@wayai/cli 0.3.215 → 0.3.217

package/dist/index.js

@@ -447,11 +447,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path41) {
+function addApiBreadcrumb(method, path42) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path41}`,
+    message: `${method} ${path42}`,
     level: "info"
   });
 }
@@ -512,7 +512,7 @@ var init_chunk_VORPHGDT = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-2TNXNKRP.js
+// ../../packages/core/dist/chunk-BBFWR2LG.js
 function spokenLineField(label, description2) {
   return { type: "text", label, maxLength: SPOKEN_LINE_MAX_CHARS, default: "", description: description2 };
 }
@@ -521,9 +521,9 @@ function byLowercaseName(a, b) {
   const y = b.connector_name.toLowerCase();
   return x < y ? -1 : x > y ? 1 : 0;
 }
-var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, REKOR_TOOLSET_SERVICE_NAME, rekorToolset, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeManagedAgents, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
-var init_chunk_2TNXNKRP = __esm({
-  "../../packages/core/dist/chunk-2TNXNKRP.js"() {
+var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, SANDBOX_AGENT_FIELDS, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, REKOR_TOOLSET_SERVICE_NAME, rekorToolset, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeManagedAgents, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
+var init_chunk_BBFWR2LG = __esm({
+  "../../packages/core/dist/chunk-BBFWR2LG.js"() {
     "use strict";
     CALLER_LANGUAGE = "caller";
     TTS_VOICE_REPLY_ENABLED_FIELD = {
@@ -546,6 +546,33 @@ var init_chunk_2TNXNKRP = __esm({
         description: 'When this agent runs as a Copilot, whether it drafts a suggestion automatically on every incoming message ("Every message") or only when a team member clicks "Suggest reply" ("On demand"). On demand reduces cost and noise. No effect on Pilot agents.'
       }
     };
+    SANDBOX_AGENT_FIELDS = {
+      code_execution_enabled: {
+        type: "toggle",
+        label: "Code Execution Sandbox",
+        default: false,
+        description: "Let this agent run code in a WayAI sandbox with the sandbox tools, bash, copy_to_sandbox and copy_from_sandbox (add them under Tools): one disposable Linux container per conversation, started on first use and ended after 10 minutes without use or 60 minutes in all. On Anthropic and OpenAI agents this also enables download_file and upload_file, which use the provider's own sandbox."
+      },
+      sandbox_network: {
+        type: "select",
+        label: "Sandbox Network",
+        options: [
+          { value: "none", label: "No network" },
+          { value: "allowlist", label: "Allowlist" },
+          { value: "web", label: "Web" }
+        ],
+        default: "none",
+        description: "What code in this agent's sandbox can reach. No network: nothing leaves the sandbox. Allowlist: HTTP and HTTPS to the hosts listed below only, through WayAI; no DNS or other protocol leaves, but data can still be sent to those hosts. Web: HTTP and HTTPS to any public host, through WayAI; data can be sent to any of them. WayAI adds no credentials to these requests."
+      },
+      sandbox_allowed_hosts: {
+        type: "array",
+        itemType: "text",
+        maxItems: 50,
+        label: "Sandbox Allowed Hosts",
+        description: "The exact host names the sandbox may reach under Allowlist, such as api.example.com: no wildcards, IP addresses, ports or paths.",
+        dependsOn: { field: "sandbox_network", values: ["allowlist"] }
+      }
+    };
     AUDIO_LANGUAGE_OPTIONS = [
       { value: "", label: "Auto-detect" },
       { value: "en", label: "en" },
@@ -728,7 +755,7 @@ var init_chunk_2TNXNKRP = __esm({
         verbosity: { type: "select", label: "Verbosity", options: ["low", "medium", "high"], default: "medium", description: "Output detail level. Only for reasoning models.", dependsOn: { field: "model", values: OPENAI_REASONING_MODELS } },
         service_tier: { type: "select", label: "Service Tier", options: ["auto", "flex", "default", "priority"], default: "auto", description: "Service tier (flex=50% cheaper, higher latency). Only for reasoning models.", dependsOn: { field: "model", values: OPENAI_REASONING_MODELS } },
         max_tokens: { type: "number", label: "Max Tokens", min: 1, default: 4096, description: "Maximum tokens to generate. On reasoning models, this cap includes reasoning tokens." },
-        code_execution_enabled: { type: "toggle", label: "Code Execution Sandbox", default: false, description: "Allow this agent to use the OpenAI code_interpreter sandbox for the download_file/upload_file tools. Off keeps the agent read-only on resources even if the tools are attached." },
+        ...SANDBOX_AGENT_FIELDS,
         streaming_enabled: { type: "toggle", label: "Stream Responses", default: false, description: "Stream responses in real-time (app channel only)" },
         deliver_preamble: { type: "toggle", label: "Deliver Pre-Tool Messages", default: true, description: 'Send the short message the model writes before running tools ("Let me check that\u2026") as its own message, so the user hears something during the tool-execution wait. Off = only the final reply is delivered (pre-tool text is discarded). Not applied on email channels; on voice conversations each preamble is spoken as its own audio clip.' },
         file_handling_mode: { type: "select", label: "File handling", options: [{ value: "always_attach", label: "Attach files" }, { value: "metadata_only", label: "Metadata only (retrieve on demand)" }], default: "always_attach", description: "No longer changes what the model receives \u2014 a conversation's earlier files are always announced by path, never re-sent as content. metadata_only still auto-enables read_file so the agent can open one of those paths on demand." },
@@ -767,7 +794,7 @@ var init_chunk_2TNXNKRP = __esm({
         max_tokens: { type: "number", label: "Max Tokens", min: 1, max: 8192, default: 4096, description: "Maximum tokens to generate", required: true },
         thinking_enabled: { type: "toggle", label: "Extended Thinking", default: false, description: "Enable Claude extended thinking for deeper reasoning. Uses output tokens; temperature/top_p are ignored when on. Not shown for Claude Fable and Claude Opus 5.5, which always reason adaptively. On Claude Sonnet 5.5 and Claude Haiku 5.5, off applies at Reasoning Effort High or below; at Extra high or Max they keep thinking.", dependsOn: { field: "model", values: ["claude-sonnet-5-5", "claude-haiku-5-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-5", "claude-sonnet-4-6", "claude-sonnet-4-5", "claude-haiku-4-5", "claude-opus-4-5"] } },
         effort: { type: "select", label: "Reasoning Effort", options: [{ value: "low", label: "Low" }, { value: "medium", label: "Medium" }, { value: "high", label: "High" }, { value: "xhigh", label: "Extra high" }, { value: "max", label: "Max" }], default: "high", description: "How hard Claude reasons and how many tokens it spends overall (output_config.effort). Higher = better quality, more cost/latency. xhigh needs Opus 4.7+/Sonnet 5+/Haiku 5.5/Fable; max excludes Opus 4.5. Levels the chosen model does not support are clamped down to the highest it allows.", dependsOn: { field: "model", values: ["claude-fable-5-1", "claude-opus-5-5", "claude-sonnet-5-5", "claude-haiku-5-5", "claude-fable-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-opus-4-5", "claude-sonnet-5", "claude-sonnet-4-6"] } },
-        code_execution_enabled: { type: "toggle", label: "Code Execution Sandbox", default: false, description: "Allow this agent to use the Anthropic code_execution sandbox for the download_file/upload_file tools. Off keeps the agent read-only on resources even if the tools are attached." },
+        ...SANDBOX_AGENT_FIELDS,
         cache_ttl: { type: "select", label: "System Prompt Cache TTL", options: [{ value: "1h", label: "1 hour (recommended)" }, { value: "5m", label: "5 minutes" }, { value: "off", label: "Disabled" }], default: "1h", description: "Caches system prompt and tool definitions (shared across all conversations on this agent). 1h amortizes the 2\xD7 write premium across concurrent conversations." },
         cache_ttl_history: { type: "select", label: "Conversation History Cache TTL", options: [{ value: "5m", label: "5 minutes (recommended)" }, { value: "1h", label: "1 hour" }, { value: "off", label: "Disabled" }], default: "5m", description: "Caches per-conversation history. Primary readers are tool-loop iterations (seconds apart) \u2014 5m captures these at 1.25\xD7 write premium instead of 2\xD7. Use 1h only if conversations frequently re-engage between 5min\u20131h." },
         streaming_enabled: { type: "toggle", label: "Stream Responses", default: false, description: "Stream responses in real-time (app channel only)" },
@@ -811,6 +838,7 @@ var init_chunk_2TNXNKRP = __esm({
         deliver_preamble: { type: "toggle", label: "Deliver Pre-Tool Messages", default: true, description: 'Send the short message the model writes before running tools ("Let me check that\u2026") as its own message, so the user hears something during the tool-execution wait. Off = only the final reply is delivered (pre-tool text is discarded). Not applied on email channels; on voice conversations each preamble is spoken as its own audio clip.' },
         file_handling_mode: { type: "select", label: "File handling", options: [{ value: "always_attach", label: "Attach files" }, { value: "metadata_only", label: "Metadata only (retrieve on demand)" }], default: "always_attach", description: "No longer changes what the model receives \u2014 a conversation's earlier files are always announced by path, never re-sent as content. metadata_only still auto-enables read_file so the agent can open one of those paths on demand." },
         max_attachment_size_mb: { type: "number", label: "Max attachment size (MB)", min: 1, description: "No longer has any effect: earlier files are announced by path rather than attached, so there is no attachment size to cap." },
+        ...SANDBOX_AGENT_FIELDS,
         ...COPILOT_TRIGGER_FIELD
       },
       channel_settings_schema: null,
@@ -852,6 +880,7 @@ var init_chunk_2TNXNKRP = __esm({
         deliver_preamble: { type: "toggle", label: "Deliver Pre-Tool Messages", default: true, description: 'Send the short message the model writes before running tools ("Let me check that\u2026") as its own message, so the user hears something during the tool-execution wait. Off = only the final reply is delivered (pre-tool text is discarded). Not applied on email channels; on voice conversations each preamble is spoken as its own audio clip.' },
         file_handling_mode: { type: "select", label: "File handling", options: [{ value: "always_attach", label: "Attach files" }, { value: "metadata_only", label: "Metadata only (retrieve on demand)" }], default: "always_attach", description: "No longer changes what the model receives \u2014 a conversation's earlier files are always announced by path, never re-sent as content. metadata_only still auto-enables read_file so the agent can open one of those paths on demand." },
         max_attachment_size_mb: { type: "number", label: "Max attachment size (MB)", min: 1, description: "No longer has any effect: earlier files are announced by path rather than attached, so there is no attachment size to cap." },
+        ...SANDBOX_AGENT_FIELDS,
         ...COPILOT_TRIGGER_FIELD
       },
       channel_settings_schema: null,
@@ -890,6 +919,7 @@ var init_chunk_2TNXNKRP = __esm({
         deliver_preamble: { type: "toggle", label: "Deliver Pre-Tool Messages", default: true, description: 'Send the short message the model writes before running tools ("Let me check that\u2026") as its own message, so the user hears something during the tool-execution wait. Off = only the final reply is delivered (pre-tool text is discarded). Not applied on email channels; on voice conversations each preamble is spoken as its own audio clip.' },
         file_handling_mode: { type: "select", label: "File handling", options: [{ value: "always_attach", label: "Attach files" }, { value: "metadata_only", label: "Metadata only (retrieve on demand)" }], default: "always_attach", description: "No longer changes what the model receives \u2014 a conversation's earlier files are always announced by path, never re-sent as content. metadata_only still auto-enables read_file so the agent can open one of those paths on demand." },
         max_attachment_size_mb: { type: "number", label: "Max attachment size (MB)", min: 1, description: "No longer has any effect: earlier files are announced by path rather than attached, so there is no attachment size to cap." },
+        ...SANDBOX_AGENT_FIELDS,
         ...COPILOT_TRIGGER_FIELD
       },
       channel_settings_schema: null,
@@ -1297,9 +1327,9 @@ var init_chunk_2TNXNKRP = __esm({
       unique_per_hub: false,
       account_sid_placeholder: null,
       models: null,
-      is_internal: false,
+      is_internal: true,
       is_harness: false,
-      connector_module: null,
+      connector_module: "native/rekor_toolset",
       enabled: true,
       connector_settings_schema: {
         toolset: { type: "text", label: "Toolset", default: "", placeholder: "support", description: "The toolset this connection reaches: its slug, as in its MCP URL (\u2026/t/<slug>/mcp). The token must be bound to it.", required: true }
@@ -1447,16 +1477,78 @@ var init_chunk_2TNXNKRP = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-SNA2DXAC.js
+// ../../packages/core/dist/chunk-DHPUPI4Y.js
+function normalizeAuthType(raw) {
+  if (VALID_AUTH_TYPES.has(raw)) return raw;
+  return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
+}
+var AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, PILOT_TRACK_ROLES, COPILOT_TRACK_ROLES, CUSTOMER_FACING_AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SKILL_INSTALL_COMMAND;
+var init_chunk_DHPUPI4Y = __esm({
+  "../../packages/core/dist/chunk-DHPUPI4Y.js"() {
+    "use strict";
+    AUTH_TYPE = {
+      OAUTH: "oauth",
+      API_KEY: "api_key",
+      BASIC_AUTH: "basic_auth",
+      BEARER: "bearer",
+      NONE: "none"
+    };
+    ORG_CREDENTIAL_AUTH_TYPES = [
+      AUTH_TYPE.API_KEY,
+      AUTH_TYPE.BEARER,
+      AUTH_TYPE.BASIC_AUTH
+    ];
+    AUTH_TYPE_DISPLAY = {
+      [AUTH_TYPE.OAUTH]: "OAuth",
+      [AUTH_TYPE.API_KEY]: "API Key",
+      [AUTH_TYPE.BASIC_AUTH]: "Basic Auth",
+      [AUTH_TYPE.BEARER]: "Bearer Token",
+      [AUTH_TYPE.NONE]: "No Authentication"
+    };
+    LEGACY_AUTH_TYPE_MAP = {
+      "OAuth": AUTH_TYPE.OAUTH,
+      "API Key": AUTH_TYPE.API_KEY,
+      "Basic Auth": AUTH_TYPE.BASIC_AUTH,
+      "Bearer Token": AUTH_TYPE.BEARER,
+      "No authentication": AUTH_TYPE.NONE,
+      // Also handle the old DISPLAY_TO_CODE bug where 'basic' was used instead of 'basic_auth'
+      "basic": AUTH_TYPE.BASIC_AUTH
+    };
+    VALID_AUTH_TYPES = new Set(Object.values(AUTH_TYPE));
+    AGENT_ROLES = [
+      "pilot",
+      "copilot",
+      "pilot_specialist",
+      "copilot_specialist",
+      "pilot_advisor",
+      "copilot_advisor",
+      "monitor",
+      "conversation_evaluator",
+      "message_evaluator",
+      "summarizer",
+      "consultant",
+      "pilot_voice"
+    ];
+    PILOT_TRACK_ROLES = ["pilot", "pilot_specialist"];
+    COPILOT_TRACK_ROLES = ["copilot", "copilot_specialist"];
+    CUSTOMER_FACING_AGENT_ROLES = [...PILOT_TRACK_ROLES, "pilot_advisor"];
+    SAFE_USER_ID_REGEX = /^[A-Za-z0-9_-]{1,64}$/;
+    SUPPORTED_LOCALES = ["en", "pt", "es"];
+    SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
+  }
+});
+
+// ../../packages/core/dist/chunk-QT7NKKPO.js
 function catalogToolSideEffects(toolName) {
   const sideEffects = CATALOG_SIDE_EFFECTS.get(toolName);
   if (sideEffects === void 0) return "unknown";
   return sideEffects ? "side_effects" : "none";
 }
-var NATIVE_TOOL_SCHEMAS, WAYAI_CONNECTOR, BASE_NATIVE_TOOLS, NATIVE_TOOLS, CATALOG_SIDE_EFFECTS;
-var init_chunk_SNA2DXAC = __esm({
-  "../../packages/core/dist/chunk-SNA2DXAC.js"() {
+var NATIVE_TOOL_SCHEMAS, WAYAI_CONNECTOR, SANDBOX_AGENT_ROLES, BASE_NATIVE_TOOLS, NATIVE_TOOLS, CATALOG_SIDE_EFFECTS;
+var init_chunk_QT7NKKPO = __esm({
+  "../../packages/core/dist/chunk-QT7NKKPO.js"() {
     "use strict";
+    init_chunk_DHPUPI4Y();
     NATIVE_TOOL_SCHEMAS = {
       "close_conversation": {
         "tool_config": {
@@ -1750,6 +1842,86 @@ var init_chunk_SNA2DXAC = __esm({
         },
         "tool_instructions": "Use to commit either an edit (file_id + sandbox_file_id) or a new file (resource_id + filename + sandbox_file_id). Returns { saved, file_id, file_hash, bytes } on success \u2014 the file_id you can reference later. Errors clearly when write access is denied or when neither identifier set is provided."
       },
+      // The code sandbox (wayai#5083 Phase 3). The figures in its description are the backend's
+      // sandbox limits (`apps/backend/src/sandbox/limits.ts`), pinned there by a test, so the model is
+      // told the limits the sandbox enforces.
+      "bash": {
+        "tool_config": {
+          "name": "bash",
+          "description": "Run a Bash command in this conversation's sandbox: a disposable Linux container (Debian, with Python 3, curl, jq, zip and other common tools) whose working directory is /workspace. The sandbox starts on the first command and keeps its files between commands in this conversation, but it ends after 10 minutes without use or 60 minutes in all; the next command then starts an empty one, and its result says so. What the sandbox can reach over the network is set for this agent by a hub admin; with no network, nothing leaves it. A command runs for at most timeout_seconds and never past the turn's own time limit. Long output keeps only its first and last parts. The result gives the exit code, stdout and stderr.",
+          "strict": false,
+          "parameters": {
+            "type": "object",
+            "properties": {
+              "command": {
+                "type": "string",
+                "description": "The Bash script to run, as with `bash -c`. It runs in /workspace unless it changes directory."
+              },
+              "timeout_seconds": {
+                "type": "integer",
+                "description": "How long the command may run before it is killed, in seconds: 120 by default, at most 540.",
+                "minimum": 1,
+                "maximum": 540
+              }
+            },
+            "required": [
+              "command"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "tool_instructions": null
+      },
+      "copy_to_sandbox": {
+        "tool_config": {
+          "name": "copy_to_sandbox",
+          "description": `Copy one of this conversation's files into the code sandbox, so commands run with bash can read or edit it there. path names the file as read_file does: this conversation's attachments under "conversation/" (e.g. "conversation/report.xlsx"), or an earlier conversation's under "conversations/<conversation_id>/<name>". Hub resource files cannot be copied. The copy lands at sandbox_path, replacing any file there; a file larger than 25 MiB is refused. If no sandbox is running, the copy starts an empty one.`,
+          "strict": false,
+          "parameters": {
+            "type": "object",
+            "properties": {
+              "path": {
+                "type": "string",
+                "description": `The file to copy, as read_file names it: "conversation/<name>" (a shorter unambiguous form or the file's id also works) or "conversations/<conversation_id>/<name>".`
+              },
+              "sandbox_path": {
+                "type": "string",
+                "description": "Where the copy lands in the sandbox, under /workspace (a relative path is taken from /workspace). Defaults to the file's name in /workspace."
