string().regex(/^[1-9][0-9]{0,14}$/, "Invalid cursor").optional(),
+      page_size: external_exports.coerce.number().int().min(1).max(HUB_USERS_PAGE_SIZE_MAX).optional(),
+      channel_type: external_exports.enum(HUB_USERS_CHANNEL_TYPES).optional(),
+      search: external_exports.string().max(HUB_USERS_SEARCH_MAX).optional()
     });
-    hubIdQuery = external_exports.object({
-      hub_id: external_exports.string().uuid()
+    PREVIEW_LABEL_MAX_LENGTH = 60;
+    MAX_ENDED_INDEX_RETENTION_DAYS = 730;
+    MAX_EVAL_RETENTION_DAYS = 3650;
+    MAX_END_USER_DAILY_MESSAGE_LIMIT = 1e4;
+    endUserDailyMessageLimitField = external_exports.number().int().min(1).max(MAX_END_USER_DAILY_MESSAGE_LIMIT).nullable().optional();
+    previewLabelField = external_exports.string().max(PREVIEW_LABEL_MAX_LENGTH).optional().nullable().transform((v) => {
+      if (v == null) return null;
+      const trimmed = v.trim();
+      return trimmed || null;
     });
-    evalDateContextSchema = external_exports.object({
-      base_time: timestampSchema.refine(isIsoTimestamp, "Expected a canonical ISO timestamp"),
-      timezone: external_exports.string().min(1).refine((timezone) => {
-        try {
-          new Intl.DateTimeFormat("en-US", { timeZone: timezone }).format(0);
-          return true;
-        } catch {
-          return false;
-        }
-      }, "Expected an IANA timezone"),
-      locale: external_exports.enum(SUPPORTED_LOCALES)
-    }).strict();
-    EVAL_FIXTURE_NAME_MAX_LENGTH = 200;
-    evalFixtureOverrideSchema = external_exports.string().trim().min(1).max(EVAL_FIXTURE_NAME_MAX_LENGTH);
-    runSessionQuery = hubIdQuery.extend({
-      fixture: evalFixtureOverrideSchema.optional()
+    hubTagsField = external_exports.array(external_exports.string()).nullable().optional();
+    createHubBody = external_exports.object({
+      organization_id: uuidSchema,
+      hub_name: external_exports.string().min(1, "hub_name is required"),
+      hub_description: external_exports.string().optional(),
+      kanban_statuses: kanbanStatusesArraySchema.nullable().optional(),
+      lanes: lanesArraySchema.nullable().optional(),
+      // Optional preview label for the first preview. Server-owned thereafter
+      // (change via `wayai relabel` / replicate); the push diff never writes it.
+      preview_label: previewLabelField,
+      // Write-once at creation; updateHubBody does not accept this.
+      primary_region: primaryRegionSchema.optional(),
+      // Org tag ids. Ids that name none of the org's tags are dropped; a hub created with
+      // any is a tag change (`hubTagChangeRefusalSchema`).
+      tags: hubTagsField,
+      // Localized end-user presentation (`hub-presentation.ts`). Validated here too: the body is
+      // `.passthrough()` and `createHub` writes all three, so an unvalidated map would persist.
+      display_names: hubDisplayNamesField,
+      welcome_messages: hubWelcomeMessagesField,
+      starter_questions: hubStarterQuestionsField,
+      // Validated here for the same reason: `createHub` writes it.
+      end_user_daily_message_limit: endUserDailyMessageLimitField
+    }).passthrough().superRefine(refineLaneReferences);
+    updateHubBody = external_exports.object({
+      support_model: external_exports.enum(["conversation", "account"]).optional(),
+      unassigned_policy: external_exports.enum(["default_team", "auto_assign_random", "auto_assign_round_robin", "pull_queue"]).optional(),
+      default_hub_team_id: uuidSchema.nullable().optional(),
+      kanban_statuses: kanbanStatusesArraySchema.nullable().optional(),
+      lanes: lanesArraySchema.nullable().optional(),
+      // summarization_threshold_tokens relocated to the summarizer AGENT (PR4) — validated/
+      // persisted via the agent path (.passthrough() agent body → HubDO column), not here.
+      auto_close_inactive_days: external_exports.number().int().min(1).max(180).optional(),
+      // Per-hub ConversationDO retention window (days) — keeps an ended conversation's DO
+      // alive for post-hoc annotation. Default 7, max 30 — the floor of the retention
+      // chain (≤ ended_index_retention_days ≤ effective storage retention).
+      conversation_retention_days: external_exports.number().int().min(1).max(30).optional(),
+      // Per-hub ended-conversation index retention window (days) — how long the warm
+      // "Ended" tab + chat-hub continuous history serve a closed conversation before
+      // the cleanup cron reaps its index row. Absent → DEFAULT_ENDED_INDEX_RETENTION_DAYS
+      // (365). Re-clamped to the effective storage retention at reap time.
+      ended_index_retention_days: external_exports.number().int().min(1).max(MAX_ENDED_INDEX_RETENTION_DAYS).optional(),
+      // Per-hub eval-session retention window (days). null CLEARS the override (back to
+      // the platform default); 0 disables retention for this hub (keep sessions forever).
+      // Nullable — unlike the fields above, "unset" is a meaningful, settable state.
+      eval_retention_days: external_exports.number().int().min(0).max(MAX_EVAL_RETENTION_DAYS).nullable().optional(),
+      // Channel contact access control. Enum-validated explicitly (not via passthrough)
+      // so `language`/`access_approval_role` can't reach the DB with an invalid value.
+      language: external_exports.enum(["en", "pt", "es"]).optional(),
+      access_request_message: external_exports.string().max(1e3).nullable().optional(),
+      access_approval_role: external_exports.enum(["admin", "team"]).optional(),
+      // AI-failure escalation. When an LLM provider outage persists past this many
+      // minutes the conversation escalates to the team; null → code default. The two
+      // message fields override the localized (hub.language) delay / hand-off notices;
+      // null → localized default. Bounds validated here so out-of-range never persists.
+      ai_failure_escalation_minutes: external_exports.number().int().min(1).max(60).nullable().optional(),
+      ai_delay_message: external_exports.string().max(1e3).nullable().optional(),
+      ai_handoff_message: external_exports.string().max(1e3).nullable().optional(),
+      // Native-completion fallback connection for a degraded harness turn (PR 2.10b).
+      // A NATIVE LLM (Agent) connection id on this hub; validated at set-time on the REST
+      // PATCH (setup/hubs.ts rejects a non-existent / non-Agent / harness id) and re-checked
+      // at fallback time in the turn seam (a stale/missing id simply no-ops). Nullable to clear it.
+      fallback_connection_id: uuidSchema.nullable().optional(),
+      // Rekor API connection used to reset/clear eval seed fixtures (gh #3090). A
+      // connection id on this hub (a REST API (custom tool) connection whose base_url
+      // is the Rekor API origin + a bearer/api_key `write:seeds` token). Validated at
+      // set-time on the REST PATCH (setup/hubs.ts). Nullable to clear it.
+      seed_connection_id: uuidSchema.nullable().optional(),
+      // Org tag ids, replacing the hub's; null clears them. A change is refused to anyone
+      // but an org admin (`hubTagChangeRefusalSchema`).
+      tags: hubTagsField,
+      // Localized end-user presentation (`hub-presentation.ts`): keys are supported locales only,
+      // each map replaces the stored one, and null or an empty map clears it.
+      display_names: hubDisplayNamesField,
+      welcome_messages: hubWelcomeMessagesField,
+      starter_questions: hubStarterQuestionsField,
+      // Messages one end user may send the hub on the app channel per 24 hours; null removes it.
+      end_user_daily_message_limit: endUserDailyMessageLimitField
+    }).passthrough().superRefine(refineLaneReferences);
+    HUB_TAG_CHANGE_REFUSED = "hub_tag_change_requires_org_admin";
+    hubTagChangeRefusalSchema = external_exports.object({
+      reason: external_exports.literal(HUB_TAG_CHANGE_REFUSED),
+      operation: external_exports.enum(["update", "publish"]),
+      hub_id: external_exports.string(),
+      tags_added: external_exports.array(external_exports.string()),
+      tags_removed: external_exports.array(external_exports.string())
     });
-    runJourneyQuery = hubIdQuery.extend({
-      call_mode: external_exports.enum(["true", "false"]).optional()
+    addHubAdminBody = external_exports.object({
+      user_email: external_exports.string().email("valid email is required")
     });
-    EVAL_INPUT_ROLES = ["user", "system"];
-    EVAL_INPUT_ROLE_LIST = EVAL_INPUT_ROLES.map((r) => `"${r}"`).join(" or ");
-    ROLE_ECHO_MAX = 40;
-    EVAL_INITIAL_STATE_SCOPES = ["user"];
-    MAX_INITIAL_STATE_ENTRIES = 20;
-    evalInitialStateEntry = external_exports.object({
-      slug: external_exports.string().min(1).max(200),
-      scope: external_exports.enum(EVAL_INITIAL_STATE_SCOPES).default("user"),
-      value: external_exports.record(external_exports.unknown())
+    addHubIdentityAuthorizationBody = external_exports.object({
+      identity_value: external_exports.string().min(1),
+      identity_type: external_exports.string().min(1),
+      channel_type: external_exports.string().min(1)
     });
-    evalBody = external_exports.object({
-      eval: external_exports.record(external_exports.unknown())
-    }).superRefine(refineEvalName).superRefine(refineEvalMessageTextRole).superRefine(refineEvalAttachments).superRefine(refineEvalInitialState);
-    EVAL_LIST_MAX_LIMIT = 1e3;
-    evalListLimit = external_exports.string().regex(/^\d+$/).refine((v) => Number(v) <= EVAL_LIST_MAX_LIMIT, {
-      message: `limit must be ${EVAL_LIST_MAX_LIMIT} or less`
-    }).optional();
-    getEvalsQuery = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      agent_id: external_exports.string().uuid().optional(),
-      enabled: external_exports.string().regex(/^(true|false)$/).optional(),
-      search: external_exports.string().optional(),
-      limit: evalListLimit,
-      offset: external_exports.string().regex(/^\d+$/).optional()
+    contactDecisionBody = external_exports.object({
+      contact_access_id: uuidSchema.optional(),
+      identity_type: external_exports.string().min(1).optional(),
+      identity_value: external_exports.string().min(1).optional(),
+      channel_type: external_exports.string().min(1).optional(),
+      channel_id: uuidSchema.optional(),
+      connection_id: uuidSchema.optional(),
+      user_id: uuidSchema.optional(),
+      sender_display_name: external_exports.string().max(200).optional()
     });
-    toggleEvalBody = external_exports.object({
-      enabled: external_exports.boolean()
+    approveContactBody = contactDecisionBody.extend({
+      user_name: external_exports.string().min(1).max(120).optional()
     });
-    bulkToggleEvalsBody = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      enabled: external_exports.boolean(),
-      filters: external_exports.object({
-        agent_id: external_exports.string().uuid().optional(),
-        search: external_exports.string().optional()
-      }).optional()
+    listContactAccessQuery = external_exports.object({
+      status: external_exports.enum(["pending", "blocked"]).optional()
     });
-    pacingConfigSchema = external_exports.object({
-      preset: external_exports.enum(EVAL_PACING_PRESET_NAMES),
-      custom_interval_ms: external_exports.number().int().min(PACING_INTERVAL_MIN_MS).max(PACING_INTERVAL_MAX_MS).optional()
-    }).refine(
-      (v) => v.preset !== "custom" || typeof v.custom_interval_ms === "number",
-      { message: 'custom_interval_ms required when preset is "custom"' }
-    );
-    EVAL_MAX_SELECTED_SCENARIOS = 200;
-    evalScenarioSelectionEntrySchema = external_exports.object({
-      eval_id: external_exports.string().uuid(),
-      run_numbers: external_exports.array(external_exports.number().int().min(1).max(EVAL_MAX_RUNS_PER_SCENARIO)).min(1).max(EVAL_MAX_RUNS_PER_SCENARIO).refine((runs) => new Set(runs).size === runs.length, {
-        message: "run_numbers must not repeat a run"
-      }).optional()
+    createHubTeamBody = external_exports.object({
+      team_name: external_exports.string().min(1, "team_name is required")
     }).strict();
-    evalScenarioSelectionSchema = external_exports.array(evalScenarioSelectionEntrySchema).min(1).max(EVAL_MAX_SELECTED_SCENARIOS).refine(
-      (entries) => new Set(entries.map((e) => e.eval_id)).size === entries.length,
-      { message: "scenario_selection must not name the same scenario twice" }
-    );
-    sessionConfigSchema = external_exports.object({
-      pacing: pacingConfigSchema.optional(),
-      scenario_selection: evalScenarioSelectionSchema.optional(),
-      /**
-       * CALL MODE (realtime voice calls, plan §12.1): every turn this session fires runs as a call
-       * turn would — the pilot gets the call-mode addendum, and the reply gate takes no rewrite (a
-       * draft it would have rewritten is held, as on a call). Delivery and scoring stay a text
-       * eval's. A property of the launch, like the two keys above.
-       */
-      call_mode: external_exports.boolean().optional(),
-      // Server-owned immutable clock.
-      date_context: external_exports.never().optional(),
-      date_context_claimed: external_exports.never().optional(),
-      seed_cleanup: external_exports.never().optional(),
-      // Per-run finalization deadline for the HubDO watchdog (gh #2591). A started
-      // run idle past this many ms is reaped to `failed`. Omitted → backend default
-      // (`EVAL_DEFAULT_RUN_DEADLINE_MS`).
-      run_deadline_ms: external_exports.number().int().min(EVAL_RUN_DEADLINE_MIN_MS).max(EVAL_RUN_DEADLINE_MAX_MS).optional(),
-      seed: external_exports.never().optional()
-    }).passthrough();
-    createSessionBody = external_exports.object({
-      session: external_exports.object({
-        session_name: external_exports.string().trim().min(1),
-        session_config: sessionConfigSchema.optional()
-      }).passthrough()
+    updateHubTeamBody = external_exports.object({
+      team_name: external_exports.string().min(1).optional(),
+      conversation_display_only_if_claimed: external_exports.boolean().optional(),
+      team_access_rule: external_exports.string().optional(),
+      initial_team: external_exports.boolean().optional()
+    }).strict();
+    addHubTeamUserBody = external_exports.object({
+      user_email: external_exports.string().email("valid email is required")
     });
-    getSessionsQuery = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      status: external_exports.string().optional(),
-      search: external_exports.string().optional(),
-      limit: evalListLimit,
-      offset: external_exports.string().regex(/^\d+$/).optional()
+    reassignHubUserBody = external_exports.object({
+      hub_team_id: uuidSchema.nullable()
     });
-    getSessionResultsQuery = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      limit: external_exports.string().regex(/^\d+$/).optional(),
-      offset: external_exports.string().regex(/^\d+$/).optional()
+    replicatePreviewBody = external_exports.object({
+      preview_label: previewLabelField
     });
-    getSessionRunsQuery = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      eval_id: external_exports.string().uuid().optional(),
-      limit: external_exports.string().regex(/^\d+$/).optional(),
-      offset: external_exports.string().regex(/^\d+$/).optional()
+    HUB_DIFF_SECTION_SET = {
+      agents: true,
+      agent_parameters: true,
+      connections: true,
+      mcp_tools: true,
+      tools: true,
+      channels: true,
+      states: true,
+      teams: true,
+      resources: true,
+      resource_folders: true,
+      resource_files: true,
+      agent_resources: true,
+      message_templates: true,
+      contact_lists: true,
+      automations: true,
+      evals: true
+    };
+    HUB_DIFF_SECTIONS = Object.keys(HUB_DIFF_SECTION_SET);
+    updateChannelTestIdentitiesBody = external_exports.object({
+      test_identities: external_exports.array(external_exports.string().max(320)).max(1e3)
     });
-    evalAnalyticsQuery = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      start_date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
-      end_date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
-      periodicity: external_exports.enum(["daily", "weekly", "monthly"]).optional(),
-      eval_id: external_exports.string().uuid().optional(),
-      session_id: external_exports.string().uuid().optional()
+    claimCodeChannelParam = external_exports.object({
+      id: uuidSchema,
+      channelId: uuidSchema
     });
-    getSessionCostQuery = external_exports.object({
-      hub_id: external_exports.string().uuid()
+    claimCodeDeleteParam = external_exports.object({
+      id: uuidSchema,
+      channelId: uuidSchema,
+      code: external_exports.string().regex(/^[A-Za-z0-9]{6}$/, "Invalid claim code format").transform((s) => s.toUpperCase())
     });
-    compareSessionsQuery = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      session_a: external_exports.string().uuid(),
-      session_b: external_exports.string().uuid()
+    PREVIOUS_CONVERSATIONS_MAX = 20;
+    NATIVE_TOOL_NAMES = new Set(NATIVE_TOOLS.map((t) => t.tool_name));
+    previousConversationsCountField = external_exports.number().int().min(0).max(PREVIOUS_CONVERSATIONS_MAX).nullable().optional();
+    summarizationThresholdField = external_exports.number().int().min(SUMMARIZATION_THRESHOLD_MIN).max(SUMMARIZATION_THRESHOLD_MAX).nullable().optional();
+    flagConditionSchema = external_exports.object({
+      variable: external_exports.string(),
+      operator: external_exports.enum(FLAG_CONDITION_OPERATORS),
+      // `boolean` is admitted for parity with the CI write path, whose refine gates the
+      // operator alone, so `value: false` on a boolean evaluation variable is storable
+      // config today and the evaluator honours it through `String()`. Narrowing here would
+      // reject on PATCH exactly what `wayai push` persists, so any REST caller that reads
+      // an agent and writes it back — the typed clients, the CLI's `ApiClient`, MCP — would
+      // fail on a hub configured through the other surface.
