@wayai/cli 0.3.221 → 0.3.222

package/dist/index.js

@@ -4604,6 +4604,38 @@ var init_zod = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-VXEAR36B.js
+var orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody;
+var init_chunk_VXEAR36B = __esm({
+  "../../packages/core/dist/chunk-VXEAR36B.js"() {
+    "use strict";
+    init_zod();
+    orgTagIdParam = external_exports.object({
+      id: external_exports.string().uuid()
+    });
+    listOrgTagsQuery = external_exports.object({
+      organization_id: external_exports.string().uuid()
+    });
+    ORG_TAG_NAME_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+    ORG_TAG_NAME_MAX_LENGTH = 50;
+    createOrgTagBody = external_exports.object({
+      organization_id: external_exports.string().uuid(),
+      name: external_exports.string().min(1).max(ORG_TAG_NAME_MAX_LENGTH).regex(ORG_TAG_NAME_REGEX, {
+        message: 'Must be lowercase alphanumeric with hyphens (e.g. "my-tag")'
+      }),
+      display_name: external_exports.string().max(100).nullish(),
+      color: external_exports.string().max(20).nullish()
+    });
+    updateOrgTagBody = external_exports.object({
+      // Required so the route targets the org the UI is managing (which may differ
+      // from the token's default `auth.org_id` for multi-org users) — mirrors create/list.
+      organization_id: external_exports.string().uuid(),
+      display_name: external_exports.string().max(100).nullish(),
+      color: external_exports.string().max(20).nullish()
+    });
+  }
+});
+
 // ../../packages/core/dist/chunk-HZ6CADSY.js
 function optionalTrimmedText(max) {
   return external_exports.string().trim().max(max).optional().transform((value) => value ? value : void 0);
@@ -5251,34 +5283,21 @@ var init_chunk_FK6HBXM7 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-VXEAR36B.js
-var orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody;
-var init_chunk_VXEAR36B = __esm({
-  "../../packages/core/dist/chunk-VXEAR36B.js"() {
+// ../../packages/core/dist/chunk-GPM7PE44.js
+var bootstrapQuery;
+var init_chunk_GPM7PE44 = __esm({
+  "../../packages/core/dist/chunk-GPM7PE44.js"() {
     "use strict";
     init_zod();
-    orgTagIdParam = external_exports.object({
-      id: external_exports.string().uuid()
-    });
-    listOrgTagsQuery = external_exports.object({
-      organization_id: external_exports.string().uuid()
-    });
-    ORG_TAG_NAME_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-    ORG_TAG_NAME_MAX_LENGTH = 50;
-    createOrgTagBody = external_exports.object({
-      organization_id: external_exports.string().uuid(),
-      name: external_exports.string().min(1).max(ORG_TAG_NAME_MAX_LENGTH).regex(ORG_TAG_NAME_REGEX, {
-        message: 'Must be lowercase alphanumeric with hyphens (e.g. "my-tag")'
-      }),
-      display_name: external_exports.string().max(100).nullish(),
-      color: external_exports.string().max(20).nullish()
-    });
-    updateOrgTagBody = external_exports.object({
-      // Required so the route targets the org the UI is managing (which may differ
-      // from the token's default `auth.org_id` for multi-org users) — mirrors create/list.
-      organization_id: external_exports.string().uuid(),
-      display_name: external_exports.string().max(100).nullish(),
-      color: external_exports.string().max(20).nullish()
+    bootstrapQuery = external_exports.object({
+      active_hub_id: external_exports.string().uuid().optional(),
+      active_conversation_id: external_exports.string().uuid().optional(),
+      active_nav: external_exports.enum(["chat", "task", "support"]).optional(),
+      /**
+       * The people thread the URL names (`/chat/threads/:threadId`, gh #4661): the snapshot
+       * preloads it as `people.active_thread` when the viewer is a member.
