@wayai/cli 0.3.212 → 0.3.214

package/dist/index.js

@@ -512,7 +512,7 @@ var init_chunk_VORPHGDT = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-POL7B3EM.js
+// ../../packages/core/dist/chunk-P5OUVLFP.js
 function spokenLineField(label, description2) {
   return { type: "text", label, maxLength: SPOKEN_LINE_MAX_CHARS, default: "", description: description2 };
 }
@@ -521,9 +521,9 @@ function byLowercaseName(a, b) {
   const y = b.connector_name.toLowerCase();
   return x < y ? -1 : x > y ? 1 : 0;
 }
-var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, e2b, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeAgentSdk, claudeManagedAgents, rekorMemory, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
-var init_chunk_POL7B3EM = __esm({
-  "../../packages/core/dist/chunk-POL7B3EM.js"() {
+var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, REKOR_TOOLSET_SERVICE_NAME, rekorToolset, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeManagedAgents, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
+var init_chunk_P5OUVLFP = __esm({
+  "../../packages/core/dist/chunk-P5OUVLFP.js"() {
     "use strict";
     CALLER_LANGUAGE = "caller";
     TTS_VOICE_REPLY_ENABLED_FIELD = {
@@ -1285,45 +1285,36 @@ var init_chunk_POL7B3EM = __esm({
       token_refresh_config: { bearer: { strategy: "none" }, oauth: { strategy: "refresh_token_flow", access_token: { refresh_window_hours: 1 }, refresh_token: { has_expiry: false } } },
       connector_description: "Connect to external MCP servers with a Bearer Token or OAuth 2.0 authentication. The protocol revision is negotiated per connection, so stateless (2026-07-28) and older servers both work without configuration."
     };
-    e2b = {
-      connector_id: "cc1bd8ca-e96e-4665-a44c-33223980d8c7",
-      service_name: "E2B",
-      connector_type: "Sandbox",
-      connector_name: "E2B",
-      authentication_types: ["api_key"],
+    REKOR_TOOLSET_SERVICE_NAME = "RekorToolset";
+    rekorToolset = {
+      connector_id: "2cf279bf-29ae-4983-a67f-bf619e391586",
+      service_name: REKOR_TOOLSET_SERVICE_NAME,
+      connector_type: "Tool",
+      tool_variant: "native",
+      connector_name: "Base Toolset",
+      authentication_types: ["bearer"],
       init_endpoint: null,
-      unique_per_hub: true,
+      unique_per_hub: false,
       account_sid_placeholder: null,
       models: null,
-      is_internal: true,
+      is_internal: false,
       is_harness: false,
-      connector_module: "sandbox",
-      // enabled: true — the harness feature has shipped (sandbox driver + durable turn + channel
-      // delivery), so the Sandbox connector is now SELECTABLE. Creating/running an is_harness agent
-      // that uses it is STILL gated by the platform-wide rollout flag
-      // (assertHarnessAllowedForConnection, default-deny), so surfacing it platform-wide is safe: a
-      // Sandbox connection does nothing until a gated harness agent uses it.
-      enabled: true,
+      connector_module: null,
+      enabled: false,
       connector_settings_schema: {
-        region: { type: "text", label: "Region", default: "", description: "E2B region to provision sandboxes in (leave empty for the provider default).", placeholder: "us-east-1" },
-        // Validated at connection write time via a preflight call to E2B with THIS
-        // connection's own credentials — confirms the template exists in the
-        // connection's account and rejects cross-tenant references (PR 1.1).
-        default_template: { type: "text", label: "Default Template", default: "base", description: "E2B template ID new sandboxes start from. Must exist in this connection's own E2B account.", placeholder: "base" },
-        cpu_limit: { type: "number", label: "vCPU Limit", min: 1, max: 8, default: 2, description: "Max vCPUs per sandbox." },
-        memory_limit_mb: { type: "number", label: "Memory (MB)", min: 512, max: 8192, default: 2048, description: "Max memory per sandbox, in MB." }
+        toolset: { type: "text", label: "Toolset", default: "", placeholder: "support", description: "The toolset this connection reaches: its slug, as in its MCP URL (\u2026/t/<slug>/mcp). The token must be bound to it.", required: true }
       },
       agent_settings_schema: null,
       channel_settings_schema: null,
       tool_settings_schema: null,
       connector_credential_schema: {
-        api_key: {
-          connection_display_name: { type: "text", label: "Connection Name", placeholder: "Enter a name for this connection", description: "This name will be used to identify the connection in the system", required: true },
-          api_key: { type: "password", label: "API Key", placeholder: "Enter your E2B API key", description: "Your E2B API key for provisioning sandboxes", required: true, maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_API_KEY__" }
+        bearer: {
+          connection_display_name: { type: "text", label: "Connection Name", placeholder: "Support knowledge", description: "This name will be used to identify the connection in the system", required: true },
+          access_token: { type: "password", label: "Toolset Token", placeholder: "rec_\u2026", description: "An API token bound to this toolset. It must be for a base of this hub's environment: a preview hub holds a preview base's token, a production hub a production base's.", required: true, maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_ACCESS_TOKEN__" }
         }
       },
-      token_refresh_config: { api_key: { strategy: "none" } },
-      connector_description: "Sandboxed Linux compute (Firecracker microVM) for harness agents \u2014 filesystem, shell, package installs, and arbitrary code execution."
+      token_refresh_config: { bearer: { strategy: "none" } },
+      connector_description: "Give agents one toolset of a base: its tools, through a token bound to that toolset."
     };
     CLAUDE_HARNESS_MODELS = ["claude-opus-5-5", "claude-opus-4-8", "claude-opus-4-7", "claude-sonnet-5", "claude-sonnet-4-6", "claude-haiku-4-5"];
     CLAUDE_HARNESS_MODEL_OPTIONS = [{ value: "claude-opus-5-5", label: "Claude Opus 5.5" }, { value: "claude-opus-4-8", label: "Claude Opus 4.8" }, { value: "claude-opus-4-7", label: "Claude Opus 4.7" }, { value: "claude-sonnet-5", label: "Claude Sonnet 5" }, { value: "claude-sonnet-4-6", label: "Claude Sonnet 4.6" }, { value: "claude-haiku-4-5", label: "Claude Haiku 4.5" }];
@@ -1331,57 +1322,8 @@ var init_chunk_POL7B3EM = __esm({
       mcp_servers: { type: "array", itemType: "text", maxItems: 32, label: "MCP Servers", description: "MCP server connection IDs (on this hub) the agent may call from inside the sandbox." }
     };
     HARNESS_EGRESS_FIELDS = {
-      network_egress_policy: { type: "select", label: "Network Egress", options: [{ value: "allowlist", label: "Allowlist (deny-all unless listed)" }, { value: "isolated", label: "Isolated (control host only)" }, { value: "open", label: "Open (internet, SSRF ranges blocked)" }], default: "allowlist", description: "Sandbox egress posture (SSRF gate). Empty allowlist \u21D2 deny-all. The SSRF deny floor holds under every policy." },
-      network_egress_allowlist: { type: "array", itemType: "text", maxItems: 64, label: "Egress Allowlist", description: "Hosts/CIDRs reachable under Allowlist, or the single control host under Isolated. Ignored under Open." }
-    };
-    claudeAgentSdk = {
-      connector_id: "2a492e72-d009-48c5-82dc-57d8f1493b0e",
-      service_name: "ClaudeAgentSdk",
-      connector_type: "Agent",
-      connector_name: "Claude Agent (Sandbox)",
-      authentication_types: ["api_key"],
-      init_endpoint: null,
-      unique_per_hub: false,
-      account_sid_placeholder: null,
-      models: CLAUDE_HARNESS_MODELS,
-      is_internal: true,
-      is_harness: true,
-      connector_module: "harness",
-      enabled: true,
-      connector_settings_schema: null,
-      agent_settings_schema: {
-        model: { type: "select", label: "Model", allowCustomValue: true, options: CLAUDE_HARNESS_MODEL_OPTIONS, default: "claude-sonnet-5", description: "Claude model the in-sandbox agent loop drives.", required: true },
-        sandbox_connection_id: { type: "text", label: "Sandbox Connection", description: "The Sandbox (E2B) connection this agent runs inside. Must be a Sandbox connection on this same hub (re-validated when the session starts).", required: true },
-        base_image: { type: "text", label: "Base Image", description: "Sandbox template/image to boot from. Empty \u21D2 the Sandbox connection's own default template.", placeholder: "base" },
-        skills: { type: "array", itemType: "text", maxItems: 32, label: "Skills", description: "Skill packages to load into the agent (Claude Agent SDK skills)." },
-        ...HARNESS_MCP_SERVERS_FIELD,
-        max_session_minutes: { type: "number", label: "Max Session (minutes)", min: 1, max: 480, default: 60, description: "Hard cap on a single harness session's wall-clock life. The sandbox is reaped at this deadline." },
-        keep_alive_minutes: { type: "number", label: "Keep-Alive (minutes)", min: 0, max: 1440, default: 5, description: "Idle minutes before the sandbox is paused (0 = pause as soon as the turn ends)." },
-        ...HARNESS_EGRESS_FIELDS,
-        // No repo_url/repo_branch here: this sandbox harness never clones a repo (the
-        // runner task carries no repo field and the image runs no clone), so both settings
-        // could only be silently ignored. Same rule as the managed connector — a setting is
-        // ABSENT rather than accepted-and-dropped. Restore them together with an actual
-        // checkout in the runner, never ahead of one.
-        // Phase 4 Track B (shared memory, PR 4.1). Optional: a Memory (Rekor) connection
-        // on this same hub whose Base the agent mounts. WayAI holds the credential and
-        // does the signed I/O (materialize transport) — the credential never enters the
-        // sandbox. Empty memory_connection_id ⇒ no memory. Each mount pins a path prefix
-        // + access mode; WayAI maps hub/org scopes to Rekor paths (paths are opaque to Rekor).