+              }
+            },
+            "required": [
+              "path"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "tool_instructions": null
+      },
+      "copy_from_sandbox": {
+        "tool_config": {
+          "name": "copy_from_sandbox",
+          "description": 'Copy a file out of the code sandbox into this conversation, so what your commands produced (a chart, a converted document) is kept after the sandbox ends. The file is stored for the support team on an internal note and is NOT sent to the customer: the result gives its path under "conversation/", and send_files with that path delivers it when it should reach them. A file larger than 25 MiB is refused.',
+          "strict": false,
+          "parameters": {
+            "type": "object",
+            "properties": {
+              "sandbox_path": {
+                "type": "string",
+                "description": "The file to copy, under /workspace (a relative path is taken from /workspace)."
+              },
+              "name": {
+                "type": "string",
+                "description": `The stored file's name, with no folders (e.g. "q3-report.xlsx"). Defaults to the file's name in the sandbox.`
+              }
+            },
+            "required": [
+              "sandbox_path"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "tool_instructions": null
+      },
       "send_files": {
         "tool_config": {
           "name": "send_files",
@@ -2232,6 +2404,7 @@ var init_chunk_SNA2DXAC = __esm({
       }
     };
     WAYAI_CONNECTOR = "b17d9f3a-4e1b-46c9-b648-a2f0c3611aa4";
+    SANDBOX_AGENT_ROLES = [...PILOT_TRACK_ROLES, ...COPILOT_TRACK_ROLES];
     BASE_NATIVE_TOOLS = [
       // --- Wayai core tools ---
       { tool_native_id: "nt-001", tool_name: "transfer_to_agent", tool_display_name: "Transfer to Agent", tool_description: "Transfer the conversation to another AI agent", connector_id: WAYAI_CONNECTOR, operation: "transfer_to_agent", tool_method: "internal", tool_group: "Native Tools", is_delegation: true, is_auto_set: false, execution_config: null, side_effects: false },
@@ -2323,7 +2496,17 @@ var init_chunk_SNA2DXAC = __esm({
       // would need remapping on both branching mechanisms and normalizing on both CI
       // directions. `action.tool_name`, one key away in the same object, is the
       // precedent.
-      { tool_native_id: "nt-029", tool_name: "run_monitor", tool_display_name: "Run Monitor", tool_description: "Run another monitor on this hub and let it act on its own rules", connector_id: WAYAI_CONNECTOR, operation: "run_monitor", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: true, assignable_roles: ["monitor"], model_callable: false }
+      { tool_native_id: "nt-029", tool_name: "run_monitor", tool_display_name: "Run Monitor", tool_description: "Run another monitor on this hub and let it act on its own rules", connector_id: WAYAI_CONNECTOR, operation: "run_monitor", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: true, assignable_roles: ["monitor"], model_callable: false },
+      // The code sandbox (wayai#5083 Phase 3): runs only for an agent whose `code_execution_enabled`
+      // setting is on, on any provider. Side effects: under an Allowlist or Web network setting, the
+      // code it runs can send data out of the conversation.
+      { tool_native_id: "nt-030", tool_name: "bash", tool_display_name: "Run Code (Bash)", tool_description: "Run a Bash command in the conversation's code sandbox", connector_id: WAYAI_CONNECTOR, operation: "bash", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: true, assignable_roles: SANDBOX_AGENT_ROLES },
+      // Copies a conversation file INTO the sandbox: the sandbox is conversation state, so nothing
+      // leaves the conversation.
+      { tool_native_id: "nt-031", tool_name: "copy_to_sandbox", tool_display_name: "Copy File to Sandbox", tool_description: "Copy one of the conversation's files into its code sandbox", connector_id: WAYAI_CONNECTOR, operation: "copy_to_sandbox", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, assignable_roles: SANDBOX_AGENT_ROLES },
+      // Copies a sandbox file OUT into the conversation, as an internal note for the team: nothing
+      // reaches the customer until `send_files` sends it.
+      { tool_native_id: "nt-032", tool_name: "copy_from_sandbox", tool_display_name: "Copy File from Sandbox", tool_description: "Copy a file out of the code sandbox into the conversation, for the team", connector_id: WAYAI_CONNECTOR, operation: "copy_from_sandbox", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, assignable_roles: SANDBOX_AGENT_ROLES }
     ];
     NATIVE_TOOLS = BASE_NATIVE_TOOLS.map((base) => {
       const schema = NATIVE_TOOL_SCHEMAS[base.tool_name];
@@ -2812,8 +2995,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path41, errorMaps, issueData } = params;
-      const fullPath = [...path41, ...issueData.path || []];
+      const { data, path: path42, errorMaps, issueData } = params;
+      const fullPath = [...path42, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -3124,11 +3307,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path41, key) {
+      constructor(parent, value, path42, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path41;
+        this._path = path42;
         this._key = key;
       }
       get path() {
@@ -6552,66 +6735,6 @@ var init_chunk_3NS3HULK = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-DHPUPI4Y.js
-function normalizeAuthType(raw) {
-  if (VALID_AUTH_TYPES.has(raw)) return raw;
-  return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
-}
-var AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, PILOT_TRACK_ROLES, CUSTOMER_FACING_AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SKILL_INSTALL_COMMAND;
-var init_chunk_DHPUPI4Y = __esm({
-  "../../packages/core/dist/chunk-DHPUPI4Y.js"() {
-    "use strict";
-    AUTH_TYPE = {
-      OAUTH: "oauth",
-      API_KEY: "api_key",
-      BASIC_AUTH: "basic_auth",
-      BEARER: "bearer",
-      NONE: "none"
-    };
-    ORG_CREDENTIAL_AUTH_TYPES = [
-      AUTH_TYPE.API_KEY,
-      AUTH_TYPE.BEARER,
-      AUTH_TYPE.BASIC_AUTH
-    ];
-    AUTH_TYPE_DISPLAY = {
-      [AUTH_TYPE.OAUTH]: "OAuth",
-      [AUTH_TYPE.API_KEY]: "API Key",
-      [AUTH_TYPE.BASIC_AUTH]: "Basic Auth",
-      [AUTH_TYPE.BEARER]: "Bearer Token",
-      [AUTH_TYPE.NONE]: "No Authentication"
-    };
-    LEGACY_AUTH_TYPE_MAP = {
-      "OAuth": AUTH_TYPE.OAUTH,
-      "API Key": AUTH_TYPE.API_KEY,
-      "Basic Auth": AUTH_TYPE.BASIC_AUTH,
-      "Bearer Token": AUTH_TYPE.BEARER,
-      "No authentication": AUTH_TYPE.NONE,
-      // Also handle the old DISPLAY_TO_CODE bug where 'basic' was used instead of 'basic_auth'
-      "basic": AUTH_TYPE.BASIC_AUTH
-    };
-    VALID_AUTH_TYPES = new Set(Object.values(AUTH_TYPE));
-    AGENT_ROLES = [
-      "pilot",
-      "copilot",
-      "pilot_specialist",
-      "copilot_specialist",
-      "pilot_advisor",
-      "copilot_advisor",
-      "monitor",
-      "conversation_evaluator",
-      "message_evaluator",
-      "summarizer",
-      "consultant",
-      "pilot_voice"
-    ];
-    PILOT_TRACK_ROLES = ["pilot", "pilot_specialist"];
-    CUSTOMER_FACING_AGENT_ROLES = [...PILOT_TRACK_ROLES, "pilot_advisor"];
-    SAFE_USER_ID_REGEX = /^[A-Za-z0-9_-]{1,64}$/;
-    SUPPORTED_LOCALES = ["en", "pt", "es"];
-    SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
-  }
-});
-
 // ../../packages/core/dist/chunk-L5F7ZOUJ.js
 function schemaToQuestions(schema) {
   const classified = classifySchema(schema);
@@ -6790,7 +6913,7 @@ var init_chunk_T7KQKDET = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-6O3TITL5.js
+// ../../packages/core/dist/chunk-2745FTNX.js
 function containsKanbanPlaceholders(value) {
   if (value == null) return false;
   const serialized = typeof value === "string" ? value : JSON.stringify(value);
@@ -6822,12 +6945,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path41, errors, opts = {}) {
+function validateSchema(schema, path42, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path41 || "<root>",
+      path: path42 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -6835,7 +6958,7 @@ function validateSchema(schema, path41, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path41,
+      path: path42,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -6843,14 +6966,14 @@ function validateSchema(schema, path41, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path41 ? `${path41}.type` : "type",
+        path: path42 ? `${path42}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path41}.type`,
+      path: `${path42}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -6860,25 +6983,25 @@ function validateSchema(schema, path41, errors, opts = {}) {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       const isOutcomePlaceholder = e === "[KANBAN_OUTCOME_VALUES]";
       errors.push({
-        path: `${path41}.enum`,
+        path: `${path42}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isOutcomePlaceholder ? "Declare `outcomes` on the hub's terminal kanban status so the platform can render the placeholder into a valid array; with none configured the platform drops the parameter instead." : isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path41}.enum`,
+        path: `${path42}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path41}.enum`,
+        path: `${path42}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path41}.enum[${i}]`,
+            path: `${path42}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -6888,7 +7011,7 @@ function validateSchema(schema, path41, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path41}.${key}`,
+        path: `${path42}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -6897,45 +7020,45 @@ function validateSchema(schema, path41, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path41}.properties`,
+        path: `${path42}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path41}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path42}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path41}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path42}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path41}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path42}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema(schema[key], `${path41}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path42}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path41}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path42}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path41}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path42}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path41}.${k}`;
+    const fieldPath = `${path42}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -6991,12 +7114,12 @@ function validateFollowupLinks(followups, label, ctx) {
   const linkTargets = /* @__PURE__ */ new Set();
   followups.forEach((followup, i) => {
     const ref = followup?.after_followup_id;
-    const path41 = ["followups", i, "after_followup_id"];
+    const path42 = ["followups", i, "after_followup_id"];
     if (followup?.type !== "inactivity_after_before_event") {
       if (ref !== void 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path41,
+          path: path42,
           message: `kanban status ${label}: after_followup_id is only valid on inactivity_after_before_event followups (this one is ${followup?.type})`
         });
       }
@@ -7005,7 +7128,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (ref === void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path41,
+        path: path42,
         message: `kanban status ${label}: inactivity_after_before_event requires after_followup_id naming the id of a before_event followup in the same status`
       });
       return;
@@ -7015,7 +7138,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (matches.length > 1) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path41,
+        path: path42,
         message: `kanban status ${label}: after_followup_id "${ref}" matches ${matches.length} followups \u2014 a link must name exactly one`
       });
       return;
@@ -7027,7 +7150,7 @@ function validateFollowupLinks(followups, label, ctx) {
       );
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path41,
+        path: path42,
         message: hasIdlessBeforeEvent ? `kanban status ${label}: after_followup_id "${ref}" matches no followup \u2014 a link target must declare an explicit id, and this status has before_event followups without one` : `kanban status ${label}: after_followup_id "${ref}" matches no followup in this status`
       });
       return;
@@ -7035,7 +7158,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (target.type !== "before_event") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path41,
+        path: path42,
         message: `kanban status ${label}: after_followup_id "${ref}" points at a ${target.type} followup \u2014 only before_event followups can anchor a chain`
       });
     }
@@ -7305,9 +7428,9 @@ function monitorRuleActions(monitorConfig) {
   if (!monitorConfig || typeof monitorConfig !== "object") return [];
   const config = monitorConfig;
   const found = [];
-  const visit = (action, path41) => {
+  const visit = (action, path42) => {
     if (!action || typeof action !== "object" || Array.isArray(action)) return;
-    found.push({ action, path: path41 });
+    found.push({ action, path: path42 });
   };
   if (Array.isArray(config.rules)) {
     config.rules.forEach((rule, index) => {
@@ -7339,25 +7462,25 @@ function collectMonitorRuleIssues(monitorConfig) {
   const trigger = resolveMonitorTrigger(monitorConfig);
   const kinds = monitorRuleActionKinds(trigger);
   const issues = [...callUtteranceRuleIssues(monitorConfig), ...automationGateIssues(monitorConfig)];
-  for (const { action, path: path41 } of monitorRuleActions(monitorConfig)) {
-    if (trigger === "call_utterance" && path41[0] === "fallback") continue;
+  for (const { action, path: path42 } of monitorRuleActions(monitorConfig)) {
+    if (trigger === "call_utterance" && path42[0] === "fallback") continue;
     const kind = action.kind;
     if (typeof kind === "string" && !kinds.includes(kind)) {
-      issues.push({ path: [...path41, "kind"], message: monitorActionKindMessage(kind, trigger) });
+      issues.push({ path: [...path42, "kind"], message: monitorActionKindMessage(kind, trigger) });
     }
     const toolName = action.tool_name;
     if (kind === "call_tool" && typeof toolName === "string" && isRefusedNativeToolName(toolName, trigger)) {
-      issues.push({ path: [...path41, "tool_name"], message: monitorRuleToolNotAllowedMessage(toolName, trigger) });
+      issues.push({ path: [...path42, "tool_name"], message: monitorRuleToolNotAllowedMessage(toolName, trigger) });
       continue;
     }
     if (kind === "call_tool" && toolName === INSERT_NOTE_TOOL_NAME) {
-      issues.push(...insertNoteArgumentIssues(action, path41));
+      issues.push(...insertNoteArgumentIssues(action, path42));
     }
     if (kind === "call_tool" && toolName === RUN_MONITOR_TOOL_NAME) {
       const callee = readRunMonitorCallee(action);
       if (!callee.ok) {
         issues.push({
-          path: [...path41, "args", "monitor_name"],
+          path: [...path42, "args", "monitor_name"],
           message: runMonitorCalleeMessage(callee.reason)
         });
       }
@@ -7417,11 +7540,11 @@ function insertNoteTemplateMessage(reason) {
       return `insert_note's template is longer than the ${MONITOR_NOTE_TEMPLATE_MAX}-character limit.`;
   }
 }
-function insertNoteArgumentIssues(action, path41) {
+function insertNoteArgumentIssues(action, path42) {
   const result = readInsertNoteTemplate(action);
   if (result.ok) return [];
   return [{
-    path: [...path41, "args", "template"],
+    path: [...path42, "args", "template"],
     message: insertNoteTemplateMessage(result.reason)
   }];
 }
@@ -7518,8 +7641,8 @@ function evalInitialStateError(input) {
     const parsed = evalInitialStateEntry.safeParse(entries[i]);
     if (!parsed.success) {
       const issue = parsed.error.issues[0];
-      const path41 = issue?.path.join(".") || "?";
-      return `initial_state[${i}].${path41} is invalid: ${issue?.message ?? "malformed"}`;
+      const path42 = issue?.path.join(".") || "?";
+      return `initial_state[${i}].${path42} is invalid: ${issue?.message ?? "malformed"}`;
     }
     if (seenSlugs.has(parsed.data.slug)) {
       return `initial_state[${i}].slug "${parsed.data.slug}" is declared more than once`;
@@ -7743,10 +7866,10 @@ function refineHubAsCodeEvals(config, ctx) {
 function refineHubAsCodeEvalAttachments(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path41, turn, name) => {