+      value: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])
     });
-    evalsSqlBody = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      // Hard size cap before the validator runs — keeps lex/parse work bounded.
-      sql: external_exports.string().min(1).max(8e3),
-      limit: external_exports.number().int().positive().max(1e4).optional()
+    MONITOR_TRIGGERS = [
+      "idle",
+      "user_message",
+      "assistant_reply",
+      "manual",
+      "call_utterance",
+      "automation_fire",
+      "automation_item"
+    ];
+    monitorTriggerSchema = external_exports.enum(MONITOR_TRIGGERS);
+    AUTOMATION_GATE_TRIGGERS = ["automation_fire", "automation_item"];
+    NON_FIRING_TRIGGERS = ["manual", ...AUTOMATION_GATE_TRIGGERS];
+    MONITOR_FIRING_TRIGGERS = MONITOR_TRIGGERS.filter(isFiringTrigger);
+    MONITOR_DELAY_SECONDS_MIN = 10;
+    MONITOR_IDLE_DELAY_REQUIRED_MESSAGE = "delay_seconds is required for an idle monitor (an absent trigger is idle)";
+    MONITOR_HISTORY_MESSAGES_MAX = 100;
+    monitorHistoryMessagesSchema = external_exports.number().int().min(1).max(MONITOR_HISTORY_MESSAGES_MAX);
+    monitorIncludeToolResultsSchema = external_exports.boolean();
+    MONITOR_INPUT_SHAPING_KEYS = ["history_messages", "include_tool_results"];
+    MONITOR_INPUT_SHAPING_SCHEMAS = {
+      history_messages: monitorHistoryMessagesSchema.optional(),
+      include_tool_results: monitorIncludeToolResultsSchema.optional()
+    };
+    MONITOR_INPUT_SHAPING_IDLE_MESSAGE = "only a user_message, assistant_reply, manual or call_utterance monitor reads this \u2014 an idle monitor runs as a full turn and takes the ordinary history window";
+    monitorArgumentSourceSchema = external_exports.union([
+      external_exports.object({ from_variable: external_exports.string().min(1) }).strict(),
+      external_exports.object({ const: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()]) }).strict()
+    ]);
+    MONITOR_NOTE_TEMPLATE_MAX = 2e3;
+    MONITOR_STEER_NOTE_MAX = 500;
+    MONITOR_GATE_AGENT_NAME_MAX = 255;
+    monitorActionSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("none") }).strict(),
+      external_exports.object({
+        kind: external_exports.literal("call_tool"),
+        tool_name: external_exports.string().min(1),
+        args: external_exports.record(monitorArgumentSourceSchema).optional()
+      }).strict(),
+      external_exports.object({ kind: external_exports.literal("hold") }).strict(),
+      external_exports.object({ kind: external_exports.literal("rewrite"), note: external_exports.string().min(1).max(MONITOR_NOTE_TEMPLATE_MAX) }).strict(),
+      external_exports.object({ kind: external_exports.literal("steer"), note: external_exports.string().min(1).max(MONITOR_STEER_NOTE_MAX) }).strict(),
+      // An automation's fire gate (`automation_fire` only): run the fire as configured, run it with
+      // another of the hub's agents — named by `agent_name`, which survives publish and push the way
+      // the gate's own name does — or skip it.
+      external_exports.object({ kind: external_exports.literal("run") }).strict(),
+      external_exports.object({ kind: external_exports.literal("run_with_agent"), agent: external_exports.string().trim().min(1).max(MONITOR_GATE_AGENT_NAME_MAX) }).strict(),
+      // An automation's item gate (`automation_item` only), for one contact of a fire's list: start
+      // its work as configured, or start it with another of the hub's agents (by `agent_name`, as
+      // `run_with_agent` names one). Both gates' `skip`, below, starts nothing.
+      external_exports.object({ kind: external_exports.literal("start") }).strict(),
+      external_exports.object({ kind: external_exports.literal("start_with_agent"), agent: external_exports.string().trim().min(1).max(MONITOR_GATE_AGENT_NAME_MAX) }).strict(),
+      external_exports.object({ kind: external_exports.literal("skip") }).strict()
+    ]);
+    monitorRuleSchema = external_exports.object({
+      when: external_exports.array(flagConditionSchema).min(1),
+      action: monitorActionSchema
+    }).strict();
+    MONITOR_RULE_KEYS = ["rules", "fallback"];
+    MONITOR_RULE_SCHEMAS = {
+      rules: external_exports.array(monitorRuleSchema).optional(),
+      fallback: monitorActionSchema.optional()
+    };
+    MONITOR_RULE_TRIGGERS = [
+      "user_message",
+      "assistant_reply",
+      "manual",
+      "call_utterance",
+      "automation_fire",
+      "automation_item"
+    ];
+    MONITOR_RULE_TRIGGER_MESSAGE = "only a user_message, assistant_reply, manual, call_utterance, automation_fire or automation_item monitor acts on rules \u2014 set one of those triggers, or remove this key. A manual monitor acts on its rules when another monitor runs it.";
+    CALL_UTTERANCE_SPEAKERS = ["caller", "voice", "both"];
+    callUtteranceSpeakerSchema = external_exports.enum(CALL_UTTERANCE_SPEAKERS);
+    MONITOR_CALL_KEYS = ["speaker"];
+    MONITOR_CALL_SCHEMAS = {
+      speaker: callUtteranceSpeakerSchema.optional()
+    };
+    MONITOR_CALL_KEY_MESSAGE = "only a call_utterance monitor reads this: it names whose speech on a live call a check waits for";
+    CALL_STEERING_MIN_CONFIDENCE = 0.9;
+    CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE = `a call_utterance rule acts on a live call from a transcript that can be misheard, so it must be high-confidence: give it a condition on one of this monitor's "\u2026${CONFIDENCE_VARIABLE_SUFFIX}" variables with ">= ${CALL_STEERING_MIN_CONFIDENCE}" or a higher bar, up to 1.`;
+    CALL_UTTERANCE_FALLBACK_MESSAGE = "a call_utterance monitor acts only when a high-confidence rule matches \u2014 a fallback would act on every check of the call. Remove it.";
+    CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE = "a call_utterance monitor checks a live call every few seconds and does not flag the conversation. Remove its flag_conditions, or flag from a monitor on another trigger.";
+    CALL_STEER_NOTE_BLANK_MESSAGE = "a steer's note is what the voice is told \u2014 write the instruction it should follow.";
+    MONITOR_USER_MESSAGE_ACTION_KINDS = ["none", "call_tool"];
+    MONITOR_ASSISTANT_REPLY_ACTION_KINDS = ["none", "call_tool", "hold", "rewrite"];
+    MONITOR_CALL_UTTERANCE_ACTION_KINDS = ["none", "call_tool", "steer"];
+    MONITOR_AUTOMATION_FIRE_ACTION_KINDS = ["run", "run_with_agent", "skip"];
+    MONITOR_AUTOMATION_ITEM_ACTION_KINDS = ["start", "start_with_agent", "skip"];
+    INSERT_NOTE_TOOL_NAME = "insert_note";
+    RUN_MONITOR_TOOL_NAME = "run_monitor";
+    MONITOR_RULE_ALLOWED_NATIVE_TOOLS = [
+      "update_state",
+      "schedule_followup",
+      "transfer_to_agent",
+      "transfer_to_team",
+      INSERT_NOTE_TOOL_NAME,
+      RUN_MONITOR_TOOL_NAME
+    ];
+    MONITOR_RULE_REENTRY_TOOLS = {
+      transfer_to_agent: "agent",
+      transfer_to_team: "team"
+    };
+    MONITOR_RULE_REENTRY_TRACKS = new Map(Object.entries(MONITOR_RULE_REENTRY_TOOLS));
+    AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE = "an automation_fire monitor decides an automation's fire before any conversation exists, so there is no conversation for it to flag. Remove flag_conditions.";
+    AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE = "an automation_fire monitor reads the automation and its fire, never a conversation's messages, so it has no history window to size. Remove this key.";
+    AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE = "an automation_item monitor decides one contact of an automation's fire before anything is started for it, so there is no conversation for it to flag. Remove flag_conditions.";
+    AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE = "an automation_item monitor reads the automation, its fire and one contact, never a conversation's messages, so it has no history window to size. Remove this key.";
+    AUTOMATION_GATE_KEY_MESSAGES = {
+      automation_fire: { flagConditions: AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, inputShaping: AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE },
+      automation_item: { flagConditions: AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, inputShaping: AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE }
+    };
+    monitorConfigField = external_exports.object({
+      delay_seconds: external_exports.number().int().min(MONITOR_DELAY_SECONDS_MIN).optional(),
+      trigger: monitorTriggerSchema.optional(),
+      ...MONITOR_INPUT_SHAPING_SCHEMAS,
+      ...MONITOR_RULE_SCHEMAS,
+      ...MONITOR_CALL_SCHEMAS,
+      flag_conditions: external_exports.array(flagConditionSchema).optional()
+    }).passthrough().superRefine((config, ctx) => {
+      if (monitorConfigNeedsDelay(config)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["delay_seconds"],
+          message: MONITOR_IDLE_DELAY_REQUIRED_MESSAGE
+        });
+      }
+      for (const key of monitorInputShapingKeysOnIdle(config)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [key],
+          message: MONITOR_INPUT_SHAPING_IDLE_MESSAGE
+        });
+      }
+      for (const key of monitorCallKeysOffTrigger(config)) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [key], message: MONITOR_CALL_KEY_MESSAGE });
+      }
+      for (const issue of collectMonitorRuleIssues(config)) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: issue.path, message: issue.message });
+      }
+    }).nullable().optional();
+    flagConditionsField = external_exports.array(flagConditionSchema).nullable().optional();
+    agentIdParam = external_exports.object({
+      id: uuidSchema
     });
-    evalsSqlSchemaQuery = external_exports.object({
-      hub_id: external_exports.string().uuid()
+    listAgentsQuery = external_exports.object({
+      hub_id: uuidSchema
     });
-    exportResultsQuery = external_exports.object({
-      format: external_exports.enum(["csv", "json"]).default("csv")
+    agentConnectionsQuery = external_exports.object({
+      hub_id: uuidSchema
     });
-    validateEvalBody = external_exports.object({
-      eval: external_exports.record(external_exports.unknown())
+    createAgentBody = external_exports.object({
+      agent_name: external_exports.string().min(1),
+      hub_id: uuidSchema,
+      agent_role: external_exports.enum(AGENT_ROLES),
+      additional_context_template: external_exports.string().max(2e4).optional(),
+      summarization_threshold_tokens: summarizationThresholdField,
+      previous_conversations_count: previousConversationsCountField,
+      monitor_config: monitorConfigField,
+      flag_conditions: flagConditionsField
+    }).passthrough().superRefine((body, ctx) => {
+      refineDecisionsModelBinding(body, ctx);
+      refineMonitorRulesStructuredOutput(body, ctx);
     });
-    hubAgentsQuery = external_exports.object({
-      hub_id: external_exports.string().uuid()
+    updateAgentBody = external_exports.object({
+      additional_context_template: external_exports.string().max(2e4).optional(),
+      summarization_threshold_tokens: summarizationThresholdField,
+      previous_conversations_count: previousConversationsCountField,
+      monitor_config: monitorConfigField,
+      flag_conditions: flagConditionsField
+    }).passthrough();
+    AGENT_PARAMETER_TYPES = ["string", "number", "boolean", "integer", "enum"];
+    AGENT_PARAMETER_NAME_REGEX = /^[a-zA-Z_][a-zA-Z0-9_]{0,63}$/;
+    agentParameterCreateSchema = external_exports.object({
+      parameter_name: external_exports.string().regex(
+        AGENT_PARAMETER_NAME_REGEX,
+        "parameter_name must start with a letter or underscore and contain only letters, digits, and underscores (max 64 chars)"
+      ),
+      parameter_type: external_exports.enum(AGENT_PARAMETER_TYPES).optional(),
+      // No length caps on the free-text fields below: the agent_parameter columns are
+      // unbounded TEXT and pre-PR rows were never length-validated, so a cap would 422
+      // an unrelated GET→edit→re-save of legitimately-long existing data. The name
+      // regex (above) and the batch cap (below) are the load-bearing guards; total
+      // payload size belongs in a global /api/* body limit, not per field here.
+      parameter_description: external_exports.string().nullable().optional(),
+      parameter_label: external_exports.string().nullable().optional(),
+      parameter_enum: external_exports.array(external_exports.string()).nullable().optional(),
+      parameter_required: external_exports.boolean().optional(),
+      // Free-form analytics grouping label — no DB CHECK and the CI path persists
+      // arbitrary strings, so keep this permissive (not the 4-value UI dropdown enum).
+      variable_category: external_exports.string().nullable().optional(),
+      is_summary: external_exports.boolean().optional()
+    }).strict();
+    MAX_AGENT_PARAMETERS_PER_REQUEST = 100;
+    createAgentParametersBody = external_exports.union([
+      agentParameterCreateSchema,
+      external_exports.array(agentParameterCreateSchema).max(MAX_AGENT_PARAMETERS_PER_REQUEST, `too many parameters (max ${MAX_AGENT_PARAMETERS_PER_REQUEST})`)
+    ]);
+    evalIdParam = external_exports.object({
+      id: external_exports.string().uuid()
     });
-    createScenarioSetBody = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      set_name: external_exports.string().min(1).max(200),
-      description: external_exports.string().max(1e3).optional(),
-      enabled: external_exports.boolean().optional()
+    sessionIdParam = external_exports.object({
+      id: external_exports.string().uuid()
     });
-    updateScenarioSetBody = external_exports.object({
-      set_name: external_exports.string().min(1).max(200).optional(),
-      description: external_exports.string().max(1e3).nullable().optional(),
-      enabled: external_exports.boolean().optional()
+    scenarioSetIdParam = external_exports.object({
+      id: external_exports.string().uuid()
     });
-    scenarioSetsHubQuery = external_exports.object({
+    hubIdQuery = external_exports.object({
+      hub_id: external_exports.string().uuid()
+    });
+    evalDateContextSchema = external_exports.object({
+      base_time: timestampSchema.refine(isIsoTimestamp, "Expected a canonical ISO timestamp"),
+      timezone: external_exports.string().min(1).refine((timezone) => {
+        try {
+          new Intl.DateTimeFormat("en-US", { timeZone: timezone }).format(0);
+          return true;
+        } catch {
+          return false;
+        }
+      }, "Expected an IANA timezone"),
+      locale: external_exports.enum(SUPPORTED_LOCALES)
+    }).strict();
+    EVAL_FIXTURE_NAME_MAX_LENGTH = 200;
+    evalFixtureOverrideSchema = external_exports.string().trim().min(1).max(EVAL_FIXTURE_NAME_MAX_LENGTH);
+    runSessionQuery = hubIdQuery.extend({
+      fixture: evalFixtureOverrideSchema.optional()
+    });
+    runJourneyQuery = hubIdQuery.extend({
+      call_mode: external_exports.enum(["true", "false"]).optional()
+    });
+    EVAL_INPUT_ROLES = ["user", "system"];
+    EVAL_INPUT_ROLE_LIST = EVAL_INPUT_ROLES.map((r) => `"${r}"`).join(" or ");
+    ROLE_ECHO_MAX = 40;
+    EVAL_INITIAL_STATE_SCOPES = ["user"];
+    MAX_INITIAL_STATE_ENTRIES = 20;
+    evalInitialStateEntry = external_exports.object({
+      slug: external_exports.string().min(1).max(200),
+      scope: external_exports.enum(EVAL_INITIAL_STATE_SCOPES).default("user"),
+      value: external_exports.record(external_exports.unknown())
+    });
+    evalBody = external_exports.object({
+      eval: external_exports.record(external_exports.unknown())
+    }).superRefine(refineEvalName).superRefine(refineEvalMessageTextRole).superRefine(refineEvalAttachments).superRefine(refineEvalInitialState);
+    EVAL_LIST_MAX_LIMIT = 1e3;
+    evalListLimit = external_exports.string().regex(/^\d+$/).refine((v) => Number(v) <= EVAL_LIST_MAX_LIMIT, {
+      message: `limit must be ${EVAL_LIST_MAX_LIMIT} or less`
+    }).optional();
+    getEvalsQuery = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      agent_id: external_exports.string().uuid().optional(),
+      enabled: external_exports.string().regex(/^(true|false)$/).optional(),
+      search: external_exports.string().optional(),
+      limit: evalListLimit,
+      offset: external_exports.string().regex(/^\d+$/).optional()
+    });
+    toggleEvalBody = external_exports.object({
+      enabled: external_exports.boolean()
+    });
+    bulkToggleEvalsBody = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      enabled: external_exports.boolean(),
+      filters: external_exports.object({
+        agent_id: external_exports.string().uuid().optional(),
+        search: external_exports.string().optional()
+      }).optional()
+    });
+    pacingConfigSchema = external_exports.object({
+      preset: external_exports.enum(EVAL_PACING_PRESET_NAMES),
+      custom_interval_ms: external_exports.number().int().min(PACING_INTERVAL_MIN_MS).max(PACING_INTERVAL_MAX_MS).optional()
+    }).refine(
+      (v) => v.preset !== "custom" || typeof v.custom_interval_ms === "number",
+      { message: 'custom_interval_ms required when preset is "custom"' }
+    );
+    EVAL_MAX_SELECTED_SCENARIOS = 200;
+    evalScenarioSelectionEntrySchema = external_exports.object({
+      eval_id: external_exports.string().uuid(),
+      run_numbers: external_exports.array(external_exports.number().int().min(1).max(EVAL_MAX_RUNS_PER_SCENARIO)).min(1).max(EVAL_MAX_RUNS_PER_SCENARIO).refine((runs) => new Set(runs).size === runs.length, {
+        message: "run_numbers must not repeat a run"
+      }).optional()
+    }).strict();
+    evalScenarioSelectionSchema = external_exports.array(evalScenarioSelectionEntrySchema).min(1).max(EVAL_MAX_SELECTED_SCENARIOS).refine(
+      (entries) => new Set(entries.map((e) => e.eval_id)).size === entries.length,
+      { message: "scenario_selection must not name the same scenario twice" }
+    );
+    sessionConfigSchema = external_exports.object({
+      pacing: pacingConfigSchema.optional(),
+      scenario_selection: evalScenarioSelectionSchema.optional(),
+      /**
+       * CALL MODE (realtime voice calls, plan §12.1): every turn this session fires runs as a call
+       * turn would — the pilot gets the call-mode addendum, and the reply gate takes no rewrite (a
+       * draft it would have rewritten is held, as on a call). Delivery and scoring stay a text
+       * eval's. A property of the launch, like the two keys above.