-        memory_connection_id: { type: "text", label: "Memory Connection", description: "Optional Memory (Rekor) connection on this same hub whose Base the agent mounts for durable, cross-agent shared storage. Empty \u21D2 no memory." },
-        memory_mounts: { type: "array", itemType: "text", maxItems: 16, label: "Memory Mounts", description: 'Path mounts from the Memory Base, each `{ "prefix": "\u2026", "mode": "read_only"|"read_write" }` (JSON per item). Empty \u21D2 no memory.' },
-        ...COPILOT_TRIGGER_FIELD
-      },
-      channel_settings_schema: null,
-      tool_settings_schema: null,
-      connector_credential_schema: {
-        api_key: {
-          connection_display_name: { type: "text", label: "Connection Name", placeholder: "Enter a name for this connection", description: "This name will be used to identify the connection in the system", required: true },
-          api_key: { type: "password", label: "API Key", placeholder: "Enter your Anthropic API key", description: "Anthropic API key the in-sandbox agent uses (kept out of the sandbox via the WayAI gateway).", required: true, maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_API_KEY__" }
-        }
-      },
-      token_refresh_config: { api_key: { strategy: "none" } },
-      connector_description: "Harness agent powered by the Claude Agent SDK running in a sandbox (skills, MCP, context compaction). Delegates the full turn to an in-sandbox agent loop. Requires a Sandbox connection + an Anthropic API key."
+      network_egress_policy: { type: "select", label: "Network Egress", options: [{ value: "allowlist", label: "Allowlist (deny-all unless listed)" }, { value: "isolated", label: "Isolated (control host only)" }, { value: "open", label: "Open (internet)" }], default: "allowlist", description: "Sandbox egress posture. Empty allowlist \u21D2 deny-all." },
+      network_egress_allowlist: { type: "array", itemType: "text", maxItems: 64, label: "Egress Allowlist", description: "Hosts reachable under Allowlist, or the single control host under Isolated. Ignored under Open." }
     };
     claudeManagedAgents = {
       connector_id: "4b8eeecf-a835-444a-abed-516d0a29cee2",
@@ -1402,11 +1344,10 @@ var init_chunk_POL7B3EM = __esm({
       agent_settings_schema: {
         model: { type: "select", label: "Model", allowCustomValue: true, options: CLAUDE_HARNESS_MODEL_OPTIONS, default: "claude-sonnet-5", description: "Claude model the Anthropic-hosted managed agent loop drives.", required: true },
         ...HARNESS_MCP_SERVERS_FIELD,
-        // Same numeric bounds as the E2B entry, different semantics: on CMA the
-        // session is conversation-lifetime and is NOT reaped at this deadline.
+        // The managed session is conversation-lifetime and is NOT reaped at this deadline.
         max_session_minutes: { type: "number", label: "Max Turn (minutes)", min: 1, max: 480, default: 60, description: "Hard cap on a single turn's drain wall-clock, and the bound on the per-turn harness token TTL. The managed session itself lives for the conversation \u2014 it is not reaped at this deadline." },
         ...HARNESS_EGRESS_FIELDS,
-        // repo_url only — NOT the shared HARNESS_REPO_FIELDS. The Managed Agents
+        // repo_url only, with no `repo_branch`. The Managed Agents
         // `github_repository` resource exposes no branch/ref/checkout field, so a
         // `repo_branch` setting could not be honoured; per this connector's own rule it is
         // ABSENT rather than silently ignored. Working on a non-default branch is an
@@ -1426,77 +1367,6 @@ var init_chunk_POL7B3EM = __esm({
       token_refresh_config: { api_key: { strategy: "none" } },
       connector_description: "Harness agent powered by Anthropic's Managed Agents API (Beta) \u2014 Anthropic hosts both the agent loop and the sandbox. Delegates the full turn to the managed loop; requires only an Anthropic API key."
     };
-    rekorMemory = {
-      connector_id: "b3f2a7d1-5c48-4e9a-9d20-8a1c6e4f0b93",
-      service_name: "RekorBase",
-      connector_type: "Memory",
-      connector_name: "Rekor Memory",
-      authentication_types: ["api_key"],
-      init_endpoint: null,
-      unique_per_hub: false,
-      account_sid_placeholder: null,
-      models: null,
-      is_internal: true,
-      is_harness: false,
-      connector_module: "memory",
-      enabled: false,
-      connector_settings_schema: {
-        rekor_base_id: { type: "text", label: "Rekor Base ID", default: "", description: "The Rekor Base this memory connection mounts (its storage namespace).", placeholder: "base-\u2026", required: true },
-        // Which INCARNATION of that id this mount was configured against. A base id is a slug its org
-        // can destroy and claim again, so `rekor_base_id` alone names whatever occupies the slug at
-        // read time — and the mount re-derives a credential from it on every harness turn, with no
-        // human in the loop. Sent as a precondition on every derivation
-        // (`DATA_BASE_GENERATION_HEADER`); the data side refuses the request when the id has changed
-        // hands since, so the hub fails loudly instead of silently mounting someone else's store.
-        //
-        // SERVER-OWNED, on every write path without exception. `captureMemoryBaseIncarnation`
-        // (`apps/backend/src/rekor/memory-base-incarnation.ts`) writes this value; a number supplied by a
-        // caller is never honoured, on any ingress. All three write seams run it:
-        // `handleConnectionAddEdit` (console/API) and the two config-as-code seams
-        // (`routes/api/ci/{name-resolver,apply-changes}.ts`), which write `settings` directly.
-        //
-        // Never taken from the caller, and that is the point rather than an implementation detail. A
-        // number a person supplies is a guess about a base they have not read: an author who writes `1`
-        // for a base already on its second incarnation pins a precondition that refuses EVERY harness turn
-        // for that hub, permanently, reported only by a `logger.warn` that never reaches Sentry.
-        //
-        // RESOLVED only on a create, on an actual `rekor_base_id` change, or for a row that stored no
-        // usable value; every other write carries the stored one across untouched. Re-resolving on every
-        // write meant an unattended `wayai push` silently re-pointed a hub at the new occupant of a
-        // recycled Base id. Re-pointing is something an operator asks for by naming a different Base.
-        //
-        // An omitted value still means NO PRECONDITION to the READ side (`configuredBaseGeneration`).
-        // That rule is unchanged, and it still governs rows written before the capture landed and any
-        // other holder of a stored base reference. What changed is that no write path can produce an
-        // omission for a Memory connection any more.
-        //
-        // NO `default`, and no `required: true`, both deliberately. A default would be a statement the
-        // operator did not make about a field whose only correct value comes off the wire; `required`
-        // would make the console form demand a number from the one caller that must NOT be its source.
-        // `min` stays a form hint — the write-side floor is `usableGeneration`, the READ side's own
-        // predicate, so a value the mount would ignore is refused rather than stored.
-        rekor_base_generation: { type: "number", label: "Rekor Base Incarnation", min: 1, description: "Set for you, and not editable in practice: anything typed here is ignored. It records which incarnation of the Base id this mount was configured against, so that if the id is ever destroyed and claimed again, mounting refuses rather than silently binding to a later occupant. It is read when the connection is created and whenever you point it at a different Base \u2014 never on an ordinary save, so a routine edit cannot re-point a mount at whatever now holds the id. If mounting is failing because the Base was recreated, recreate this connection to record the new one." },
-        // The placeholder must be THIS platform's data service: the write path refuses any other origin
-        // (owner decision 2026-08-20 — cross-org / self-hosted mounts are unsupported), so suggesting the
-        // retired `api.rekor.pro` offered operators a value that would be rejected on sight. The pinned
-        // hostname is `data.wayai.pro`; the deployment's own value is `REKOR_PUBLIC_ORIGIN`.
-        endpoint: { type: "text", label: "Endpoint", default: "", description: "This platform's data service origin (or its /s3 facade base). Must be the platform's own \u2014 a connection pointing anywhere else is refused, because the Base recorded when you save would not be the one the agent reads.", placeholder: "https://data.wayai.pro", required: true },
-        default_file_type: { type: "text", label: "Default File Type", default: "", description: "Default Rekor Bucket (file_type) to mount when a mount does not name one.", placeholder: "kb" }
-      },
-      agent_settings_schema: null,
-      channel_settings_schema: null,
-      tool_settings_schema: null,
-      connector_credential_schema: {
-        api_key: {
-          connection_display_name: { type: "text", label: "Connection Name", placeholder: "Enter a name for this connection", description: "This name will be used to identify the connection in the system", required: true },
-          // The Rekor `rec_` Bearer token. A SECRET — WayAI mints scoped, short-TTL S3
-          // credentials from it in the Worker and never injects it into the sandbox.
-          api_key: { type: "password", label: "API Token", placeholder: "rec_\u2026", description: "Rekor API token (rec_\u2026) with read:files (and write:files for read_write mounts) on the Base. Used server-side only to mint scoped S3 mount credentials.", required: true, maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_API_KEY__" }
-        }
-      },
-      token_refresh_config: { api_key: { strategy: "none" } },
-      connector_description: "Durable, shared cross-agent memory backed by a Rekor Base (S3-compatible). Harness agents mount it read-only or read-write; WayAI holds the credential and performs the signed I/O so it never enters the sandbox."