+  const addTurnIssue = (path42, turn, name) => {
     const error = evalTurnAttachmentsError(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path41, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path42, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes(turn)) referencedHashes.add(hash);
@@ -7821,17 +7944,17 @@ function refineHubAsCodeCallOpenings(config, ctx) {
       const agent = entry;
       const openings = agent?.call_openings;
       if (openings === void 0 || openings === null) return;
-      const path41 = ["agents", a, "call_openings"];
+      const path42 = ["agents", a, "call_openings"];
       const name = `agent "${typeof agent?.name === "string" ? agent.name : "<unnamed>"}"`;
       if (typeof openings !== "object" || Array.isArray(openings)) {
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path41, message: `${name}: call_openings must map a language to an opening` });
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path42, message: `${name}: call_openings must map a language to an opening` });
         return;
       }
       if (agent?.role !== "pilot_voice" && Object.keys(openings).length > 0) {
-        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path41, message: `${name}: only a pilot_voice agent has call_openings` });
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path42, message: `${name}: only a pilot_voice agent has call_openings` });
       }
       for (const [language, raw] of Object.entries(openings)) {
-        const at = [...path41, language];
+        const at = [...path42, language];
         if (!callOpeningLanguage.safeParse(language).success) {
           ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: at, message: `${name}: call_openings language must be one of ${CALL_OPENING_LANGUAGES.join(", ")}` });
           continue;
@@ -7958,11 +8081,11 @@ function refineHubAsCodeDelegation(config, ctx) {
         }
       }
       if (del.context_boundary === void 0) return;
-      const path41 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
+      const path42 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
       if (del.type !== "hub") {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path41,
+          path: path42,
           message: `context_boundary applies only to \`type: hub\` delegations (got type "${String(del.type)}")`
         });
         return;
@@ -7970,7 +8093,7 @@ function refineHubAsCodeDelegation(config, ctx) {
       if (!CONTEXT_BOUNDARIES.includes(del.context_boundary)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path41,
+          path: path42,
           message: `context_boundary must be one of: ${CONTEXT_BOUNDARIES.join(", ")}`
         });
       }
@@ -8114,10 +8237,10 @@ function refineHubAsCodeMonitorRulesOutput(config, ctx) {
   });
 }
 var PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, uuidSchema, USER_ID_REGEX, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, MESSAGE_ENVELOPE_HEADROOM_BYTES, MAX_AUDIO_FILE_BASE64_BYTES, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupTypeSchema, EVENT_RELATIVE_FOLLOWUP_TYPES, followupTimeUnitSchema, followupIdSchema, SELECTABLE_FOLLOWUP_TYPES, MAX_LINKED_FOLLOWUP_TARGETS_PER_STATUS, followupSchema, MAX_OUTCOMES_PER_STATUS, kanbanOutcomeSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, HUB_DISPLAY_NAME_MAX_CHARS, HUB_WELCOME_MESSAGE_MAX_CHARS, HUB_STARTER_QUESTIONS_MAX, HUB_STARTER_QUESTION_MAX_CHARS, displayName, welcomeMessage, starterQuestions, hubDisplayNamesSchema, hubWelcomeMessagesSchema, hubStarterQuestionsSchema, hubDisplayNamesField, hubWelcomeMessagesField, hubStarterQuestionsField, HUB_PRESENTATION_FIELDS, HUB_PRESENTATION_SCHEMAS, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, HUB_USERS_PAGE_SIZE_MAX, HUB_USERS_SEARCH_MAX, HUB_USERS_CHANNEL_TYPES, getHubUsersQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, MAX_EVAL_RETENTION_DAYS, MAX_END_USER_DAILY_MESSAGE_LIMIT, endUserDailyMessageLimitField, previewLabelField, hubTagsField, createHubBody, updateHubBody, HUB_TAG_CHANGE_REFUSED, hubTagChangeRefusalSchema, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, CONTACT_ACCESS_PAGE_SIZE_MAX, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, HUB_DIFF_SECTION_SET, HUB_DIFF_SECTIONS, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, PREVIOUS_CONVERSATIONS_MAX, NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, AUTOMATION_GATE_TRIGGERS, NON_FIRING_TRIGGERS, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, MONITOR_GATE_AGENT_NAME_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, MONITOR_AUTOMATION_FIRE_ACTION_KINDS, MONITOR_AUTOMATION_ITEM_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE, AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE, AUTOMATION_GATE_KEY_MESSAGES, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, evalDateContextSchema, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, runJourneyQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, evalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, EVAL_ATTACHMENT_HASH_REGEX, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT, MAX_RESOURCE_FILE_SIZE, CALL_OPENING_LANGUAGES, callOpeningLanguage, CALL_OPENING_MAX_DURATION_MS, CALL_OPENING_MAX_BYTES, CALL_OPENING_CAPTION_MAX_CHARS, CALL_OPENING_CONTENT_TYPES, callOpeningContentType, CALL_OPENING_HASH_REGEX, callOpeningHash, callOpeningCaption, storedCallOpening, MAX_CALL_OPENING_ENCODED_BYTES, MAX_CALL_OPENING_BODY_BYTES, agentCallOpeningParams, putAgentCallOpeningBody, deleteAgentCallOpeningQuery, callOpeningParam, callOpeningQuery, MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
-var init_chunk_6O3TITL5 = __esm({
-  "../../packages/core/dist/chunk-6O3TITL5.js"() {
+var init_chunk_2745FTNX = __esm({
+  "../../packages/core/dist/chunk-2745FTNX.js"() {
     "use strict";
-    init_chunk_SNA2DXAC();
+    init_chunk_QT7NKKPO();
     init_chunk_MIWZOSPI();
     init_chunk_IBL7FANV();
     init_chunk_2ISUBJG7();
@@ -9610,7 +9733,7 @@ var init_chunk_6O3TITL5 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-RBKQBA3D.js
+// ../../packages/core/dist/chunk-3OSR5AZZ.js
 function cacheReconcileIdCount(body) {
   return body.conversations.length + body.histories.reduce((n, history) => n + history.conversation_ids.length, 0) + body.threads.length;
 }
@@ -9656,16 +9779,16 @@ function parseCommunityLessonVideoUrl(url) {
   const parts = /^https?:\/\/([^/?#]+)([^?#]*)(?:\?([^#]*))?(?:#.*)?$/i.exec(url.trim());
   if (!parts) return null;
   const host = parts[1].toLowerCase();
-  const path41 = parts[2] ?? "";
+  const path42 = parts[2] ?? "";
   const query = parts[3] ?? "";
   let id;
   if (host === YOUTU_BE) {
-    id = /^\/([A-Za-z0-9_-]{11})\/?$/.exec(path41)?.[1];
+    id = /^\/([A-Za-z0-9_-]{11})\/?$/.exec(path42)?.[1];
   } else if (YOUTUBE_HOSTS.has(host)) {
-    if (path41 === "/watch" || path41 === "/watch/") {
+    if (path42 === "/watch" || path42 === "/watch/") {
       id = query.split("&").find((param) => param.startsWith("v="))?.slice(2);
     } else {
-      id = YOUTUBE_ID_PATH.exec(path41)?.[1];
+      id = YOUTUBE_ID_PATH.exec(path42)?.[1];
     }
   }
   return id !== void 0 && YOUTUBE_ID.test(id) ? { provider: "youtube", id } : null;
@@ -9676,13 +9799,13 @@ function communityLessonVideoWatchUrl(video) {
       return `https://www.youtube.com/watch?v=${video.id}`;
   }
 }
-var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, CALL_STATUSES, callStatus, CALL_END_REASONS, callEndReason, CALL_TRANSPORTS, callTransport, CALL_PARTICIPANT_TYPES, callParticipantType, callInstant, MAX_SDP_OFFER_LENGTH, sdpDescription, sdpOffer, MAX_CALL_REQUEST_BODY_BYTES, hubScoped, callSummaryFields, callSummary, callIdParam, createCallBody, createCallResponse, callReadyBody, callHangupBody, callStatusQuery, MAX_REPORTED_DELEGATION_IDS, callDelegationId, callDelegationsBody, callResponse, MAX_CALL_RECORDING_GAPS, callRecordingGap, callRecordingNoteMetadata, evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, recordAiDisclosureAcceptanceBody, activityQuery, deletionModeSchema, deletionRequestBody, CACHE_RECONCILE_MAX_IDS, CACHE_RECONCILE_MAX_HUBS, cacheReconcileScopeSchema, cachedConversationPageSchema, cachedHistoryThreadSchema, cachedPeopleThreadSchema, cacheReconcileBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, planKeySchema, billingStatusSchema, paidTierSchema, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, changeTierBody, updateBillingCurrencyBody, invoicesQuery, billingPlanTypeSchema, dataUsageCountersSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, SIGN_URL_MAX_EXPIRES_IN_SECONDS, signUrlBody, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, CONTACT_ENVIRONMENTS, CONTACT_NAME_MAX, CONTACT_EMAIL_MAX, CONTACT_PHONE_INPUT_MAX, CONTACT_INSTAGRAM_SID_MAX, CONTACT_METADATA_MAX_BYTES, CONTACT_LABEL_MAX, CONTACT_LABELS_MAX, CONTACT_SCOPE_TAGS_MAX, CONTACT_PAGE_MAX, CONTACT_IMPORT_BATCH_MAX, CONTACT_SEARCH_MAX, CONTACT_LIST_NAME_MAX, CONTACT_LIST_NAME_REGEX, CONTACT_LIST_DESCRIPTION_MAX, CONTACT_LIST_FILTER_MAX, CONTACT_LIST_PINS_PER_REQUEST_MAX, SUPPRESSION_SCOPES, SUPPRESSION_ID_REGEX, contactName, contactPhone, contactEmail, contactInstagramSid, contactLabel, contactLabels, contactMetadata, scopeTagIds, contactVisibilitySchema, hasIdentity, IDENTITY_REQUIRED, contactBookOrgQuery, contactBookContactParam, contactBookListParam, contactBookHubParam, contactBookPageQuery, listContactBookContactsQuery, listHubContactBookContactsQuery, contactBookLinkCandidatesQuery, listContactBookListMembersQuery, contactRowFields, createContactBookContactBody, updateContactBookContactBody, contactImportRowSchema, importContactBookContactsBody, linkContactBookContactBody, listName, contactListFilterSchema, createContactBookListBody, updateContactBookListBody, updateContactBookListPinsBody, suppressionIdentitySchema, createContactBookSuppressionBody, contactBookSuppressionParam, listContactBookSuppressionsQuery, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, contactBookEmailUnsubscribeTokenSchema, contactBookEmailUnsubscribeQuery, orgListReferenceSchema, hubListNameSchema, HUB_LIST_FILTER_REQUIRED, hubContactListFilterSchema, hubContactListIdParam, hubContactListHubQuery, description, createHubContactListBody, updateHubContactListBody, AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, AUTOMATION_WEBHOOK_MOUNT, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam, VERSION_PART, MOBILE_APP_VERSION_RE, mobileAppVersionSchema, MOBILE_PLATFORMS, mobilePlatformSchema, mobileVersionPolicyQuery, mobileVersionPolicySchema, mobileVersionPolicyResponse, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, TURN_DEADLINE_SECONDS_FLOOR, TURN_DEADLINE_SECONDS_MAX, turnDeadlineSeconds, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, META_ENTITY_ID_PATTERN, metaEntityId, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, normalizeEmail, REVIEW_ACCOUNT_EMAILS, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, invitePreviewQuery, inviteRolePreviewResponse, inviteContactPreviewResponse, invitePreviewResponse, inviteUnsubscribeBody, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, baseDestructionConfirmBody, BASE_DESTRUCTION_GRACE_MS, BASE_DESTRUCTION_CONFIRM_TTL_MS, BASE_DESTRUCTION_ORG_QUERY_PARAM, baseDestructionQuery, baseDestructionParam, baseDestructionInitiateBody, baseDestructionStatus, baseDestructionRequest, baseDestructionListResponse, baseDestructionInitiateResponse, baseDestructionConfirmResponse, baseDestructionCancelResponse, rekorBaseChangeMessageSchema, baseEnvironmentSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorToolsetToolsSchema, rekorResolvedToolsetSchema, PEOPLE_CONTACT_PAGE_MAX, PEOPLE_CONTACT_PAGE_DEFAULT, PEOPLE_CONTACT_EMAIL_MAX_LENGTH, peopleUserIdSchema, peopleInviteEmailSchema, peopleContactInviteBody, peopleContactInviteIdParam, peopleContactUserIdParam, peopleContactBlockBody, peopleContactPageQuery, peopleOutgoingInviteSchema, peopleContactPersonSchema, peopleContactSchema, peopleIncomingInviteSchema, peopleBlockedUserSchema, PEOPLE_THREAD_MESSAGE_MAX_LENGTH, PEOPLE_THREAD_MESSAGES_PAGE_MAX, PEOPLE_THREAD_PAGE_MAX, PEOPLE_THREAD_PAGE_DEFAULT, PEOPLE_GROUP_NAME_MAX_LENGTH, PEOPLE_GROUP_AVATAR_URL_MAX_LENGTH, PEOPLE_THREAD_ATTACHMENT_MAX_BYTES, PEOPLE_THREAD_ATTACHMENT_NAME_MAX_LENGTH, PEOPLE_ATTACHMENT_STORAGE_PER_USER_BYTES, PEOPLE_THREAD_ATTACHMENT_MAX_MB, PEOPLE_THREAD_ATTACHMENT_URL_TTL_SECONDS, PEOPLE_THREAD_ATTACHMENT_URLS_MAX, peopleThreadIdParam, peopleThreadMessageIdParam, peopleThreadListQuery, peopleThreadMessagesQuery, peopleThreadAttachmentUploadSchema, peopleThreadSendBody, peopleThreadAttachmentUrlsBody, peopleThreadReadBody, peopleThreadSettingsBody, peopleGroupNameSchema, peopleGroupAvatarUrlSchema, peopleGroupCreateBody, peopleOrgDirectBody, peopleGroupUpdateBody, peopleGroupInviteBody, peopleOrgErasureBody, peopleGroupLeaveBody, peopleGroupInviteIdParam, peopleGroupIncomingInviteIdParam, peopleGroupMemberParam, peopleThreadKindSchema, peopleThreadMemberSchema, peopleThreadLastMessageSchema, peopleGroupRoleSchema, peopleGroupSummarySchema, peopleThreadSummarySchema, peopleThreadAttachmentSchema, peopleThreadMessageSchema, peopleGroupMemberSchema, peopleGroupSentInviteSchema, peopleGroupIncomingInviteSchema, PEOPLE_REPORT_DETAILS_MAX_LENGTH, peopleReportReasonSchema, reportDetailsSchema, reportFields, peopleReportBody, PEOPLE_MODERATION_NOTE_MAX_LENGTH, ADMIN_PEOPLE_REPORTS_PAGE_MAX, ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT, PEOPLE_SUSPENDED_REASON, peopleModerationActionSchema, moderationNoteSchema, adminPeopleReportListQuery, adminPeopleReportIdParam, adminPeopleMessageRemovalBody, adminPeopleSuspendBody, adminPeopleNoteBody, COMMUNITIES_PER_ORG_MAX, COMMUNITY_NAME_MAX_LENGTH, COMMUNITY_REGISTRY_CLOSED_REASON, COMMUNITY_MEMBERS_MAX, COMMUNITY_ADMISSIONS, COMMUNITY_ACCESS_MAX, COMMUNITY_ACCESS_ADD_MAX, COMMUNITY_ACCESS_FULL_REASON, COMMUNITY_JOIN_SOURCE_MAX_LENGTH, COMMUNITY_JOIN_FLOW_TOKEN_MAX_LENGTH, COMMUNITY_ROOMS_MAX, COMMUNITY_ROOM_NAME_MAX_LENGTH, COMMUNITY_MESSAGE_MAX_LENGTH, COMMUNITY_MESSAGES_PAGE_SIZE, COMMUNITY_ATTACHMENT_URLS_MAX, COMMUNITY_POST_TITLE_MAX_LENGTH, COMMUNITY_POST_SEARCH_MAX_LENGTH, COMMUNITY_MEMBER_STATUSES, COMMUNITY_RULES_MAX_LENGTH, COMMUNITY_SLOW_MODE_MAX_SECONDS, COMMUNITY_COURSES_LABEL_MAX_LENGTH, COMMUNITY_LIVE_TICKET_PREFIX, COMMUNITY_STATS_DAYS, communityNameSchema, adminCreateCommunityBody, communityIdParam, communityJoinTokenSchema, communityJoinSourceSchema, communityJoinPreviewQuery, communityJoinBody, communityRoomKindSchema, communityRoomNameSchema, communityRoomIdParam, communityMessageIdParam, communityRoomCreateBody, communityRoomUpdateBody, communityMessagesQuery, communityMessageBodySchema, communityPostTitleSchema, communityAttachmentUploadSchema, communitySendBody, communityEditBody, communityPostIdParam, communityPostsQuery, communityAnswerBody, communityReadBody, communityAttachmentUrlsBody, communityPersonParam, communityOrgParam, communityPeopleQuery, communityCoursesLabelSchema, communityAdmissionSchema, communitySettingsBody, communityAccessEmailSchema, communityAccessAddBody, communityAccessQuery, communityAccessIdParam, communityBanBody, communityLockBody, communityPinBody, communityModLogQuery, communityReportsQuery, communityReportIdParam, communityLiveTicketSchema, communityLiveQuery, communityMuteBody, communityEmailUnsubscribeTokenSchema, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, communityEmailUnsubscribeQuery, COMMUNITY_COURSES_MAX, COMMUNITY_COURSE_MODULES_MAX, COMMUNITY_COURSE_LESSONS_MAX, COMMUNITY_LESSONS_MAX, COMMUNITY_COURSE_TITLE_MAX_LENGTH, COMMUNITY_COURSE_DESCRIPTION_MAX_LENGTH, COMMUNITY_LESSON_BODY_MAX_LENGTH, COMMUNITY_LESSON_LINKS_MAX, COMMUNITY_LESSON_URL_MAX_LENGTH, YOUTUBE_ID, YOUTUBE_HOSTS, YOUTU_BE, YOUTUBE_ID_PATH, communityCourseIdParam, communityCourseModuleIdParam, communityLessonIdParam, communityCourseTitleSchema, communityCourseDescriptionSchema, communityCoursePositionSchema, communityLessonVideoUrlSchema, communityLessonLinkSchema, communityLessonLinksSchema, communityLessonBodySchema, communityCourseCreateBody, communityCourseUpdateBody, communityModuleCreateBody, communityModuleUpdateBody, communityLessonCreateBody, communityLessonUpdateBody, COMMUNITY_LESSON_TREE_MAX_BYTES, COMMUNITY_LESSON_LINK_PROTOCOLS, COMMUNITY_LESSON_TREE_TOO_LARGE_REASON, COMMUNITY_LESSON_TREE_TOO_DEEP_REASON, COMMUNITY_LESSON_LINE_PREFIX_TOO_WIDE_REASON, LINK_SCHEME, adminSetGuideHubBody, GUIDE_HUB_INELIGIBLE_REASON;
-var init_chunk_RBKQBA3D = __esm({
-  "../../packages/core/dist/chunk-RBKQBA3D.js"() {