+       */
+      call_mode: external_exports.boolean().optional(),
+      // Server-owned immutable clock.
+      date_context: external_exports.never().optional(),
+      date_context_claimed: external_exports.never().optional(),
+      seed_cleanup: external_exports.never().optional(),
+      // Per-run finalization deadline for the HubDO watchdog (gh #2591). A started
+      // run idle past this many ms is reaped to `failed`. Omitted → backend default
+      // (`EVAL_DEFAULT_RUN_DEADLINE_MS`).
+      run_deadline_ms: external_exports.number().int().min(EVAL_RUN_DEADLINE_MIN_MS).max(EVAL_RUN_DEADLINE_MAX_MS).optional(),
+      seed: external_exports.never().optional()
+    }).passthrough();
+    createSessionBody = external_exports.object({
+      session: external_exports.object({
+        session_name: external_exports.string().trim().min(1),
+        session_config: sessionConfigSchema.optional()
+      }).passthrough()
+    });
+    getSessionsQuery = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      status: external_exports.string().optional(),
+      search: external_exports.string().optional(),
+      limit: evalListLimit,
+      offset: external_exports.string().regex(/^\d+$/).optional()
+    });
+    getSessionResultsQuery = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      limit: external_exports.string().regex(/^\d+$/).optional(),
+      offset: external_exports.string().regex(/^\d+$/).optional()
+    });
+    getSessionRunsQuery = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      eval_id: external_exports.string().uuid().optional(),
+      limit: external_exports.string().regex(/^\d+$/).optional(),
+      offset: external_exports.string().regex(/^\d+$/).optional()
+    });
+    evalAnalyticsQuery = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      start_date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
+      end_date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
+      periodicity: external_exports.enum(["daily", "weekly", "monthly"]).optional(),
+      eval_id: external_exports.string().uuid().optional(),
+      session_id: external_exports.string().uuid().optional()
+    });
+    getSessionCostQuery = external_exports.object({
+      hub_id: external_exports.string().uuid()
+    });
+    compareSessionsQuery = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      session_a: external_exports.string().uuid(),
+      session_b: external_exports.string().uuid()
+    });
+    evalsSqlBody = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      // Hard size cap before the validator runs — keeps lex/parse work bounded.
+      sql: external_exports.string().min(1).max(8e3),
+      limit: external_exports.number().int().positive().max(1e4).optional()
+    });
+    evalsSqlSchemaQuery = external_exports.object({
+      hub_id: external_exports.string().uuid()
+    });
+    exportResultsQuery = external_exports.object({
+      format: external_exports.enum(["csv", "json"]).default("csv")
+    });
+    validateEvalBody = external_exports.object({
+      eval: external_exports.record(external_exports.unknown())
+    });
+    hubAgentsQuery = external_exports.object({
+      hub_id: external_exports.string().uuid()
+    });
+    createScenarioSetBody = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      set_name: external_exports.string().min(1).max(200),
+      description: external_exports.string().max(1e3).optional(),
+      enabled: external_exports.boolean().optional()
+    });
+    updateScenarioSetBody = external_exports.object({
+      set_name: external_exports.string().min(1).max(200).optional(),
+      description: external_exports.string().max(1e3).nullable().optional(),
+      enabled: external_exports.boolean().optional()
+    });
+    scenarioSetsHubQuery = external_exports.object({
       hub_id: external_exports.string().uuid()
     });
     createScenarioFromConversationBody = external_exports.object({
@@ -9195,7 +9544,9 @@ var init_chunk_YEYIDIR6 = __esm({
     hubAsCodeConfigSchema = external_exports.object({
       version: external_exports.literal(1),
       hub: external_exports.object({
-        name: external_exports.string().min(1, "config.hub.name is required")
+        name: external_exports.string().min(1, "config.hub.name is required"),
+        // Apply writes it as it comes, so this is its validation on push and diff.
+        end_user_daily_message_limit: endUserDailyMessageLimitField
       }).passthrough(),
       states: external_exports.array(hubAsCodeStateSchema).optional(),
       resources: boundedHubAsCodeResourcesSchema.optional()
@@ -9203,6 +9554,7 @@ var init_chunk_YEYIDIR6 = __esm({
       refineHubAsCodeCustomTools(config, ctx);
       refineHubAsCodeKanbanStatuses(config, ctx);
       refineHubAsCodeLanes(config, ctx);
+      refineHubAsCodePresentation(config, ctx);
       refineHubAsCodeEvals(config, ctx);
       refineHubAsCodeEvalAttachments(config, ctx);
       refineHubAsCodeCallOpenings(config, ctx);
@@ -9372,15 +9724,7 @@ var init_chunk_YEYIDIR6 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-H4RTULPH.js
-function refineLaneReferences(val, ctx) {
-  const lanes = val.lanes;
-  const statuses = val.kanban_statuses;
-  if (lanes == null || statuses == null) return;
-  for (const issue of validateLaneReferences(lanes, statuses)) {
-    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["kanban_statuses", ...issue.path], message: issue.message });
-  }
-}
+// ../../packages/core/dist/chunk-FRU7E62M.js
 function cacheReconcileIdCount(body) {
   return body.conversations.length + body.histories.reduce((n, history) => n + history.conversation_ids.length, 0) + body.threads.length;
 }
@@ -9440,16 +9784,17 @@ function parseCommunityLessonVideoUrl(url) {
   }
   return id !== void 0 && YOUTUBE_ID.test(id) ? { provider: "youtube", id } : null;
 }
-var primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, MAX_EVAL_RETENTION_DAYS, previewLabelField, hubTagsField, createHubBody, updateHubBody, HUB_TAG_CHANGE_REFUSED, hubTagChangeRefusalSchema, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, HUB_DIFF_SECTION_SET, HUB_DIFF_SECTIONS, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, CALL_STATUSES, callStatus, CALL_END_REASONS, callEndReason, CALL_TRANSPORTS, callTransport, CALL_PARTICIPANT_TYPES, callParticipantType, callInstant, MAX_SDP_OFFER_LENGTH, sdpDescription, sdpOffer, MAX_CALL_REQUEST_BODY_BYTES, hubScoped, callSummaryFields, callSummary, callIdParam, createCallBody, createCallResponse, callReadyBody, callHangupBody, callStatusQuery, MAX_REPORTED_DELEGATION_IDS, callDelegationId, callDelegationsBody, callResponse, MAX_CALL_RECORDING_GAPS, callRecordingGap, callRecordingNoteMetadata, evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, recordAiDisclosureAcceptanceBody, activityQuery, deletionModeSchema, deletionRequestBody, CACHE_RECONCILE_MAX_IDS, CACHE_RECONCILE_MAX_HUBS, cacheReconcileScopeSchema, cachedConversationPageSchema, cachedHistoryThreadSchema, cachedPeopleThreadSchema, cacheReconcileBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, planKeySchema, billingStatusSchema, billingPlanTypeSchema, dataUsageCountersSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, SIGN_URL_MAX_EXPIRES_IN_SECONDS, signUrlBody, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, CONTACT_ENVIRONMENTS, CONTACT_NAME_MAX, CONTACT_EMAIL_MAX, CONTACT_PHONE_INPUT_MAX, CONTACT_INSTAGRAM_SID_MAX, CONTACT_METADATA_MAX_BYTES, CONTACT_LABEL_MAX, CONTACT_LABELS_MAX, CONTACT_SCOPE_TAGS_MAX, CONTACT_PAGE_MAX, CONTACT_IMPORT_BATCH_MAX, CONTACT_SEARCH_MAX, CONTACT_LIST_NAME_MAX, CONTACT_LIST_NAME_REGEX, CONTACT_LIST_DESCRIPTION_MAX, CONTACT_LIST_FILTER_MAX, CONTACT_LIST_PINS_PER_REQUEST_MAX, SUPPRESSION_SCOPES, SUPPRESSION_ID_REGEX, contactName, contactPhone, contactEmail, contactInstagramSid, contactLabel, contactLabels, contactMetadata, scopeTagIds, contactVisibilitySchema, hasIdentity, IDENTITY_REQUIRED, contactBookOrgQuery, contactBookContactParam, contactBookListParam, contactBookHubParam, contactBookPageQuery, listContactBookContactsQuery, listHubContactBookContactsQuery, contactBookLinkCandidatesQuery, listContactBookListMembersQuery, contactRowFields, createContactBookContactBody, updateContactBookContactBody, contactImportRowSchema, importContactBookContactsBody, linkContactBookContactBody, listName, contactListFilterSchema, createContactBookListBody, updateContactBookListBody, updateContactBookListPinsBody, suppressionIdentitySchema, createContactBookSuppressionBody, contactBookSuppressionParam, listContactBookSuppressionsQuery, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, contactBookEmailUnsubscribeTokenSchema, contactBookEmailUnsubscribeQuery, orgListReferenceSchema, hubListNameSchema, HUB_LIST_FILTER_REQUIRED, hubContactListFilterSchema, hubContactListIdParam, hubContactListHubQuery, description, createHubContactListBody, updateHubContactListBody, AUTOMATION_TRIGGER_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationName, automationDescription, automationIdParam, automationHubQuery, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, VERSION_PART, MOBILE_APP_VERSION_RE, mobileAppVersionSchema, MOBILE_PLATFORMS, mobilePlatformSchema, mobileVersionPolicyQuery, mobileVersionPolicySchema, mobileVersionPolicyResponse, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_LIST_MAX_CONTACTS_BOUND, automationListMaxContacts, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, META_ENTITY_ID_PATTERN, metaEntityId, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, invitePreviewQuery, inviteRolePreviewResponse, inviteContactPreviewResponse, invitePreviewResponse, inviteUnsubscribeBody, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, baseDestructionConfirmBody, BASE_DESTRUCTION_GRACE_MS, BASE_DESTRUCTION_CONFIRM_TTL_MS, BASE_DESTRUCTION_ORG_QUERY_PARAM, baseDestructionQuery, baseDestructionParam, baseDestructionInitiateBody, baseDestructionStatus, baseDestructionRequest, baseDestructionListResponse, baseDestructionInitiateResponse, baseDestructionConfirmResponse, baseDestructionCancelResponse, rekorBaseChangeMessageSchema, PEOPLE_CONTACT_PAGE_MAX, PEOPLE_CONTACT_PAGE_DEFAULT, PEOPLE_CONTACT_EMAIL_MAX_LENGTH, peopleUserIdSchema, peopleInviteEmailSchema, peopleContactInviteBody, peopleContactInviteIdParam, peopleContactUserIdParam, peopleContactBlockBody, peopleContactPageQuery, peopleOutgoingInviteSchema, peopleContactPersonSchema, peopleContactSchema, peopleIncomingInviteSchema, peopleBlockedUserSchema, PEOPLE_THREAD_MESSAGE_MAX_LENGTH, PEOPLE_THREAD_MESSAGES_PAGE_MAX, PEOPLE_THREAD_PAGE_MAX, PEOPLE_THREAD_PAGE_DEFAULT, PEOPLE_GROUP_NAME_MAX_LENGTH, PEOPLE_GROUP_AVATAR_URL_MAX_LENGTH, PEOPLE_THREAD_ATTACHMENT_MAX_BYTES, PEOPLE_THREAD_ATTACHMENT_NAME_MAX_LENGTH, PEOPLE_ATTACHMENT_STORAGE_PER_USER_BYTES, PEOPLE_THREAD_ATTACHMENT_MAX_MB, PEOPLE_THREAD_ATTACHMENT_URL_TTL_SECONDS, PEOPLE_THREAD_ATTACHMENT_URLS_MAX, peopleThreadIdParam, peopleThreadMessageIdParam, peopleThreadListQuery, peopleThreadMessagesQuery, peopleThreadAttachmentUploadSchema, peopleThreadSendBody, peopleThreadAttachmentUrlsBody, peopleThreadReadBody, peopleThreadSettingsBody, peopleGroupNameSchema, peopleGroupAvatarUrlSchema, peopleGroupCreateBody, peopleOrgDirectBody, peopleGroupUpdateBody, peopleGroupInviteBody, peopleOrgErasureBody, peopleGroupLeaveBody, peopleGroupInviteIdParam, peopleGroupIncomingInviteIdParam, peopleGroupMemberParam, peopleThreadKindSchema, peopleThreadMemberSchema, peopleThreadLastMessageSchema, peopleGroupRoleSchema, peopleGroupSummarySchema, peopleThreadSummarySchema, peopleThreadAttachmentSchema, peopleThreadMessageSchema, peopleGroupMemberSchema, peopleGroupSentInviteSchema, peopleGroupIncomingInviteSchema, PEOPLE_REPORT_DETAILS_MAX_LENGTH, peopleReportReasonSchema, reportDetailsSchema, reportFields, peopleReportBody, PEOPLE_MODERATION_NOTE_MAX_LENGTH, ADMIN_PEOPLE_REPORTS_PAGE_MAX, ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT, peopleModerationActionSchema, moderationNoteSchema, adminPeopleReportListQuery, adminPeopleReportIdParam, adminPeopleMessageRemovalBody, adminPeopleSuspendBody, adminPeopleNoteBody, COMMUNITIES_PER_ORG_MAX, COMMUNITY_NAME_MAX_LENGTH, COMMUNITY_REGISTRY_CLOSED_REASON, COMMUNITY_JOIN_SOURCE_MAX_LENGTH, COMMUNITY_JOIN_FLOW_TOKEN_MAX_LENGTH, COMMUNITY_ROOM_NAME_MAX_LENGTH, COMMUNITY_MESSAGE_MAX_LENGTH, COMMUNITY_MESSAGES_PAGE_SIZE, COMMUNITY_ATTACHMENT_URLS_MAX, COMMUNITY_POST_TITLE_MAX_LENGTH, COMMUNITY_POST_SEARCH_MAX_LENGTH, COMMUNITY_RULES_MAX_LENGTH, COMMUNITY_SLOW_MODE_MAX_SECONDS, COMMUNITY_COURSES_LABEL_MAX_LENGTH, COMMUNITY_LIVE_TICKET_PREFIX, communityNameSchema, adminCreateCommunityBody, communityIdParam, communityJoinTokenSchema, communityJoinSourceSchema, communityJoinPreviewQuery, communityJoinBody, communityRoomKindSchema, communityRoomNameSchema, communityRoomIdParam, communityMessageIdParam, communityRoomCreateBody, communityRoomUpdateBody, communityMessagesQuery, communityMessageBodySchema, communityPostTitleSchema, communityAttachmentUploadSchema, communitySendBody, communityEditBody, communityPostIdParam, communityPostsQuery, communityAnswerBody, communityReadBody, communityAttachmentUrlsBody, communityPersonParam, communityOrgParam, communityPeopleQuery, communityCoursesLabelSchema, communitySettingsBody, communityBanBody, communityLockBody, communityPinBody, communityModLogQuery, communityReportsQuery, communityReportIdParam, communityLiveTicketSchema, communityLiveQuery, communityMuteBody, communityEmailUnsubscribeTokenSchema, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, communityEmailUnsubscribeQuery, COMMUNITY_COURSE_TITLE_MAX_LENGTH, COMMUNITY_COURSE_DESCRIPTION_MAX_LENGTH, COMMUNITY_LESSON_BODY_MAX_LENGTH, COMMUNITY_LESSON_LINKS_MAX, COMMUNITY_LESSON_URL_MAX_LENGTH, YOUTUBE_ID, YOUTUBE_HOSTS, YOUTU_BE, YOUTUBE_ID_PATH, communityCourseIdParam, communityCourseModuleIdParam, communityLessonIdParam, communityCourseTitleSchema, communityCourseDescriptionSchema, communityCoursePositionSchema, communityLessonVideoUrlSchema, communityLessonLinkSchema, communityLessonLinksSchema, communityLessonBodySchema, communityCourseCreateBody, communityCourseUpdateBody, communityModuleCreateBody, communityModuleUpdateBody, communityLessonCreateBody, communityLessonUpdateBody, COMMUNITY_LESSON_TREE_MAX_BYTES, COMMUNITY_LESSON_LINK_PROTOCOLS, LINK_SCHEME;