-    };
     SPOKEN_LINE_MAX_CHARS = 300;
     gptLive = {
       connector_id: "01e7b19c-bc94-43f4-a780-ad5a22fb7127",
@@ -1551,9 +1421,7 @@ var init_chunk_POL7B3EM = __esm({
     CONNECTORS = [
       anthropic,
       apiChannel,
-      claudeAgentSdk,
       claudeManagedAgents,
-      e2b,
       elevenLabsStt,
       elevenLabsTts,
       externalResources,
@@ -1568,10 +1436,10 @@ var init_chunk_POL7B3EM = __esm({
       openai,
       openaiStt,
       openaiTts,
-      rekorMemory,
       resend,
       telegram,
       restApiTool,
+      rekorToolset,
       wayai,
       whatsapp,
       xai
@@ -6684,14 +6552,14 @@ var init_chunk_3NS3HULK = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-JWPRTSIB.js
+// ../../packages/core/dist/chunk-DHPUPI4Y.js
 function normalizeAuthType(raw) {
   if (VALID_AUTH_TYPES.has(raw)) return raw;
   return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
 }
-var AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SKILL_INSTALL_COMMAND;
-var init_chunk_JWPRTSIB = __esm({
-  "../../packages/core/dist/chunk-JWPRTSIB.js"() {
+var AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, PILOT_TRACK_ROLES, CUSTOMER_FACING_AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SKILL_INSTALL_COMMAND;
+var init_chunk_DHPUPI4Y = __esm({
+  "../../packages/core/dist/chunk-DHPUPI4Y.js"() {
     "use strict";
     AUTH_TYPE = {
       OAUTH: "oauth",
@@ -6736,6 +6604,8 @@ var init_chunk_JWPRTSIB = __esm({
       "consultant",
       "pilot_voice"
     ];
+    PILOT_TRACK_ROLES = ["pilot", "pilot_specialist"];
+    CUSTOMER_FACING_AGENT_ROLES = [...PILOT_TRACK_ROLES, "pilot_advisor"];
     SAFE_USER_ID_REGEX = /^[A-Za-z0-9_-]{1,64}$/;
     SUPPORTED_LOCALES = ["en", "pt", "es"];
     SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
@@ -6920,7 +6790,7 @@ var init_chunk_T7KQKDET = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-YV4TZ2HR.js
+// ../../packages/core/dist/chunk-XFKJHZ4E.js
 function containsKanbanPlaceholders(value) {
   if (value == null) return false;
   const serialized = typeof value === "string" ? value : JSON.stringify(value);
@@ -8230,8 +8100,8 @@ function refineHubAsCodeMonitorRulesOutput(config, ctx) {
   });
 }
 var PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, uuidSchema, USER_ID_REGEX, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, MESSAGE_ENVELOPE_HEADROOM_BYTES, MAX_AUDIO_FILE_BASE64_BYTES, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupTypeSchema, EVENT_RELATIVE_FOLLOWUP_TYPES, followupTimeUnitSchema, followupIdSchema, SELECTABLE_FOLLOWUP_TYPES, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS, followupSchema, MAX_OUTCOMES_PER_STATUS, kanbanOutcomeSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, HUB_DISPLAY_NAME_MAX_CHARS, HUB_WELCOME_MESSAGE_MAX_CHARS, HUB_STARTER_QUESTIONS_MAX, HUB_STARTER_QUESTION_MAX_CHARS, displayName, welcomeMessage, starterQuestions, hubDisplayNamesSchema, hubWelcomeMessagesSchema, hubStarterQuestionsSchema, hubDisplayNamesField, hubWelcomeMessagesField, hubStarterQuestionsField, HUB_PRESENTATION_FIELDS, HUB_PRESENTATION_SCHEMAS, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, HUB_USERS_PAGE_SIZE_MAX, HUB_USERS_SEARCH_MAX, HUB_USERS_CHANNEL_TYPES, getHubUsersQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, MAX_EVAL_RETENTION_DAYS, MAX_END_USER_DAILY_MESSAGE_LIMIT, endUserDailyMessageLimitField, previewLabelField, hubTagsField, createHubBody, updateHubBody, HUB_TAG_CHANGE_REFUSED, hubTagChangeRefusalSchema, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, CONTACT_ACCESS_PAGE_SIZE_MAX, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, HUB_DIFF_SECTION_SET, HUB_DIFF_SECTIONS, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, PREVIOUS_CONVERSATIONS_MAX, NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, AUTOMATION_GATE_TRIGGERS, NON_FIRING_TRIGGERS, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, MONITOR_GATE_AGENT_NAME_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, MONITOR_AUTOMATION_FIRE_ACTION_KINDS, MONITOR_AUTOMATION_ITEM_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE, AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE, AUTOMATION_GATE_KEY_MESSAGES, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, evalDateContextSchema, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, runJourneyQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, evalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT, MAX_RESOURCE_FILE_SIZE, CALL_OPENING_LANGUAGES, callOpeningLanguage, CALL_OPENING_MAX_DURATION_MS, CALL_OPENING_MAX_BYTES, CALL_OPENING_CAPTION_MAX_CHARS, CALL_OPENING_CONTENT_TYPES, callOpeningContentType, CALL_OPENING_HASH_REGEX, callOpeningHash, callOpeningCaption, storedCallOpening, MAX_CALL_OPENING_ENCODED_BYTES, MAX_CALL_OPENING_BODY_BYTES, agentCallOpeningParams, putAgentCallOpeningBody, deleteAgentCallOpeningQuery, callOpeningParam, callOpeningQuery, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
-var init_chunk_YV4TZ2HR = __esm({
-  "../../packages/core/dist/chunk-YV4TZ2HR.js"() {
+var init_chunk_XFKJHZ4E = __esm({
+  "../../packages/core/dist/chunk-XFKJHZ4E.js"() {
     "use strict";
     init_chunk_SNA2DXAC();
     init_chunk_MIWZOSPI();
@@ -8239,7 +8109,7 @@ var init_chunk_YV4TZ2HR = __esm({
     init_chunk_2ISUBJG7();
     init_chunk_C2UEA2KW();
     init_chunk_3NS3HULK();
-    init_chunk_JWPRTSIB();
+    init_chunk_DHPUPI4Y();
     init_chunk_T7KQKDET();
     init_chunk_L5F7ZOUJ();
     init_zod();
@@ -9726,7 +9596,7 @@ var init_chunk_YV4TZ2HR = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-GI5ELTXF.js
+// ../../packages/core/dist/chunk-EKPXHJ4G.js
 function cacheReconcileIdCount(body) {
   return body.conversations.length + body.histories.reduce((n, history) => n + history.conversation_ids.length, 0) + body.threads.length;
 }
@@ -9792,16 +9662,16 @@ function communityLessonVideoWatchUrl(video) {
       return `https://www.youtube.com/watch?v=${video.id}`;
   }
 }
-var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, CALL_STATUSES, callStatus, CALL_END_REASONS, callEndReason, CALL_TRANSPORTS, callTransport, CALL_PARTICIPANT_TYPES, callParticipantType, callInstant, MAX_SDP_OFFER_LENGTH, sdpDescription, sdpOffer, MAX_CALL_REQUEST_BODY_BYTES, hubScoped, callSummaryFields, callSummary, callIdParam, createCallBody, createCallResponse, callReadyBody, callHangupBody, callStatusQuery, MAX_REPORTED_DELEGATION_IDS, callDelegationId, callDelegationsBody, callResponse, MAX_CALL_RECORDING_GAPS, callRecordingGap, callRecordingNoteMetadata, evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, recordAiDisclosureAcceptanceBody, activityQuery, deletionModeSchema, deletionRequestBody, CACHE_RECONCILE_MAX_IDS, CACHE_RECONCILE_MAX_HUBS, cacheReconcileScopeSchema, cachedConversationPageSchema, cachedHistoryThreadSchema, cachedPeopleThreadSchema, cacheReconcileBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, planKeySchema, billingStatusSchema, paidTierSchema, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, changeTierBody, updateBillingCurrencyBody, invoicesQuery, billingPlanTypeSchema, dataUsageCountersSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, SIGN_URL_MAX_EXPIRES_IN_SECONDS, signUrlBody, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, CONTACT_ENVIRONMENTS, CONTACT_NAME_MAX, CONTACT_EMAIL_MAX, CONTACT_PHONE_INPUT_MAX, CONTACT_INSTAGRAM_SID_MAX, CONTACT_METADATA_MAX_BYTES, CONTACT_LABEL_MAX, CONTACT_LABELS_MAX, CONTACT_SCOPE_TAGS_MAX, CONTACT_PAGE_MAX, CONTACT_IMPORT_BATCH_MAX, CONTACT_SEARCH_MAX, CONTACT_LIST_NAME_MAX, CONTACT_LIST_NAME_REGEX, CONTACT_LIST_DESCRIPTION_MAX, CONTACT_LIST_FILTER_MAX, CONTACT_LIST_PINS_PER_REQUEST_MAX, SUPPRESSION_SCOPES, SUPPRESSION_ID_REGEX, contactName, contactPhone, contactEmail, contactInstagramSid, contactLabel, contactLabels, contactMetadata, scopeTagIds, contactVisibilitySchema, hasIdentity, IDENTITY_REQUIRED, contactBookOrgQuery, contactBookContactParam, contactBookListParam, contactBookHubParam, contactBookPageQuery, listContactBookContactsQuery, listHubContactBookContactsQuery, contactBookLinkCandidatesQuery, listContactBookListMembersQuery, contactRowFields, createContactBookContactBody, updateContactBookContactBody, contactImportRowSchema, importContactBookContactsBody, linkContactBookContactBody, listName, contactListFilterSchema, createContactBookListBody, updateContactBookListBody, updateContactBookListPinsBody, suppressionIdentitySchema, createContactBookSuppressionBody, contactBookSuppressionParam, listContactBookSuppressionsQuery, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, contactBookEmailUnsubscribeTokenSchema, contactBookEmailUnsubscribeQuery, orgListReferenceSchema, hubListNameSchema, HUB_LIST_FILTER_REQUIRED, hubContactListFilterSchema, hubContactListIdParam, hubContactListHubQuery, description, createHubContactListBody, updateHubContactListBody, AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, AUTOMATION_WEBHOOK_MOUNT, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam, VERSION_PART, MOBILE_APP_VERSION_RE, mobileAppVersionSchema, MOBILE_PLATFORMS, mobilePlatformSchema, mobileVersionPolicyQuery, mobileVersionPolicySchema, mobileVersionPolicyResponse, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, META_ENTITY_ID_PATTERN, metaEntityId, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, invitePreviewQuery, inviteRolePreviewResponse, inviteContactPreviewResponse, invitePreviewResponse, inviteUnsubscribeBody, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, baseDestructionConfirmBody, BASE_DESTRUCTION_GRACE_MS, BASE_DESTRUCTION_CONFIRM_TTL_MS, BASE_DESTRUCTION_ORG_QUERY_PARAM, baseDestructionQuery, baseDestructionParam, baseDestructionInitiateBody, baseDestructionStatus, baseDestructionRequest, baseDestructionListResponse, baseDestructionInitiateResponse, baseDestructionConfirmResponse, baseDestructionCancelResponse, rekorBaseChangeMessageSchema, PEOPLE_CONTACT_PAGE_MAX, PEOPLE_CONTACT_PAGE_DEFAULT, PEOPLE_CONTACT_EMAIL_MAX_LENGTH, peopleUserIdSchema, peopleInviteEmailSchema, peopleContactInviteBody, peopleContactInviteIdParam, peopleContactUserIdParam, peopleContactBlockBody, peopleContactPageQuery, peopleOutgoingInviteSchema, peopleContactPersonSchema, peopleContactSchema, peopleIncomingInviteSchema, peopleBlockedUserSchema, PEOPLE_THREAD_MESSAGE_MAX_LENGTH, PEOPLE_THREAD_MESSAGES_PAGE_MAX, PEOPLE_THREAD_PAGE_MAX, PEOPLE_THREAD_PAGE_DEFAULT, PEOPLE_GROUP_NAME_MAX_LENGTH, PEOPLE_GROUP_AVATAR_URL_MAX_LENGTH, PEOPLE_THREAD_ATTACHMENT_MAX_BYTES, PEOPLE_THREAD_ATTACHMENT_NAME_MAX_LENGTH, PEOPLE_ATTACHMENT_STORAGE_PER_USER_BYTES, PEOPLE_THREAD_ATTACHMENT_MAX_MB, PEOPLE_THREAD_ATTACHMENT_URL_TTL_SECONDS, PEOPLE_THREAD_ATTACHMENT_URLS_MAX, peopleThreadIdParam, peopleThreadMessageIdParam, peopleThreadListQuery, peopleThreadMessagesQuery, peopleThreadAttachmentUploadSchema, peopleThreadSendBody, peopleThreadAttachmentUrlsBody, peopleThreadReadBody, peopleThreadSettingsBody, peopleGroupNameSchema, peopleGroupAvatarUrlSchema, peopleGroupCreateBody, peopleOrgDirectBody, peopleGroupUpdateBody, peopleGroupInviteBody, peopleOrgErasureBody, peopleGroupLeaveBody, peopleGroupInviteIdParam, peopleGroupIncomingInviteIdParam, peopleGroupMemberParam, peopleThreadKindSchema, peopleThreadMemberSchema, peopleThreadLastMessageSchema, peopleGroupRoleSchema, peopleGroupSummarySchema, peopleThreadSummarySchema, peopleThreadAttachmentSchema, peopleThreadMessageSchema, peopleGroupMemberSchema, peopleGroupSentInviteSchema, peopleGroupIncomingInviteSchema, PEOPLE_REPORT_DETAILS_MAX_LENGTH, peopleReportReasonSchema, reportDetailsSchema, reportFields, peopleReportBody, PEOPLE_MODERATION_NOTE_MAX_LENGTH, ADMIN_PEOPLE_REPORTS_PAGE_MAX, ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT, PEOPLE_SUSPENDED_REASON, peopleModerationActionSchema, moderationNoteSchema, adminPeopleReportListQuery, adminPeopleReportIdParam, adminPeopleMessageRemovalBody, adminPeopleSuspendBody, adminPeopleNoteBody, COMMUNITIES_PER_ORG_MAX, COMMUNITY_NAME_MAX_LENGTH, COMMUNITY_REGISTRY_CLOSED_REASON, COMMUNITY_MEMBERS_MAX, COMMUNITY_ADMISSIONS, COMMUNITY_ACCESS_MAX, COMMUNITY_ACCESS_ADD_MAX, COMMUNITY_ACCESS_FULL_REASON, COMMUNITY_JOIN_SOURCE_MAX_LENGTH, COMMUNITY_JOIN_FLOW_TOKEN_MAX_LENGTH, COMMUNITY_ROOMS_MAX, COMMUNITY_ROOM_NAME_MAX_LENGTH, COMMUNITY_MESSAGE_MAX_LENGTH, COMMUNITY_MESSAGES_PAGE_SIZE, COMMUNITY_ATTACHMENT_URLS_MAX, COMMUNITY_POST_TITLE_MAX_LENGTH, COMMUNITY_POST_SEARCH_MAX_LENGTH, COMMUNITY_MEMBER_STATUSES, COMMUNITY_RULES_MAX_LENGTH, COMMUNITY_SLOW_MODE_MAX_SECONDS, COMMUNITY_COURSES_LABEL_MAX_LENGTH, COMMUNITY_LIVE_TICKET_PREFIX, COMMUNITY_STATS_DAYS, communityNameSchema, adminCreateCommunityBody, communityIdParam, communityJoinTokenSchema, communityJoinSourceSchema, communityJoinPreviewQuery, communityJoinBody, communityRoomKindSchema, communityRoomNameSchema, communityRoomIdParam, communityMessageIdParam, communityRoomCreateBody, communityRoomUpdateBody, communityMessagesQuery, communityMessageBodySchema, communityPostTitleSchema, communityAttachmentUploadSchema, communitySendBody, communityEditBody, communityPostIdParam, communityPostsQuery, communityAnswerBody, communityReadBody, communityAttachmentUrlsBody, communityPersonParam, communityOrgParam, communityPeopleQuery, communityCoursesLabelSchema, communityAdmissionSchema, communitySettingsBody, communityAccessEmailSchema, communityAccessAddBody, communityAccessQuery, communityAccessIdParam, communityBanBody, communityLockBody, communityPinBody, communityModLogQuery, communityReportsQuery, communityReportIdParam, communityLiveTicketSchema, communityLiveQuery, communityMuteBody, communityEmailUnsubscribeTokenSchema, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, communityEmailUnsubscribeQuery, COMMUNITY_COURSES_MAX, COMMUNITY_COURSE_MODULES_MAX, COMMUNITY_COURSE_LESSONS_MAX, COMMUNITY_LESSONS_MAX, COMMUNITY_COURSE_TITLE_MAX_LENGTH, COMMUNITY_COURSE_DESCRIPTION_MAX_LENGTH, COMMUNITY_LESSON_BODY_MAX_LENGTH, COMMUNITY_LESSON_LINKS_MAX, COMMUNITY_LESSON_URL_MAX_LENGTH, YOUTUBE_ID, YOUTUBE_HOSTS, YOUTU_BE, YOUTUBE_ID_PATH, communityCourseIdParam, communityCourseModuleIdParam, communityLessonIdParam, communityCourseTitleSchema, communityCourseDescriptionSchema, communityCoursePositionSchema, communityLessonVideoUrlSchema, communityLessonLinkSchema, communityLessonLinksSchema, communityLessonBodySchema, communityCourseCreateBody, communityCourseUpdateBody, communityModuleCreateBody, communityModuleUpdateBody, communityLessonCreateBody, communityLessonUpdateBody, COMMUNITY_LESSON_TREE_MAX_BYTES, COMMUNITY_LESSON_LINK_PROTOCOLS, COMMUNITY_LESSON_TREE_TOO_LARGE_REASON, COMMUNITY_LESSON_TREE_TOO_DEEP_REASON, COMMUNITY_LESSON_LINE_PREFIX_TOO_WIDE_REASON, LINK_SCHEME, adminSetGuideHubBody, GUIDE_HUB_INELIGIBLE_REASON;
-var init_chunk_GI5ELTXF = __esm({
-  "../../packages/core/dist/chunk-GI5ELTXF.js"() {
+var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, CALL_STATUSES, callStatus, CALL_END_REASONS, callEndReason, CALL_TRANSPORTS, callTransport, CALL_PARTICIPANT_TYPES, callParticipantType, callInstant, MAX_SDP_OFFER_LENGTH, sdpDescription, sdpOffer, MAX_CALL_REQUEST_BODY_BYTES, hubScoped, callSummaryFields, callSummary, callIdParam, createCallBody, createCallResponse, callReadyBody, callHangupBody, callStatusQuery, MAX_REPORTED_DELEGATION_IDS, callDelegationId, callDelegationsBody, callResponse, MAX_CALL_RECORDING_GAPS, callRecordingGap, callRecordingNoteMetadata, evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, recordAiDisclosureAcceptanceBody, activityQuery, deletionModeSchema, deletionRequestBody, CACHE_RECONCILE_MAX_IDS, CACHE_RECONCILE_MAX_HUBS, cacheReconcileScopeSchema, cachedConversationPageSchema, cachedHistoryThreadSchema, cachedPeopleThreadSchema, cacheReconcileBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, planKeySchema, billingStatusSchema, paidTierSchema, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, changeTierBody, updateBillingCurrencyBody, invoicesQuery, billingPlanTypeSchema, dataUsageCountersSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, SIGN_URL_MAX_EXPIRES_IN_SECONDS, signUrlBody, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, CONTACT_ENVIRONMENTS, CONTACT_NAME_MAX, CONTACT_EMAIL_MAX, CONTACT_PHONE_INPUT_MAX, CONTACT_INSTAGRAM_SID_MAX, CONTACT_METADATA_MAX_BYTES, CONTACT_LABEL_MAX, CONTACT_LABELS_MAX, CONTACT_SCOPE_TAGS_MAX, CONTACT_PAGE_MAX, CONTACT_IMPORT_BATCH_MAX, CONTACT_SEARCH_MAX, CONTACT_LIST_NAME_MAX, CONTACT_LIST_NAME_REGEX, CONTACT_LIST_DESCRIPTION_MAX, CONTACT_LIST_FILTER_MAX, CONTACT_LIST_PINS_PER