+var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlTable, analyticsSqlSchemaQuery, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse, CALL_STATUSES, callStatus, CALL_END_REASONS, callEndReason, CALL_TRANSPORTS, callTransport, CALL_PARTICIPANT_TYPES, callParticipantType, callInstant, MAX_SDP_OFFER_LENGTH, sdpDescription, sdpOffer, MAX_CALL_REQUEST_BODY_BYTES, hubScoped, callSummaryFields, callSummary, callIdParam, createCallBody, createCallResponse, callReadyBody, callHangupBody, callStatusQuery, MAX_REPORTED_DELEGATION_IDS, callDelegationId, callDelegationsBody, callResponse, MAX_CALL_RECORDING_GAPS, callRecordingGap, callRecordingNoteMetadata, evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, recordAiDisclosureAcceptanceBody, activityQuery, deletionModeSchema, deletionRequestBody, CACHE_RECONCILE_MAX_IDS, CACHE_RECONCILE_MAX_HUBS, cacheReconcileScopeSchema, cachedConversationPageSchema, cachedHistoryThreadSchema, cachedPeopleThreadSchema, cacheReconcileBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, copilotSuggestBody, copilotSuggestResponse, CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS, billingOrgIdParam, subscriptionItemParams, planKeySchema, billingStatusSchema, paidTierSchema, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, changeTierBody, updateBillingCurrencyBody, invoicesQuery, billingPlanTypeSchema, dataUsageCountersSchema, REKOR_ENTITLEMENT_CONTRACT_VERSION, entitlementProjectionSchema, rekorEntitlementRefreshMessageSchema, downloadBody, uploadQuery, SIGN_URL_MAX_EXPIRES_IN_SECONDS, signUrlBody, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, CONTACT_ENVIRONMENTS, CONTACT_NAME_MAX, CONTACT_EMAIL_MAX, CONTACT_PHONE_INPUT_MAX, CONTACT_INSTAGRAM_SID_MAX, CONTACT_METADATA_MAX_BYTES, CONTACT_LABEL_MAX, CONTACT_LABELS_MAX, CONTACT_SCOPE_TAGS_MAX, CONTACT_PAGE_MAX, CONTACT_IMPORT_BATCH_MAX, CONTACT_SEARCH_MAX, CONTACT_LIST_NAME_MAX, CONTACT_LIST_NAME_REGEX, CONTACT_LIST_DESCRIPTION_MAX, CONTACT_LIST_FILTER_MAX, CONTACT_LIST_PINS_PER_REQUEST_MAX, SUPPRESSION_SCOPES, SUPPRESSION_ID_REGEX, contactName, contactPhone, contactEmail, contactInstagramSid, contactLabel, contactLabels, contactMetadata, scopeTagIds, contactVisibilitySchema, hasIdentity, IDENTITY_REQUIRED, contactBookOrgQuery, contactBookContactParam, contactBookListParam, contactBookHubParam, contactBookPageQuery, listContactBookContactsQuery, listHubContactBookContactsQuery, contactBookLinkCandidatesQuery, listContactBookListMembersQuery, contactRowFields, createContactBookContactBody, updateContactBookContactBody, contactImportRowSchema, importContactBookContactsBody, linkContactBookContactBody, listName, contactListFilterSchema, createContactBookListBody, updateContactBookListBody, updateContactBookListPinsBody, suppressionIdentitySchema, createContactBookSuppressionBody, contactBookSuppressionParam, listContactBookSuppressionsQuery, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, contactBookEmailUnsubscribeTokenSchema, contactBookEmailUnsubscribeQuery, orgListReferenceSchema, hubListNameSchema, HUB_LIST_FILTER_REQUIRED, hubContactListFilterSchema, hubContactListIdParam, hubContactListHubQuery, description, createHubContactListBody, updateHubContactListBody, AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, AUTOMATION_WEBHOOK_MOUNT, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam, VERSION_PART, MOBILE_APP_VERSION_RE, mobileAppVersionSchema, MOBILE_PLATFORMS, mobilePlatformSchema, mobileVersionPolicyQuery, mobileVersionPolicySchema, mobileVersionPolicyResponse, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, TURN_DEADLINE_SECONDS_FLOOR, TURN_DEADLINE_SECONDS_MAX, turnDeadlineSeconds, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, META_ENTITY_ID_PATTERN, metaEntityId, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, passwordLoginBody, normalizeEmail, REVIEW_ACCOUNT_EMAILS, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, invitePreviewQuery, inviteRolePreviewResponse, inviteContactPreviewResponse, invitePreviewResponse, inviteUnsubscribeBody, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, REKOR_BOUND_BASE_HEADER, REKOR_BOUND_TOOLSET_HEADER, DATA_BASE_GENERATION_HEADER, REKOR_MAX_ACTOR_ID_LENGTH, REKOR_MAX_ACTOR_LABEL_LENGTH, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, baseDestructionConfirmBody, BASE_DESTRUCTION_GRACE_MS, BASE_DESTRUCTION_CONFIRM_TTL_MS, BASE_DESTRUCTION_ORG_QUERY_PARAM, baseDestructionQuery, baseDestructionParam, baseDestructionInitiateBody, baseDestructionStatus, baseDestructionRequest, baseDestructionListResponse, baseDestructionInitiateResponse, baseDestructionConfirmResponse, baseDestructionCancelResponse, rekorBaseChangeMessageSchema, baseEnvironmentSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, TOOLSET_SLUG_PATTERN, REKOR_STRUCTURAL_ID_PATTERN, rekorToolsetToolsSchema, rekorBoundAttestation, rekorResolvedToolsetSchema, PEOPLE_CONTACT_PAGE_MAX, PEOPLE_CONTACT_PAGE_DEFAULT, PEOPLE_CONTACT_EMAIL_MAX_LENGTH, peopleUserIdSchema, peopleInviteEmailSchema, peopleContactInviteBody, peopleContactInviteIdParam, peopleContactUserIdParam, peopleContactBlockBody, peopleContactPageQuery, peopleOutgoingInviteSchema, peopleContactPersonSchema, peopleContactSchema, peopleIncomingInviteSchema, peopleBlockedUserSchema, PEOPLE_THREAD_MESSAGE_MAX_LENGTH, PEOPLE_THREAD_MESSAGES_PAGE_MAX, PEOPLE_THREAD_PAGE_MAX, PEOPLE_THREAD_PAGE_DEFAULT, PEOPLE_GROUP_NAME_MAX_LENGTH, PEOPLE_GROUP_AVATAR_URL_MAX_LENGTH, PEOPLE_THREAD_ATTACHMENT_MAX_BYTES, PEOPLE_THREAD_ATTACHMENT_NAME_MAX_LENGTH, PEOPLE_ATTACHMENT_STORAGE_PER_USER_BYTES, PEOPLE_THREAD_ATTACHMENT_MAX_MB, PEOPLE_THREAD_ATTACHMENT_URL_TTL_SECONDS, PEOPLE_THREAD_ATTACHMENT_URLS_MAX, peopleThreadIdParam, peopleThreadMessageIdParam, peopleThreadListQuery, peopleThreadMessagesQuery, peopleThreadAttachmentUploadSchema, peopleThreadSendBody, peopleThreadAttachmentUrlsBody, peopleThreadReadBody, peopleThreadSettingsBody, peopleGroupNameSchema, peopleGroupAvatarUrlSchema, peopleGroupCreateBody, peopleOrgDirectBody, peopleGroupUpdateBody, peopleGroupInviteBody, peopleOrgErasureBody, peopleGroupLeaveBody, peopleGroupInviteIdParam, peopleGroupIncomingInviteIdParam, peopleGroupMemberParam, peopleThreadKindSchema, peopleThreadMemberSchema, peopleThreadLastMessageSchema, peopleGroupRoleSchema, peopleGroupSummarySchema, peopleThreadSummarySchema, peopleThreadAttachmentSchema, peopleThreadMessageSchema, peopleGroupMemberSchema, peopleGroupSentInviteSchema, peopleGroupIncomingInviteSchema, PEOPLE_REPORT_DETAILS_MAX_LENGTH, peopleReportReasonSchema, reportDetailsSchema, reportFields, peopleReportBody, PEOPLE_MODERATION_NOTE_MAX_LENGTH, ADMIN_PEOPLE_REPORTS_PAGE_MAX, ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT, PEOPLE_SUSPENDED_REASON, peopleModerationActionSchema, moderationNoteSchema, adminPeopleReportListQuery, adminPeopleReportIdParam, adminPeopleMessageRemovalBody, adminPeopleSuspendBody, adminPeopleNoteBody, COMMUNITIES_PER_ORG_MAX, COMMUNITY_NAME_MAX_LENGTH, COMMUNITY_REGISTRY_CLOSED_REASON, COMMUNITY_MEMBERS_MAX, COMMUNITY_ADMISSIONS, COMMUNITY_ACCESS_MAX, COMMUNITY_ACCESS_ADD_MAX, COMMUNITY_ACCESS_FULL_REASON, COMMUNITY_JOIN_SOURCE_MAX_LENGTH, COMMUNITY_JOIN_FLOW_TOKEN_MAX_LENGTH, COMMUNITY_ROOMS_MAX, COMMUNITY_ROOM_NAME_MAX_LENGTH, COMMUNITY_MESSAGE_MAX_LENGTH, COMMUNITY_MESSAGES_PAGE_SIZE, COMMUNITY_ATTACHMENT_URLS_MAX, COMMUNITY_POST_TITLE_MAX_LENGTH, COMMUNITY_POST_SEARCH_MAX_LENGTH, COMMUNITY_MEMBER_STATUSES, COMMUNITY_RULES_MAX_LENGTH, COMMUNITY_SLOW_MODE_MAX_SECONDS, COMMUNITY_COURSES_LABEL_MAX_LENGTH, COMMUNITY_LIVE_TICKET_PREFIX, COMMUNITY_STATS_DAYS, communityNameSchema, adminCreateCommunityBody, communityIdParam, communityJoinTokenSchema, communityJoinSourceSchema, communityJoinPreviewQuery, communityJoinBody, communityRoomKindSchema, communityRoomNameSchema, communityRoomIdParam, communityMessageIdParam, communityRoomCreateBody, communityRoomUpdateBody, communityMessagesQuery, communityMessageBodySchema, communityPostTitleSchema, communityAttachmentUploadSchema, communitySendBody, communityEditBody, communityPostIdParam, communityPostsQuery, communityAnswerBody, communityReadBody, communityAttachmentUrlsBody, communityPersonParam, communityOrgParam, communityPeopleQuery, communityCoursesLabelSchema, communityAdmissionSchema, communitySettingsBody, communityAccessEmailSchema, communityAccessAddBody, communityAccessQuery, communityAccessIdParam, communityBanBody, communityLockBody, communityPinBody, communityModLogQuery, communityReportsQuery, communityReportIdParam, communityLiveTicketSchema, communityLiveQuery, communityMuteBody, communityEmailUnsubscribeTokenSchema, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, communityEmailUnsubscribeQuery, COMMUNITY_COURSES_MAX, COMMUNITY_COURSE_MODULES_MAX, COMMUNITY_COURSE_LESSONS_MAX, COMMUNITY_LESSONS_MAX, COMMUNITY_COURSE_TITLE_MAX_LENGTH, COMMUNITY_COURSE_DESCRIPTION_MAX_LENGTH, COMMUNITY_LESSON_BODY_MAX_LENGTH, COMMUNITY_LESSON_LINKS_MAX, COMMUNITY_LESSON_URL_MAX_LENGTH, YOUTUBE_ID, YOUTUBE_HOSTS, YOUTU_BE, YOUTUBE_ID_PATH, communityCourseIdParam, communityCourseModuleIdParam, communityLessonIdParam, communityCourseTitleSchema, communityCourseDescriptionSchema, communityCoursePositionSchema, communityLessonVideoUrlSchema, communityLessonLinkSchema, communityLessonLinksSchema, communityLessonBodySchema, communityCourseCreateBody, communityCourseUpdateBody, communityModuleCreateBody, communityModuleUpdateBody, communityLessonCreateBody, communityLessonUpdateBody, COMMUNITY_LESSON_TREE_MAX_BYTES, COMMUNITY_LESSON_LINK_PROTOCOLS, COMMUNITY_LESSON_TREE_TOO_LARGE_REASON, COMMUNITY_LESSON_TREE_TOO_DEEP_REASON, COMMUNITY_LESSON_LINE_PREFIX_TOO_WIDE_REASON, LINK_SCHEME, adminSetGuideHubBody, GUIDE_HUB_INELIGIBLE_REASON;
+var init_chunk_3OSR5AZZ = __esm({
+  "../../packages/core/dist/chunk-3OSR5AZZ.js"() {
     "use strict";
     init_chunk_VORPHGDT();
-    init_chunk_2TNXNKRP();
-    init_chunk_6O3TITL5();
+    init_chunk_BBFWR2LG();
+    init_chunk_2745FTNX();
     init_chunk_MIWZOSPI();
     init_chunk_3NS3HULK();
     init_chunk_DHPUPI4Y();
@@ -12400,6 +12523,11 @@ var init_chunk_RBKQBA3D = __esm({
       [REKOR_TOOL_ID_HEADER]: rekorToolIdSchema.optional()
     });
     REQUIRED_REKOR_ATTESTATION_HEADERS = Object.entries(rekorAttestation.shape).filter(([, field]) => !field.isOptional()).map(([header]) => header);
+    REKOR_BOUND_BASE_HEADER = "X-Rekor-Bound-Base";
+    REKOR_BOUND_TOOLSET_HEADER = "X-Rekor-Bound-Toolset";
+    DATA_BASE_GENERATION_HEADER = "X-Data-Base-Generation";
+    REKOR_MAX_ACTOR_ID_LENGTH = 256;
+    REKOR_MAX_ACTOR_LABEL_LENGTH = 256;
     BASE_DESTRUCTION_MOUNT = "/bases";
     BASE_DESTRUCTION_PREFIX = `/api${BASE_DESTRUCTION_MOUNT}`;
     BASE_DESTRUCTION_CONFIRM_PATH = `${BASE_DESTRUCTION_PREFIX}/destruction/confirm`;
@@ -12497,11 +12625,31 @@ var init_chunk_RBKQBA3D = __esm({
       environment: baseEnvironmentSchema,
       surface: toolsetSurfaceSchema
     });
+    TOOLSET_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+    REKOR_STRUCTURAL_ID_PATTERN = TOOLSET_SLUG_PATTERN;
     rekorToolsetToolsSchema = external_exports.object({
       data: external_exports.object({
-        tools: external_exports.array(external_exports.object({ name: external_exports.string() }))
+        tools: external_exports.array(external_exports.object({
+          name: external_exports.string(),
+          description: external_exports.string().optional(),
+          inputSchema: external_exports.record(external_exports.unknown()).optional()
+        }))
       })
     });
+    rekorBoundAttestation = rekorAttestation.extend({
+      [REKOR_ACTOR_TYPE_HEADER]: external_exports.literal("token"),
+      /** Trimmed and checked as the far side trims and checks it. */
+      [REKOR_ACTOR_ID_HEADER]: external_exports.string().trim().min(1).max(REKOR_MAX_ACTOR_ID_LENGTH),
+      [REKOR_ACTOR_LABEL_HEADER]: external_exports.string().max(REKOR_MAX_ACTOR_LABEL_LENGTH),
+      [REKOR_ACTOR_ADMIN_HEADER]: external_exports.literal("0"),
+      [REKOR_BOUND_BASE_HEADER]: external_exports.string().regex(REKOR_STRUCTURAL_ID_PATTERN),
+      [REKOR_BOUND_TOOLSET_HEADER]: external_exports.string().regex(REKOR_STRUCTURAL_ID_PATTERN),
+      /**
+       * Decimal digits only, as the far side parses it, and at most 15 of them: its `Number()` reads
+       * every such value back exactly, where a longer one may round or overflow to `Infinity` (a 400).
+       */
+      [DATA_BASE_GENERATION_HEADER]: external_exports.string().regex(/^[1-9]\d{0,14}$/)
+    });
     rekorResolvedToolsetSchema = external_exports.object({
       data: external_exports.object({
         base_id: external_exports.string().min(1),
@@ -13213,11 +13361,11 @@ var init_chunk_BPDC67ML = __esm({
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
-    init_chunk_RBKQBA3D();
+    init_chunk_3OSR5AZZ();
     init_chunk_VORPHGDT();
-    init_chunk_2TNXNKRP();
-    init_chunk_6O3TITL5();
-    init_chunk_SNA2DXAC();
+    init_chunk_BBFWR2LG();
+    init_chunk_2745FTNX();
+    init_chunk_QT7NKKPO();
     init_chunk_MIWZOSPI();
     init_chunk_LKBSHANA();
     init_chunk_IBL7FANV();
@@ -13255,10 +13403,10 @@ function toDataProxyPath(v1Path) {
   }
   return `${DATA_PROXY_PREFIX}${v1Path.slice(REKOR_V1_PREFIX.length)}`;
 }
-function withOrgSelector(path41, orgId) {
-  if (!orgId) return path41;
-  const separator = path41.includes("?") ? "&" : "?";
-  return `${path41}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
+function withOrgSelector(path42, orgId) {
+  if (!orgId) return path42;
+  const separator = path42.includes("?") ? "&" : "?";
+  return `${path42}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
 }
 function dataErrorMessage(err) {
   if (!(err instanceof ApiError)) return null;
@@ -13282,7 +13430,7 @@ var init_api_client = __esm({
     init_sentry();
     init_mask_secrets();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
-    delay = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
+    delay = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
     courseAuthoring = (communityId, courseId) => `/api/communities/${encodeURIComponent(communityId)}/authoring/courses${courseId === void 0 ? "" : `/${encodeURIComponent(courseId)}`}`;
     ApiError = class extends Error {
       status;
@@ -13293,13 +13441,13 @@ var init_api_client = __esm({
        * telling them apart by body shape misreads one for the other.
        */
       path;
-      constructor(method, path41, status, body) {
+      constructor(method, path42, status, body) {
         const safeBody = maskSecretsInMessage(body);
-        super(`API request failed: ${method} ${path41} (${status}): ${safeBody}`);
+        super(`API request failed: ${method} ${path42} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
-        this.path = path41;
+        this.path = path42;
       }
       /** True when the status code is a 4xx client error (expected user-facing condition, not a bug). */
       get isExpected() {
@@ -13508,8 +13656,8 @@ var init_api_client = __esm({
           ...opts?.check && { check: true }
         });
       }
-      async lookup(path41, opts) {
-        const params = new URLSearchParams({ path: path41 });
+      async lookup(path42, opts) {
+        const params = new URLSearchParams({ path: path42 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -14050,9 +14198,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path41, body, extraHeaders, contentType) {
-        addApiBreadcrumb(method, path41);
-        const url = `${this.apiUrl}${path41}`;
+      async request(method, path42, body, extraHeaders, contentType) {
+        addApiBreadcrumb(method, path42);
+        const url = `${this.apiUrl}${path42}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body, extraHeaders, contentType);
@@ -14077,7 +14225,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path41, response.status, errorBody);
+          throw new ApiError(method, path42, response.status, errorBody);
         }
       }
       /**
@@ -14104,12 +14252,17 @@ var init_api_client = __esm({
        * It travels as the proxy's own query param, whose name is imported rather
        * than spelled — the handler validates it and strips it before forwarding,
        * since it is WayAI's selector and not an input Rekor sees.
+       *
+       * `extraHeaders` carries the surface's own request headers — a file delete's
+       * `If-Match` — under the same rule as `dataUpload`'s: caller-supplied, so
+       * nothing `send` pins can be displaced by them.
        */
-      async dataRequest(method, v1Path, body, orgId) {
+      async dataRequest(method, v1Path, body, orgId, extraHeaders) {
         const envelope = await this.request(
           method,
           withOrgSelector(toDataProxyPath(v1Path), orgId),
-          body
+          body,
+          extraHeaders
         );
         return envelope ?? {};
       }
@@ -14139,9 +14292,9 @@ var init_api_client = __esm({
        * transient-retry loop — re-streaming a blob is not worth a cold-start probe.