-var init_chunk_H4RTULPH = __esm({
-  "../../packages/core/dist/chunk-H4RTULPH.js"() {
+var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, CALL_STATUSES, callStatus, CALL_END_REASONS, callEndReason, CALL_TRANSPORTS, callTransport, CALL_PARTICIPANT_TYPES, callParticipantType, callInstant, MAX_SDP_OFFER_LENGTH, sdpDescription, sdpOffer, MAX_CALL_REQUEST_BODY_BYTES, hubScoped, callSummaryFields, callSummary, callIdParam, createCallBody, createCallResponse, callReadyBody, callHangupBody, callStatusQuery, MAX_REPORTED_DELEGATION_IDS, callDelegationId, callDelegationsBody, callResponse, MAX_CALL_RECORDING_GAPS, callRecordingGap, callRecordingNoteMetadata, evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, recordAiDisclosureAcceptanceBody, activityQuery, deletionModeSchema, deletionRequestBody, CACHE_RECONCILE_MAX_IDS, CACHE_RECONCILE_MAX_HUBS, cacheReconcileScopeSchema, cachedConversationPageSchema, cachedHistoryThreadSchema, cachedPeopleThreadSchema, cacheReconcileBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, planKeySchema, billingStatusSchema, billingPlanTypeSchema, dataUsageCountersSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, SIGN_URL_MAX_EXPIRES_IN_SECONDS, signUrlBody, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, CONTACT_ENVIRONMENTS, CONTACT_NAME_MAX, CONTACT_EMAIL_MAX, CONTACT_PHONE_INPUT_MAX, CONTACT_INSTAGRAM_SID_MAX, CONTACT_METADATA_MAX_BYTES, CONTACT_LABEL_MAX, CONTACT_LABELS_MAX, CONTACT_SCOPE_TAGS_MAX, CONTACT_PAGE_MAX, CONTACT_IMPORT_BATCH_MAX, CONTACT_SEARCH_MAX, CONTACT_LIST_NAME_MAX, CONTACT_LIST_NAME_REGEX, CONTACT_LIST_DESCRIPTION_MAX, CONTACT_LIST_FILTER_MAX, CONTACT_LIST_PINS_PER_REQUEST_MAX, SUPPRESSION_SCOPES, SUPPRESSION_ID_REGEX, contactName, contactPhone, contactEmail, contactInstagramSid, contactLabel, contactLabels, contactMetadata, scopeTagIds, contactVisibilitySchema, hasIdentity, IDENTITY_REQUIRED, contactBookOrgQuery, contactBookContactParam, contactBookListParam, contactBookHubParam, contactBookPageQuery, listContactBookContactsQuery, listHubContactBookContactsQuery, contactBookLinkCandidatesQuery, listContactBookListMembersQuery, contactRowFields, createContactBookContactBody, updateContactBookContactBody, contactImportRowSchema, importContactBookContactsBody, linkContactBookContactBody, listName, contactListFilterSchema, createContactBookListBody, updateContactBookListBody, updateContactBookListPinsBody, suppressionIdentitySchema, createContactBookSuppressionBody, contactBookSuppressionParam, listContactBookSuppressionsQuery, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, contactBookEmailUnsubscribeTokenSchema, contactBookEmailUnsubscribeQuery, orgListReferenceSchema, hubListNameSchema, HUB_LIST_FILTER_REQUIRED, hubContactListFilterSchema, hubContactListIdParam, hubContactListHubQuery, description, createHubContactListBody, updateHubContactListBody, AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, AUTOMATION_WEBHOOK_MOUNT, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam, VERSION_PART, MOBILE_APP_VERSION_RE, mobileAppVersionSchema, MOBILE_PLATFORMS, mobilePlatformSchema, mobileVersionPolicyQuery, mobileVersionPolicySchema, mobileVersionPolicyResponse, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, META_ENTITY_ID_PATTERN, metaEntityId, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, invitePreviewQuery, inviteRolePreviewResponse, inviteContactPreviewResponse, invitePreviewResponse, inviteUnsubscribeBody, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, baseDestructionConfirmBody, BASE_DESTRUCTION_GRACE_MS, BASE_DESTRUCTION_CONFIRM_TTL_MS, BASE_DESTRUCTION_ORG_QUERY_PARAM, baseDestructionQuery, baseDestructionParam, baseDestructionInitiateBody, baseDestructionStatus, baseDestructionRequest, baseDestructionListResponse, baseDestructionInitiateResponse, baseDestructionConfirmResponse, baseDestructionCancelResponse, rekorBaseChangeMessageSchema, PEOPLE_CONTACT_PAGE_MAX, PEOPLE_CONTACT_PAGE_DEFAULT, PEOPLE_CONTACT_EMAIL_MAX_LENGTH, peopleUserIdSchema, peopleInviteEmailSchema, peopleContactInviteBody, peopleContactInviteIdParam, peopleContactUserIdParam, peopleContactBlockBody, peopleContactPageQuery, peopleOutgoingInviteSchema, peopleContactPersonSchema, peopleContactSchema, peopleIncomingInviteSchema, peopleBlockedUserSchema, PEOPLE_THREAD_MESSAGE_MAX_LENGTH, PEOPLE_THREAD_MESSAGES_PAGE_MAX, PEOPLE_THREAD_PAGE_MAX, PEOPLE_THREAD_PAGE_DEFAULT, PEOPLE_GROUP_NAME_MAX_LENGTH, PEOPLE_GROUP_AVATAR_URL_MAX_LENGTH, PEOPLE_THREAD_ATTACHMENT_MAX_BYTES, PEOPLE_THREAD_ATTACHMENT_NAME_MAX_LENGTH, PEOPLE_ATTACHMENT_STORAGE_PER_USER_BYTES, PEOPLE_THREAD_ATTACHMENT_MAX_MB, PEOPLE_THREAD_ATTACHMENT_URL_TTL_SECONDS, PEOPLE_THREAD_ATTACHMENT_URLS_MAX, peopleThreadIdParam, peopleThreadMessageIdParam, peopleThreadListQuery, peopleThreadMessagesQuery, peopleThreadAttachmentUploadSchema, peopleThreadSendBody, peopleThreadAttachmentUrlsBody, peopleThreadReadBody, peopleThreadSettingsBody, peopleGroupNameSchema, peopleGroupAvatarUrlSchema, peopleGroupCreateBody, peopleOrgDirectBody, peopleGroupUpdateBody, peopleGroupInviteBody, peopleOrgErasureBody, peopleGroupLeaveBody, peopleGroupInviteIdParam, peopleGroupIncomingInviteIdParam, peopleGroupMemberParam, peopleThreadKindSchema, peopleThreadMemberSchema, peopleThreadLastMessageSchema, peopleGroupRoleSchema, peopleGroupSummarySchema, peopleThreadSummarySchema, peopleThreadAttachmentSchema, peopleThreadMessageSchema, peopleGroupMemberSchema, peopleGroupSentInviteSchema, peopleGroupIncomingInviteSchema, PEOPLE_REPORT_DETAILS_MAX_LENGTH, peopleReportReasonSchema, reportDetailsSchema, reportFields, peopleReportBody, PEOPLE_MODERATION_NOTE_MAX_LENGTH, ADMIN_PEOPLE_REPORTS_PAGE_MAX, ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT, peopleModerationActionSchema, moderationNoteSchema, adminPeopleReportListQuery, adminPeopleReportIdParam, adminPeopleMessageRemovalBody, adminPeopleSuspendBody, adminPeopleNoteBody, COMMUNITIES_PER_ORG_MAX, COMMUNITY_NAME_MAX_LENGTH, COMMUNITY_REGISTRY_CLOSED_REASON, COMMUNITY_JOIN_SOURCE_MAX_LENGTH, COMMUNITY_JOIN_FLOW_TOKEN_MAX_LENGTH, COMMUNITY_ROOM_NAME_MAX_LENGTH, COMMUNITY_MESSAGE_MAX_LENGTH, COMMUNITY_MESSAGES_PAGE_SIZE, COMMUNITY_ATTACHMENT_URLS_MAX, COMMUNITY_POST_TITLE_MAX_LENGTH, COMMUNITY_POST_SEARCH_MAX_LENGTH, COMMUNITY_RULES_MAX_LENGTH, COMMUNITY_SLOW_MODE_MAX_SECONDS, COMMUNITY_COURSES_LABEL_MAX_LENGTH, COMMUNITY_LIVE_TICKET_PREFIX, communityNameSchema, adminCreateCommunityBody, communityIdParam, communityJoinTokenSchema, communityJoinSourceSchema, communityJoinPreviewQuery, communityJoinBody, communityRoomKindSchema, communityRoomNameSchema, communityRoomIdParam, communityMessageIdParam, communityRoomCreateBody, communityRoomUpdateBody, communityMessagesQuery, communityMessageBodySchema, communityPostTitleSchema, communityAttachmentUploadSchema, communitySendBody, communityEditBody, communityPostIdParam, communityPostsQuery, communityAnswerBody, communityReadBody, communityAttachmentUrlsBody, communityPersonParam, communityOrgParam, communityPeopleQuery, communityCoursesLabelSchema, communitySettingsBody, communityBanBody, communityLockBody, communityPinBody, communityModLogQuery, communityReportsQuery, communityReportIdParam, communityLiveTicketSchema, communityLiveQuery, communityMuteBody, communityEmailUnsubscribeTokenSchema, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, communityEmailUnsubscribeQuery, COMMUNITY_COURSE_TITLE_MAX_LENGTH, COMMUNITY_COURSE_DESCRIPTION_MAX_LENGTH, COMMUNITY_LESSON_BODY_MAX_LENGTH, COMMUNITY_LESSON_LINKS_MAX, COMMUNITY_LESSON_URL_MAX_LENGTH, YOUTUBE_ID, YOUTUBE_HOSTS, YOUTU_BE, YOUTUBE_ID_PATH, communityCourseIdParam, communityCourseModuleIdParam, communityLessonIdParam, communityCourseTitleSchema, communityCourseDescriptionSchema, communityCoursePositionSchema, communityLessonVideoUrlSchema, communityLessonLinkSchema, communityLessonLinksSchema, communityLessonBodySchema, communityCourseCreateBody, communityCourseUpdateBody, communityModuleCreateBody, communityModuleUpdateBody, communityLessonCreateBody, communityLessonUpdateBody, COMMUNITY_LESSON_TREE_MAX_BYTES, COMMUNITY_LESSON_LINK_PROTOCOLS, LINK_SCHEME, adminSetGuideHubBody, GUIDE_HUB_INELIGIBLE_REASON;
+var init_chunk_FRU7E62M = __esm({
+  "../../packages/core/dist/chunk-FRU7E62M.js"() {
     "use strict";
     init_chunk_VORPHGDT();
     init_chunk_POL7B3EM();
-    init_chunk_YEYIDIR6();
-    init_chunk_3NS3HULK();
+    init_chunk_T2RKGBYS();
     init_chunk_MIWZOSPI();
+    init_chunk_3NS3HULK();
     init_chunk_JWPRTSIB();
+    init_chunk_T7KQKDET();
     init_zod();
     init_zod();
     init_zod();
@@ -9503,258 +9848,57 @@ var init_chunk_H4RTULPH = __esm({
     init_zod();
     init_zod();
     init_zod();
-    init_zod();
-    primaryRegionSchema = external_exports.enum([
-      "wnam",
-      "enam",
-      "sam",
-      "weur",
-      "eeur",
-      "apac",
-      "oc",
-      "afr",
-      "me"
-    ]);
-    placementSourceSchema = external_exports.enum([
-      "hub_config",
-      "org_config",
-      "parent_cascade",
-      "cf_colo",
-      "country",
-      "fallback"
-    ]);
-    orgIdParam = external_exports.object({
-      id: uuidSchema
+    connectionIdParam = external_exports.object({ id: uuidSchema });
+    connectorIdParam = external_exports.object({ id: uuidSchema });
+    listConnectionsQuery = external_exports.object({ hub_id: uuidSchema });
+    deleteConnectionQuery = external_exports.object({ hub_id: uuidSchema });
+    addConnectionBody = external_exports.object({
+      hub_id: uuidSchema,
+      connector_id: uuidSchema,
+      authentication_type: external_exports.string().optional(),
+      inbound_mode: external_exports.enum(["wayai", "resend"]).optional(),
+      inbound_address: external_exports.string().email().optional(),
+      // Opt out of copying this connection's credentials into production on publish/sync.
+      // Defaults to true at the DB layer.
+      sync_credentials_to_production: external_exports.boolean().optional()
+    }).passthrough().superRefine((data, ctx) => {
+      if (data.inbound_mode === "resend" && !data.inbound_address) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: "Receiving email address is required when using Resend inbound mode",
+          path: ["inbound_address"]
+        });
+      }
     });
-    orgAdminIdParam = external_exports.object({
-      id: uuidSchema,
-      adminId: external_exports.string().min(1)
+    editConnectionBody = external_exports.object({
+      hub_id: uuidSchema,
+      sync_credentials_to_production: external_exports.boolean().optional()
+    }).passthrough();
+    PRODUCTION_DIRECT_FIELDS = ["username", "api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "webhook_signing_secret"];
+    setProductionCredentialBody = external_exports.object({
+      hub_id: uuidSchema,
+      organization_credential_id: external_exports.string().nullable().optional(),
+      organization_credential_token_id: external_exports.string().nullable().optional(),
+      username: external_exports.string().optional(),
+      api_key: external_exports.string().optional(),
+      access_token: external_exports.string().optional(),
+      password: external_exports.string().optional(),
+      refresh_token: external_exports.string().optional(),
+      webhook_secret_token: external_exports.string().optional(),
+      webhook_signing_secret: external_exports.string().optional()
+    }).strict().superRefine((data, ctx) => {
+      const hasOrgLink = !!data.organization_credential_id || !!data.organization_credential_token_id;
+      const hasDirect = PRODUCTION_DIRECT_FIELDS.some((f) => data[f] != null);
+      if (hasOrgLink && hasDirect) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Provide either an organization credential link or direct credential fields, not both" });
+      }
+      if (!hasOrgLink && !hasDirect) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "A credential is required: link an organization credential or provide a credential field" });
+      }
     });
-    createOrganizationBody = external_exports.object({
-      organization_name: external_exports.string().min(1, "organization_name is required"),
-      // Write-once at creation; updateOrganizationBody does not accept this.