_REQUEST_MAX, SUPPRESSION_SCOPES, SUPPRESSION_ID_REGEX, contactName, contactPhone, contactEmail, contactInstagramSid, contactLabel, contactLabels, contactMetadata, scopeTagIds, contactVisibilitySchema, hasIdentity, IDENTITY_REQUIRED, contactBookOrgQuery, contactBookContactParam, contactBookListParam, contactBookHubParam, contactBookPageQuery, listContactBookContactsQuery, listHubContactBookContactsQuery, contactBookLinkCandidatesQuery, listContactBookListMembersQuery, contactRowFields, createContactBookContactBody, updateContactBookContactBody, contactImportRowSchema, importContactBookContactsBody, linkContactBookContactBody, listName, contactListFilterSchema, createContactBookListBody, updateContactBookListBody, updateContactBookListPinsBody, suppressionIdentitySchema, createContactBookSuppressionBody, contactBookSuppressionParam, listContactBookSuppressionsQuery, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, contactBookEmailUnsubscribeTokenSchema, contactBookEmailUnsubscribeQuery, orgListReferenceSchema, hubListNameSchema, HUB_LIST_FILTER_REQUIRED, hubContactListFilterSchema, hubContactListIdParam, hubContactListHubQuery, description, createHubContactListBody, updateHubContactListBody, AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, AUTOMATION_WEBHOOK_MOUNT, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam, VERSION_PART, MOBILE_APP_VERSION_RE, mobileAppVersionSchema, MOBILE_PLATFORMS, mobilePlatformSchema, mobileVersionPolicyQuery, mobileVersionPolicySchema, mobileVersionPolicyResponse, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, TURN_DEADLINE_SECONDS_FLOOR, TURN_DEADLINE_SECONDS_MAX, turnDeadlineSeconds, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, META_ENTITY_ID_PATTERN, metaEntityId, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, normalizeEmail, REVIEW_ACCOUNT_EMAILS, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, invitePreviewQuery, inviteRolePreviewResponse, inviteContactPreviewResponse, invitePreviewResponse, inviteUnsubscribeBody, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, baseDestructionConfirmBody, BASE_DESTRUCTION_GRACE_MS, BASE_DESTRUCTION_CONFIRM_TTL_MS, BASE_DESTRUCTION_ORG_QUERY_PARAM, baseDestructionQuery, baseDestructionParam, baseDestructionInitiateBody, baseDestructionStatus, baseDestructionRequest, baseDestructionListResponse, baseDestructionInitiateResponse, baseDestructionConfirmResponse, baseDestructionCancelResponse, rekorBaseChangeMessageSchema, baseEnvironmentSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorResolvedToolsetSchema, PEOPLE_CONTACT_PAGE_MAX, PEOPLE_CONTACT_PAGE_DEFAULT, PEOPLE_CONTACT_EMAIL_MAX_LENGTH, peopleUserIdSchema, peopleInviteEmailSchema, peopleContactInviteBody, peopleContactInviteIdParam, peopleContactUserIdParam, peopleContactBlockBody, peopleContactPageQuery, peopleOutgoingInviteSchema, peopleContactPersonSchema, peopleContactSchema, peopleIncomingInviteSchema, peopleBlockedUserSchema, PEOPLE_THREAD_MESSAGE_MAX_LENGTH, PEOPLE_THREAD_MESSAGES_PAGE_MAX, PEOPLE_THREAD_PAGE_MAX, PEOPLE_THREAD_PAGE_DEFAULT, PEOPLE_GROUP_NAME_MAX_LENGTH, PEOPLE_GROUP_AVATAR_URL_MAX_LENGTH, PEOPLE_THREAD_ATTACHMENT_MAX_BYTES, PEOPLE_THREAD_ATTACHMENT_NAME_MAX_LENGTH, PEOPLE_ATTACHMENT_STORAGE_PER_USER_BYTES, PEOPLE_THREAD_ATTACHMENT_MAX_MB, PEOPLE_THREAD_ATTACHMENT_URL_TTL_SECONDS, PEOPLE_THREAD_ATTACHMENT_URLS_MAX, peopleThreadIdParam, peopleThreadMessageIdParam, peopleThreadListQuery, peopleThreadMessagesQuery, peopleThreadAttachmentUploadSchema, peopleThreadSendBody, peopleThreadAttachmentUrlsBody, peopleThreadReadBody, peopleThreadSettingsBody, peopleGroupNameSchema, peopleGroupAvatarUrlSchema, peopleGroupCreateBody, peopleOrgDirectBody, peopleGroupUpdateBody, peopleGroupInviteBody, peopleOrgErasureBody, peopleGroupLeaveBody, peopleGroupInviteIdParam, peopleGroupIncomingInviteIdParam, peopleGroupMemberParam, peopleThreadKindSchema, peopleThreadMemberSchema, peopleThreadLastMessageSchema, peopleGroupRoleSchema, peopleGroupSummarySchema, peopleThreadSummarySchema, peopleThreadAttachmentSchema, peopleThreadMessageSchema, peopleGroupMemberSchema, peopleGroupSentInviteSchema, peopleGroupIncomingInviteSchema, PEOPLE_REPORT_DETAILS_MAX_LENGTH, peopleReportReasonSchema, reportDetailsSchema, reportFields, peopleReportBody, PEOPLE_MODERATION_NOTE_MAX_LENGTH, ADMIN_PEOPLE_REPORTS_PAGE_MAX, ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT, PEOPLE_SUSPENDED_REASON, peopleModerationActionSchema, moderationNoteSchema, adminPeopleReportListQuery, adminPeopleReportIdParam, adminPeopleMessageRemovalBody, adminPeopleSuspendBody, adminPeopleNoteBody, COMMUNITIES_PER_ORG_MAX, COMMUNITY_NAME_MAX_LENGTH, COMMUNITY_REGISTRY_CLOSED_REASON, COMMUNITY_MEMBERS_MAX, COMMUNITY_ADMISSIONS, COMMUNITY_ACCESS_MAX, COMMUNITY_ACCESS_ADD_MAX, COMMUNITY_ACCESS_FULL_REASON, COMMUNITY_JOIN_SOURCE_MAX_LENGTH, COMMUNITY_JOIN_FLOW_TOKEN_MAX_LENGTH, COMMUNITY_ROOMS_MAX, COMMUNITY_ROOM_NAME_MAX_LENGTH, COMMUNITY_MESSAGE_MAX_LENGTH, COMMUNITY_MESSAGES_PAGE_SIZE, COMMUNITY_ATTACHMENT_URLS_MAX, COMMUNITY_POST_TITLE_MAX_LENGTH, COMMUNITY_POST_SEARCH_MAX_LENGTH, COMMUNITY_MEMBER_STATUSES, COMMUNITY_RULES_MAX_LENGTH, COMMUNITY_SLOW_MODE_MAX_SECONDS, COMMUNITY_COURSES_LABEL_MAX_LENGTH, COMMUNITY_LIVE_TICKET_PREFIX, COMMUNITY_STATS_DAYS, communityNameSchema, adminCreateCommunityBody, communityIdParam, communityJoinTokenSchema, communityJoinSourceSchema, communityJoinPreviewQuery, communityJoinBody, communityRoomKindSchema, communityRoomNameSchema, communityRoomIdParam, communityMessageIdParam, communityRoomCreateBody, communityRoomUpdateBody, communityMessagesQuery, communityMessageBodySchema, communityPostTitleSchema, communityAttachmentUploadSchema, communitySendBody, communityEditBody, communityPostIdParam, communityPostsQuery, communityAnswerBody, communityReadBody, communityAttachmentUrlsBody, communityPersonParam, communityOrgParam, communityPeopleQuery, communityCoursesLabelSchema, communityAdmissionSchema, communitySettingsBody, communityAccessEmailSchema, communityAccessAddBody, communityAccessQuery, communityAccessIdParam, communityBanBody, communityLockBody, communityPinBody, communityModLogQuery, communityReportsQuery, communityReportIdParam, communityLiveTicketSchema, communityLiveQuery, communityMuteBody, communityEmailUnsubscribeTokenSchema, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, communityEmailUnsubscribeQuery, COMMUNITY_COURSES_MAX, COMMUNITY_COURSE_MODULES_MAX, COMMUNITY_COURSE_LESSONS_MAX, COMMUNITY_LESSONS_MAX, COMMUNITY_COURSE_TITLE_MAX_LENGTH, COMMUNITY_COURSE_DESCRIPTION_MAX_LENGTH, COMMUNITY_LESSON_BODY_MAX_LENGTH, COMMUNITY_LESSON_LINKS_MAX, COMMUNITY_LESSON_URL_MAX_LENGTH, YOUTUBE_ID, YOUTUBE_HOSTS, YOUTU_BE, YOUTUBE_ID_PATH, communityCourseIdParam, communityCourseModuleIdParam, communityLessonIdParam, communityCourseTitleSchema, communityCourseDescriptionSchema, communityCoursePositionSchema, communityLessonVideoUrlSchema, communityLessonLinkSchema, communityLessonLinksSchema, communityLessonBodySchema, communityCourseCreateBody, communityCourseUpdateBody, communityModuleCreateBody, communityModuleUpdateBody, communityLessonCreateBody, communityLessonUpdateBody, COMMUNITY_LESSON_TREE_MAX_BYTES, COMMUNITY_LESSON_LINK_PROTOCOLS, COMMUNITY_LESSON_TREE_TOO_LARGE_REASON, COMMUNITY_LESSON_TREE_TOO_DEEP_REASON, COMMUNITY_LESSON_LINE_PREFIX_TOO_WIDE_REASON, LINK_SCHEME, adminSetGuideHubBody, GUIDE_HUB_INELIGIBLE_REASON;
+var init_chunk_EKPXHJ4G = __esm({
+  "../../packages/core/dist/chunk-EKPXHJ4G.js"() {
     "use strict";
     init_chunk_VORPHGDT();
-    init_chunk_POL7B3EM();
-    init_chunk_YV4TZ2HR();
+    init_chunk_P5OUVLFP();
+    init_chunk_XFKJHZ4E();
     init_chunk_MIWZOSPI();
     init_chunk_3NS3HULK();
-    init_chunk_JWPRTSIB();
+    init_chunk_DHPUPI4Y();
     init_chunk_T7KQKDET();
     init_zod();
     init_zod();
@@ -11811,6 +11681,9 @@ var init_chunk_GI5ELTXF = __esm({
     automationGateEvaluationsPerOperation = external_exports.number().int().min(1).max(AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND);
     AUTOMATION_RUN_RETENTION_DAYS_MAX = 3650;
     automationRunRetentionDays = external_exports.number().int().min(1).max(AUTOMATION_RUN_RETENTION_DAYS_MAX);
+    TURN_DEADLINE_SECONDS_FLOOR = 300;
+    TURN_DEADLINE_SECONDS_MAX = 840;