+       */
+      active_thread_id: external_exports.string().uuid().optional()
     });
   }
 });
@@ -5553,6 +5572,583 @@ var init_chunk_5DGHIY7L = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-F3JHI4Y4.js
+var DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, AUTOMATION_WEBHOOK_MOUNT;
+var init_chunk_F3JHI4Y4 = __esm({
+  "../../packages/core/dist/chunk-F3JHI4Y4.js"() {
+    "use strict";
+    DATA_PROXY_MOUNT = "/data";
+    DATA_PROXY_PREFIX = `/api${DATA_PROXY_MOUNT}`;
+    BASE_DESTRUCTION_MOUNT = "/bases";
+    BASE_DESTRUCTION_PREFIX = `/api${BASE_DESTRUCTION_MOUNT}`;
+    BASE_DESTRUCTION_CONFIRM_PATH = `${BASE_DESTRUCTION_PREFIX}/destruction/confirm`;
+    COMMUNITY_EMAIL_UNSUBSCRIBE_PATH = "/api/communities/email-unsubscribe";
+    CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH = "/api/contact-book/email-unsubscribe";
+    AUTOMATION_WEBHOOK_MOUNT = "/webhooks/automations";
+  }
+});
+
+// ../../packages/core/dist/chunk-IEWJ5MZH.js
+function matchPath(pattern, path42) {
+  const normalizedPath = path42.replace(/\/$/, "");
+  if (pattern.endsWith("/*")) {
+    const prefix = pattern.slice(0, -2);
+    return normalizedPath === prefix || normalizedPath.startsWith(prefix + "/");
+  }
+  return pattern === normalizedPath;
+}
+function getEndpointConfig(path42) {
+  for (const excluded of EXCLUDED_PATHS) {
+    if (matchPath(excluded, path42)) {
+      return null;
+    }
+  }
+  const normalizedPath = path42.replace(/\/$/, "");
+  if (!normalizedPath.endsWith("/*") && Object.prototype.hasOwnProperty.call(ENDPOINT_CONFIGS, normalizedPath)) {
+    return ENDPOINT_CONFIGS[normalizedPath];
+  }
+  const sortedPatterns = Object.keys(ENDPOINT_CONFIGS).sort((a, b) => b.length - a.length);
+  for (const pattern of sortedPatterns) {
+    if (matchPath(pattern, path42)) {
+      return ENDPOINT_CONFIGS[pattern];
+    }
+  }
+  return { tier: "STANDARD" };
+}
+var ENDPOINT_CONFIGS, EXCLUDED_PATHS;
+var init_chunk_IEWJ5MZH = __esm({
+  "../../packages/core/dist/chunk-IEWJ5MZH.js"() {
+    "use strict";
+    init_chunk_F3JHI4Y4();
+    ENDPOINT_CONFIGS = {
+      // OAuth callbacks - strict, fail-closed (prevent brute force)
+      "/oauth/callback/*": { tier: "STRICT", failClosed: true },
+      // Auth endpoints - strict, fail-closed
+      "/auth/phone": { tier: "STRICT", failClosed: true },
+      "/auth/mcp/exchange": { tier: "MODERATE", failClosed: true },
+      // Native magic-code login (pre-auth) — STRICT per-IP bounds a single host; WorkOS owns
+      // the per-email lockout / TTL / single-use guarantees.
+      "/api/auth/magic-code/*": { tier: "STRICT", failClosed: true },
+      // Native password login (pre-auth) — same posture as magic-code above. STRICT per-IP bounds a
+      // single host but FAILS OPEN on a binding error (like every IP limit); the `failClosed` flag
+      // here is inert on a pre-auth route (it's only enforced on the per-user branch, which needs an
+      // authenticated caller). The fail-CLOSED brute-force guarantee for the static credential comes
+      // from the route's per-email caps (burst + cumulative hourly), not this flag.
+      "/api/auth/password/*": { tier: "STRICT", failClosed: true },
+      // Every `/api/*` group whose paths carry ids pins `userLimitKey` (gh #4756), held there by
+      // `security/endpoint-invariants.test.ts`.
+      // Billing - moderate, fail-closed with user limits
+      "/api/billing/*": {
+        tier: "MODERATE",
+        userLimit: 100,
+        failClosed: true,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/billing/*"
+      },
+      "/webhooks/stripe": { tier: "MODERATE", failClosed: true },
+      "/webhooks/workos": { tier: "MODERATE", failClosed: true },
+      // API endpoints - standard with user limits
+      // 500 because the web's settings live updates refetch per hub in every open tab, whatever page
+      // it shows (`settingsLiveUpdateStore.ts`): one batch of changes costs about 10 + 4 per agent
+      // whose tools were opened + 2 per loaded resource, so a CLI push and publish (both hubs) with
+      // two tabs open passes 150 in a minute. A multi-file resource upload adds 2–5 per file.