-      primary_region: primaryRegionSchema.optional()
-    });
-    updateOrganizationBody = external_exports.object({
-      organization_name: external_exports.string().min(1).optional(),
-      organization_avatar_url: external_exports.string().url().nullable().optional(),
-      timezone: external_exports.string().optional(),
-      business_hours: external_exports.unknown().optional()
-    }).passthrough();
-    addOrgAdminBody = external_exports.object({
-      user_email: external_exports.string().email("valid email is required")
-    });
-    hubIdParam = external_exports.object({ id: uuidSchema });
-    hubAdminIdParam = external_exports.object({ id: uuidSchema, adminId: uuidSchema });
-    hubUserIdParam = external_exports.object({ id: uuidSchema, hubUserId: uuidSchema });
-    hubIdentityIdParam = external_exports.object({ id: uuidSchema, identityId: uuidSchema });
-    hubTeamIdParam = external_exports.object({ id: uuidSchema, teamId: uuidSchema });
-    hubTeamUserDeleteParam = external_exports.object({ id: uuidSchema, teamUserId: uuidSchema });
-    hubSchemaQuery = external_exports.object({ hub_id: uuidSchema });
-    PREVIEW_LABEL_MAX_LENGTH = 60;
-    MAX_ENDED_INDEX_RETENTION_DAYS = 730;
-    MAX_EVAL_RETENTION_DAYS = 3650;
-    previewLabelField = external_exports.string().max(PREVIEW_LABEL_MAX_LENGTH).optional().nullable().transform((v) => {
-      if (v == null) return null;
-      const trimmed = v.trim();
-      return trimmed || null;
-    });
-    hubTagsField = external_exports.array(external_exports.string()).nullable().optional();
-    createHubBody = external_exports.object({
-      organization_id: uuidSchema,
-      hub_name: external_exports.string().min(1, "hub_name is required"),
-      hub_description: external_exports.string().optional(),
-      kanban_statuses: kanbanStatusesArraySchema.nullable().optional(),
-      lanes: lanesArraySchema.nullable().optional(),
-      // Optional preview label for the first preview. Server-owned thereafter
-      // (change via `wayai relabel` / replicate); the push diff never writes it.
-      preview_label: previewLabelField,
-      // Write-once at creation; updateHubBody does not accept this.
-      primary_region: primaryRegionSchema.optional(),
-      // Org tag ids. Ids that name none of the org's tags are dropped; a hub created with
-      // any is a tag change (`hubTagChangeRefusalSchema`).
-      tags: hubTagsField
-    }).passthrough().superRefine(refineLaneReferences);
-    updateHubBody = external_exports.object({
-      support_model: external_exports.enum(["conversation", "account"]).optional(),
-      unassigned_policy: external_exports.enum(["default_team", "auto_assign_random", "auto_assign_round_robin", "pull_queue"]).optional(),
-      default_hub_team_id: uuidSchema.nullable().optional(),
-      kanban_statuses: kanbanStatusesArraySchema.nullable().optional(),
-      lanes: lanesArraySchema.nullable().optional(),
-      // summarization_threshold_tokens relocated to the summarizer AGENT (PR4) — validated/
-      // persisted via the agent path (.passthrough() agent body → HubDO column), not here.
-      auto_close_inactive_days: external_exports.number().int().min(1).max(180).optional(),
-      // Per-hub ConversationDO retention window (days) — keeps an ended conversation's DO
-      // alive for post-hoc annotation. Default 7, max 30 — the floor of the retention
-      // chain (≤ ended_index_retention_days ≤ effective storage retention).
-      conversation_retention_days: external_exports.number().int().min(1).max(30).optional(),
-      // Per-hub ended-conversation index retention window (days) — how long the warm
-      // "Ended" tab + chat-hub continuous history serve a closed conversation before
-      // the cleanup cron reaps its index row. Absent → DEFAULT_ENDED_INDEX_RETENTION_DAYS
-      // (365). Re-clamped to the effective storage retention at reap time.
-      ended_index_retention_days: external_exports.number().int().min(1).max(MAX_ENDED_INDEX_RETENTION_DAYS).optional(),
-      // Per-hub eval-session retention window (days). null CLEARS the override (back to
-      // the platform default); 0 disables retention for this hub (keep sessions forever).
-      // Nullable — unlike the fields above, "unset" is a meaningful, settable state.
-      eval_retention_days: external_exports.number().int().min(0).max(MAX_EVAL_RETENTION_DAYS).nullable().optional(),
-      // Channel contact access control. Enum-validated explicitly (not via passthrough)
-      // so `language`/`access_approval_role` can't reach the DB with an invalid value.
-      language: external_exports.enum(["en", "pt", "es"]).optional(),
-      access_request_message: external_exports.string().max(1e3).nullable().optional(),
-      access_approval_role: external_exports.enum(["admin", "team"]).optional(),
-      // AI-failure escalation. When an LLM provider outage persists past this many
-      // minutes the conversation escalates to the team; null → code default. The two
-      // message fields override the localized (hub.language) delay / hand-off notices;
-      // null → localized default. Bounds validated here so out-of-range never persists.
-      ai_failure_escalation_minutes: external_exports.number().int().min(1).max(60).nullable().optional(),
-      ai_delay_message: external_exports.string().max(1e3).nullable().optional(),
-      ai_handoff_message: external_exports.string().max(1e3).nullable().optional(),
-      // Native-completion fallback connection for a degraded harness turn (PR 2.10b).
-      // A NATIVE LLM (Agent) connection id on this hub; validated at set-time on the REST
-      // PATCH (setup/hubs.ts rejects a non-existent / non-Agent / harness id) and re-checked
-      // at fallback time in the turn seam (a stale/missing id simply no-ops). Nullable to clear it.
-      fallback_connection_id: uuidSchema.nullable().optional(),
-      // Rekor API connection used to reset/clear eval seed fixtures (gh #3090). A
-      // connection id on this hub (a REST API (custom tool) connection whose base_url
-      // is the Rekor API origin + a bearer/api_key `write:seeds` token). Validated at
-      // set-time on the REST PATCH (setup/hubs.ts). Nullable to clear it.
-      seed_connection_id: uuidSchema.nullable().optional(),
-      // Org tag ids, replacing the hub's; null clears them. A change is refused to anyone
-      // but an org admin (`hubTagChangeRefusalSchema`).
-      tags: hubTagsField
-    }).passthrough().superRefine(refineLaneReferences);
-    HUB_TAG_CHANGE_REFUSED = "hub_tag_change_requires_org_admin";
-    hubTagChangeRefusalSchema = external_exports.object({
-      reason: external_exports.literal(HUB_TAG_CHANGE_REFUSED),
-      operation: external_exports.enum(["update", "publish"]),
-      hub_id: external_exports.string(),
-      tags_added: external_exports.array(external_exports.string()),
-      tags_removed: external_exports.array(external_exports.string())
-    });
-    addHubAdminBody = external_exports.object({
-      user_email: external_exports.string().email("valid email is required")
-    });
-    addHubIdentityAuthorizationBody = external_exports.object({
-      identity_value: external_exports.string().min(1),
-      identity_type: external_exports.string().min(1),
-      channel_type: external_exports.string().min(1)
-    });
-    contactDecisionBody = external_exports.object({
-      contact_access_id: uuidSchema.optional(),
-      identity_type: external_exports.string().min(1).optional(),
-      identity_value: external_exports.string().min(1).optional(),
-      channel_type: external_exports.string().min(1).optional(),
-      channel_id: uuidSchema.optional(),
-      connection_id: uuidSchema.optional(),
-      user_id: uuidSchema.optional(),
-      sender_display_name: external_exports.string().max(200).optional()
-    });
-    approveContactBody = contactDecisionBody.extend({
-      user_name: external_exports.string().min(1).max(120).optional()
-    });
-    listContactAccessQuery = external_exports.object({
-      status: external_exports.enum(["pending", "blocked"]).optional()
-    });
-    createHubTeamBody = external_exports.object({
-      team_name: external_exports.string().min(1, "team_name is required")
-    }).strict();
-    updateHubTeamBody = external_exports.object({
-      team_name: external_exports.string().min(1).optional(),
-      conversation_display_only_if_claimed: external_exports.boolean().optional(),
-      team_access_rule: external_exports.string().optional(),
-      initial_team: external_exports.boolean().optional()
-    }).strict();
-    addHubTeamUserBody = external_exports.object({
-      user_email: external_exports.string().email("valid email is required")
-    });
-    reassignHubUserBody = external_exports.object({
-      hub_team_id: uuidSchema.nullable()
-    });
-    replicatePreviewBody = external_exports.object({
-      preview_label: previewLabelField
-    });
-    HUB_DIFF_SECTION_SET = {
-      agents: true,
-      agent_parameters: true,
-      connections: true,
-      mcp_tools: true,
-      tools: true,
-      channels: true,
-      states: true,
-      teams: true,
-      resources: true,
-      resource_folders: true,
-      resource_files: true,
-      agent_resources: true,
-      message_templates: true,
-      contact_lists: true,
-      automations: true,
-      evals: true
-    };
-    HUB_DIFF_SECTIONS = Object.keys(HUB_DIFF_SECTION_SET);
-    updateChannelTestIdentitiesBody = external_exports.object({
-      test_identities: external_exports.array(external_exports.string().max(320)).max(1e3)
-    });
-    claimCodeChannelParam = external_exports.object({
-      id: uuidSchema,
-      channelId: uuidSchema
-    });
-    claimCodeDeleteParam = external_exports.object({
-      id: uuidSchema,
-      channelId: uuidSchema,
-      code: external_exports.string().regex(/^[A-Za-z0-9]{6}$/, "Invalid claim code format").transform((s) => s.toUpperCase())
-    });
-    connectionIdParam = external_exports.object({ id: uuidSchema });
-    connectorIdParam = external_exports.object({ id: uuidSchema });
-    listConnectionsQuery = external_exports.object({ hub_id: uuidSchema });
-    deleteConnectionQuery = external_exports.object({ hub_id: uuidSchema });
-    addConnectionBody = external_exports.object({
-      hub_id: uuidSchema,
-      connector_id: uuidSchema,
-      authentication_type: external_exports.string().optional(),
-      inbound_mode: external_exports.enum(["wayai", "resend"]).optional(),
-      inbound_address: external_exports.string().email().optional(),
-      // Opt out of copying this connection's credentials into production on publish/sync.
-      // Defaults to true at the DB layer.
-      sync_credentials_to_production: external_exports.boolean().optional()
-    }).passthrough().superRefine((data, ctx) => {
-      if (data.inbound_mode === "resend" && !data.inbound_address) {
-        ctx.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          message: "Receiving email address is required when using Resend inbound mode",
-          path: ["inbound_address"]
-        });
-      }
-    });
-    editConnectionBody = external_exports.object({
-      hub_id: uuidSchema,
-      sync_credentials_to_production: external_exports.boolean().optional()
-    }).passthrough();
-    PRODUCTION_DIRECT_FIELDS = ["username", "api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "webhook_signing_secret"];
-    setProductionCredentialBody = external_exports.object({
-      hub_id: uuidSchema,
-      organization_credential_id: external_exports.string().nullable().optional(),
-      organization_credential_token_id: external_exports.string().nullable().optional(),
-      username: external_exports.string().optional(),
-      api_key: external_exports.string().optional(),
-      access_token: external_exports.string().optional(),
-      password: external_exports.string().optional(),
-      refresh_token: external_exports.string().optional(),
-      webhook_secret_token: external_exports.string().optional(),
-      webhook_signing_secret: external_exports.string().optional()
-    }).strict().superRefine((data, ctx) => {
-      const hasOrgLink = !!data.organization_credential_id || !!data.organization_credential_token_id;
-      const hasDirect = PRODUCTION_DIRECT_FIELDS.some((f) => data[f] != null);
-      if (hasOrgLink && hasDirect) {
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Provide either an organization credential link or direct credential fields, not both" });
-      }
-      if (!hasOrgLink && !hasDirect) {
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "A credential is required: link an organization credential or provide a credential field" });
-      }
-    });
-    registerWhatsappQuery = external_exports.object({ hub_id: uuidSchema });
-    registerWhatsappBody = external_exports.object({
-      pin: external_exports.string().optional()
+    registerWhatsappQuery = external_exports.object({ hub_id: uuidSchema });
+    registerWhatsappBody = external_exports.object({
+      pin: external_exports.string().optional()
     });
     retryProvisioningQuery = external_exports.object({ hub_id: uuidSchema });
     resendDomainStatusQuery = external_exports.object({ hub_id: uuidSchema });
@@ -11443,6 +11587,7 @@ var init_chunk_H4RTULPH = __esm({
       filter: hubContactListFilterSchema.optional()
     }).strict();
     AUTOMATION_TRIGGER_TYPES = ["schedule", "event", "webhook"];
+    AUTOMATION_EVENT_TYPES = ["conversation.flagged", "conversation.closed"];
     AUTOMATION_TARGET_TYPES = ["none", "contact_list"];
     AUTOMATION_ACTION_TYPES = ["run_agent", "send_message"];
     AUTOMATION_CHANNEL_TYPES = ["whatsapp", "instagram", "email", "app"];
@@ -11452,10 +11597,36 @@ var init_chunk_H4RTULPH = __esm({
     AUTOMATION_INSTRUCTIONS_MAX = 1e4;
     AUTOMATION_TEXT_MAX = 4096;
     AUTOMATION_CRON_MAX = 512;
+    AUTOMATION_WEBHOOK_AUTHS = ["hmac", "static_header"];
+    AUTOMATION_WEBHOOK_HEADERS = {
+      signature: "X-Data-Signature",
+      timestamp: "X-Data-Timestamp",
+      id: "X-Data-Id",
+      idempotencyKey: "X-Data-Idempotency-Key"
+    };
+    AUTOMATION_WEBHOOK_BODY_MAX_BYTES = 64 * 1024;
+    AUTOMATION_WEBHOOK_HEADER_NAME_MAX = 64;
+    AUTOMATION_WEBHOOK_MOUNT = "/webhooks/automations";
+    WEBHOOK_RESERVED_HEADERS = /* @__PURE__ */ new Set([
+      "host",
+      "connection",
+      "cookie",
+      "transfer-encoding",
+      "forwarded",
+      "via",
+      "true-client-ip",
+      "x-real-ip",
+      ...Object.values(AUTOMATION_WEBHOOK_HEADERS).map((h) => h.toLowerCase())
+    ]);
     automationTriggerSchema = external_exports.object({
       type: external_exports.enum(AUTOMATION_TRIGGER_TYPES),
       cron: external_exports.string().trim().min(1).max(AUTOMATION_CRON_MAX).optional(),
-      timezone: external_exports.string().trim().min(1).optional()
+      timezone: external_exports.string().trim().min(1).optional(),
+      event: external_exports.enum(AUTOMATION_EVENT_TYPES).optional(),
+      /** The production hub whose events an `event` trigger listens to; absent: this hub's own. */
+      source_hub: external_exports.string().uuid().optional(),
+      auth: external_exports.enum(AUTOMATION_WEBHOOK_AUTHS).optional(),
+      header: external_exports.string().trim().min(1).max(AUTOMATION_WEBHOOK_HEADER_NAME_MAX).optional()
     }).strict();
     automationTargetSchema = external_exports.object({
       type: external_exports.enum(AUTOMATION_TARGET_TYPES),
@@ -11471,6 +11642,9 @@ var init_chunk_H4RTULPH = __esm({
       agent_id: external_exports.string().uuid().nullable().optional(),
       instructions: external_exports.string().max(AUTOMATION_INSTRUCTIONS_MAX).nullable().optional()
     }).strict();
+    automationGateSchema = external_exports.object({
+      monitor: external_exports.string().trim().min(1).max(MONITOR_GATE_AGENT_NAME_MAX)
+    }).strict();
     automationName = external_exports.string().trim().min(1).max(AUTOMATION_NAME_MAX);
     automationDescription = external_exports.string().max(AUTOMATION_DESCRIPTION_MAX).nullable().optional();
     automationIdParam = external_exports.object({
@@ -11479,6 +11653,10 @@ var init_chunk_H4RTULPH = __esm({
     automationHubQuery = external_exports.object({
       hub_id: external_exports.string().uuid()
     });
+    automationWebhookParams = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      automation_id: external_exports.string().uuid()
+    });
     AUTOMATION_RUNS_PAGE_MAX = 50;
     listAutomationRunsQuery = external_exports.object({
       hub_id: external_exports.string().uuid(),
@@ -11493,7 +11671,9 @@ var init_chunk_H4RTULPH = __esm({
       purpose: external_exports.enum(AUTOMATION_PURPOSES).optional(),
       trigger: automationTriggerSchema,
       target: automationTargetSchema,
-      action: automationActionSchema
+      action: automationActionSchema,
+      /** Absent or null: every fire runs. */
+      gate: automationGateSchema.nullable().optional()
     }).strict();
     updateAutomationBody = external_exports.object({
       name: automationName.optional(),
@@ -11501,13 +11681,18 @@ var init_chunk_H4RTULPH = __esm({
       purpose: external_exports.enum(AUTOMATION_PURPOSES).optional(),
       trigger: automationTriggerSchema.optional(),
       target: automationTargetSchema.optional(),
-      action: automationActionSchema.optional()
+      action: automationActionSchema.optional(),
+      /** Replaced when present; null removes the gate. */
+      gate: automationGateSchema.nullable().optional()
     }).strict();
     AUTOMATION_ALERT_CATEGORIES = {
       list_not_found: "automation_list_not_found",
       list_over_cap: "automation_list_over_cap"
     };
     AUTOMATION_BLOCKED_ALERT_CATEGORY = "automation_blocked";
+    automationEventSubscriberParam = external_exports.object({
+      subscriber_hub_id: external_exports.string().uuid()
+    });
     VERSION_PART = "(0|[1-9][0-9]{0,5})";
     MOBILE_APP_VERSION_RE = new RegExp(`^${VERSION_PART}\\.${VERSION_PART}\\.${VERSION_PART}$`);
     mobileAppVersionSchema = external_exports.string().regex(MOBILE_APP_VERSION_RE, "must be a MAJOR.MINOR.PATCH version, e.g. 1.0.0");
@@ -11608,8 +11793,10 @@ var init_chunk_H4RTULPH = __esm({
     });
     MAX_VOICE_CALL_MINUTE_OPS = 60;
     voiceCallMinuteOps = external_exports.number().int().min(0).max(MAX_VOICE_CALL_MINUTE_OPS);
-    AUTOMATION_LIST_MAX_CONTACTS_BOUND = 1e4;
-    automationListMaxContacts = external_exports.number().int().min(1).max(AUTOMATION_LIST_MAX_CONTACTS_BOUND);
+    AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND = 1e3;
+    automationGateEvaluationsPerOperation = external_exports.number().int().min(1).max(AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND);
+    AUTOMATION_RUN_RETENTION_DAYS_MAX = 3650;
+    automationRunRetentionDays = external_exports.number().int().min(1).max(AUTOMATION_RUN_RETENTION_DAYS_MAX);
     updatePlatformConfigBody = external_exports.object({
       free_plan_max_free_orgs_per_user: external_exports.number().int().min(0).optional(),
       /** Kill switch for admin debug-read endpoints. 0 = off, 1 = on. */
@@ -11649,8 +11836,10 @@ var init_chunk_H4RTULPH = __esm({
        * `wayai admin communities enable|disable` flips this.