+    turnDeadlineSeconds = external_exports.number().int().min(TURN_DEADLINE_SECONDS_FLOOR).max(TURN_DEADLINE_SECONDS_MAX);
     updatePlatformConfigBody = external_exports.object({
       free_plan_max_free_orgs_per_user: external_exports.number().int().min(0).optional(),
       /** Kill switch for admin debug-read endpoints. 0 = off, 1 = on. */
@@ -11854,6 +11727,8 @@ var init_chunk_GI5ELTXF = __esm({
       automation_gate_evaluations_per_operation: automationGateEvaluationsPerOperation.optional(),
       /** How many days a hub keeps an automation's runs (`automationRunRetentionDays`). */
       automation_run_retention_days: automationRunRetentionDays.optional(),
+      /** How long a native agent turn may run (`turnDeadlineSeconds`). */
+      turn_deadline_seconds: turnDeadlineSeconds.optional(),
       /**
        * The mobile app version policy (`MOBILE_VERSION_POLICY_COLUMNS`), per platform: an install
        * below the minimum is blocked until it updates from the store; one below the recommended
@@ -12052,31 +11927,6 @@ var init_chunk_GI5ELTXF = __esm({
     debugMessageIdQuery = external_exports.object({
       message_id: debugUuid.optional()
     });
-    sandboxEgressPolicy = external_exports.enum(["open", "allowlist", "isolated"]);
-    SANDBOX_EXEC_MAX_CMD_LENGTH = 4096;
-    SANDBOX_EXEC_MAX_ALLOWLIST = 64;
-    SANDBOX_EXEC_MAX_TIMEOUT_MS = 3e5;
-    adminSandboxExecBody = external_exports.object({
-      /** Hub owning the E2B Sandbox connection whose credential we resolve. */
-      hub_id: uuidSchema,
-      /** The Sandbox (E2B) connection to source the api_key from. */
-      connection_id: uuidSchema,
-      /** Shell command to run in the sandbox. Required, bounded length. */
-      cmd: external_exports.string().min(1, "cmd is required").max(SANDBOX_EXEC_MAX_CMD_LENGTH, `cmd must be <= ${SANDBOX_EXEC_MAX_CMD_LENGTH} chars`),
-      /**
-       * Egress posture. Omitted ⇒ the driver fails closed to deny-all outbound (the
-       * safe default). The route re-validates the (policy, allowlist) pair via
-       * `validateEgressConfig`.
-       */
-      egress_policy: sandboxEgressPolicy.optional(),
-      /**
-       * Hosts/CIDRs reachable under `allowlist` (or the single control host under
-       * `isolated`). Ignored under `open`. Bounded count.
-       */
-      egress_allowlist: external_exports.array(external_exports.string().min(1).max(253)).max(SANDBOX_EXEC_MAX_ALLOWLIST, `at most ${SANDBOX_EXEC_MAX_ALLOWLIST} allowlist entries`).optional(),
-      /** Sandbox wall-clock lifetime in ms (bounded). */
-      timeout_ms: external_exports.number().int().min(1).max(SANDBOX_EXEC_MAX_TIMEOUT_MS).optional()
-    });
     META_ENTITY_ID_PATTERN = /^\d{1,32}$/;
     metaEntityId = external_exports.string().regex(META_ENTITY_ID_PATTERN, "must be a numeric Meta entity id");
     whatsappCallbackBody = external_exports.object({
@@ -12141,6 +11991,12 @@ var init_chunk_GI5ELTXF = __esm({
       password: external_exports.string().min(1, "Password is required").max(128)
       // bound the payload; WorkOS validates
     });
+    normalizeEmail = (email) => email.trim().toLowerCase();
+    REVIEW_ACCOUNT_EMAILS = new Set(
+      ["apple.review@wayai.pro", "play.review@wayai.pro", "microsoft.review@wayai.pro", "meta.review@wayai.pro"].map(
+        normalizeEmail
+      )
+    );
     stateOperationBody = external_exports.object({
       hub_id: external_exports.string().uuid(),
       operation: external_exports.enum(["get", "update", "set_path", "reset"]),
@@ -12611,6 +12467,46 @@ var init_chunk_GI5ELTXF = __esm({
       /** Which pane refetches. `base` covers create/delete/promote/config changes. */
       scope: external_exports.enum(["records", "record_types", "files", "base"])
     });
+    baseEnvironmentSchema = external_exports.enum(["preview", "production"]);
+    toolsetSurfaceSchema = external_exports.object({
+      /** Any record, composite or relationship tool: the toolset reaches records. */
+      records: external_exports.boolean(),
+      sql_query: external_exports.boolean(),
+      batch: external_exports.boolean()
+    });
+    toolsetConnectionBindingSchema = external_exports.object({
+      base_id: external_exports.string().min(1),
+      /** The slug the token was resolved against — `settings.toolset` at that write. */
+      toolset: external_exports.string().min(1),
+      /** The base's incarnation when the token was written; a bound attested call states it. */
+      base_generation: external_exports.number().int().min(1),
+      environment: baseEnvironmentSchema,
+      surface: toolsetSurfaceSchema
+    });
+    rekorResolvedToolsetSchema = external_exports.object({
+      data: external_exports.object({
+        base_id: external_exports.string().min(1),
+        environment: baseEnvironmentSchema,
+        base_generation: external_exports.number().int().min(1),
+        /**
+         * The calling token's binding, or null for a token bound to none. A bound token can call only
+         * its toolset's tools, which is what a toolset connection stores (#5083 decision 14). Its org
+         * is the token's own: base ids are unique only per org, so the base id alone does not say
+         * which base the token reaches.
+         */
+        toolset_binding: external_exports.object({
+          org_id: external_exports.string().optional(),
+          base_id: external_exports.string(),
+          toolset_id: external_exports.string()
+        }).nullable().optional(),
+        actions: external_exports.array(external_exports.unknown()).optional(),
+        composites: external_exports.array(external_exports.unknown()).optional(),
+        relationships: external_exports.array(external_exports.unknown()).optional(),
+        files: external_exports.array(external_exports.unknown()).optional(),
+        batch: external_exports.object({ enabled: external_exports.boolean().optional() }).passthrough().nullable().optional(),
+        sql_query: external_exports.boolean().optional()
+      }).passthrough()
+    });
     PEOPLE_CONTACT_PAGE_MAX = 100;
     PEOPLE_CONTACT_PAGE_DEFAULT = 50;
     PEOPLE_CONTACT_EMAIL_MAX_LENGTH = 254;
@@ -13298,10 +13194,10 @@ var init_chunk_BPDC67ML = __esm({
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
-    init_chunk_GI5ELTXF();
+    init_chunk_EKPXHJ4G();
     init_chunk_VORPHGDT();
-    init_chunk_POL7B3EM();
-    init_chunk_YV4TZ2HR();
+    init_chunk_P5OUVLFP();
+    init_chunk_XFKJHZ4E();
     init_chunk_SNA2DXAC();
     init_chunk_MIWZOSPI();
     init_chunk_LKBSHANA();
@@ -13309,7 +13205,7 @@ var init_contracts = __esm({
     init_chunk_2ISUBJG7();
     init_chunk_C2UEA2KW();
     init_chunk_3NS3HULK();
-    init_chunk_JWPRTSIB();
+    init_chunk_DHPUPI4Y();
     init_chunk_T7KQKDET();
     init_chunk_L5F7ZOUJ();
     init_chunk_BPDC67ML();
@@ -13442,12 +13338,7 @@ var init_api_client = __esm({
       async adminSkillInstall(name) {
         return this.request("GET", `/api/admin/skills/${encodeURIComponent(name)}`);
       }
-      // Run a shell command in a fresh E2B sandbox (platform-admin gated — the
-      // harness-agents PR 1.5 isolation surface). Never carries the E2B key.
-      async adminSandboxExec(body) {
-        return this.request("POST", "/api/admin/sandbox/exec", body);
-      }
-      // Reap every live harness sandbox / token / slot in scope (platform-admin gated
+      // Reap every live harness session / token / slot in scope (platform-admin gated
       // — the harness-agents PR 2.9b incident-response surface). Never carries tokens.
       async adminHarnessMassDestroy(body) {
         return this.request("POST", "/api/admin/harness/mass-destroy", body);
@@ -14098,35 +13989,6 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      /**
-       * Download the harness sandbox FILESYSTEM archive (harness-agents PR 2.12) as
-       * raw zip bytes. Distinct from the JSON `request<T>` path — the response is a
-       * binary `application/zip`, so this reads `arrayBuffer()`. Single-refresh-on-401
-       * like `request`, but no transient-retry loop (a large binary GET is idempotent
-       * but not worth re-streaming on a cold-start body probe). 404 ⇒ ApiError (no
-       * sandbox for this conversation, or the blob was purged).