        */
       async dataDownload(v1Path, orgId) {
-        const path41 = withOrgSelector(toDataProxyPath(v1Path), orgId);
-        addApiBreadcrumb("GET", path41);
-        const url = `${this.apiUrl}${path41}`;
+        const path42 = withOrgSelector(toDataProxyPath(v1Path), orgId);
+        addApiBreadcrumb("GET", path42);
+        const url = `${this.apiUrl}${path42}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -14155,7 +14308,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path41, response.status, await response.text());
+          throw new ApiError("GET", path42, response.status, await response.text());
         }
         return {
           bytes: new Uint8Array(await response.arrayBuffer()),
@@ -14349,6 +14502,32 @@ var init_chunk_BF4WRSOQ = __esm({
 });
 
 // ../../packages/core/dist/index.js
+function matchPath(pattern, path42) {
+  const normalizedPath = path42.replace(/\/$/, "");
+  if (pattern.endsWith("/*")) {
+    const prefix = pattern.slice(0, -2);
+    return normalizedPath === prefix || normalizedPath.startsWith(prefix + "/");
+  }
+  return pattern === normalizedPath;
+}
+function getEndpointConfig(path42) {
+  for (const excluded of EXCLUDED_PATHS) {
+    if (matchPath(excluded, path42)) {
+      return null;
+    }
+  }
+  const normalizedPath = path42.replace(/\/$/, "");
+  if (!normalizedPath.endsWith("/*") && Object.prototype.hasOwnProperty.call(ENDPOINT_CONFIGS, normalizedPath)) {
+    return ENDPOINT_CONFIGS[normalizedPath];
+  }
+  const sortedPatterns = Object.keys(ENDPOINT_CONFIGS).sort((a, b) => b.length - a.length);
+  for (const pattern of sortedPatterns) {
+    if (matchPath(pattern, path42)) {
+      return ENDPOINT_CONFIGS[pattern];
+    }
+  }
+  return { tier: "STANDARD" };
+}
 function bytesToUuid(bytes) {
   const hex = [];
   for (let i = 0; i < 16; i++) hex.push(bytes[i].toString(16).padStart(2, "0"));
@@ -14396,16 +14575,16 @@ function markdownToPlainText(text) {
   result = result.replace(/^[-*_]{3,}$/gm, "");
   return result;
 }
-var ENDPOINT_CONFIGS, UUID_RE2, WAYAI_WORKSPACE_LAYOUT;
+var ENDPOINT_CONFIGS, EXCLUDED_PATHS, UUID_RE2, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
     init_chunk_P3AWZG3N();
-    init_chunk_RBKQBA3D();
+    init_chunk_3OSR5AZZ();
     init_chunk_VORPHGDT();
-    init_chunk_2TNXNKRP();
-    init_chunk_6O3TITL5();
-    init_chunk_SNA2DXAC();
+    init_chunk_BBFWR2LG();
+    init_chunk_2745FTNX();
+    init_chunk_QT7NKKPO();
     init_chunk_MIWZOSPI();
     init_chunk_LKBSHANA();
     init_chunk_IBL7FANV();
@@ -14879,6 +15058,7 @@ var init_dist = __esm({
       "/api/auth/session-check": { tier: "STANDARD", userLimit: 120, skipAuthenticatedUsers: true },
       "/api/auth/logout": { tier: "MODERATE", userLimit: 10, failClosed: true, skipAuthenticatedUsers: true }
     };
+    EXCLUDED_PATHS = /* @__PURE__ */ new Set(["/health"]);
     UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     WAYAI_WORKSPACE_LAYOUT = {
       /** Product-namespaced root dir at the git root. */
@@ -15660,13 +15840,13 @@ function resolve3(gitRoot) {
   }
   return { kind: "none" };
 }
-function conflictMessage(manifestOrg, rootOrg, remedy = RECONCILE_REMEDY) {
+function conflictMessage(manifestOrg, rootOrg, remedy2 = RECONCILE_REMEDY) {
   return [
     "Refusing to guess the organization: two files in this repo name different ones.",
     `  ${WORKSPACE_MANIFEST_LABEL} -> ${manifestOrg}   (the workspace manifest)`,
     `  ${ROOT_CONFIG_FILE} -> ${rootOrg}   (deprecated fallback)`,
     "",
-    ...remedy
+    ...remedy2
   ].join("\n");
 }
 function rebindRefusal(requestedOrg, rootOrg) {
@@ -15848,24 +16028,24 @@ import * as path6 from "path";
 import * as readline from "readline";
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve12(answer.trim());
+      resolve13(answer.trim());
     });
   });
 }
 function confirm(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
-      resolve12(answer.trim().toLowerCase() === "y");
+      resolve13(answer.trim().toLowerCase() === "y");
     });
   });
 }
 function promptSecret(question) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const originalWrite = rl._writeToOutput;
     let firstWrite = true;
@@ -15881,18 +16061,18 @@ function promptSecret(question) {
       rl._writeToOutput = originalWrite;
       process.stdout.write("\n");
       rl.close();
-      resolve12(answer);
+      resolve13(answer);
     });
   });
 }
 function readStdin() {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
-    process.stdin.on("end", () => resolve12(data.trim()));
+    process.stdin.on("end", () => resolve13(data.trim()));
     process.stdin.on("error", reject);
   });
 }
@@ -16607,9 +16787,9 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path41 = getVersionCachePath(filename);
-    if (!existsSync3(path41)) return null;
-    const parsed = JSON.parse(readFileSync5(path41, "utf-8"));
+    const path42 = getVersionCachePath(filename);
+    if (!existsSync3(path42)) return null;
+    const parsed = JSON.parse(readFileSync5(path42, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -16629,10 +16809,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path41 = getVersionCachePath(filename);
-  const dir = dirname6(path41);
+  const path42 = getVersionCachePath(filename);
+  const dir = dirname6(path42);
   if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
-  writeFileSync2(path41, JSON.stringify(cache));
+  writeFileSync2(path42, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -16671,14 +16851,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path41 = join8(projectRoot, rel);
-    if (!existsSync4(path41)) continue;
+    const path42 = join8(projectRoot, rel);
+    if (!existsSync4(path42)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path41, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path42, "utf-8"));
     } catch {
     }
-    found.push({ path: path41, version });
+    found.push({ path: path42, version });
   }
   return found;
 }
@@ -17132,7 +17312,7 @@ async function validateToken(apiUrl, token) {
   }
 }
 function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
       if (url.pathname === "/callback") {
@@ -17158,7 +17338,7 @@ function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login successful!</h2><p>You can close this tab and return to your terminal.</p></body></html>");
           server.close();
-          resolve12({ code, port });
+          resolve13({ code, port });
         } else {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login failed</h2><p>No authorization code received</p></body></html>");
@@ -17370,10 +17550,10 @@ import * as readline2 from "readline";
 function prompt2(question, defaultValue) {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     rl.question(display, (answer) => {
       rl.close();
-      resolve12(answer.trim() || defaultValue || "");
+      resolve13(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -17501,8 +17681,8 @@ async function tryOpenBrowser(url) {
       cmd = "xdg-open";
       args2 = [url];
     }
-    return new Promise((resolve12) => {
-      execFile(cmd, args2, (err) => resolve12(!err));
+    return new Promise((resolve13) => {
+      execFile(cmd, args2, (err) => resolve13(!err));
     });
   } catch {
     return false;
@@ -18452,17 +18632,17 @@ function writeResourceFileTree(resDir, files, root, log) {
   }
   const writtenPaths = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const filePath = path12.join(resDir, file.path);
-    if (!filePath.startsWith(resDir + path12.sep) && filePath !== resDir) {
+    const filePath2 = path12.join(resDir, file.path);
+    if (!filePath2.startsWith(resDir + path12.sep) && filePath2 !== resDir) {
       console.warn(`  Warning: skipping ${file.path} (path traversal detected)`);
       continue;
     }
     writtenPaths.add(file.path);
     const buf = file.content !== void 0 ? Buffer.from(file.content, "utf-8") : file.content_base64 ? Buffer.from(file.content_base64, "base64") : void 0;
     if (buf === void 0) continue;
-    if (fileHasBytes(filePath, buf)) continue;
-    if (writeFileNoFollow(resDir, filePath, buf)) {
-      log?.changed.push(path12.relative(root, filePath));
+    if (fileHasBytes(filePath2, buf)) continue;
+    if (writeFileNoFollow(resDir, filePath2, buf)) {
+      log?.changed.push(path12.relative(root, filePath2));
     } else {
       console.warn(`  Warning: skipping ${file.path} (destination escapes the resource folder via a symlink)`);
       writtenPaths.delete(file.path);
@@ -18493,15 +18673,15 @@ async function downloadBinaryFiles(resDir, files, root, log) {
   for (const file of files) {
     if (!file.download_url || file.content !== void 0) continue;
     try {
-      const filePath = path12.join(resDir, file.path);
-      if (!filePath.startsWith(resDir + path12.sep) && filePath !== resDir) {
+      const filePath2 = path12.join(resDir, file.path);
+      if (!filePath2.startsWith(resDir + path12.sep) && filePath2 !== resDir) {
         console.warn(`  Warning: skipping ${file.path} (path traversal detected)`);
         continue;
       }
       if (file.hash) {
         try {
-          const st = fs10.lstatSync(filePath);
-          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs10.readFileSync(filePath)) === file.hash) continue;
+          const st = fs10.lstatSync(filePath2);
+          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs10.readFileSync(filePath2)) === file.hash) continue;
         } catch {
         }
       }
@@ -18511,10 +18691,10 @@ async function downloadBinaryFiles(resDir, files, root, log) {
         continue;
       }
       const buffer = Buffer.from(await response.arrayBuffer());
-      if (fileHasBytes(filePath, buffer)) continue;
-      if (writeFileNoFollow(resDir, filePath, buffer)) {
+      if (fileHasBytes(filePath2, buffer)) continue;
+      if (writeFileNoFollow(resDir, filePath2, buffer)) {
         count++;
-        log?.changed.push(path12.relative(root, filePath));
+        log?.changed.push(path12.relative(root, filePath2));
       } else {
         console.warn(`  Warning: skipping ${file.path} (destination escapes the resource folder via a symlink)`);
       }
@@ -19016,8 +19196,8 @@ function scanEvalYamlFiles(hubFolder, bytesByHash, unreadable) {
   }
   return evals;
 }
-function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesByHash, unreadable) {
-  const evalEntry = parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash);
+function collectEval(evals, seen, filePath2, relPath, setName, hubFolder, bytesByHash, unreadable) {
+  const evalEntry = parseEvalYaml(filePath2, relPath, setName, hubFolder, bytesByHash);
   if (!evalEntry) {
     unreadable(relPath, NOT_A_YAML_OBJECT);
     return;
@@ -19026,14 +19206,14 @@ function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesBy
   if (seen.has(key)) {
     const where = setName ? `scenario set "${setName}"` : "root";
     throw expected(
-      `Duplicate eval at ${where}: "${evalEntry.name}" (in ${path15.basename(filePath)}). Each (name, scenario set) pair must be unique.`
+      `Duplicate eval at ${where}: "${evalEntry.name}" (in ${path15.basename(filePath2)}). Each (name, scenario set) pair must be unique.`
     );
   }
   seen.add(key);
   evals.push(evalEntry);
 }
-function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
-  const content = fs13.readFileSync(filePath, "utf-8");
+function parseEvalYaml(filePath2, relPath, setName, hubFolder, bytesByHash) {
+  const content = fs13.readFileSync(filePath2, "utf-8");
   let raw;
   try {
     raw = yaml7.load(content);
@@ -19045,7 +19225,7 @@ function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
   }
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
   const data = raw;
-  const fileSlug = path15.basename(filePath, ".yaml");
+  const fileSlug = path15.basename(filePath2, ".yaml");
   const evalName = typeof data.name === "string" && data.name.trim().length > 0 ? data.name : fileSlug;
   if (typeof data.agent !== "string" || data.agent.trim().length === 0) {
     throw expected(`Eval "${evalName}" in ${relPath}: missing required field "agent" (string).`);
@@ -19160,8 +19340,8 @@ function scanJourneyYamlFiles(hubFolder, bytesByHash, unreadable) {
   }
   return journeys;
 }
-function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
-  const content = fs13.readFileSync(filePath, "utf-8");
+function parseJourneyYaml(filePath2, relPath, hubFolder, bytesByHash) {
+  const content = fs13.readFileSync(filePath2, "utf-8");
   let raw;
   try {
     raw = yaml7.load(content);
@@ -19173,7 +19353,7 @@ function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
   }
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
   const data = raw;
-  const fileSlug = path15.basename(filePath, ".yaml");
+  const fileSlug = path15.basename(filePath2, ".yaml");
   const journeyName = typeof data.name === "string" && data.name.trim().length > 0 ? data.name : fileSlug;
   if (typeof data.agent !== "string" || data.agent.trim().length === 0) {
     throw expected(`Journey "${journeyName}" in ${relPath}: missing required field "agent" (string).`);
@@ -19219,8 +19399,8 @@ function scanAgentYamlFiles(hubFolder, unreadable) {
   if (yamlFiles.length === 0) return [];
   const agents = [];
   for (const file of yamlFiles) {
-    const filePath = path15.join(agentsDir, file);
-    const content = readRealFileOrThrow(hubFolder, filePath) ?? "";
+    const filePath2 = path15.join(agentsDir, file);
+    const content = readRealFileOrThrow(hubFolder, filePath2) ?? "";
     let agent;
     try {
       agent = yaml7.load(content);
@@ -19325,8 +19505,8 @@ function perHubAgentsMd(hubFolderName) {
     ""
   ].join("\n");
 }
-function writeIfAbsent(root, filePath, content) {
-  return createFileNoFollow(root, filePath, Buffer.from(content, "utf-8")) === "created" ? path16.basename(filePath) : null;
+function writeIfAbsent(root, filePath2, content) {
+  return createFileNoFollow(root, filePath2, Buffer.from(content, "utf-8")) === "created" ? path16.basename(filePath2) : null;
 }
 var init_workspace_files = __esm({
   "src/lib/workspace-files.ts"() {
@@ -20156,12 +20336,12 @@ async function createDataClient(orgId) {
     return orgId2;
   }
   return {
-    async request(method, path41, body) {
-      const envelope = await api.dataRequest(method, path41, body, org);
+    async request(method, path42, body, headers) {
+      const envelope = await api.dataRequest(method, path42, body, org, headers);
       return envelope.data;
     },
-    async requestRaw(method, path41, body) {
-      const body_ = await api.dataRequest(method, path41, body, org);
+    async requestRaw(method, path42, body) {
+      const body_ = await api.dataRequest(method, path42, body, org);
       return body_;
     },
     async collectPages(makePath) {
@@ -21060,8 +21240,8 @@ function installEvalSignalHandlers(input) {
   let signalCount = 0;
   let disposed = false;
   let settle;
-  const settled = new Promise((resolve12) => {
-    settle = resolve12;
+  const settled = new Promise((resolve13) => {
+    settle = resolve13;
   });
   const listeners = /* @__PURE__ */ new Map();
   const dispose = () => {
@@ -21199,7 +21379,7 @@ var init_pacer = __esm({
     WINDOW_MS = 6e4;
     DEFAULT_RETRY_AFTER_SECONDS = 60;
     MAX_RATE_LIMITED_RETRIES = 5;
-    realSleep = (ms) => new Promise((resolve12) => setTimeout(resolve12, ms));
+    realSleep = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
     Pacer = class {
       perMinute;
       now;
@@ -21313,11 +21493,11 @@ function classify(base, file, server) {
   if (known === void 0) return file === server ? "converged" : "conflict";
   return threeWay(file !== known, server !== known, file === server);
 }
-function threeWay(fileChanged, serverChanged, agree) {
+function threeWay(fileChanged, serverChanged, agree2) {
   if (!fileChanged && !serverChanged) return "in_sync";
   if (!serverChanged) return "local";
   if (!fileChanged) return "remote";
-  return agree ? "converged" : "conflict";
+  return agree2 ? "converged" : "conflict";
 }
 function createClientId(communityId, kind, localName2) {
   return uuidV5(communityId, `${kind}:${localName2}`);
@@ -21943,8 +22123,12 @@ var init_files = __esm({
 
 // src/communities/listing.ts
 function lineDiff(from, to) {
-  const a = from ? sanitizeTerminalText(from).split("\n") : [];
-  const b = to ? sanitizeTerminalText(to).split("\n") : [];
+  return lineDiffOf(
+    from ? sanitizeTerminalText(from).split("\n") : [],
+    to ? sanitizeTerminalText(to).split("\n") : []
+  );
+}
+function lineDiffOf(a, b) {
   if (a.length * b.length > 25e4) return [...a.map((l) => `- ${l}`), ...b.map((l) => `+ ${l}`)];
   const lcs = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
   for (let i2 = a.length - 1; i2 >= 0; i2--) {
@@ -25540,26 +25724,26 @@ __export(send_message_exports, {
 });
 import * as fs25 from "fs";
 import * as path36 from "path";
-function statAttachment(filePath) {
+function statAttachment(filePath2) {
   let stat2;
   try {
-    stat2 = fs25.statSync(filePath);
+    stat2 = fs25.statSync(filePath2);
   } catch {
-    console.error(`Error: file not found: ${filePath}`);
+    console.error(`Error: file not found: ${filePath2}`);
     process.exit(1);
   }
   if (stat2.isDirectory()) {
-    console.error(`Error: not a file: ${filePath}`);
+    console.error(`Error: not a file: ${filePath2}`);
     process.exit(1);
   }
-  return { filePath, size: stat2.size };
+  return { filePath: filePath2, size: stat2.size };
 }
-function readAttachment(filePath, size) {
-  const fileName = path36.basename(filePath);
+function readAttachment(filePath2, size) {
+  const fileName = path36.basename(filePath2);
   const ext = path36.extname(fileName).replace(/^\./, "");
   return {
     file_name: fileName,
-    file_binary: fs25.readFileSync(filePath).toString("base64"),
+    file_binary: fs25.readFileSync(filePath2).toString("base64"),
     file_size: size,
     ...ext && { file_extension: ext }
   };
@@ -25589,12 +25773,12 @@ async function sendMessageCommand(args2) {
     if (arg === "-c" || arg === "--conversation") {
       conversationId = args2[++i];
     } else if (arg === "-f" || arg === "--file") {
-      const filePath = args2[++i];
-      if (!filePath) {
+      const filePath2 = args2[++i];
+      if (!filePath2) {
         console.error("Error: --file requires a path");
         process.exit(1);
       }
-      filePaths.push(filePath);
+      filePaths.push(filePath2);
     } else if (!arg.startsWith("-")) {
       message = arg;
     }
@@ -27384,7 +27568,7 @@ Timeout after ${timeoutSeconds}s${queuedSeconds > 0 ? ` (${queuedSeconds}s of it
   process.exit(1);
 }
 function sleep(ms) {
-  return new Promise((resolve12) => setTimeout(resolve12, ms));
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 function parseRunNumbers(raw) {
   if (!raw || raw.startsWith("--")) {
@@ -27741,15 +27925,15 @@ var init_caller_audio = __esm({
       }
       describe;
       async clipFor(line) {
-        const path41 = line.clip ? isAbsolute2(line.clip) ? line.clip : resolve10(this.planDir, line.clip) : this.dir ? join31(this.dir, `${line.n}.wav`) : null;
-        if (!path41) throw new Error(`Line ${line.n} has no clip: give --clips <dir>, or a "clip" for it in the plan.`);
+        const path42 = line.clip ? isAbsolute2(line.clip) ? line.clip : resolve10(this.planDir, line.clip) : this.dir ? join31(this.dir, `${line.n}.wav`) : null;
+        if (!path42) throw new Error(`Line ${line.n} has no clip: give --clips <dir>, or a "clip" for it in the plan.`);
         let buf;
         try {
-          buf = readFileSync17(path41);
+          buf = readFileSync17(path42);
         } catch {
-          throw new Error(`Line ${line.n}'s clip ${path41} cannot be read.`);
+          throw new Error(`Line ${line.n}'s clip ${path42} cannot be read.`);
         }
-        return parseWav(buf, path41);
+        return parseWav(buf, path42);
       }
     };
     OPENAI_PCM_SAMPLE_RATE = 24e3;
@@ -27779,17 +27963,17 @@ ${text}`).digest("hex");
         return join31(this.cacheDir, `${key}.pcm`);
       }
       clipFor(line) {
-        const path41 = this.cachePath(line.say);
-        let pending = this.inFlight.get(path41);
+        const path42 = this.cachePath(line.say);
+        let pending = this.inFlight.get(path42);
         if (!pending) {
-          pending = this.readOrSynthesize(line, path41);
-          this.inFlight.set(path41, pending);
+          pending = this.readOrSynthesize(line, path42);
+          this.inFlight.set(path42, pending);
         }
         return pending;
       }
-      async readOrSynthesize(line, path41) {
+      async readOrSynthesize(line, path42) {
         try {
-          return pcmClip(readFileSync17(path41));
+          return pcmClip(readFileSync17(path42));
         } catch {
         }
         const res = await this.doFetch("https://api.openai.com/v1/audio/speech", {
@@ -27803,10 +27987,10 @@ ${text}`).digest("hex");
         }
         const buf = Buffer.from(await res.arrayBuffer());
         if (buf.length < 2) throw new Error(`OpenAI speech synthesis returned no audio for line ${line.n}.`);
-        mkdirSync12(dirname12(path41), { recursive: true });
-        const tmp = `${path41}.${process.pid}.tmp`;
+        mkdirSync12(dirname12(path42), { recursive: true });
+        const tmp = `${path42}.${process.pid}.tmp`;
         writeFileSync7(tmp, buf);
-        renameSync5(tmp, path41);
+        renameSync5(tmp, path42);
         return pcmClip(buf);
       }
     };
@@ -27833,14 +28017,14 @@ async function loadWrtcRuntime(importPackage = () => import(WRTC_PACKAGE)) {
 function waitFor(ready, timeoutMs, clock = systemClock) {
   if (ready()) return Promise.resolve(true);
   const deadline = clock.now() + timeoutMs;
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const timer = setInterval(() => {
       if (ready()) {
         clearInterval(timer);
-        resolve12(true);
+        resolve13(true);
       } else if (clock.now() >= deadline) {
         clearInterval(timer);
-        resolve12(false);
+        resolve13(false);
       }
     }, WAIT_POLL_MS);
   });
@@ -27955,8 +28139,8 @@ var init_call_media = __esm({
        * asked before every frame, answers true — the rest of the clip is then dropped.