        */
       communities_enabled: external_exports.number().int().min(0).max(1).optional(),
-      /** The most contacts one automation fire reaches (`automationListMaxContacts`). */
-      automation_list_max_contacts: automationListMaxContacts.optional(),
+      /** How many automation gate evaluations bill one operation (`automationGateEvaluationsPerOperation`). */
+      automation_gate_evaluations_per_operation: automationGateEvaluationsPerOperation.optional(),
+      /** How many days a hub keeps an automation's runs (`automationRunRetentionDays`). */
+      automation_run_retention_days: automationRunRetentionDays.optional(),
       /**
        * The mobile app version policy (`MOBILE_VERSION_POLICY_COLUMNS`), per platform: an install
        * below the minimum is blocked until it updates from the store; one below the recommended
@@ -11801,7 +11990,7 @@ var init_chunk_H4RTULPH = __esm({
       /** Filter to specific DO types (default: all) */
       do_types: external_exports.array(pitrDoNamespace).optional()
     });
-    dataExplorerDebugDoType = external_exports.enum(["hub", "org", "conversation", "user", "platform", "thread", "community", "contact_book"]);
+    dataExplorerDebugDoType = external_exports.enum(["hub", "org", "conversation", "user", "platform", "thread", "community", "contact_book", "batch"]);
     DEBUG_READ_MAX_LIMIT = 100;
     DEBUG_READ_DEFAULT_LIMIT = 20;
     DEBUG_DO_HEX_PREFIX = "hex:";
@@ -12758,13 +12947,18 @@ var init_chunk_H4RTULPH = __esm({
     COMMUNITY_LESSON_TREE_MAX_BYTES = 512 * 1024;
     COMMUNITY_LESSON_LINK_PROTOCOLS = ["http", "https", "mailto"];
     LINK_SCHEME = new RegExp(`^(${COMMUNITY_LESSON_LINK_PROTOCOLS.join("|")}):`, "i");
+    adminSetGuideHubBody = external_exports.object({
+      hub_id: uuidSchema,
+      dry_run: external_exports.boolean().optional()
+    }).strict();
+    GUIDE_HUB_INELIGIBLE_REASON = "guide_hub_ineligible";
   }
 });
 
-// ../../packages/core/dist/chunk-R5WRRHCL.js
+// ../../packages/core/dist/chunk-LKBSHANA.js
 var DESKTOP_SHELL_VERSION_RE, DESKTOP_PLATFORMS, DESKTOP_FLAVORS, desktopShellInfoSchema, DESKTOP_PRESENCE_STATES, desktopPresenceSchema, desktopUpdateSchema, DESKTOP_SIGN_IN_URL_MAX_LENGTH, DESKTOP_APP_PATH_MAX_LENGTH, desktopAppPathSchema, DESKTOP_NOTIFICATION_KINDS, DESKTOP_NOTIFICATION_TITLE_MAX_LENGTH, DESKTOP_NOTIFICATION_BODY_MAX_LENGTH, notificationTitleSchema, notificationBodySchema, desktopNotificationSchema, DESKTOP_BADGE_MAX_COUNT, DESKTOP_BADGE_LABEL_MAX_LENGTH, desktopBadgeSchema, desktopNavigateSchema, desktopSettingsSchema, desktopSettingsChangeSchema, desktopBridgeArgsSchemas;
-var init_chunk_R5WRRHCL = __esm({
-  "../../packages/core/dist/chunk-R5WRRHCL.js"() {
+var init_chunk_LKBSHANA = __esm({
+  "../../packages/core/dist/chunk-LKBSHANA.js"() {
     "use strict";
     init_zod();
     DESKTOP_SHELL_VERSION_RE = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})(-[0-9A-Za-z.-]{1,32})?$/;
@@ -12856,27 +13050,232 @@ var init_chunk_R5WRRHCL = __esm({
   }
 });
 
-// ../../packages/core/dist/contracts/index.js
-var init_contracts = __esm({
-  "../../packages/core/dist/contracts/index.js"() {
-    "use strict";
-    init_chunk_H4RTULPH();
-    init_chunk_VORPHGDT();
-    init_chunk_POL7B3EM();
-    init_chunk_YEYIDIR6();
-    init_chunk_SNA2DXAC();
-    init_chunk_R5WRRHCL();
-    init_chunk_IBL7FANV();
-    init_chunk_C2UEA2KW();
-    init_chunk_3NS3HULK();
-    init_chunk_MIWZOSPI();
-    init_chunk_JWPRTSIB();
-    init_chunk_T7KQKDET();
-    init_chunk_L5F7ZOUJ();
-    init_chunk_2ISUBJG7();
+// ../../packages/core/dist/chunk-R7VSUKKX.js
+function isPublicIdentifier(value) {
+  return UUID_RE.test(value) || HEX_RE.test(value) || WORKOS_ID_RE.test(value) || TRACE_HEADER_RE.test(value);
+}
+function redactTokenShapes(input) {
+  return input.replace(TOKEN_RE, REDACTED).replace(PROVIDER_TOKEN_RE, `$1${REDACTED}`).replace(JSON_CREDENTIAL_RE, `$1"${REDACTED}"`).replace(QUERY_CREDENTIAL_RE, `$1${REDACTED}`);
+}
+function redactSecrets(value) {
+  if (isPublicIdentifier(value)) {
+    return value;
   }
-});
-
+  if (OPAQUE_SECRET_RE.test(value)) {
+    return REDACTED;
+  }
+  if (BASE64_SECRET_RE.test(value) && BASE64_MARKER_RE.test(value)) {
+    return REDACTED;
+  }
+  return redactTokenShapes(value);
+}
+var UUID_RE, HEX_RE, WORKOS_ID_RE, TRACE_HEADER_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE;
+var init_chunk_R7VSUKKX = __esm({
+  "../../packages/core/dist/chunk-R7VSUKKX.js"() {
+    "use strict";
+    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    HEX_RE = /^[0-9a-f]{16,}$/;
+    WORKOS_ID_RE = /^(?:user|org)_[0-9A-HJKMNP-TV-Z]{26}$/;
+    TRACE_HEADER_RE = /^(?:[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}|[0-9a-f]{32}-[0-9a-f]{16}(?:-[01])?)$/;
+    OPAQUE_SECRET_RE = /^[A-Za-z0-9_-]{21,}$/;
+    BASE64_SECRET_RE = /^[A-Za-z0-9+/]{20,}={0,2}$/;
+    BASE64_MARKER_RE = /[+=]/;
+    TOKEN_RE = new RegExp(
+      [
+        // WayAI API tokens and WebSocket tickets.
+        "(?:way|wst)_[A-Za-z0-9._-]{8,}",
+        // Authorization header values, including base64 Basic credentials.
+        "(?:Bearer|Basic)\\s+[A-Za-z0-9._~+/=-]{8,}",
+        // JWTs — WorkOS session/access tokens. `eyJ` is base64 for `{"`.
+        "eyJ[A-Za-z0-9._-]{10,}",
+        // Stripe secret/publishable/restricted keys and webhook signing secrets.
+        "(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{8,}",
+        "whsec_[A-Za-z0-9]{8,}",
+        // Telegram bot tokens as the Bot API takes them, in the URL path: `/bot<id>:<secret>/`.
+        "bot[0-9]{5,}:[A-Za-z0-9_-]{30,}"
+        // NOTE: LLM provider keys are NOT here — they need a delimiter-preserving
+        // boundary, so they live in PROVIDER_TOKEN_RE below.
+      ].join("|"),
+      "g"
+    );
+    SENSITIVE_FIELDS = [
+      "password",
+      "token",
+      "secret",
+      "api_key",
+      "apikey",
+      "api-key",
+      "authorization",
+      "auth",
+      "credential",
+      "private_key",
+      "privatekey",
+      "access_token",
+      "refresh_token",
+      "session_id",
+      "sessionid",
+      "cookie",
+      "jwt"
+    ];
+    SENSITIVE_KEY_ALTERNATION = SENSITIVE_FIELDS.map(
+      (field) => field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+    ).join("|");
+    SENSITIVE_KEY_PATTERN = `[A-Za-z0-9_.-]*(?:${SENSITIVE_KEY_ALTERNATION})[A-Za-z0-9_.-]*`;
+    JSON_CREDENTIAL_RE = new RegExp(
+      `("${SENSITIVE_KEY_PATTERN}"\\s*:\\s*)"(?:[^"\\\\]|\\\\.)*"`,
+      "gi"
+    );
+    QUERY_CREDENTIAL_RE = new RegExp(
+      `((?:^|[?&#;\\s])${SENSITIVE_KEY_PATTERN}=)[^&;\\s"']+`,
+      "gi"
+    );
+    REDACTED = "[REDACTED]";
+    PROVIDER_TOKEN_RE = new RegExp(
+      "(^|[^A-Za-z0-9])(?:" + [
+        "sk-[A-Za-z0-9_-]{16,}",
+        "AIza[A-Za-z0-9_-]{16,}",
+        "xai-[A-Za-z0-9_-]{16,}"
+      ].join("|") + ")",
+      "g"
+    );
+  }
+});
+
+// ../../packages/core/dist/chunk-BPDC67ML.js
+var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError;
+var init_chunk_BPDC67ML = __esm({
+  "../../packages/core/dist/chunk-BPDC67ML.js"() {
+    "use strict";
+    init_chunk_R7VSUKKX();
+    APP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("wayai.AppError");
+    AppError = class extends Error {
+      constructor(message, code, statusCode = 500, details) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.details = details;
+        this.name = "AppError";
+      }
+      [APP_ERROR_BRAND] = true;
+      toJSON() {
+        return {
+          error: this.code,
+          message: this.message,
+          ...this.details && { details: this.details }
+        };
+      }
+    };
+    LLM_RATE_LIMIT_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmRateLimitError");
+    LlmRateLimitError = class extends Error {
+      constructor(provider, retryAfterMs) {
+        super(`${provider} rate limited; retry after ${retryAfterMs}ms`);
+        this.provider = provider;
+        this.retryAfterMs = retryAfterMs;
+        this.name = "LlmRateLimitError";
+      }
+      [LLM_RATE_LIMIT_BRAND] = true;
+    };
+    LLM_PROVIDER_HTTP_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmProviderHttpError");
+    LlmProviderHttpError = class extends Error {
+      constructor(message, status, provider, providerError) {
+        super(redactSecrets(message));
+        this.status = status;
+        this.provider = provider;
+        this.providerError = providerError;
+        this.name = "LlmProviderHttpError";
+      }
+      [LLM_PROVIDER_HTTP_BRAND] = true;
+    };
+    LLM_PROVIDER_CONTENT_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmProviderContentError");
+    LlmProviderContentError = class extends Error {
+      constructor(message, provider, providerError) {
+        super(redactSecrets(message));
+        this.provider = provider;
+        this.providerError = providerError;
+        this.name = "LlmProviderContentError";
+      }
+      [LLM_PROVIDER_CONTENT_BRAND] = true;
+    };
+    LLM_PROVIDER_TIMEOUT_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmProviderTimeoutError");
+    LlmProviderTimeoutError = class extends Error {
+      constructor(message, provider) {
+        super(message);
+        this.provider = provider;
+        this.name = "LlmProviderTimeoutError";
+      }
+      [LLM_PROVIDER_TIMEOUT_BRAND] = true;
+    };
+    ExternalServiceError = class extends AppError {
+      constructor(service, originalError) {
+        super(`External service error: ${service}`, "EXTERNAL_SERVICE_ERROR", 502, {
+          service,
+          originalMessage: originalError?.message
+        });
+        this.name = "ExternalServiceError";
+      }
+    };
+    CHANNEL_PROVIDER_HTTP_BRAND = /* @__PURE__ */ Symbol.for("wayai.ChannelProviderHttpError");
+    ChannelProviderHttpError = class extends ExternalServiceError {
+      [CHANNEL_PROVIDER_HTTP_BRAND] = true;
+      status;
+      provider;
+      /** Provider numeric error code (Meta `error.code`) — body-free. */
+      providerCode;
+      /** Provider numeric error subcode (Meta `error.error_subcode`) — body-free. */
+      providerSubcode;
+      constructor(provider, status, providerCode, providerSubcode) {
+        super(provider);
+        this.name = "ChannelProviderHttpError";
+        this.status = status;
+        this.provider = provider;
+        this.providerCode = providerCode;
+        this.providerSubcode = providerSubcode;
+      }
+    };
+    MEDIA_PROVIDER_HTTP_BRAND = /* @__PURE__ */ Symbol.for("wayai.MediaProviderHttpError");
+    MediaProviderHttpError = class extends Error {
+      constructor(provider, status, options = {}) {
+        super(`${provider} API error (${status})`);
+        this.provider = provider;
+        this.status = status;
+        this.name = "MediaProviderHttpError";
+        this.credentialRejected = options.credentialRejected ?? false;
+      }
+      [MEDIA_PROVIDER_HTTP_BRAND] = true;
+      /**
+       * The provider said the credential itself was rejected, under a status that does not say so
+       * (Google answers an invalid or expired key with 400 `API_KEY_INVALID`, not 401). Read off
+       * the body at the throw site, which carries only this flag on. Alerting keys on it so the
+       * admin is told to re-enter the key, not that the key is fine.
+       */
+      credentialRejected;
+    };
+  }
+});
+
+// ../../packages/core/dist/contracts/index.js
+var init_contracts = __esm({
+  "../../packages/core/dist/contracts/index.js"() {
+    "use strict";
+    init_chunk_FRU7E62M();
+    init_chunk_VORPHGDT();
+    init_chunk_POL7B3EM();
+    init_chunk_T2RKGBYS();
+    init_chunk_SNA2DXAC();
+    init_chunk_MIWZOSPI();
+    init_chunk_LKBSHANA();
+    init_chunk_IBL7FANV();
+    init_chunk_2ISUBJG7();
+    init_chunk_C2UEA2KW();
+    init_chunk_3NS3HULK();
+    init_chunk_JWPRTSIB();
+    init_chunk_T7KQKDET();
+    init_chunk_L5F7ZOUJ();
+    init_chunk_BPDC67ML();
+    init_chunk_R7VSUKKX();
+  }
+});
+
 // src/lib/api-client.ts
 var api_client_exports = {};
 __export(api_client_exports, {
@@ -13048,6 +13447,20 @@ var init_api_client = __esm({
       async adminDestroyCommunity(communityId) {
         return this.request("DELETE", `/api/admin/communities/${encodeURIComponent(communityId)}`);
       }
+      // Read which hub is the WayAI Guide (platform-admin gated, wayai#4948). Used by
+      // `wayai admin guide status`.
+      async adminGetGuide() {
+        return this.request("GET", "/api/admin/guide");
+      }
+      // Make a hub the WayAI Guide, or with `dry_run` only check it (platform-admin gated,
+      // wayai#4948). Used by `wayai admin guide set-hub`.