-       */
-      async downloadArchiveSandboxFs(hubId, conversationId) {
-        const path41 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
-        addApiBreadcrumb("GET", path41);
-        const url = `${this.apiUrl}${path41}`;
-        let response = await this.send(url, "GET");
-        if (response.status === 401 && this.onUnauthorized) {
-          let refreshed;
-          try {
-            refreshed = await this.onUnauthorized();
-          } catch {
-          }
-          if (refreshed) {
-            this.accessToken = refreshed;
-            response = await this.send(url, "GET");
-          }
-        }
-        if (!response.ok) {
-          throw new ApiError("GET", path41, response.status, await response.text());
-        }
-        return new Uint8Array(await response.arrayBuffer());
-      }
       /**
        * List per-message observability metadata summaries for a conversation (hub-scoped auth). The
        * hub is named so the backend checks the conversation's row names it; a request naming none is
@@ -14520,10 +14382,10 @@ var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
     init_chunk_P3AWZG3N();
-    init_chunk_GI5ELTXF();
+    init_chunk_EKPXHJ4G();
     init_chunk_VORPHGDT();
-    init_chunk_POL7B3EM();
-    init_chunk_YV4TZ2HR();
+    init_chunk_P5OUVLFP();
+    init_chunk_XFKJHZ4E();
     init_chunk_SNA2DXAC();
     init_chunk_MIWZOSPI();
     init_chunk_LKBSHANA();
@@ -14534,7 +14396,7 @@ var init_dist = __esm({
     init_chunk_RPGBR5IN();
     init_chunk_C2UEA2KW();
     init_chunk_3NS3HULK();
-    init_chunk_JWPRTSIB();
+    init_chunk_DHPUPI4Y();
     init_chunk_BF4WRSOQ();
     init_chunk_T7KQKDET();
     init_chunk_L5F7ZOUJ();
@@ -14828,20 +14690,8 @@ var init_dist = __esm({
         failClosed: true,
         userLimitKey: "/api/admin/data-explorer/*"
       },
-      // Admin sandbox exec (harness-agents PR 1.5) — this is ARBITRARY CODE EXECUTION,
-      // so it gets the strictest budget on the platform: STRICT tier + a low per-user
-      // hourly cap (well below the debug-read cap) + fail-closed. Platform-admin
-      // is enforced at the route; this is the independent defense-in-depth signal so a
-      // runaway exec loop surfaces as 429 instead of silently provisioning sandboxes.
-      "/api/admin/sandbox/*": {
-        tier: "STRICT",
-        userLimit: 20,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: "/api/admin/sandbox/*"
-      },
       // Admin harness incident-response (harness-agents PR 2.9b) — mass-destroy reaps
-      // EVERY live harness sandbox/token/slot in scope, so it gets a strict budget
+      // EVERY live harness session/token/slot in scope, so it gets a strict budget
       // (STRICT + a low per-user hourly cap + fail-closed). Platform-admin is enforced
       // at the route; this is the independent defense-in-depth signal so a runaway
       // reap loop surfaces as 429. The break-glass disable/enable rides through
@@ -16374,7 +16224,7 @@ var init_utils = __esm({
       ["report accept", { positionals: 1 }],
       ["report contest", { positionals: 1, values: ["--reason"] }],
       ["update", { positionals: 0 }],
-      ["admin archive", { positionals: 2, values: ["--message-id", "--out"] }],
+      ["admin archive", { positionals: 2, values: ["--message-id"] }],
       ["admin observability", { positionals: 2, values: ["--message-id"] }],
       ["admin do tables", { positionals: 2 }],
       ["admin do read", { positionals: 3, values: ["--limit", "--id"] }],
@@ -16401,7 +16251,6 @@ var init_utils = __esm({
       ["admin notice list", { positionals: 0, values: ["--status", "--limit", "--offset"] }],
       ["admin notice resolve", { positionals: 1 }],
       ["admin skill install", { positionals: 1 }],
-      ["admin sandbox exec", { positionals: 1, values: ["--hub", "--connection", "--cmd", "--egress", "--allow", "--timeout"] }],
       ["admin hubs repair-team-orphans", { positionals: 0, values: ["--org", "--hub"], dryRun: true }],
       ["admin hubs repair-branching-orphans", { positionals: 0, values: ["--org", "--hub", "--id"], dryRun: true }],
       ["admin orgs repair-legacy-grants", { positionals: 0, values: ["--org"], dryRun: true }],
@@ -18191,7 +18040,7 @@ var init_whoami = __esm({
 var init_constants = __esm({
   "../../packages/core/dist/constants.js"() {
     "use strict";
-    init_chunk_JWPRTSIB();
+    init_chunk_DHPUPI4Y();
   }
 });
 
@@ -20668,7 +20517,7 @@ var init_config_writer = __esm({
         "skip_cascade_writes",
         "enabled"
       ],
-      toolsets: ["id", "name", "description", "actions", "relationships", "files", "batch", "sql_query"],
+      toolsets: ["id", "name", "description", "actions", "relationships", "files", "batch", "sql_query", "customer_scope"],
       actions: [
         "id",
         "record_type",
@@ -32202,21 +32051,6 @@ async function adminCommand(args2) {
         process.exit(1);
     }
   }
-  if (group === "sandbox") {
-    if (!sub) {
-      printHelp2();
-      process.exit(1);
-    }
-    switch (sub) {
-      // The command is positional after `exec`; the rest are flags.
-      case "exec":
-        await runSandboxExec(positional, flagArgs);
-        return;
-      default:
-        printHelp2();
-        process.exit(1);
-    }
-  }
   if (group === "hubs") {
     if (!sub) {
       printHelp2();
@@ -32460,31 +32294,14 @@ async function runAnalyticsRead(positional, flagArgs) {
 }
 async function runArchiveRead(positional, flagArgs) {
   if (positional.length < 2) {
-    console.error("wayai admin archive <hub_id> <conversation_id> [--message-id X] [--sandbox [--out <path>]] [--json]");
+    console.error("wayai admin archive <hub_id> <conversation_id> [--message-id X] [--json]");
     process.exit(1);
   }
   const hubId = positional[0];
   const conversationId = positional[1];
-  const flags = parseFlags2(flagArgs, ["--json", "--message-id", "--sandbox", "--out"]);
+  const flags = parseFlags2(flagArgs, ["--json", "--message-id"]);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-  if (flags.sandbox) {
-    const outPath = flags.out || `${conversationId}-sandbox.zip`;
-    let zip;
-    try {
-      zip = await client.downloadArchiveSandboxFs(hubId, conversationId);
-    } catch (err) {
-      if (err instanceof ApiError && err.status === 404) {
-        console.error("Sandbox archive not found. This conversation had no harness sandbox, or the R2 blob was purged.");
-        process.exit(1);
-      }
-      exitOnApiError(err);
-      throw err;
-    }
-    fs29.writeFileSync(outPath, zip);
-    console.log(`Wrote ${zip.byteLength} bytes to ${outPath}`);
-    return;
-  }
   let response;
   try {
     response = await client.debugReadArchive(hubId, conversationId, {
@@ -32573,18 +32390,12 @@ function parseFlags2(flagArgs, allowed) {
       out.jsonOutput = true;
       continue;
     }
-    if (arg === "--sandbox") {
-      out.sandbox = true;
-      continue;
-    }
     const v = flagArgs[++i];
     if (!v) {
       console.error(`${arg} requires a value`);
       process.exit(1);
     }
-    if (arg === "--out") {
-      out.out = v;
-    } else if (arg === "--limit") {
+    if (arg === "--limit") {
       const n = Number.parseInt(v, 10);
       if (!Number.isFinite(n)) {
         console.error("--limit must be an integer");
@@ -32634,112 +32445,6 @@ async function runSkillInstall(positional) {
   console.log(`Installed skill "${name}" (${fileCount} file${fileCount === 1 ? "" : "s"}) \u2192 ${relDirs.join(", ")}`);
   console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
 }
-async function runSandboxExec(positional, flagArgs) {
-  const USAGE3 = 'wayai admin sandbox exec [--cmd "<command>" | <command>] --hub <hub_id> --connection <connection_id> [--egress open|allowlist|isolated] [--allow <host> ...] [--timeout <ms>] [--json]';
-  let hubId;
-  let connectionId;
-  let egress;
-  let cmdFlag;
-  let timeoutMs;
-  let jsonOutput = false;
-  const allow = [];
-  for (let i = 0; i < flagArgs.length; i++) {
-    const arg = flagArgs[i];
-    switch (arg) {
-      case "--json":
-        jsonOutput = true;
-        break;
-      case "--hub":
-        hubId = requireFlagValue(flagArgs, ++i, "--hub");
-        break;
-      case "--connection":
-        connectionId = requireFlagValue(flagArgs, ++i, "--connection");
-        break;
-      case "--cmd":
-        cmdFlag = requireFlagValue(flagArgs, ++i, "--cmd");
-        break;
-      case "--egress": {
-        const v = requireFlagValue(flagArgs, ++i, "--egress");
-        const parsed = sandboxEgressPolicy.safeParse(v);
-        if (!parsed.success) {
-          console.error(`--egress must be one of: ${sandboxEgressPolicy.options.join(", ")}`);
-          process.exit(1);
-        }
-        egress = parsed.data;
-        break;
-      }
-      case "--allow":
-        allow.push(requireFlagValue(flagArgs, ++i, "--allow"));
-        break;
-      case "--timeout": {
-        const v = requireFlagValue(flagArgs, ++i, "--timeout");
-        const n = Number.parseInt(v, 10);
-        if (!Number.isFinite(n) || n < 1) {
-          console.error("--timeout must be a positive integer (milliseconds)");
-          process.exit(1);
-        }
-        timeoutMs = n;
-        break;
-      }
-      default:
-        console.error(`Unknown flag: ${arg}`);
-        process.exit(1);
-    }
-  }
-  const positionalCmd = positional[0];
-  if (positional.length > 1) {