        */
       play(clip, abort = () => false) {
-        return new Promise((resolve12) => {
-          this.queue.push({ samples: resample(clip, PUMP_SAMPLE_RATE), offset: 0, startedAtMs: null, abort, resolve: resolve12 });
+        return new Promise((resolve13) => {
+          this.queue.push({ samples: resample(clip, PUMP_SAMPLE_RATE), offset: 0, startedAtMs: null, abort, resolve: resolve13 });
         });
       }
       /** Send every frame the wall clock says is due. */
@@ -29168,7 +29352,7 @@ var init_runner = __esm({
     init_score();
     systemRunnerClock = {
       now: () => Date.now(),
-      sleep: (ms) => new Promise((resolve12) => setTimeout(resolve12, ms))
+      sleep: (ms) => new Promise((resolve13) => setTimeout(resolve13, ms))
     };
     LONGEST_SPOKEN_LINE_MS = Math.ceil(EVAL_CALL_SPOKEN_LINE_MAX_CHARS / 15) * 1e3;
     DEFAULT_RUNNER_TIMINGS = {
@@ -29371,15 +29555,15 @@ function parseEvalCallArgs(args2) {
   if (parsed.jsonPath) checkReportPath(parsed.jsonPath);
   return parsed;
 }
-function checkReportPath(path41) {
-  const target = resolve11(path41);
+function checkReportPath(path42) {
+  const target = resolve11(path42);
   const dir = dirname13(target);
-  if (!existsSync16(dir) || !statSync8(dir).isDirectory()) fail(`--json ${path41}: the folder ${dir} does not exist.`);
-  if (existsSync16(target) && statSync8(target).isDirectory()) fail(`--json ${path41} is a folder; name a file.`);
+  if (!existsSync16(dir) || !statSync8(dir).isDirectory()) fail(`--json ${path42}: the folder ${dir} does not exist.`);
+  if (existsSync16(target) && statSync8(target).isDirectory()) fail(`--json ${path42} is a folder; name a file.`);
   try {
     accessSync(existsSync16(target) ? target : dir, fsConstants.W_OK);
   } catch {
-    fail(`--json ${path41} cannot be written here.`);
+    fail(`--json ${path42} cannot be written here.`);
   }
 }
 function suiteExitCode(report2, runs, reportWritten) {
@@ -31074,10 +31258,12 @@ async function setConnectionCredentialCommand(args2) {
   console.log(`Setting ${orgMode ? `org credential "${parsed.orgCredential}"` : `${parsed.field}`} on ${target} connection "${conn.connection_display_name}"...`);
   if (isProduction) {
     await client.setProductionConnectionCredential(connectionId, body);
+    console.log("Credential set.");
   } else {
-    await client.setPreviewConnectionCredential(connectionId, body);
+    const result = await client.setPreviewConnectionCredential(connectionId, body);
+    console.log("Credential set.");
+    printWarnings(result.warnings ?? []);
   }
-  console.log("Credential set.");
 }
 var VALID_FIELDS;
 var init_set_connection_credential = __esm({
@@ -31088,6 +31274,7 @@ var init_set_connection_credential = __esm({
     init_repo_config();
     init_workspace();
     init_utils();
+    init_push();
     VALID_FIELDS = ["api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "username"];
   }
 });
@@ -35454,16 +35641,16 @@ MCP URL: ${toolsetMcpUrl(slug)}`);
   ).option("--force", "Revoke even if the token appears to be in live use").action(async function(tokenId, opts) {
     const client = await createDataClient();
     const id = pathSegment(tokenId, "token id");
-    const path41 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
+    const path42 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
     const format = outputFormat(this);
     const revoked = (forced) => printOutput({ token_id: tokenId, revoked: true, forced }, format);
     if (opts.force) {
-      await client.request("DELETE", path41(true));
+      await client.request("DELETE", path42(true));
       revoked(true);
       return;
     }
     try {
-      await client.request("DELETE", path41(false));
+      await client.request("DELETE", path42(false));
       revoked(false);
     } catch (err) {
       if (!(err instanceof ApiError) || err.status !== 409 || dataErrorDetails(err)?.requires_force !== true) {
@@ -35478,7 +35665,7 @@ MCP URL: ${toolsetMcpUrl(slug)}`);
         console.error("Aborted.");
         return process.exit(1);
       }
-      await client.request("DELETE", path41(true));
+      await client.request("DELETE", path42(true));
       revoked(true);
     }
   });
@@ -35626,9 +35813,9 @@ var init_base_tags = __esm({
 
 // src/data/commands/bases.ts
 import { Command as Command10 } from "commander";
-function pageOf(path41, cursor) {
-  if (!cursor) return path41;
-  return `${path41}${path41.includes("?") ? "&" : "?"}cursor=${encodeURIComponent(cursor)}`;
+function pageOf(path42, cursor) {
+  if (!cursor) return path42;
+  return `${path42}${path42.includes("?") ? "&" : "?"}cursor=${encodeURIComponent(cursor)}`;
 }
 function parseEnum(flag, value, allowed) {
   if (value === void 0) return void 0;
@@ -35785,20 +35972,21 @@ function buildBasesCommand() {
   });
   bases.command("list-previews <origin-id>").description("List preview bases cloned from a base (production or preview)").action(async function(originId) {
     const client = await createDataClient();
-    const path41 = `/v1/${pathSegment(originId, "origin base id")}/previews`;
+    const path42 = `/v1/${pathSegment(originId, "origin base id")}/previews`;
     printOutput(
-      await client.collectPages((cursor) => pageOf(path41, cursor)),
+      await client.collectPages((cursor) => pageOf(path42, cursor)),
       outputFormat(this)
     );
   });
-  bases.command("promote <production-id>").description("Promote config from a preview base to production (human-only)").requiredOption("--from <preview-id>", "Source preview base id").option("--dry-run", "Show what would change without applying").option("--record-types <ids>", "Comma-separated record type ids to promote", splitList).option("--triggers <ids>", "Comma-separated trigger ids to promote", splitList).option("--inbound-webhooks <ids>", "Comma-separated inbound webhook ids to promote", splitList).action(async function(productionId, opts) {
+  bases.command("promote <production-id>").description("Promote config from a preview base to production (human-only)").requiredOption("--from <preview-id>", "Source preview base id").option("--dry-run", "Show what would change without applying").option("--record-types <ids>", "Comma-separated record type ids to promote", splitList).option("--triggers <ids>", "Comma-separated trigger ids to promote", splitList).option("--inbound-webhooks <ids>", "Comma-separated inbound webhook ids to promote", splitList).option("--file-types <ids>", "Comma-separated file type ids to promote", splitList).action(async function(productionId, opts) {
     const client = await createDataClient();
     const data = await client.request("POST", `/v1/${pathSegment(productionId, "production base id")}/promote`, {
       source_base_id: opts.from,
       dry_run: opts.dryRun ?? false,
       record_types: opts.recordTypes,
       triggers: opts.triggers,
-      inbound_webhooks: opts.inboundWebhooks
+      inbound_webhooks: opts.inboundWebhooks,
+      file_types: opts.fileTypes
     });
     printOutput(data, outputFormat(this));
     const warnings = data?.source_credential_warnings ?? [];
@@ -35834,9 +36022,9 @@ function buildBasesCommand() {
   });
   bases.command("promotions <production-id>").description("List promotion history for a production base").action(async function(productionId) {
     const client = await createDataClient();
-    const path41 = `/v1/${pathSegment(productionId, "production base id")}/promotions`;
+    const path42 = `/v1/${pathSegment(productionId, "production base id")}/promotions`;
     printOutput(
-      await client.collectPages((cursor) => pageOf(path41, cursor)),
+      await client.collectPages((cursor) => pageOf(path42, cursor)),
       outputFormat(this)
     );
   });
@@ -35972,12 +36160,879 @@ var init_file_types = __esm({
   }
 });
 
+// src/data/files-sync/headers.ts
+function ifMatchValue(raw) {
+  const hash = raw.trim().replace(/^W\//, "").replace(/^"(.*)"$/, "$1");
+  if (!/^[\x21\x23-\x7e]+$/.test(hash)) {
+    throw expected(
+      `--if-match must be the file's content hash (its ETag, or content_sha256 from \`wayai files get --meta\`), got ${JSON.stringify(raw)}.`
+    );
+  }
+  return `"${hash}"`;
+}
+function labelValue(raw) {
+  if (raw.length === 0 || !/^[\x20-\x7e]+$/.test(raw)) {
+    throw expected(
+      `--label must be printable ASCII text (a request header cannot carry other characters intact), got ${JSON.stringify(raw)}.`
+    );
+  }
+  return raw;
+}
+function metadataValue(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw expected("--metadata must be a JSON object.");
+  }
+  return JSON.stringify(value).replace(
+    /[\u007f-￿]/g,
+    (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+}
+function fileWriteHeaders(opts) {
+  const headers = {};
+  if (opts.ifMatch !== void 0) headers["If-Match"] = ifMatchValue(opts.ifMatch);
+  if (opts.label !== void 0) headers["X-Data-Label"] = labelValue(opts.label);
+  if (opts.metadata !== void 0) headers["X-Data-Metadata"] = metadataValue(opts.metadata);
+  return headers;
+}
+var init_headers = __esm({
+  "src/data/files-sync/headers.ts"() {
+    "use strict";
+    init_expected();
+  }
+});
+
+// src/data/files-sync/local.ts
+import * as fs30 from "fs";
+import * as path41 from "path";
+function foldSegment(segment) {
+  return segment.normalize("NFC").toLowerCase().replace(/[. ]+$/, "");
+}
+function foldPath(rel) {
+  return rel.split("/").map(foldSegment).join("/");
+}
+function isOutsideSync(rel) {
+  return rel.split("/").some((segment) => OUTSIDE_SYNC_FOLDED.has(foldSegment(segment)));
+}
+function isCleanPath(segments) {
+  return segments.every((s) => s !== "" && s !== "." && s !== ".." && !/[\\\0]/.test(s));
+}
+function normalizeFolder(raw) {
+  if (raw === void 0) return "";
+  const folder = raw.replace(/\/+$/, "");
+  if (folder === "") return "";
+  if (folder.startsWith("/") || !isCleanPath(folder.split("/"))) {
+    throw expected(
+      `--folder must be a folder path inside the file type (e.g. hr or hr/benefits), got ${JSON.stringify(raw)}.`
+    );
+  }
+  return folder;
+}
+function remotePath(folder, rel) {
+  return folder ? `${folder}/${rel}` : rel;
+}
+function defaultDir(fileType, folder) {
+  return path41.join(fileType, ...folder ? folder.split("/") : []);
+}
+function describeSync(r) {
+  const where = r.folder ? `folder "${r.folder}"` : "the whole file type";
+  return sanitizeTerminalText(`base "${r.base}", file type "${r.file_type}", ${where}`);
+}
+function isWindowsAlias(segment) {
+  if (segment.includes(":")) return true;
+  const dot = segment.lastIndexOf(".");
+  const [stem, ext] = dot > 0 ? [segment.slice(0, dot), segment.slice(dot + 1)] : [segment, ""];
+  return stem.length <= 8 && /~\d+$/.test(stem) && ext.length <= 3;
+}
+function assertRepresentable(rels, platform2 = process.platform) {
+  const problems2 = [];
+  const index = new CaseIndex();
+  const all = new Set(rels);
+  for (const rel of rels) {
+    if (!isCleanPath(rel.split("/"))) {
+      problems2.push(`"${rel}" cannot be a local file name`);
+      continue;
+    }
+    if (platform2 === "win32" && rel.split("/").some(isWindowsAlias)) {
+      problems2.push(`"${rel}" cannot be a local file name on Windows`);
+      continue;
+    }
+    const twin = index.twinOf(rel);
+    if (twin !== void 0) problems2.push(`"${twin}" and "${rel}" differ only in case, so they would share one name locally`);
+    index.add(rel);
+    const segments = rel.split("/");
+    for (let i = 1; i < segments.length; i++) {
+      const parent = segments.slice(0, i).join("/");
+      if (all.has(parent)) problems2.push(`"${parent}" is both a file and a folder`);
+    }
+  }
+  if (problems2.length > 0) {
+    throw expected(
+      sanitizeTerminalText(
+        `The base holds paths this folder cannot hold as files, so nothing was pulled:
+  ${problems2.join("\n  ")}`
+      )
+    );
+  }
+}
+function assertPushable(folder, rels, platform2 = process.platform) {
+  const problems2 = [];
+  for (const rel of rels) {
+    const full = remotePath(folder, rel);
+    if (full !== full.trim()) problems2.push(`"${rel}" starts or ends with a space`);
+    else if (full.length > MAX_REMOTE_PATH) problems2.push(`"${rel}" makes a path longer than ${MAX_REMOTE_PATH} characters`);
+    else if (!isCleanPath(rel.split("/"))) problems2.push(`"${rel}" cannot be a file path on the base`);
+    else if (platform2 === "win32" && rel.split("/").some(isWindowsAlias)) {
+      problems2.push(`"${rel}" cannot be a file name on Windows, where it can stand for another file`);
+    }
+  }
+  if (problems2.length > 0) {
+    throw expected(
+      sanitizeTerminalText(`Rename these local files, so nothing was pushed:
+  ${problems2.join("\n  ")}`)
+    );
+  }
+}
+function syncDirExists(dir) {
+  try {
+    fs30.lstatSync(dir);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ensureSyncDir(dir) {
+  if (!syncDirExists(dir)) {
+    fs30.mkdirSync(dir, { recursive: true });
+    return;
+  }
+  if (!fs30.lstatSync(dir).isDirectory()) throw symlinkRefusal(dir, "directory");
+}
+function readRecord(dir) {
+  const text = readRealFileOrThrow(dir, path41.join(dir, RECORD_FILE));
+  if (text === null) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = void 0;
+  }
+  if (!isRecord3(parsed)) {
+    throw expected(
+      `${path41.join(dir, RECORD_FILE)} is not a record \`wayai files pull\` wrote. Restore it from version control, or move the folder aside and pull again.`
+    );
+  }
+  return parsed;
+}
+function isRecord3(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const r = v;
+  if (typeof r.base !== "string" || typeof r.file_type !== "string" || typeof r.folder !== "string") return false;
+  if (typeof r.files !== "object" || r.files === null || Array.isArray(r.files)) return false;
+  return Object.values(r.files).every((f) => {
+    const e = f;
+    return typeof e === "object" && e !== null && typeof e.version === "number" && typeof e.content_sha256 === "string";
+  });
+}
+function writeRecord(dir, record) {
+  const files = {};
+  for (const rel of Object.keys(record.files).sort()) files[rel] = syncedFile(record.files[rel]);
+  const body = `${JSON.stringify({ base: record.base, file_type: record.file_type, folder: record.folder, files }, null, 2)}
+`;
+  const tmp = path41.join(dir, `${RECORD_FILE}.tmp`);
+  if (!writeFileNoFollow(dir, tmp, Buffer.from(body, "utf-8"))) throw symlinkRefusal(tmp, "file");
+  fs30.renameSync(tmp, path41.join(dir, RECORD_FILE));
+}
+function syncedFile(f) {
+  return { version: f.version, content_sha256: f.content_sha256 };
+}
+function readLocal(dir, rel) {
+  const bytes = readFileNoFollow(dir, path41.join(dir, ...rel.split("/")));
+  if (!bytes) throw symlinkRefusal(path41.join(dir, rel), "file");
+  return bytes;
+}
+function scanLocal(dir) {
+  const out = /* @__PURE__ */ new Map();
+  if (!syncDirExists(dir)) return out;
+  ensureSyncDir(dir);
+  const walk = (absDir, relDir) => {
+    for (const name of fs30.readdirSync(absDir).sort()) {
+      const rel = relDir ? `${relDir}/${name}` : name;
+      if (foldSegment(name) === ".git") {
+        throw expected(
+          `${sanitizeTerminalText(path41.join(dir, rel))} is a git repository inside the synced folder, which files pull and push do not sync into. Sync into a folder of its own \u2014 a folder inside a repository is fine; a repository's root, or a folder holding one, is not.`
+        );
+      }
+      if (isOutsideSync(rel)) continue;
+      const st = fs30.lstatSync(path41.join(absDir, name));
+      if (st.isDirectory()) {
+        walk(path41.join(absDir, name), rel);
+      } else if (st.isFile()) {
+        const bytes = readLocal(dir, rel);
+        out.set(rel, { rel, content_sha256: computeHash(bytes), size: bytes.length });
+      } else {
+        throw symlinkRefusal(path41.join(dir, rel), "file or folder");
+      }
+    }
+  };
+  walk(dir, "");
+  return out;
+}
+function matchesScan(dir, rel, scanned) {
+  const abs = path41.join(dir, ...rel.split("/"));
+  if (!syncDirExists(abs)) return scanned === void 0;
+  if (scanned === void 0) return false;
+  const bytes = readFileNoFollow(dir, abs);
+  return bytes !== null && computeHash(bytes) === scanned.content_sha256;
+}
+function writeLocal(dir, rel, bytes) {
+  const data = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (!writeFileNoFollow(dir, path41.join(dir, ...rel.split("/")), data)) {
+    throw symlinkRefusal(path41.join(dir, rel), "file");
+  }
+}
+function removeLocal(dir, rel) {
+  const abs = path41.join(dir, ...rel.split("/"));
+  requireRealSubdirNoSymlink(dir, path41.dirname(abs), false);
+  let st;
+  try {
+    st = fs30.lstatSync(abs);
+  } catch {
+    return;
+  }
+  if (!st.isFile()) throw symlinkRefusal(path41.join(dir, rel), "file");
+  fs30.rmSync(abs);
+  const root = path41.resolve(dir);
+  for (let parent = path41.dirname(path41.resolve(abs)); parent !== root && isUnder(root, parent); parent = path41.dirname(parent)) {
+    const names = fs30.readdirSync(parent);
+    if (names.some((n) => n !== ".DS_Store")) break;
+    for (const n of names) fs30.rmSync(path41.join(parent, n));
+    fs30.rmdirSync(parent);
+  }
+}
+function diskClash(dir, rel) {
+  const segments = rel.split("/");
+  let abs = dir;
+  for (let i = 0; i < segments.length; i++) {
+    let names;
+    try {
+      names = fs30.readdirSync(abs);
+    } catch {
+      return void 0;
+    }
+    const want = foldSegment(segments[i]);
+    const twin = names.find((n) => n !== segments[i] && foldSegment(n) === want);
+    if (twin !== void 0) return { reason: "case_twin", other: [...segments.slice(0, i), twin].join("/") };
+    if (!names.includes(segments[i])) return void 0;
+    abs = path41.join(abs, segments[i]);
+    const isDir = fs30.lstatSync(abs).isDirectory();
+    const here2 = segments.slice(0, i + 1).join("/");
+    if (i < segments.length - 1 && !isDir) return { reason: "file_folder", other: here2 };
+    if (i === segments.length - 1 && isDir) return { reason: "file_folder", other: `${here2}/` };
+  }
+  return void 0;
+}
+var RECORD_FILE, OUTSIDE_SYNC, OUTSIDE_SYNC_FOLDED, CaseIndex, MAX_REMOTE_PATH;
+var init_local = __esm({
+  "src/data/files-sync/local.ts"() {
+    "use strict";
+    init_expected();
+    init_resource_files();
+    init_fs_safety();
+    init_terminal_output();
+    RECORD_FILE = ".wayai-files.json";
+    OUTSIDE_SYNC = [RECORD_FILE, `${RECORD_FILE}.tmp`, ".git", ".DS_Store"];
+    OUTSIDE_SYNC_FOLDED = new Set(OUTSIDE_SYNC.map((n) => foldSegment(n)));
+    CaseIndex = class {
+      bySpelling = /* @__PURE__ */ new Map();
+      constructor(rels = []) {
+        for (const rel of rels) this.add(rel);
+      }
+      add(rel) {
+        const segments = rel.split("/");
+        for (let i = 1; i <= segments.length; i++) {
+          const prefix = segments.slice(0, i).join("/");
+          const key = foldPath(prefix);
+          if (!this.bySpelling.has(key)) this.bySpelling.set(key, prefix);
+        }
+      }
+      /**
+       * The spelling already indexed for a folder or file of `rel` that differs from `rel`'s own only
+       * by case or normalization — the entry `rel` would land in on a case-insensitive filesystem.