+      "/api/setup/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/setup/*"
+      },
+      // 500 because an eval run's drill-down (`SessionResults.tsx`) fetches its list and then every
+      // LLM turn's record at once: up to 201 requests (`OBSERVABILITY_LIST_CAP`, 200). Sending keeps
+      // the 150 it had when each path held its own budget, on the exact key below.
+      "/api/conversations/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/conversations/*"
+      },
+      "/api/conversations/send-message": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      "/api/users/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      "/api/analytics/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/analytics/*"
+      },
+      // 500 because `wayai eval-results --eval` reads completed sessions one by one, newest first,
+      // until one holds the eval (up to the 1000 the list returns). Tenant SQL keeps the 150 it had
+      // when each path held its own budget: each query may run 30 s on shared-tenant ClickHouse
+      // after its caller has gone (`sql-validator.ts`, stage 10b).
+      "/api/evals/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/evals/*"
+      },
+      "/api/evals/sql": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      // An eval run's calls (gh #4418), kept off the end user's call budgets below. Create keeps the
+      // 150 it had: it opens a provider session on the org's own key, billed per second. The routes
+      // on one call take a budget of their own so no eval read can spend it: a refused hang-up
+      // leaves the call running, and billing. 500 because a call suite polls each run's record
+      // every second, about 64 requests a minute per suite.
+      "/api/evals/calls": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      "/api/evals/calls/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/evals/calls/*"
+      },
+      "/api/files/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      // The org contact book (wayai#4931 PR 2b). A CSV import sends one request per
+      // `CONTACT_IMPORT_BATCH_MAX` rows, so 150 a minute imports 75,000 rows a minute.
+      "/api/contact-book/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/contact-book/*"
+      },
+      // An automation email's one-click unsubscribe (wayai#4931 PR 2d) — public: its token is its one
+      // credential, so this per-IP limit is its one bound, and runs before the route reads anything.
+      // MODERATE (30/min per IP), as the community email's unsubscribe, for the same reason: mail
+      // clients' one-click unsubscribe POSTs it from their own servers, which many recipients' clicks
+      // share. An exact key, so it wins over the wildcard above.
+      [CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
+      "/api/automations/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/automations/*"
+      },
+      // A hub's own contact lists (wayai#4931 PR 2c): config edits, at the automations' rate.
+      "/api/hub-contact-lists/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/hub-contact-lists/*"
+      },
+      "/api/message-templates/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/message-templates/*"
+      },
+      "/api/live-updates/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      "/api/hub-users/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/hub-users/*"
+      },
+      "/api/conversation-state/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/conversation-state/*"
+      },
+      // The authenticated byte route (`routes/files/r2.ts`), mounted after its `authMiddleware` so
+      // the caller is known: each request reads the HubDO its key names, and a hub id never created
+      // still wakes a Durable Object (gh #4747; since gh #4775 T5 one that writes nothing). The key is pinned
+      // because the paths are file keys, which would otherwise each get a fresh budget (and one
+      // over 256 characters would be refused outright, `checkUserLimitNative`).
+      //
+      // 500 a minute because the web chat fetches every attachment of every loaded message at
+      // once, with no list virtualization: up to 50 per 50-message page, 200 per ended
+      // conversation or history entry at one file per message, and 4 per message at most in its
+      // image grid. Repeats come from the browser's HTTP cache (`private, max-age=3600`); mobile
+      // renders through a disk cache and plays audio from `/files/signed`. The budget is shared by
+      // a caller's tabs and devices. The other two byte routes, `/files/signed/*` and
+      // `/files/public/*`, mount no limiter (the reason is at their entries in
+      // `security/endpoint-invariants.test.ts`'s route registry).