+      async adminSetGuideHub(body) {
+        return this.request("PUT", "/api/admin/guide", body);
+      }
+      // Turn the WayAI Guide off (platform-admin gated, wayai#4948). Used by `wayai admin guide clear`.
+      async adminClearGuideHub() {
+        return this.request("DELETE", "/api/admin/guide");
+      }
       /**
        * Re-discover an MCP connection's tool/resource catalog (refreshes stale
        * input schemas that `push` leaves untouched). `connection` is the display
@@ -13718,371 +14131,146 @@ var init_api_client = __esm({
       /**
        * Download a Data `/v1` path's raw bytes. Distinct from `dataRequest`, which
        * parses the JSON envelope: the response here is the stored blob itself, so
-       * this reads `arrayBuffer()`. Single-refresh-on-401 like `request`, but no
-       * transient-retry loop — re-streaming a blob is not worth a cold-start probe.
-       */
-      async dataDownload(v1Path, orgId) {
-        const path36 = withOrgSelector(toDataProxyPath(v1Path), orgId);
-        addApiBreadcrumb("GET", path36);
-        const url = `${this.apiUrl}${path36}`;
-        let response = await this.send(url, "GET");
-        if (response.status === 401 && this.onUnauthorized) {
-          let refreshed;
-          try {
-            refreshed = await this.onUnauthorized();
-          } catch {
-          }
-          if (refreshed) {
-            this.accessToken = refreshed;
-            response = await this.send(url, "GET");
-          }
-        }
-        if (!response.ok) {
-          throw new ApiError("GET", path36, response.status, await response.text());
-        }
-        return {
-          bytes: new Uint8Array(await response.arrayBuffer()),
-          contentType: response.headers.get("Content-Type") ?? "application/octet-stream"
-        };
-      }
-      /**
-       * The absolute URL of a Data `/v1` path, for handing the user a link they can
-       * fetch themselves. Only the address — every request the CLI issues goes
-       * through the methods above, which carry the session.
-       */
-      dataUrl(v1Path, orgId) {
-        return `${this.apiUrl}${withOrgSelector(toDataProxyPath(v1Path), orgId)}`;
-      }
-      /** Issue a single authenticated request with the client's current token. */
-      send(url, method, body, extraHeaders, contentType) {
-        return fetch(url, {
-          method,
-          headers: {
-            // Caller-supplied FIRST, so everything pinned below is out of their
-            // reach: a metadata header cannot restate the credential or mislabel
-            // the body.
-            ...extraHeaders,
-            Authorization: `Bearer ${this.accessToken}`,
-            // The content type describes THIS body, so it is derived from the body
-            // rather than accepted from `extraHeaders` — which is pinned out above,
-            // and would otherwise be the one way to mislabel a JSON request.
-            // `||`, not `??`: an empty content type is not a content type, and an
-            // unlabelled body should fall back rather than announce nothing.
-            "Content-Type": body instanceof Uint8Array ? contentType || "application/octet-stream" : "application/json",
-            // Names the calling surface for the Data Worker's audit rows, which
-            // record `cli` vs `api` vs `mcp`. A HINT, not an
-            // authorization input: any client can send it, so the backend must
-            // normalize it against what it knows about its own ingress rather than
-            // trust it. Nothing is granted or denied on its value; the Data Worker's
-            // audit rows are its consumer.
-            "X-WayAI-Client": "cli"
-          },
-          // Bytes go on the wire verbatim (file content, attachments); everything
-          // else is JSON. Encoding a Uint8Array through JSON.stringify would send
-          // `{"0":137,…}` — a corrupt upload rather than a failed one.
-          body: !body ? void 0 : body instanceof Uint8Array ? body : JSON.stringify(body)
-        });
-      }
-    };
-  }
-});
-
-// src/lib/errors.ts
-function extractApiMessage(err) {
-  if (err instanceof ApiError) {
-    try {
-      const parsed = JSON.parse(err.body);
-      if (parsed.message) return parsed.message;
-      if (parsed.error) return parsed.error;
-    } catch {
-    }
-    return err.body || err.message;
-  }
-  return err instanceof Error ? err.message : String(err);
-}
-function extractApiErrorCode(err) {
-  if (!(err instanceof ApiError)) return null;
-  try {
-    const parsed = JSON.parse(err.body);
-    return typeof parsed.error === "string" ? parsed.error : null;
-  } catch {
-    return null;
-  }
-}
-function extractApiRetryAfterSeconds(err) {
-  if (!(err instanceof ApiError)) return null;
-  try {
-    const parsed = JSON.parse(err.body);
-    const seconds2 = parsed?.details?.retry_after_seconds;
-    return typeof seconds2 === "number" && Number.isFinite(seconds2) && seconds2 >= 0 ? seconds2 : null;
-  } catch {
-    return null;
-  }
-}
-function friendlyHint(err) {
-  if (isNetworkError(err)) {
-    return "Couldn't reach WayAI \u2014 check your network connection and try again.";
-  }
-  if (!(err instanceof ApiError)) return null;
-  if (err.body.includes("FREE_PLAN_RESTRICTION")) {
-    return "Publishing to production requires a paid plan. Upgrade your organization to publish or sync.";
-  }
-  const dataMessage = dataErrorMessage(err);
-  if (dataMessage) return dataMessage;
-  const { status } = err;
-  if (status === 401) return "Your session may have expired. Run `wayai login` to re-authenticate.";
-  if (status === 402) return "Quota exceeded for your plan. Review usage or upgrade your plan.";
-  if (status === 403) return "Access denied. Your token may lack permission for this hub or resource.";
-  if (status === 429) return "Rate limited. Wait a moment and try again.";
-  if (status >= 500) return "WayAI server error \u2014 likely temporary. Try again shortly.";
-  return null;
-}
-var init_errors2 = __esm({
-  "src/lib/errors.ts"() {
-    "use strict";
-    init_api_client();
-    init_network_error();
-  }
-});
-
-// ../../packages/core/dist/chunk-WSROLRJN.js
-function identifyTokenType(token) {
-  if (token.startsWith("way_")) return "way_token";
-  if (token.startsWith("eyJ")) return "jwt";
-  return "unknown";
-}
-var init_chunk_WSROLRJN = __esm({
-  "../../packages/core/dist/chunk-WSROLRJN.js"() {
-    "use strict";
-    init_chunk_VORPHGDT();
-  }
-});
-
-// ../../packages/core/dist/chunk-FEOO3UPS.js
-var init_chunk_FEOO3UPS = __esm({
-  "../../packages/core/dist/chunk-FEOO3UPS.js"() {
-    "use strict";
-  }
-});
-
-// ../../packages/core/dist/chunk-IOJOM4DE.js
-var init_chunk_IOJOM4DE = __esm({
-  "../../packages/core/dist/chunk-IOJOM4DE.js"() {
-    "use strict";
-    init_chunk_C2UEA2KW();
-  }
-});
-
-// ../../packages/core/dist/chunk-BF4WRSOQ.js
-var init_chunk_BF4WRSOQ = __esm({
-  "../../packages/core/dist/chunk-BF4WRSOQ.js"() {
-    "use strict";
-  }
-});
-
-// ../../packages/core/dist/chunk-R7VSUKKX.js
-function isPublicIdentifier(value) {
-  return UUID_RE.test(value) || HEX_RE.test(value) || WORKOS_ID_RE.test(value) || TRACE_HEADER_RE.test(value);
-}
-function redactTokenShapes(input) {
-  return input.replace(TOKEN_RE, REDACTED).replace(PROVIDER_TOKEN_RE, `$1${REDACTED}`).replace(JSON_CREDENTIAL_RE, `$1"${REDACTED}"`).replace(QUERY_CREDENTIAL_RE, `$1${REDACTED}`);
-}
-function redactSecrets(value) {
-  if (isPublicIdentifier(value)) {
-    return value;
-  }
-  if (OPAQUE_SECRET_RE.test(value)) {
-    return REDACTED;
-  }
-  if (BASE64_SECRET_RE.test(value) && BASE64_MARKER_RE.test(value)) {
-    return REDACTED;
-  }
-  return redactTokenShapes(value);
-}
-var UUID_RE, HEX_RE, WORKOS_ID_RE, TRACE_HEADER_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE;
-var init_chunk_R7VSUKKX = __esm({
-  "../../packages/core/dist/chunk-R7VSUKKX.js"() {
-    "use strict";
-    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-    HEX_RE = /^[0-9a-f]{16,}$/;
-    WORKOS_ID_RE = /^(?:user|org)_[0-9A-HJKMNP-TV-Z]{26}$/;
-    TRACE_HEADER_RE = /^(?:[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}|[0-9a-f]{32}-[0-9a-f]{16}(?:-[01])?)$/;
-    OPAQUE_SECRET_RE = /^[A-Za-z0-9_-]{21,}$/;
-    BASE64_SECRET_RE = /^[A-Za-z0-9+/]{20,}={0,2}$/;
-    BASE64_MARKER_RE = /[+=]/;
-    TOKEN_RE = new RegExp(
-      [
-        // WayAI API tokens and WebSocket tickets.
-        "(?:way|wst)_[A-Za-z0-9._-]{8,}",
-        // Authorization header values, including base64 Basic credentials.
-        "(?:Bearer|Basic)\\s+[A-Za-z0-9._~+/=-]{8,}",
-        // JWTs — WorkOS session/access tokens. `eyJ` is base64 for `{"`.
-        "eyJ[A-Za-z0-9._-]{10,}",
-        // Stripe secret/publishable/restricted keys and webhook signing secrets.
-        "(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{8,}",
-        "whsec_[A-Za-z0-9]{8,}",
-        // Telegram bot tokens as the Bot API takes them, in the URL path: `/bot<id>:<secret>/`.
-        "bot[0-9]{5,}:[A-Za-z0-9_-]{30,}"
-        // NOTE: LLM provider keys are NOT here — they need a delimiter-preserving
-        // boundary, so they live in PROVIDER_TOKEN_RE below.
-      ].join("|"),
-      "g"
-    );
-    SENSITIVE_FIELDS = [
-      "password",
-      "token",
-      "secret",
-      "api_key",
-      "apikey",
-      "api-key",
-      "authorization",
-      "auth",
-      "credential",
-      "private_key",
-      "privatekey",
-      "access_token",
-      "refresh_token",
-      "session_id",
-      "sessionid",
-      "cookie",
-      "jwt"
-    ];
-    SENSITIVE_KEY_ALTERNATION = SENSITIVE_FIELDS.map(
-      (field) => field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
-    ).join("|");
-    SENSITIVE_KEY_PATTERN = `[A-Za-z0-9_.-]*(?:${SENSITIVE_KEY_ALTERNATION})[A-Za-z0-9_.-]*`;
-    JSON_CREDENTIAL_RE = new RegExp(
-      `("${SENSITIVE_KEY_PATTERN}"\\s*:\\s*)"(?:[^"\\\\]|\\\\.)*"`,
-      "gi"
-    );
-    QUERY_CREDENTIAL_RE = new RegExp(
-      `((?:^|[?&#;\\s])${SENSITIVE_KEY_PATTERN}=)[^&;\\s"']+`,
-      "gi"
-    );
-    REDACTED = "[REDACTED]";
-    PROVIDER_TOKEN_RE = new RegExp(
-      "(^|[^A-Za-z0-9])(?:" + [
-        "sk-[A-Za-z0-9_-]{16,}",
-        "AIza[A-Za-z0-9_-]{16,}",
-        "xai-[A-Za-z0-9_-]{16,}"
-      ].join("|") + ")",
-      "g"
-    );
-  }
-});
-
-// ../../packages/core/dist/chunk-4MBOLX7Q.js
-var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_CONTENT_BRAND, LlmProviderContentError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError;
-var init_chunk_4MBOLX7Q = __esm({
-  "../../packages/core/dist/chunk-4MBOLX7Q.js"() {
-    "use strict";
-    init_chunk_R7VSUKKX();
-    APP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("wayai.AppError");
-    AppError = class extends Error {
-      constructor(message, code, statusCode = 500, details) {
-        super(message);
-        this.code = code;
-        this.statusCode = statusCode;
-        this.details = details;
-        this.name = "AppError";
-      }
-      [APP_ERROR_BRAND] = true;
-      toJSON() {
-        return {
-          error: this.code,
-          message: this.message,
-          ...this.details && { details: this.details }
-        };
-      }
-    };
-    LLM_RATE_LIMIT_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmRateLimitError");
-    LlmRateLimitError = class extends Error {
-      constructor(provider, retryAfterMs) {
-        super(`${provider} rate limited; retry after ${retryAfterMs}ms`);
-        this.provider = provider;
-        this.retryAfterMs = retryAfterMs;
-        this.name = "LlmRateLimitError";
-      }
-      [LLM_RATE_LIMIT_BRAND] = true;
-    };
-    LLM_PROVIDER_HTTP_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmProviderHttpError");
-    LlmProviderHttpError = class extends Error {
-      constructor(message, status, provider, providerError) {
-        super(redactSecrets(message));
-        this.status = status;
-        this.provider = provider;
-        this.providerError = providerError;
-        this.name = "LlmProviderHttpError";
-      }
-      [LLM_PROVIDER_HTTP_BRAND] = true;
-    };
-    LLM_PROVIDER_CONTENT_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmProviderContentError");
-    LlmProviderContentError = class extends Error {
-      constructor(message, provider, providerError) {
-        super(redactSecrets(message));
-        this.provider = provider;
-        this.providerError = providerError;
-        this.name = "LlmProviderContentError";
-      }
-      [LLM_PROVIDER_CONTENT_BRAND] = true;
-    };
-    LLM_PROVIDER_TIMEOUT_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmProviderTimeoutError");
-    LlmProviderTimeoutError = class extends Error {
-      constructor(message, provider) {
-        super(message);
-        this.provider = provider;
-        this.name = "LlmProviderTimeoutError";
-      }
-      [LLM_PROVIDER_TIMEOUT_BRAND] = true;
-    };
-    ExternalServiceError = class extends AppError {
-      constructor(service, originalError) {
-        super(`External service error: ${service}`, "EXTERNAL_SERVICE_ERROR", 502, {
-          service,
-          originalMessage: originalError?.message
-        });
-        this.name = "ExternalServiceError";
-      }
-    };
-    CHANNEL_PROVIDER_HTTP_BRAND = /* @__PURE__ */ Symbol.for("wayai.ChannelProviderHttpError");
-    ChannelProviderHttpError = class extends ExternalServiceError {
-      [CHANNEL_PROVIDER_HTTP_BRAND] = true;
-      status;
-      provider;
-      /** Provider numeric error code (Meta `error.code`) — body-free. */
-      providerCode;
-      /** Provider numeric error subcode (Meta `error.error_subcode`) — body-free. */
-      providerSubcode;
-      constructor(provider, status, providerCode, providerSubcode) {
-        super(provider);
-        this.name = "ChannelProviderHttpError";
-        this.status = status;
-        this.provider = provider;
-        this.providerCode = providerCode;
-        this.providerSubcode = providerSubcode;
-      }
-    };
-    MEDIA_PROVIDER_HTTP_BRAND = /* @__PURE__ */ Symbol.for("wayai.MediaProviderHttpError");
-    MediaProviderHttpError = class extends Error {
-      constructor(provider, status, options = {}) {
-        super(`${provider} API error (${status})`);
-        this.provider = provider;
-        this.status = status;
-        this.name = "MediaProviderHttpError";
-        this.credentialRejected = options.credentialRejected ?? false;
+       * this reads `arrayBuffer()`. Single-refresh-on-401 like `request`, but no
+       * transient-retry loop — re-streaming a blob is not worth a cold-start probe.
+       */
+      async dataDownload(v1Path, orgId) {
+        const path36 = withOrgSelector(toDataProxyPath(v1Path), orgId);
+        addApiBreadcrumb("GET", path36);
+        const url = `${this.apiUrl}${path36}`;
+        let response = await this.send(url, "GET");
+        if (response.status === 401 && this.onUnauthorized) {
+          let refreshed;
+          try {
+            refreshed = await this.onUnauthorized();
+          } catch {
+          }
+          if (refreshed) {
+            this.accessToken = refreshed;
+            response = await this.send(url, "GET");
+          }
+        }
+        if (!response.ok) {
+          throw new ApiError("GET", path36, response.status, await response.text());
+        }
+        return {
+          bytes: new Uint8Array(await response.arrayBuffer()),
+          contentType: response.headers.get("Content-Type") ?? "application/octet-stream"
+        };
       }
-      [MEDIA_PROVIDER_HTTP_BRAND] = true;
       /**
-       * The provider said the credential itself was rejected, under a status that does not say so
-       * (Google answers an invalid or expired key with 400 `API_KEY_INVALID`, not 401). Read off
-       * the body at the throw site, which carries only this flag on. Alerting keys on it so the
-       * admin is told to re-enter the key, not that the key is fine.