+       */
+      twinOf(rel) {
+        const segments = rel.split("/");
+        for (let i = 1; i <= segments.length; i++) {
+          const prefix = segments.slice(0, i).join("/");
+          const known = this.bySpelling.get(foldPath(prefix));
+          if (known !== void 0 && known !== prefix) return known;
+        }
+        return void 0;
+      }
+    };
+    MAX_REMOTE_PATH = 1024;
+  }
+});
+
+// src/data/files-sync/plan.ts
+function inStep(b, r) {
+  return b !== void 0 && b.content_sha256 === r.content_sha256 && b.version === r.version;
+}
+function allPaths({ synced: synced2, local, remote }) {
+  return [.../* @__PURE__ */ new Set([...Object.keys(synced2), ...local.keys(), ...remote.keys()])].sort();
+}
+function planPush(input) {
+  const plan = {
+    steps: [],
+    adopt: [],
+    forget: [],
+    conflicts: [],
+    changedOnBase: [],
+    deletedOnBase: [],
+    onlyOnBase: [],
+    keptOnBase: []
+  };
+  const deletes = [];
+  const writes = [];
+  for (const rel of allPaths(input)) {
+    const b = input.synced[rel];
+    const l = input.local.get(rel);
+    const r = input.remote.get(rel);
+    if (l && r && l.content_sha256 === r.content_sha256) {
+      if (!inStep(b, r)) plan.adopt.push(r);
+      continue;
+    }
+    if (b) {
+      if (l) {
+        if (l.content_sha256 === b.content_sha256) {
+          if (!r) plan.deletedOnBase.push(rel);
+          else if (r.content_sha256 !== b.content_sha256) plan.changedOnBase.push(rel);
+        } else if (!r) {
+          plan.conflicts.push({ rel, reason: "deleted_on_base" });
+        } else if (r.content_sha256 !== b.content_sha256) {
+          plan.conflicts.push({ rel, reason: "changed_on_base" });
+        } else {
+          writes.push({ op: "update", rel, local: l, remote: r, ifMatch: b.content_sha256 });
+        }
+      } else if (!r) {
+        plan.forget.push(rel);
+      } else if (!input.prune) {
+        plan.keptOnBase.push(rel);
+      } else if (r.content_sha256 !== b.content_sha256) {
+        plan.conflicts.push({ rel, reason: "changed_on_base" });
+      } else {
+        deletes.push({ op: "delete", rel, remote: r, ifMatch: b.content_sha256 });
+      }
+    } else if (l) {
+      if (r) plan.conflicts.push({ rel, reason: "exists_on_base" });
+      else writes.push({ op: "create", rel, local: l });
+    } else if (r) {
+      plan.onlyOnBase.push(rel);
+    }
+  }
+  const full = (rel) => remotePath(input.folder ?? "", rel);
+  const deleted = new Set(deletes.map((d) => d.rel));
+  const onBase = new BaseNames([
+    ...[...input.remote.keys()].filter((rel) => !deleted.has(rel)).map(full),
+    ...input.elsewhere ?? []
+  ]);
+  const freed = new BaseNames([...deleted].map(full));
+  const kept = [];
+  for (const step of writes) {
+    if (step.op === "create") {
+      const clash = onBase.clash(full(step.rel));
+      if (clash !== void 0) {
+        plan.conflicts.push({ rel: step.rel, ...clash });
+        continue;
+      }
+      const after = freed.clash(full(step.rel)) === void 0 ? [] : [...deleted].flatMap((d) => {
+        const held = new BaseNames([full(d)]).clash(full(step.rel));
+        return held === void 0 ? [] : [{ rel: d, reason: held.reason }];
+      });
+      kept.push(after.length === 0 ? step : { ...step, after });
+    } else {
+      kept.push(step);
+    }
+    onBase.add(full(step.rel));
+  }
+  plan.steps = [...deletes, ...kept];
+  return plan;
+}
+function planPull(input) {
+  const plan = { writes: [], removes: [], adopt: [], forget: [], kept: [], conflicts: [], replacedLocal: [] };
+  const { overwrite } = input;
+  const take = (rel, r, replacesLocal) => {
+    plan.writes.push({ rel, remote: r });
+    if (replacesLocal) plan.replacedLocal.push(rel);
+  };
+  for (const rel of allPaths(input)) {
+    const b = input.synced[rel];
+    const l = input.local.get(rel);
+    const r = input.remote.get(rel);
+    if (r) {
+      if (l && l.content_sha256 === r.content_sha256) {
+        if (!inStep(b, r)) plan.adopt.push(r);
+        continue;
+      }
+      const localUnchanged = b !== void 0 && l !== void 0 && l.content_sha256 === b.content_sha256;
+      if (localUnchanged || !b && !l) {
+        take(rel, r, false);
+        continue;
+      }
+      if (overwrite) {
+        take(rel, r, true);
+      } else if (!b) {
+        plan.conflicts.push({ rel, reason: "exists_locally" });
+      } else if (r.content_sha256 === b.content_sha256) {
+        plan.kept.push({ rel, reason: l ? "edited" : "deleted" });
+      } else {
+        plan.conflicts.push({ rel, reason: l ? "both_changed" : "deleted_locally" });
+      }
+    } else if (b) {
+      if (!l) {
+        plan.forget.push(rel);
+      } else if (l.content_sha256 === b.content_sha256 || overwrite) {
+        plan.removes.push(rel);
+        if (l.content_sha256 !== b.content_sha256) plan.replacedLocal.push(rel);
+      } else {
+        plan.conflicts.push({ rel, reason: "deleted_on_base" });
+      }
+    }
+  }
+  return plan;
+}
+var BaseNames;
+var init_plan = __esm({
+  "src/data/files-sync/plan.ts"() {
+    "use strict";
+    init_local();
+    BaseNames = class {
+      cases = new CaseIndex();
+      files = /* @__PURE__ */ new Set();
+      /** Each folder a path sits in, with one path in it to name. */
+      folders = /* @__PURE__ */ new Map();
+      constructor(paths = []) {
+        for (const p of paths) this.add(p);
+      }
+      add(path42) {
+        this.cases.add(path42);
+        this.files.add(path42);
+        const segments = path42.split("/");
+        for (let i = 1; i < segments.length; i++) {
+          const folder = segments.slice(0, i).join("/");
+          if (!this.folders.has(folder)) this.folders.set(folder, path42);
+        }
+      }
+      /** The path `path` would collide with, and how; undefined when it collides with none. */
+      clash(path42) {
+        const twin = this.cases.twinOf(path42);
+        if (twin !== void 0) return { reason: "case_twin", other: twin };
+        const segments = path42.split("/");
+        for (let i = 1; i < segments.length; i++) {
+          const folder = segments.slice(0, i).join("/");
+          if (this.files.has(folder)) return { reason: "file_folder", other: folder };
+        }
+        const inside = this.folders.get(path42);
+        return inside === void 0 ? void 0 : { reason: "file_folder", other: inside };
+      }
+    };
+  }
+});
+
+// src/data/files-sync/sync.ts
+function filesSyncRequestsPerMinute() {
+  const budget = getEndpointConfig(`${DATA_PROXY_PREFIX}/files`)?.userLimit;
+  return budget ? Math.max(1, Math.floor(budget * 4 / 5)) : 60;
+}
+async function openRemote2() {
+  const client = await createDataClient();
+  const perMinute = filesSyncRequestsPerMinute();
+  const pacer = new Pacer({
+    perMinute,
+    onWait: (ms, reason) => console.error(
+      reason === "paced" ? `  Pacing at ${perMinute} requests a minute: waiting ${Math.ceil(ms / 1e3)} s.` : `  The data request budget is spent (your other commands and the web console share it): waiting ${Math.ceil(ms / 1e3)} s.`
+    )
+  });
+  return {
+    request: (method, path42, body, headers) => pacer.run(() => client.request(method, path42, body, headers)),
+    upload: (path42, bytes, contentType, headers) => pacer.run(() => client.upload(path42, bytes, contentType, headers)),
+    download: (path42) => pacer.run(() => client.download(path42))
+  };
+}
+function filesRoot(t) {
+  return `/v1/${pathSegment(t.base, "--base")}/files/${pathSegment(t.file_type, "file_type")}`;
+}
+function filePath(t, rel) {
+  return `${filesRoot(t)}/${pathSegments(remotePath(t.folder, rel))}`;
+}
+function pullCommand2(t, dir, overwrite = false) {
+  const folder = t.folder ? ` --folder ${t.folder}` : "";
+  const dirFlag = dir === void 0 ? "" : ` --dir ${dir}`;
+  return sanitizeTerminalText(`wayai files pull ${t.file_type} --base ${t.base}${folder}${dirFlag}${overwrite ? " --overwrite" : ""}`);
+}
+function resolveSync(opts) {
+  pathSegment(opts.base, "--base");
+  pathSegment(opts.fileType, "file_type");
+  const target = { base: opts.base, file_type: opts.fileType, folder: normalizeFolder(opts.folder) };
+  const dir = opts.dir ?? defaultDir(target.file_type, target.folder);
+  const existing = syncDirExists(dir) ? readRecord(dir) : null;
+  if (existing && (existing.base !== target.base || existing.file_type !== target.file_type || existing.folder !== target.folder)) {
+    throw expected(
+      `${sanitizeTerminalText(dir)} was pulled from ${describeSync(existing)}, not ${describeSync(target)}. Its recorded versions are that base's, so they cannot check writes to another: name that sync, or use another --dir.`
+    );
+  }
+  return { target, dir, existing };
+}
+async function listFiles(client, t, prefix) {
+  const rows = [];
+  for (let page = 0; ; page++) {
+    if (page === MAX_LIST_PAGES) {
+      throw expected(`The listing of ${describeSync(t)} did not end after ${MAX_LIST_PAGES} pages. Sync a narrower --folder.`);
+    }
+    const qs = new URLSearchParams({ limit: String(LIST_PAGE), offset: String(page * LIST_PAGE) });
+    if (prefix) qs.set("prefix", prefix);
+    const pageRows = await client.request("GET", `${filesRoot(t)}?${qs}`) ?? [];
+    for (const row of pageRows) if (row.path.startsWith(prefix)) rows.push(row);
+    if (pageRows.length < LIST_PAGE) return rows;
+  }
+}
+async function readBase(t) {
+  const client = await openRemote2();
+  try {
+    await client.request("GET", `/v1/${pathSegment(t.base, "--base")}/file-types/${pathSegment(t.file_type, "file_type")}`);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) {
+      throw expected(sanitizeTerminalText(`Base "${t.base}" has no file type "${t.file_type}".`));
+    }
+    throw err;
+  }
+  const remote = /* @__PURE__ */ new Map();
+  const excluded = [];
+  const prefix = t.folder ? `${t.folder}/` : "";
+  for (const row of await listFiles(client, t, prefix)) {
+    const rel = row.path.slice(prefix.length);
+    if (isOutsideSync(rel)) {
+      excluded.push(rel);
+      continue;
+    }
+    remote.set(rel, {
+      rel,
+      version: row.version,
+      content_sha256: row.content_sha256,
+      content_type: row.content_type || "application/octet-stream",
+      size: row.size ?? 0
+    });
+  }
+  return { client, remote, excluded };
+}
+function isNotFound(err) {
+  return err instanceof ApiError && err.status === 404;
+}
+async function agree(question, yes) {
+  if (yes) return true;
+  if (!isInteractive()) {
+    throw expected(`${question.trim().replace(/\?$/, "")}: there is no terminal to ask, so pass -y to go ahead.`);
+  }
+  return confirm(question);
+}
+function isConflict(err) {
+  return err instanceof ApiError && (err.status === 409 || err.status === 412);
+}
+function conflictLine(c, texts) {
+  return `${safe(c.rel)}: ${texts[c.reason]}${c.other === void 0 ? "" : ` "${safe(c.other)}"`}`;
+}
+function remedy(conflicts, overwriteCommand) {
+  const isClash = (c) => c.reason === "case_twin" || c.reason === "file_folder";
+  const parts = [];
+  if (conflicts.some((c) => !isClash(c))) {
+    parts.push(`take the base's copies with \`${overwriteCommand}\` (commit yours first to merge them)`);
+  }
+  if (conflicts.some(isClash)) {
+    parts.push("rename or remove one path of each pair that differs only in case or is both a file and a folder (--overwrite cannot settle those)");
+  }
+  return parts.join("; ");
+}
+async function pullFiles(opts) {
+  const { target, dir, existing } = resolveSync(opts);
+  const { client, remote, excluded } = await readBase(target);
+  assertRepresentable([...remote.keys()]);
+  const local = scanLocal(dir);
+  const plan = planPull({ synced: existing?.files ?? {}, local, remote, overwrite: opts.overwrite });
+  if (plan.replacedLocal.length > 0) {
+    console.log("These local changes would be replaced with the base's copies:");
+    for (const rel of plan.replacedLocal) console.log(`  ${safe(rel)}`);
+    if (!await agree(`Replace ${plan.replacedLocal.length} locally changed file(s)?`, opts.yes)) {
+      console.log("Cancelled.");
+      return;
+    }
+  }
+  ensureSyncDir(dir);
+  const record = { ...target, files: { ...existing?.files ?? {} } };
+  for (const rel of plan.forget) delete record.files[rel];
+  for (const r of plan.adopt) record.files[r.rel] = syncedFile(r);
+  const conflicts = [...plan.conflicts];
+  const changes = [];
+  const changedWhilePulling = [];
+  try {
+    for (const rel of plan.removes) {
+      if (!matchesScan(dir, rel, local.get(rel))) {
+        conflicts.push({ rel, reason: "edited_while_pulling" });
+        continue;
+      }
+      removeLocal(dir, rel);
+      delete record.files[rel];
+      changes.push(`${MARK.delete} ${safe(rel)}`);
+    }
+    for (const w of plan.writes) {
+      const clash = diskClash(dir, w.rel);
+      if (clash !== void 0) {
+        conflicts.push({ rel: w.rel, ...clash });
+        continue;
+      }
+      const path42 = filePath(target, w.rel);
+      let bytes;
+      let version = w.remote.version;
+      try {
+        bytes = (await client.download(path42)).bytes;
+        if (computeHash(bytes) !== w.remote.content_sha256) {
+          const meta = await client.request("GET", `${path42}?meta=1`);
+          if (meta?.content_sha256 !== computeHash(bytes)) {
+            changedWhilePulling.push(w.rel);
+            continue;
+          }
+          version = meta.version;
+        }
+      } catch (err) {
+        if (!isNotFound(err)) throw err;
+        changedWhilePulling.push(w.rel);
+        continue;
+      }
+      if (!matchesScan(dir, w.rel, local.get(w.rel))) {
+        conflicts.push({ rel: w.rel, reason: "edited_while_pulling" });
+        continue;
+      }
+      const hash = computeHash(bytes);
+      writeLocal(dir, w.rel, bytes);
+      record.files[w.rel] = { version, content_sha256: hash };
+      changes.push(`${local.has(w.rel) ? MARK.update : MARK.create} ${safe(w.rel)}`);
+    }
+  } finally {
+    writeRecord(dir, record);
+  }
+  const count = Object.keys(record.files).length;
+  console.log(sanitizeTerminalText(`Pulled ${describeSync(target)} \u2192 ${dir} (${count} file${count === 1 ? "" : "s"}).`));
+  printSection("Changes:", changes);
+  printSection("Kept \u2014 your local changes:", plan.kept.map((k) => `${safe(k.rel)}: ${PULL_KEPT[k.reason]}`));
+  printSection(
+    `Conflicts \u2014 your copy is kept; to settle them, ${remedy(conflicts, pullCommand2(target, opts.dir, true))}:`,
+    conflicts.map((c) => conflictLine(c, PULL_CONFLICT))
+  );
+  printSection("Changed or deleted on the base while pulling \u2014 left as is; pull again to take it:", changedWhilePulling.map(safe));
+  printSection(`Not synced \u2014 names a synced folder leaves out (${OUTSIDE_SYNC.join(", ")}):`, excluded.map(safe));
+}
+function isTextType(contentType) {
+  const ct = contentType.split(";")[0].trim().toLowerCase();
+  return ct.startsWith("text/") || /^application\/(json|xml|yaml|x-yaml|javascript|x-ndjson)$/.test(ct) || /\+(json|xml)$/.test(ct);
+}
+function changedLines(before, after) {
+  const a = sanitizeTerminalText(before).split("\n");
+  const b = sanitizeTerminalText(after).split("\n");
+  let start = 0;
+  while (start < a.length && start < b.length && a[start] === b[start]) start++;
+  let end = 0;
+  while (end < a.length - start && end < b.length - start && a[a.length - 1 - end] === b[b.length - 1 - end]) end++;
+  return lineDiffOf(a.slice(start, a.length - end), b.slice(start, b.length - end));
+}
+async function describeSteps(client, t, dir, steps) {
+  const lines = [];
+  for (const step of steps) {
+    const rel = safe(step.rel);
+    if (step.op === "create") {
+      lines.push(`${MARK.create} ${rel} (new, ${step.local.size} bytes)`);
+    } else if (step.op === "delete") {
+      lines.push(`${MARK.delete} ${rel} (delete)`);
+    } else {
+      lines.push(`${MARK.update} ${rel}`);
+      if (!isTextType(step.remote.content_type) || step.remote.size > MAX_DIFF_BYTES || step.local.size > MAX_DIFF_BYTES) {
+        lines.push(`    (content changed: ${step.remote.size} \u2192 ${step.local.size} bytes)`);
+        continue;
+      }
+      let bytes;
+      try {
+        bytes = (await client.download(filePath(t, step.rel))).bytes;
+      } catch (err) {
+        if (!isNotFound(err)) throw err;
+        lines.push("    (deleted on the base since it was listed)");
+        continue;
+      }
+      const before = Buffer.from(bytes).toString("utf-8");
+      const after = readLocal(dir, step.rel).toString("utf-8");
+      for (const line of changedLines(before, after)) lines.push(`    ${line}`);
+    }
+  }
+  return lines;
+}
+function printPushNotes(plan) {
+  printSection("Changed on the base since your last pull \u2014 left as is; pull to take it:", plan.changedOnBase.map(safe));
+  printSection("Deleted on the base since your last pull \u2014 left as is; pull to remove your copy:", plan.deletedOnBase.map(safe));
+  printSection("On the base, not in your files \u2014 left as is; pull to fetch it:", plan.onlyOnBase.map(safe));
+  printSection("Deleted in your files \u2014 kept on the base; push with --prune to delete it:", plan.keptOnBase.map(safe));
+}
+async function pushFiles(opts) {
+  const label = opts.label === void 0 ? void 0 : labelValue(opts.label);
+  const { target, dir, existing } = resolveSync(opts);
+  if (!existing) {
+    throw expected(
+      `${sanitizeTerminalText(dir)} has no record of a pull (${RECORD_FILE}), so there is nothing to check a push against. Run \`${pullCommand2(target, opts.dir)}\` first; a file type with no files pulls an empty record.`
+    );
+  }
+  const local = scanLocal(dir);
+  assertPushable(target.folder, [...local.keys()]);
+  const { client, remote } = await readBase(target);
+  let plan = planPush({ synced: existing.files, local, remote, prune: opts.prune });
+  if (target.folder && plan.steps.some((s) => s.op === "create")) {
+    const prefix = `${target.folder}/`;
+    const elsewhere = (await listFiles(client, target, "")).map((r) => r.path).filter((p) => !p.startsWith(prefix));
+    plan = planPush({ synced: existing.files, local, remote, prune: opts.prune, folder: target.folder, elsewhere });
+  }
+  const conflicts = [...plan.conflicts];
+  console.log(sanitizeTerminalText(`Push ${dir} \u2192 ${describeSync(target)}`));
+  printSection("Changes:", await describeSteps(client, target, dir, plan.steps));
+  printPushNotes(plan);
+  printSection("Conflicts \u2014 not pushed:", conflicts.map((c) => conflictLine(c, PUSH_CONFLICT)));
+  if (opts.dryRun) {
+    console.log("\nDry run \u2014 nothing pushed.");
+    finishWithConflicts(target, opts.dir, conflicts);
+    return;
+  }
+  const record = { ...existing, files: { ...existing.files } };
+  for (const r of plan.adopt) record.files[r.rel] = syncedFile(r);
+  for (const rel of plan.forget) delete record.files[rel];
+  if (plan.adopt.length > 0 || plan.forget.length > 0) writeRecord(dir, record);
+  if (plan.steps.length === 0) {
+    if (conflicts.length === 0) console.log(`
+Nothing to push \u2014 the base already has every change in ${sanitizeTerminalText(dir)}.`);
+    finishWithConflicts(target, opts.dir, conflicts);
+    return;
+  }
+  const n = plan.steps.length;
+  if (!await agree(`
+Push ${n} change${n === 1 ? "" : "s"} to ${describeSync(target)}?`, opts.yes)) {
+    console.log("Cancelled.");
+    return;
+  }
+  let pushed = 0;
+  const refusedDeletes = /* @__PURE__ */ new Set();
+  for (const step of plan.steps) {
+    const path42 = filePath(target, step.rel);
+    const blockedBy = step.op === "create" ? step.after?.find((d) => refusedDeletes.has(d.rel)) : void 0;
+    if (blockedBy !== void 0) {
+      const conflict = { rel: step.rel, reason: blockedBy.reason, other: blockedBy.rel };
+      conflicts.push(conflict);
+      console.log(`  ! ${conflictLine(conflict, PUSH_CONFLICT)}`);
+      continue;
+    }
+    try {
+      if (step.op === "delete") {