-    console.error("Provide the command as a single quoted argument (or use --cmd).");
-    console.error(USAGE3);
-    process.exit(1);
-  }
-  if (positionalCmd && cmdFlag) {
-    console.error("Provide the command EITHER positionally OR via --cmd, not both.");
-    process.exit(1);
-  }
-  const cmd = cmdFlag ?? positionalCmd;
-  if (!cmd || !hubId || !connectionId) {
-    console.error(USAGE3);
-    process.exit(1);
-  }
-  const body = {
-    hub_id: hubId,
-    connection_id: connectionId,
-    cmd,
-    ...egress ? { egress_policy: egress } : {},
-    ...allow.length > 0 ? { egress_allowlist: allow } : {},
-    ...timeoutMs !== void 0 ? { timeout_ms: timeoutMs } : {}
-  };
-  const { config, accessToken } = await requireAuth();
-  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-  let response;
-  try {
-    response = await client.adminSandboxExec(body);
-  } catch (err) {
-    exitOnApiError(err);
-    throw err;
-  }
-  const data = response.data;
-  if (jsonOutput) {
-    console.log(JSON.stringify(data, null, 2));
-    return;
-  }
-  console.log(`exit_code:  ${data.exit_code}`);
-  console.log(`sandbox_id: ${data.sandbox_id}`);
-  if (!data.destroyed) {
-    console.log("warning:    sandbox destroy failed on the backend (leak logged; cron will reap it)");
-  }
-  if (data.stdout) {
-    console.log("--- stdout ---");
-    console.log(data.stdout.replace(/\n$/, ""));
-  }
-  if (data.stderr) {
-    console.log("--- stderr ---");
-    console.log(data.stderr.replace(/\n$/, ""));
-  }
-  if (data.exit_code !== 0) {
-    process.exit(data.exit_code);
-  }
-}
 function parseScopedTargetFlags(flagArgs, usage3, opts = {}) {
   const scopes = opts.scopes ?? ["all", "org", "hub"];
   let all = false;
@@ -32981,8 +32686,8 @@ async function runHarnessMassDestroy(flagArgs) {
   const USAGE3 = "wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
   const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE3);
   if (!dryRun && !yes && !jsonOutput) {
-    console.log(`About to REAP every live harness sandbox / token / slot in: ${targetLabel}.`);
-    console.log("This destroys running sandboxes and revokes their tokens. Run with --dry-run first to see the blast radius.");
+    console.log(`About to REAP every live harness session / token / slot in: ${targetLabel}.`);
+    console.log("This destroys running harness sessions and revokes their tokens. Run with --dry-run first to see the blast radius.");
     const ok = await confirm("Proceed?");
     if (!ok) {
       console.log("Aborted.");
@@ -33017,11 +32722,11 @@ async function runHarnessMassDestroy(flagArgs) {
     return;
   }
   console.log("");
-  console.log("hub_id | conversation_id | had_sandbox | sandbox_destroyed | reaped");
-  console.log("-------+-----------------+-------------+-------------------+-------");
+  console.log("hub_id | conversation_id | sandbox_destroyed | reaped");
+  console.log("-------+-----------------+-------------------+-------");
   for (const d of data.details) {
     console.log(
-      `${d.hub_id} | ${d.conversation_id} | ${d.had_sandbox} | ${d.sandbox_destroyed} | ${d.reaped}`
+      `${d.hub_id} | ${d.conversation_id} | ${d.sandbox_destroyed} | ${d.reaped}`
     );
   }
 }
@@ -33914,7 +33619,7 @@ Usage:
   wayai admin analytics tables
   wayai admin analytics read <table> [--conversation-id X] [--hub-id Y] [--message-id Z] [--limit N] [--json]
 
-  wayai admin archive <hub_id> <conversation_id> [--message-id X] [--sandbox [--out <path>]] [--json]
+  wayai admin archive <hub_id> <conversation_id> [--message-id X] [--json]
 
   wayai admin observability <hub_id> <conversation_id> [--message-id X] [--json]
 
@@ -33946,9 +33651,6 @@ Usage:
 
   wayai admin skill install [name]                 Install a private operator skill (default: wayai-admin) into each present harness's skills/ dir
 
-  wayai admin sandbox exec [--cmd "<c>" | <c>] --hub <id> --connection <id> [--egress open|allowlist|isolated] [--allow <host> ...] [--timeout <ms>] [--json]
-                                                   Run one shell command in a fresh E2B sandbox (create \u2192 run \u2192 destroy) to test the sandbox driver + egress gate
-
   wayai admin hubs repair-team-orphans --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]
                                                    Purge hub_team_id references left dangling by a pre-cascade team deletion (silently empties a support agent's queue). Idempotent \u2014 run --dry-run first
 
@@ -33962,7 +33664,7 @@ Usage:
   wayai admin harness enable                       Flip the platform harness_enabled flag ON
   wayai admin harness status                       Print the platform harness_enabled flag
   wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]
-                                                   Reap every live harness sandbox/token/slot in scope (run --dry-run first to see the blast radius)
+                                                   Reap every live harness session/token/slot in scope (run --dry-run first to see the blast radius)
 
   wayai admin voice-calls enable                   Flip the platform voice_calls_enabled kill switch ON (every org)
   wayai admin voice-calls disable                  Flip it OFF: every voice-call surface goes dark for every org
@@ -34048,17 +33750,12 @@ Sources:
                  to a real person and sends no email, so read --dry-run output as the list of
                  people about to get access. Idempotent.
 
-  sandbox        Run arbitrary code in a fresh E2B sandbox (harness-agents isolation surface).
-                 \`exec\` provisions a sandbox from a named Sandbox connection, runs one
-                 command, and destroys it. Egress omitted \u21D2 deny-all (fail-closed); opt up
-                 with --egress + --allow. The E2B key never leaves the backend. Capped at
-                 20 execs/hour/user (the strictest tier \u2014 this is arbitrary code execution).
   harness        Incident response for harness agents. \`disable\`/\`enable\` flip the single
                  PLATFORM-wide harness_enabled flag; \`status\` prints it. That one flag both
                  gates harness-agent create/update (default-deny, fail-closed) and drives
                  the per-turn kill switch, so \`disable\` is the break-glass: each harness
                  turn aborts on its next invocation. \`mass-destroy\` reaps every harness
-                 sandbox/token/slot that is live NOW (scope: --hub < --org < --all, prefer
+                 session/token/slot that is live NOW (scope: --hub < --org < --all, prefer
                  the narrowest). Run \`mass-destroy --dry-run\` first to see the blast
                  radius.
   voice-calls    The voice-calls gate, default-deny: the PLATFORM-wide voice_calls_enabled
@@ -34100,11 +33797,8 @@ Examples:
   wayai admin analytics read conversation --conversation-id <conv-id>
   wayai admin archive <hub-id> <conv-id>
   wayai admin archive <hub-id> <conv-id> --message-id <msg-id> --json
-  wayai admin archive <hub-id> <conv-id> --sandbox --out session.zip
   wayai admin observability <hub-id> <conv-id>
   wayai admin observability <hub-id> <conv-id> --message-id <msg-id> --json
-  wayai admin sandbox exec "echo hi" --hub <hub-id> --connection <conn-id>
-  wayai admin sandbox exec --cmd "curl -s https://api.github.com" --hub <hub-id> --connection <conn-id> --egress allowlist --allow api.github.com
   wayai admin hubs repair-branching-orphans --hub <prod-hub-id>
   wayai admin hubs repair-branching-orphans --hub <prod-hub-id> --id connection:<id> --dry-run
   wayai admin orgs repair-legacy-grants --all --dry-run
@@ -35141,7 +34835,7 @@ var init_import = __esm({
 
 // src/data/commands/providers.ts
 import { Command as Command5 } from "commander";
-import { writeFileSync as writeFileSync11 } from "fs";
+import { writeFileSync as writeFileSync10 } from "fs";
 function providerSegment(provider) {
   if (!VALID_PROVIDERS.includes(provider)) {
     throw expected(`Unknown provider ${JSON.stringify(provider)}. Expected one of: ${VALID_PROVIDERS_HELP}.`);
@@ -35174,7 +34868,7 @@ function buildBasesProvidersCommand() {
     );
     if (opts.to) {
       try {
-        writeFileSync11(opts.to, JSON.stringify(data, null, 2));
+        writeFileSync10(opts.to, JSON.stringify(data, null, 2));
       } catch (e) {
         throw expected(`--to ${opts.to}: ${e instanceof Error ? e.message : "could not be written"}`);
       }
@@ -36259,7 +35953,7 @@ var init_file_types = __esm({
 
 // src/data/commands/files.ts
 import { Command as Command12 } from "commander";
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "fs";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync11 } from "fs";
 import { basename as basename25 } from "path";
 function renderFileDiff(fileType, filePath, from, to, d) {
   console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
@@ -36339,7 +36033,7 @@ function buildFilesCommand() {
     const { bytes } = await client.download(
       `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${encoded}${versionQs ? `?${versionQs}` : ""}`
     );
-    writeFileSync12(out, bytes);
+    writeFileSync11(out, bytes);
     console.log(`Downloaded to ${out}`);
   });
   files.command("history <file_type> <path>").description("List the content versions of a file (newest first)").option("--limit <n>", "Max versions to return").option("--offset <n>", "Pagination offset").action(async function(fileType, filePath, opts) {