+      "/files/auth/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/files/auth/*"
+      },
+      // Channel webhooks - high throughput (external systems, never authenticated)
+      "/webhooks/whatsapp/*": { tier: "HIGH" },
+      "/webhooks/instagram/*": { tier: "HIGH" },
+      // An automation's webhook deliveries (wayai#4931 D13) — no bearer token: the automation's
+      // secret is the credential, checked against one HubDO read. This per-IP limit runs first, before
+      // anything is read. HIGH, as the channel webhooks: senders are servers, and an integration
+      // platform's egress addresses carry many tenants' deliveries. The per-automation budget is
+      // `AUTOMATION_WEBHOOK_PER_AUTOMATION_LIMIT`, counted after the delivery is verified.
+      [`${AUTOMATION_WEBHOOK_MOUNT}/*`]: { tier: "HIGH" },
+      // Reports (CLI → platform_report triage queue). One per-user budget covers intake
+      // (POST), the content edit (PATCH /:id), the reporter read-back (GET, GET /:id), and the
+      // verification loop (POST /:id/accept, /:id/contest). The limiter is path-based, so a
+      // method-level split (loose reads, strict writes) isn't expressible — GET /:id and PATCH
+      // /:id share a path. So the budget is sized for the read-heavy poll loop (a reporter agent
+      // polling `report get`/`list` while it waits for the fix), at 60/hour. Intake-flooding stays
+      // bounded regardless: identical reports collapse on `fingerprint` (ON CONFLICT DO NOTHING),
+      // so a runaway create loop merges rather than floods. Still STRICT tier + failClosed so a
+      // genuinely runaway distinct-report loop surfaces as 429. The `/*` is load-bearing — an
+      // exact `/api/reports` key would leave the `/:id` paths unmatched (→ unthrottled).
+      // `userLimitKey` is equally load-bearing: without it, middleware falls back to each request's
+      // path and report IDs/actions receive independent counters instead of this shared budget.
+      "/api/reports/*": {
+        tier: "STRICT",
+        userLimit: 60,
+        userWindow: 3600,
+        failClosed: true,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/reports/*"
+      },
+      // Admin report mutations (transition/group/ungroup/edit) — platform-admin
+      // gated at the route, rate-limited here as defense-in-depth. Generous STANDARD
+      // cap so legitimate triage bursts aren't throttled (grouping is one request
+      // even for many members); deliberately NOT failClosed so a Redis blip never
+      // blocks an admin's triage. The bare GET reads share this budget harmlessly.
+      "/api/admin/reports/*": { tier: "STANDARD", userLimit: 150, userLimitKey: "/api/admin/reports/*" },
+      // GitHub webhook (issues.closed → platform_report addressed). MODERATE +
+      // fail-closed; GitHub retries on transient failures so a brief Redis blip
+      // doesn't lose state.
+      "/webhooks/github": { tier: "MODERATE", failClosed: true },
+      // Account deletion — strict on the destructive POST + public undo. The
+      // /api/users/* default tier above ALSO matches these, but `getEndpointConfig`
+      // returns the longest-prefix match, so the more specific entries here win.
+      // `skipAuthenticatedUsers` deliberately omitted: every caller is authenticated,
+      // so including it would make `userLimit` a no-op — the per-user cap IS the gate.
+      "/api/users/me/deletion": { tier: "STRICT", userLimit: 3, userWindow: 3600, failClosed: true },
+      "/api/users/me/deletion/preflight": { tier: "STANDARD", userLimit: 30, failClosed: true },
+      "/api/users/deletion/undo": { tier: "STRICT", failClosed: true },
+      // Production-base destruction.
+      //
+      // Keyed off the CONTRACT constants, not literals: `BASE_DESTRUCTION_CONFIRM_PATH`'s own
+      // docstring promises that the mount, the `AUTH_BYPASS_PATHS` entry, the rate-limit key and
+      // the URL the email embeds move together, and a literal here is exactly how that promise
+      // goes quietly false — leaving an unauthenticated HMAC endpoint on the default tier.
+      //
+      // The emailed GET is PUBLIC, so it gets the IP-tier bound the pre-auth routes get.
+      // `failClosed` is deliberately NOT set: it is only consulted on the per-USER branch, which
+      // needs an authenticated caller, so on a pre-auth route it is inert — the same thing
+      // `/api/auth/magic-code/send` above says about itself. The IP limiter fails OPEN on a
+      // limiter error by design (`packages/runtime/src/rate-limiter.ts`), and claiming otherwise
+      // would tell the next auditor a protection exists that does not.