+       * The absolute URL of a Data `/v1` path, for handing the user a link they can
+       * fetch themselves. Only the address — every request the CLI issues goes
+       * through the methods above, which carry the session.
        */
-      credentialRejected;
+      dataUrl(v1Path, orgId) {
+        return `${this.apiUrl}${withOrgSelector(toDataProxyPath(v1Path), orgId)}`;
+      }
+      /** Issue a single authenticated request with the client's current token. */
+      send(url, method, body, extraHeaders, contentType) {
+        return fetch(url, {
+          method,
+          headers: {
+            // Caller-supplied FIRST, so everything pinned below is out of their
+            // reach: a metadata header cannot restate the credential or mislabel
+            // the body.
+            ...extraHeaders,
+            Authorization: `Bearer ${this.accessToken}`,
+            // The content type describes THIS body, so it is derived from the body
+            // rather than accepted from `extraHeaders` — which is pinned out above,
+            // and would otherwise be the one way to mislabel a JSON request.
+            // `||`, not `??`: an empty content type is not a content type, and an
+            // unlabelled body should fall back rather than announce nothing.
+            "Content-Type": body instanceof Uint8Array ? contentType || "application/octet-stream" : "application/json",
+            // Names the calling surface for the Data Worker's audit rows, which
+            // record `cli` vs `api` vs `mcp`. A HINT, not an
+            // authorization input: any client can send it, so the backend must
+            // normalize it against what it knows about its own ingress rather than
+            // trust it. Nothing is granted or denied on its value; the Data Worker's
+            // audit rows are its consumer.
+            "X-WayAI-Client": "cli"
+          },
+          // Bytes go on the wire verbatim (file content, attachments); everything
+          // else is JSON. Encoding a Uint8Array through JSON.stringify would send
+          // `{"0":137,…}` — a corrupt upload rather than a failed one.
+          body: !body ? void 0 : body instanceof Uint8Array ? body : JSON.stringify(body)
+        });
+      }
     };
   }
 });
 
+// src/lib/errors.ts
+function extractApiMessage(err) {
+  if (err instanceof ApiError) {
+    try {
+      const parsed = JSON.parse(err.body);
+      if (parsed.message) return parsed.message;
+      if (parsed.error) return parsed.error;
+    } catch {
+    }
+    return err.body || err.message;
+  }
+  return err instanceof Error ? err.message : String(err);
+}
+function extractApiErrorCode(err) {
+  if (!(err instanceof ApiError)) return null;
+  try {
+    const parsed = JSON.parse(err.body);
+    return typeof parsed.error === "string" ? parsed.error : null;
+  } catch {
+    return null;
+  }
+}
+function extractApiRetryAfterSeconds(err) {
+  if (!(err instanceof ApiError)) return null;
+  try {
+    const parsed = JSON.parse(err.body);
+    const seconds2 = parsed?.details?.retry_after_seconds;
+    return typeof seconds2 === "number" && Number.isFinite(seconds2) && seconds2 >= 0 ? seconds2 : null;
+  } catch {
+    return null;
+  }
+}
+function friendlyHint(err) {
+  if (isNetworkError(err)) {
+    return "Couldn't reach WayAI \u2014 check your network connection and try again.";
+  }
+  if (!(err instanceof ApiError)) return null;
+  if (err.body.includes("FREE_PLAN_RESTRICTION")) {
+    return "Publishing to production requires a paid plan. Upgrade your organization to publish or sync.";
+  }
+  const dataMessage = dataErrorMessage(err);
+  if (dataMessage) return dataMessage;
+  const { status } = err;
+  if (status === 401) return "Your session may have expired. Run `wayai login` to re-authenticate.";
+  if (status === 402) return "Quota exceeded for your plan. Review usage or upgrade your plan.";
+  if (status === 403) return "Access denied. Your token may lack permission for this hub or resource.";
+  if (status === 429) return "Rate limited. Wait a moment and try again.";
+  if (status >= 500) return "WayAI server error \u2014 likely temporary. Try again shortly.";
+  return null;
+}
+var init_errors2 = __esm({
+  "src/lib/errors.ts"() {
+    "use strict";
+    init_api_client();
+    init_network_error();
+  }
+});
+
+// ../../packages/core/dist/chunk-WSROLRJN.js
+function identifyTokenType(token) {
+  if (token.startsWith("way_")) return "way_token";
+  if (token.startsWith("eyJ")) return "jwt";
+  return "unknown";
+}
+var init_chunk_WSROLRJN = __esm({
+  "../../packages/core/dist/chunk-WSROLRJN.js"() {
+    "use strict";
+    init_chunk_VORPHGDT();
+  }
+});
+
 // ../../packages/core/dist/chunk-ERFR7IRY.js
 function findStepBoundaries(transcript) {
   const out = [];
@@ -14125,6 +14313,28 @@ var init_chunk_ERFR7IRY = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-FEOO3UPS.js
+var init_chunk_FEOO3UPS = __esm({
+  "../../packages/core/dist/chunk-FEOO3UPS.js"() {
+    "use strict";
+  }
+});
+
+// ../../packages/core/dist/chunk-RPGBR5IN.js
+var init_chunk_RPGBR5IN = __esm({
+  "../../packages/core/dist/chunk-RPGBR5IN.js"() {
+    "use strict";
+    init_chunk_C2UEA2KW();
+  }
+});
+
+// ../../packages/core/dist/chunk-BF4WRSOQ.js
+var init_chunk_BF4WRSOQ = __esm({
+  "../../packages/core/dist/chunk-BF4WRSOQ.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/core/dist/index.js
 function markdownToPlainText(text) {
   let result = text;
@@ -14147,26 +14357,26 @@ var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
     init_chunk_WSROLRJN();
-    init_chunk_H4RTULPH();
+    init_chunk_FRU7E62M();
     init_chunk_VORPHGDT();
     init_chunk_POL7B3EM();
-    init_chunk_YEYIDIR6();
+    init_chunk_T2RKGBYS();
     init_chunk_SNA2DXAC();
-    init_chunk_R5WRRHCL();
+    init_chunk_MIWZOSPI();
+    init_chunk_LKBSHANA();
     init_chunk_IBL7FANV();
+    init_chunk_ERFR7IRY();
+    init_chunk_2ISUBJG7();
     init_chunk_FEOO3UPS();
-    init_chunk_IOJOM4DE();
+    init_chunk_RPGBR5IN();
     init_chunk_C2UEA2KW();
     init_chunk_3NS3HULK();
-    init_chunk_MIWZOSPI();
     init_chunk_JWPRTSIB();
     init_chunk_BF4WRSOQ();
     init_chunk_T7KQKDET();
     init_chunk_L5F7ZOUJ();
-    init_chunk_4MBOLX7Q();
+    init_chunk_BPDC67ML();
     init_chunk_R7VSUKKX();
-    init_chunk_ERFR7IRY();
-    init_chunk_2ISUBJG7();
     ENDPOINT_CONFIGS = {
       // OAuth callbacks - strict, fail-closed (prevent brute force)
       "/oauth/callback/*": { tier: "STRICT", failClosed: true },
@@ -14315,6 +14525,12 @@ var init_dist = __esm({
       // Channel webhooks - high throughput (external systems, never authenticated)
       "/webhooks/whatsapp/*": { tier: "HIGH" },
       "/webhooks/instagram/*": { tier: "HIGH" },
+      // An automation's webhook deliveries (wayai#4931 D13) — no bearer token: the automation's
+      // secret is the credential, checked against one HubDO read. This per-IP limit runs first, before
+      // anything is read. HIGH, as the channel webhooks: senders are servers, and an integration
+      // platform's egress addresses carry many tenants' deliveries. The per-automation budget is
+      // `AUTOMATION_WEBHOOK_PER_AUTOMATION_LIMIT`, counted after the delivery is verified.
+      [`${AUTOMATION_WEBHOOK_MOUNT}/*`]: { tier: "HIGH" },
       // Reports (CLI → platform_report triage queue). One per-user budget covers intake
       // (POST), the content edit (PATCH /:id), the reporter read-back (GET, GET /:id), and the
       // verification loop (POST /:id/accept, /:id/contest). The limiter is path-based, so a
@@ -14599,6 +14815,17 @@ var init_dist = __esm({
       // many members' clicks share, and STRICT's 5/min bucket is shared with sign-in. An exact key, so
       // it wins over the wildcard above.
       [COMMUNITY_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
+      // The WayAI Guide's help entry (wayai#4948, `routes/api/guide.ts`): one POST per click by a viewer
+      // the snapshot does not show enrolled, which reads the person's row on the Guide hub and writes only
+      // what is missing (an enrolled viewer's click opens the hub without a request). Every caller is
+      // signed in, so the per-IP tier is skipped; 10 a minute per person on the native binding (fails
+      // open, like every 60 s budget) bounds what a looping client costs the one Guide HubDO.
+      "/api/guide/access": {
+        tier: "STANDARD",
+        userLimit: 10,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/guide/access"
+      },
       // App channel - high throughput with user limits
       "/channels/app/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
       // API channel (api-channel-connector) - machine-to-machine, high throughput
@@ -22849,7 +23076,7 @@ function describeCategory(category) {
     case AUTOMATION_ALERT_CATEGORIES.list_over_cap:
       return {
         label: "Automation list over the cap",
-        hint: "An automation's list holds more contacts this hub sees than one fire may reach. Narrow the list's filter \u2014 a hub list in `hub.yaml` `contact_lists:`, an org list in the organization's Contacts settings."
+        hint: "Raised before lists were read a page at a time: a list is no longer capped per fire, so the automation's next fire reaches the whole list. Nothing to change; the alert clears on its own."
       };
     // wayai#4931 D15: an automation, enabled and not paused, that cannot fire. Its subject is the
     // automation, never a connection; the reason, naming the automation, is the alert's detail.
@@ -28126,6 +28353,26 @@ async function adminCommand(args2) {
         process.exit(1);
     }
   }
+  if (group === "guide") {
+    if (!sub) {
+      printHelp2();
+      process.exit(1);
+    }
+    switch (sub) {
+      case "set-hub":
+        await runGuideSetHub(positional, flagArgs);
+        return;
+      case "clear":
+        await runGuideClear(positional, flagArgs);
+        return;
+      case "status":
+        await runGuideStatus(positional, flagArgs);
+        return;
+      default:
+        printHelp2();
+        process.exit(1);
+    }
+  }
   if (group === "voice-calls") {
     if (!sub) {
       printHelp2();
@@ -29038,6 +29285,121 @@ async function runCommunitiesDestroy(positional, flagArgs) {
   }
   console.log(`Destroyed community ${data.community_id} \u2014 "${data.name}", owned by ${data.org_name} (${data.org_id}), at ${data.destroyed_at}.`);
 }
+function describeGuideHub(hub) {
+  return `${hub.hub_name ?? "(unnamed)"} (${hub.hub_id}), owned by ${hub.organization_name ?? "(unnamed org)"} (${hub.organization_id})`;
+}
+function parseGuideFlags(flagArgs, usage3, allowed) {
+  for (const flag of flagArgs) {
+    if (!allowed.includes(flag)) {
+      console.error(`Unknown flag: ${flag}`);
+      console.error(usage3);
+      process.exit(1);
+    }
+  }
+  return { yes: flagArgs.includes("--yes"), jsonOutput: flagArgs.includes("--json") };
+}
+async function runGuideSetHub(positional, flagArgs) {
+  const usage3 = "wayai admin guide set-hub <hub_id> [--yes] [--json]";
+  const { yes, jsonOutput } = parseGuideFlags(flagArgs, usage3, ["--yes", "--json"]);
+  const parsed = adminSetGuideHubBody.safeParse({ hub_id: positional[0] });
+  if (positional.length !== 1 || !parsed.success) {
+    console.error("<hub_id> must be one hub id (a UUID).");
+    console.error(usage3);
+    process.exit(1);
+  }
+  const hubId = parsed.data.hub_id;
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  const put = async (dryRun) => {
+    try {
+      return (await client.adminSetGuideHub({ hub_id: hubId, dry_run: dryRun })).data;
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 404) {
+        console.error(`Hub ${hubId} not found (never created, or deleted).`);
+        process.exit(1);
+      }
+      if (err instanceof ApiError && err.status === 409 && conflictReasonOf(err) === GUIDE_HUB_INELIGIBLE_REASON) {
+        console.error(`Refused: ${extractApiMessage(err)}.`);
+        process.exit(1);
+      }
+      exitOnApiError(err);
+      throw err;
+    }
+  };
+  if (!yes && !jsonOutput) {
+    const checked = await put(true);
+    console.log(`The Guide will be ${describeGuideHub(checked.hub)}.`);
+    console.log("Every account provisioned from now on is enrolled in it as an end user, and the");
+    console.log("owning org pays for every Guide conversation.");
+    const ok = await confirm("Proceed?");
+    if (!ok) {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const written = await put(false);
+  if (jsonOutput) {
+    console.log(JSON.stringify(written, null, 2));
+    return;
+  }
+  console.log(`The Guide is ${describeGuideHub(written.hub)}.`);
+  console.log(PLATFORM_CONFIG_PROPAGATION_NOTE);
+}
+async function runGuideClear(positional, flagArgs) {
+  const usage3 = "wayai admin guide clear [--json]";
+  if (positional.length > 0) {
+    console.error(usage3);
+    process.exit(1);
+  }
+  const { jsonOutput } = parseGuideFlags(flagArgs, usage3, ["--json"]);
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  try {
+    const { data } = await client.adminClearGuideHub();
+    if (jsonOutput) {
+      console.log(JSON.stringify(data, null, 2));
+      return;
+    }
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  console.log("The Guide is off: nobody new is enrolled, and the help entry is hidden.");
+  console.log("People already enrolled keep their row on the Guide hub.");
+  console.log(PLATFORM_CONFIG_PROPAGATION_NOTE);
+}
+async function runGuideStatus(positional, flagArgs) {
+  const usage3 = "wayai admin guide status [--json]";
+  if (positional.length > 0) {
+    console.error(usage3);
+    process.exit(1);
+  }
+  const { jsonOutput } = parseGuideFlags(flagArgs, usage3, ["--json"]);
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let data;
+  try {
+    data = (await client.adminGetGuide()).data;
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  if (jsonOutput) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (!data.guide_hub_id) {
+    console.log("guide_hub_id (platform): not set \u2014 the Guide is off.");
+    return;
+  }
+  console.log(`guide_hub_id (platform): ${data.guide_hub_id}`);
+  if (!data.hub) {
+    console.log("The hub cannot be read (deleted?). Run `wayai admin guide clear`.");
+    return;
+  }
+  console.log(`Hub: ${describeGuideHub(data.hub)}`);
+  console.log(`Environment: ${data.hub.hub_environment ?? "unknown"}; type: ${data.hub.hub_type ?? "unknown"}; app channel: ${data.hub.app_channel_enabled ? "enabled" : "DISABLED"}`);
+}
 function conflictReasonOf(err) {
   try {
     const reason = JSON.parse(err.body).details?.reason;
@@ -29656,6 +30018,11 @@ Usage:
   wayai admin communities destroy <community_id> [--yes] [--json]
                                                    Destroy a community: its members' lists drop it and its storage is deleted (DESTRUCTIVE; confirms unless --yes)
 
+  wayai admin guide set-hub <hub_id> [--yes] [--json]
+                                                   Make a production chat hub with an enabled app channel the WayAI Guide (prints its owning org and confirms, unless --yes or --json)
+  wayai admin guide clear [--json]                 Turn the Guide off: nobody new is enrolled and the help entry is hidden
+  wayai admin guide status [--json]                Print which hub is the Guide, and its facts
+
 Sources:
   do             Live DO SQLite (existing conversation, hub config, etc.).
   analytics      ClickHouse projections (conversation, message, schedule_event).
@@ -29745,6 +30112,12 @@ Sources:
                  community for an org and \`destroy\` removes one, whichever way the switch
                  is set; deleting an org destroys its communities too. Changes to the
                  switch land within about 60 s.
+  guide          The WayAI Guide: ONE production chat hub, owned by WayAI, whose agent answers
+                 questions about the platform. While \`set-hub\` has named it, every account
+                 provisioned is enrolled in it as an end user and every signed-in person reaches
+                 it from the help entry ("Ask WayAI"); its owning org pays. \`clear\` stops new
+                 enrollment and hides the help entry; people already enrolled keep their row.
+                 Changes land within about 60 s.
 
 Types (do): ${VALID_TYPES.join(" | ")}
 Tables (analytics): ${VALID_ANALYTICS_TABLES.join(" | ")}
@@ -29795,6 +30168,7 @@ var init_admin = __esm({
     init_workspace();
     init_skill_version();
     init_file_map();
+    init_errors2();
     init_contracts();
     VALID_TYPES = dataExplorerDebugDoType.options;
     VALID_ANALYTICS_TABLES = dataExplorerDebugAnalyticsTable.options;