+        await client.request("DELETE", path42, void 0, fileWriteHeaders({ ifMatch: step.ifMatch }));
+        delete record.files[step.rel];
+      } else {
+        const bytes = readLocal(dir, step.rel);
+        if (computeHash(bytes) !== step.local.content_sha256) {
+          throw expected(`${safe(step.rel)} changed while the push ran. Nothing more was pushed; run the push again.`);
+        }
+        const contentType = step.op === "update" ? step.remote.content_type : guessMimeType(step.rel) ?? "application/octet-stream";
+        const row = await client.upload(
+          path42,
+          bytes,
+          contentType,
+          fileWriteHeaders({ ifMatch: step.op === "update" ? step.ifMatch : void 0, label })
+        );
+        record.files[step.rel] = {
+          version: typeof row?.version === "number" ? row.version : 0,
+          content_sha256: row?.content_sha256 ?? step.local.content_sha256
+        };
+      }
+      pushed++;
+      console.log(`  ${MARK[step.op]} ${safe(step.rel)}`);
+    } catch (err) {
+      if (step.op === "delete" && err instanceof ApiError && err.status === 404) {
+        delete record.files[step.rel];
+      } else if (isConflict(err)) {
+        if (step.op === "delete") refusedDeletes.add(step.rel);
+        const conflict = { rel: step.rel, reason: "changed_while_pushing" };
+        conflicts.push(conflict);
+        console.log(`  ! ${conflictLine(conflict, PUSH_CONFLICT)}`);
+        continue;
+      } else {
+        throw err;
+      }
+    }
+    writeRecord(dir, record);
+  }
+  console.log(sanitizeTerminalText(`
+Pushed ${pushed} change${pushed === 1 ? "" : "s"} to ${describeSync(target)}.`));
+  finishWithConflicts(target, opts.dir, conflicts);
+}
+function finishWithConflicts(t, dir, conflicts) {
+  const count = conflicts.length;
+  if (count === 0) return;
+  throw expected(
+    `${count} conflict${count === 1 ? "" : "s"} not pushed \u2014 the base's copies of those files were left as they are. To settle them, ${remedy(conflicts, pullCommand2(t, dir, true))}, then push again.`
+  );
+}
+var LIST_PAGE, MAX_LIST_PAGES, MAX_DIFF_BYTES, MARK, safe, PULL_KEPT, PULL_CONFLICT, PUSH_CONFLICT;
+var init_sync3 = __esm({
+  "src/data/files-sync/sync.ts"() {
+    "use strict";
+    init_dist();
+    init_contracts();
+    init_api_client();
+    init_expected();
+    init_resource_files();
+    init_terminal_output();
+    init_utils();
+    init_listing();
+    init_pacer();
+    init_client();
+    init_helpers();
+    init_headers();
+    init_local();
+    init_plan();
+    LIST_PAGE = 1e3;
+    MAX_LIST_PAGES = 1e3;
+    MAX_DIFF_BYTES = 256 * 1024;
+    MARK = { create: "+", update: "~", delete: "-" };
+    safe = (rel) => sanitizeTerminalText(rel);
+    PULL_KEPT = {
+      edited: "edited in your files, not pushed yet",
+      deleted: "deleted in your files, not pushed yet (push --prune deletes it from the base)"
+    };
+    PULL_CONFLICT = {
+      both_changed: "changed in your files and on the base",
+      deleted_on_base: "edited in your files, deleted on the base",
+      deleted_locally: "deleted in your files, changed on the base",
+      exists_locally: "in your files and on the base, with different content",
+      case_twin: "differs only in case from your local",
+      file_folder: "would be both a file and a folder with your local",
+      edited_while_pulling: "changed in your files while pulling \u2014 kept; pull again"
+    };
+    PUSH_CONFLICT = {
+      changed_on_base: "changed on the base since your last pull",
+      deleted_on_base: "deleted on the base since your last pull",
+      exists_on_base: "created on the base since your last pull",
+      case_twin: "differs only in case from the base's",
+      file_folder: "would make one path both a file and a folder with the base's",
+      changed_while_pushing: "changed on the base while pushing \u2014 not written"
+    };
+  }
+});
+
 // src/data/commands/files.ts
 import { Command as Command12 } from "commander";
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync11 } from "fs";
 import { basename as basename25 } from "path";
-function renderFileDiff(fileType, filePath, from, to, d) {
-  console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
+function renderFileDiff(fileType, filePath2, from, to, d) {
+  console.log(sanitizeTerminalText(`${fileType}/${filePath2}: v${from} \u2192 v${to}`));
   const md = d.metadata_delta;
   if (md) {
     for (const f of ["path", "size", "content_type", "label"]) {
@@ -36005,12 +37060,12 @@ function renderFileDiff(fileType, filePath, from, to, d) {
     console.log(sanitizeTerminalText(`  content: changed (${content.kind})`));
   }
 }
-function downloadTarget(remotePath, to) {
+function downloadTarget(remotePath2, to) {
   if (to) return to;
-  const derived = basename25(remotePath);
+  const derived = basename25(remotePath2);
   if (derived === "" || derived === "." || derived === "..") {
     throw expected(
-      `Cannot derive a local filename from "${remotePath}" \u2014 pass --to <local> to name it.`
+      `Cannot derive a local filename from "${remotePath2}" \u2014 pass --to <local> to name it.`
     );
   }
   return derived;
@@ -36021,23 +37076,32 @@ function buildFilesCommand() {
   );
   files.command("put <file_type> <path>").description(
     "Upload a local file to a path (e.g. wayai files put reports q3/summary.pdf --file ./summary.pdf)"
-  ).requiredOption("--file <local>", "Local file to upload").option("--content-type <type>", "MIME type", "application/octet-stream").action(async function(fileType, filePath, opts) {
+  ).requiredOption("--file <local>", "Local file to upload").option("--content-type <type>", "MIME type", "application/octet-stream").option(
+    "--if-match <hash>",
+    "Write only if the file's content hash is still this one (its ETag, or content_sha256 from get --meta); refused with a conflict otherwise"
+  ).option("--label <text>", "Label for the content version this upload creates (printable ASCII)").option("--metadata <json>", "The file's metadata, a JSON object (inline or @filename)").action(async function(fileType, filePath2, opts) {
     const base = pathSegment(requireBase(this), "--base");
+    const headers = fileWriteHeaders({
+      ifMatch: opts.ifMatch,
+      label: opts.label,
+      metadata: opts.metadata === void 0 ? void 0 : parseData(opts.metadata, "--metadata")
+    });
     const body = readFileSync23(opts.file);
     const client = await createDataClient();
     printOutput(
       await client.upload(
-        `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath)}`,
+        `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath2)}`,
         body,
-        opts.contentType
+        opts.contentType,
+        headers
       ),
       outputFormat(this)
     );
   });
   files.command("get <file_type> <path>").description(
     "Download a file (or --meta for metadata only). --version N reads a specific retained content version."
-  ).option("--to <local>", "Local file to save to (defaults to the file basename)").option("--meta", "Print metadata JSON instead of downloading the content").option("--version <n>", "Read a specific content version (default: latest)").action(async function(fileType, filePath, opts) {
-    const encoded = pathSegments(filePath);
+  ).option("--to <local>", "Local file to save to (defaults to the file basename)").option("--meta", "Print metadata JSON instead of downloading the content").option("--version <n>", "Read a specific content version (default: latest)").action(async function(fileType, filePath2, opts) {
+    const encoded = pathSegments(filePath2);
     const versionQs = opts.version !== void 0 ? `version=${encodeURIComponent(opts.version)}` : "";
     const base = pathSegment(requireBase(this), "--base");
     if (opts.meta) {
@@ -36049,7 +37113,7 @@ function buildFilesCommand() {
       );
       return;
     }
-    const out = downloadTarget(filePath, opts.to);
+    const out = downloadTarget(filePath2, opts.to);
     const client = await createDataClient();
     const { bytes } = await client.download(
       `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${encoded}${versionQs ? `?${versionQs}` : ""}`
@@ -36057,7 +37121,7 @@ function buildFilesCommand() {
     writeFileSync11(out, bytes);
     console.log(`Downloaded to ${out}`);
   });
-  files.command("history <file_type> <path>").description("List the content versions of a file (newest first)").option("--limit <n>", "Max versions to return").option("--offset <n>", "Pagination offset").action(async function(fileType, filePath, opts) {
+  files.command("history <file_type> <path>").description("List the content versions of a file (newest first)").option("--limit <n>", "Max versions to return").option("--offset <n>", "Pagination offset").action(async function(fileType, filePath2, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
     const qs = new URLSearchParams({ history: "1" });
@@ -36066,24 +37130,24 @@ function buildFilesCommand() {
     printOutput(
       await client.request(
         "GET",
-        `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath)}?${qs}`
+        `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath2)}?${qs}`
       ),
       outputFormat(this)
     );
   });
-  files.command("diff <file_type> <path>").description("Diff two content versions of a file \u2014 metadata delta plus a text content diff").requiredOption("--from <n>", "Base version number").requiredOption("--to <n>", "Target version number").action(async function(fileType, filePath, opts) {
+  files.command("diff <file_type> <path>").description("Diff two content versions of a file \u2014 metadata delta plus a text content diff").requiredOption("--from <n>", "Base version number").requiredOption("--to <n>", "Target version number").action(async function(fileType, filePath2, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
     const qs = new URLSearchParams({ diff: "1", from: opts.from, to: opts.to });
     const data = await client.request(
       "GET",
-      `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath)}?${qs}`
+      `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath2)}?${qs}`
     );
     if (outputFormat(this) === "json") {
       printOutput(data, "json");
       return;
     }
-    renderFileDiff(fileType, filePath, opts.from, opts.to, data);
+    renderFileDiff(fileType, filePath2, opts.from, opts.to, data);
   });
   files.command("list <file_type>").description("List files by path prefix").option("--prefix <path>", "Path prefix filter (e.g. q3/)").option("--depth <n>", "Max folder depth below the prefix (1 = immediate children)").option("--limit <n>", "Max results").option("--offset <n>", "Pagination offset").action(async function(fileType, opts) {
     const base = pathSegment(requireBase(this), "--base");
@@ -36109,16 +37173,53 @@ function buildFilesCommand() {
       outputFormat(this)
     );
   });
-  files.command("rm <file_type> <path>").description("Delete a file").option("-y, --yes", "Skip confirmation prompt").action(async function(fileType, filePath, opts) {
-    if (!opts.yes && !await confirm(`Delete file "${fileType}/${filePath}"? This cannot be undone.`)) {
+  files.command("rm <file_type> <path>").description("Delete a file").option("-y, --yes", "Skip confirmation prompt").option(
+    "--if-match <hash>",
+    "Delete only if the file's content hash is still this one; refused with a conflict otherwise"
+  ).action(async function(fileType, filePath2, opts) {
+    const headers = fileWriteHeaders({ ifMatch: opts.ifMatch });
+    if (!opts.yes && !await confirm(`Delete file "${fileType}/${filePath2}"? This cannot be undone.`)) {
       console.log("Aborted");
       return;
     }
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    await client.request("DELETE", `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath)}`);
+    await client.request(
+      "DELETE",
+      `/v1/${base}/files/${pathSegment(fileType, "file_type")}/${pathSegments(filePath2)}`,
+      void 0,
+      headers
+    );
     console.log("Deleted");
   });
+  files.command("pull <file_type>").description(
+    "Pull a file type, or one --folder of it, into a local folder (default ./<file_type>[/<folder>]), recording each file's version for push. Local changes are kept; --overwrite replaces them"
+  ).option("--folder <path>", "Sync one folder of the file type (e.g. hr), not all of it").option("--dir <local>", "Local folder to sync into (default ./<file_type>, or ./<file_type>/<folder>)").option("--overwrite", "Replace local changes with the base's copies").option("-y, --yes", "Skip the confirmation --overwrite asks for").action(async function(fileType, opts) {
+    const base = requireBase(this);
+    await pullFiles({
+      base,
+      fileType,
+      folder: opts.folder,
+      dir: opts.dir,
+      overwrite: opts.overwrite ?? false,
+      yes: opts.yes ?? false
+    });
+  });
+  files.command("push <file_type>").description(
+    "Push the local changes of a folder pulled with `files pull` to the base, after showing the diff. A file changed, deleted or created on the base since your pull is a conflict, not written; an update or delete also carries the version pulled, so the base refuses it if the file changed meanwhile"
+  ).option("--folder <path>", "The folder of the file type the local folder was pulled from").option("--dir <local>", "Local folder to push (default ./<file_type>, or ./<file_type>/<folder>)").option("--dry-run", "Show the diff and push nothing").option("--prune", "Also delete files you deleted locally \u2014 only those unchanged on the base since your pull").option("--label <text>", "Label for every content version the push creates (printable ASCII)").option("-y, --yes", "Push without asking").action(async function(fileType, opts) {
+    const base = requireBase(this);
+    await pushFiles({
+      base,
+      fileType,
+      folder: opts.folder,
+      dir: opts.dir,
+      dryRun: opts.dryRun ?? false,
+      prune: opts.prune ?? false,
+      label: opts.label,
+      yes: opts.yes ?? false
+    });
+  });
   files.command("mount <file_type>").description(
     "Mint an S3 credential so any harness can mount this file type as a filesystem (s3fs, cloud mount SDKs). Read-only by default; the secret is shown once."
   ).option("--expires-in <seconds>", "Credential lifetime in seconds (default 30 days, max 90)").option(
@@ -36171,6 +37272,8 @@ var init_files2 = __esm({
     init_helpers();
     init_utils();
     init_terminal_output();
+    init_headers();
+    init_sync3();
   }
 });
 
@@ -36383,8 +37486,8 @@ function buildRecordsCommand() {
     const body = { data: parseData(opts.data) };
     if (opts.externalId) body.external_id = opts.externalId;
     if (opts.externalSource) body.external_source = opts.externalSource;
-    const path41 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
-    printOutput(await client.request("PUT", path41, body), outputFormat(this));
+    const path42 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
+    printOutput(await client.request("PUT", path42, body), outputFormat(this));
   });
   records.command("query <record_type>").description("List/search records: exact filters + fuzzy `search`, sorting, pagination").option(
     "--external-source <source>",
@@ -36419,9 +37522,9 @@ function buildRecordsCommand() {
   ).action(async function(recordType2, id, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    let path41 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
-    if (opts.externalSource) path41 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
-    printOutput(await client.request("GET", path41), outputFormat(this));
+    let path42 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    if (opts.externalSource) path42 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
+    printOutput(await client.request("GET", path42), outputFormat(this));
   });
   records.command("delete <record_type> <id>").description(
     "Delete a record by internal ID, or by external_id (pass --external-source to scope it)"
@@ -36435,11 +37538,11 @@ function buildRecordsCommand() {
     }
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    let path41 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    let path42 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
     if (opts.externalSource) {
-      path41 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
+      path42 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
     }
-    await client.request("DELETE", path41);
+    await client.request("DELETE", path42);
     console.log("Deleted");
   });
   records.command("history <id>").description(
@@ -36604,8 +37707,8 @@ function buildRelationshipsCommand() {
     if (opts.data) body.data = parseData(opts.data);
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const path41 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
-    printOutput(await client.request("PUT", path41, body), outputFormat(this));
+    const path42 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
+    printOutput(await client.request("PUT", path42, body), outputFormat(this));
   });
   relationships.command("get <id>").description(
     "Get a relationship by ID (or by its external key: pass the external_id with --rel-type)"
@@ -36838,8 +37941,8 @@ function buildToolsetsCommand() {
   toolsets.command("get <slug>").description("Get a toolset").option("--resolved", "Include resolved record_type schemas").action(async function(slug, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const path41 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
-    printOutput(await client.request("GET", path41), outputFormat(this));
+    const path42 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
+    printOutput(await client.request("GET", path42), outputFormat(this));
   });
   toolsets.command("list").description("List all toolsets").action(async function() {
     const base = pathSegment(requireBase(this), "--base");
@@ -37074,7 +38177,7 @@ init_utils();
 init_registry();
 import { readFileSync as readFileSync24 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname16, join as join37 } from "path";
+import { dirname as dirname17, join as join38 } from "path";
 
 // src/lib/version-refresh.ts
 init_version_cache();
@@ -37082,7 +38185,7 @@ init_skill_version();
 import { exec } from "child_process";
 var REFRESH_TIMEOUT_MS = 1e4;
 function refreshCliCache() {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     exec("npm view @wayai/cli version", { timeout: REFRESH_TIMEOUT_MS }, (err, stdout) => {
       if (!err) {
         const latest = stdout.trim();
@@ -37093,7 +38196,7 @@ function refreshCliCache() {
           }
         }
       }
-      resolve12();
+      resolve13();
     });
   });
 }
@@ -37119,8 +38222,8 @@ async function refreshSkillCache() {
 }
 async function refreshAdminSkillCache() {
   let timer;
-  const deadline = new Promise((resolve12) => {
-    timer = setTimeout(resolve12, REFRESH_TIMEOUT_MS);
+  const deadline = new Promise((resolve13) => {
+    timer = setTimeout(resolve13, REFRESH_TIMEOUT_MS);
   });
   await Promise.race([deadline, fetchAndCacheAdminSkillVersion().catch(() => {
   })]);
@@ -37229,8 +38332,8 @@ Run \`wayai admin skill install\` to update.`);
 }
 
 // src/index.ts
-var __dirname = dirname16(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync24(join37(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname17(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync24(join38(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
@@ -37280,8 +38383,8 @@ async function main() {
       break;
     }
     case "pull": {
-      const { pullCommand: pullCommand2 } = await Promise.resolve().then(() => (init_pull(), pull_exports));
-      await pullCommand2(args);
+      const { pullCommand: pullCommand3 } = await Promise.resolve().then(() => (init_pull(), pull_exports));
+      await pullCommand3(args);
       break;
     }
     case "push": {