+      [BASE_DESTRUCTION_CONFIRM_PATH]: { tier: "STRICT" },
+      // The console's read, which every production base's settings pane issues on mount. Without
+      // its own entry it inherits the mount-wide budget below, and an admin clicking through
+      // thirty bases in an hour would be 429'd by a limit sized for irreversible writes.
+      [`${BASE_DESTRUCTION_PREFIX}/destructions`]: { tier: "STANDARD", userLimit: 150 },
+      // The mutating routes: initiate, the authenticated confirm, and cancel. Per user rather than
+      // per IP — all three are authenticated and org-admin gated — and hourly, since a single human
+      // touching thirty production-deletion operations in an hour is already far past normal.
+      // Longest-prefix wins, so the two entries above are not widened by this one. The key is
+      // pinned so those thirty are counted across every base the caller touches (gh #4756).
+      [`${BASE_DESTRUCTION_PREFIX}/*`]: {
+        tier: "STANDARD",
+        userLimit: 30,
+        userWindow: 3600,
+        failClosed: true,
+        userLimitKey: `${BASE_DESTRUCTION_PREFIX}/*`
+      },
+      // Email-invite preview — public, fail-closed. MODERATE (30/min IP) leaves
+      // headroom for the signup-page server-fetch + reloads + prefetches; STRICT
+      // would throttle legitimate users opening the link in multiple tabs.
+      "/api/invites/preview": { tier: "MODERATE", failClosed: true },
+      // "Don't email me again" (gh #4661) — public; one POST per click on its confirm page. STRICT
+      // per IP. No `failClosed`: it is consulted only on the per-user branch, which a pre-auth route
+      // never reaches (see `BASE_DESTRUCTION_CONFIRM_PATH` above).
+      "/api/invites/unsubscribe": { tier: "STRICT" },
+      // Admin DO debug reads — the ONE deliberate deviation from the Data Explorer
+      // catch-all below, and the only reason a per-route key still exists here.
+      // Platform-admin is enforced at the route; this is the independent
+      // defense-in-depth signal so a runaway investigation script surfaces as 429.
+      //
+      // STRICT is kept ON PURPOSE even though the catch-all moved off it: per IP, at 5/min vs
+      // STANDARD's 100/min, walking 10k ids takes ~33h instead of ~100min — a detection window
+      // worth keeping on the routes that return RAW DO ROWS.
+      //
+      // The cost, stated rather than elided: STRICT is one bucket shared with
+      // `/oauth/callback/*` and `/api/auth/magic-code/*`, so a debug session from a
+      // NAT'd office IP can 429 a colleague's login for up to a minute. That trade is
+      // accepted for a rare, deliberate investigation surface — and is exactly why the
+      // browse routes below are NOT here.
+      //
+      // The key is pinned, so a sweep of `/debug/do/hub/<id>/tables` across ids spends one
+      // per-admin budget (gh #4756). 120 an hour: an agent's investigation of a dozen
+      // conversations made 37 debug reads in its busiest hour.
+      "/api/admin/data-explorer/debug/*": {
+        tier: "STRICT",
+        userLimit: 120,
+        userWindow: 3600,
+        failClosed: true,
+        userLimitKey: "/api/admin/data-explorer/debug/*"
+      },
+      // Catch-all for the rest of the Data Explorer (`/search`, `/entity/*`, `/do/*`,
+      // `/kv/*`, the DELETE routes). Added as a catch-all rather than another per-route
+      // key because this budget kept lagging behind routes joining the debug boundary:
+      // with no match the path falls to the default, which sets no `userLimit`, so the
+      // per-user layer never runs at all. `getEndpointConfig` takes the longest match,
+      // so `debug/*` above still wins.
+      //
+      // `/entity/*` deliberately has NO key of its own: it needs precisely this config,
+      // and a duplicate entry is how the two drift apart on the next edit.
+      //
+      // `tier` is deliberately STANDARD, not STRICT. `tier` is the per-IP knob and
+      // STRICT is 5/min keyed on IP ALONE — one bucket shared across every STRICT
+      // endpoint. On these browse routes that breaks the console (open Browse KV and
+      // inspect four values = 6 requests; expand six org rows in the search results =
+      // 6 `/entity/org/:id` calls) and would drain the same IP's budget for
+      // `/oauth/callback/*` and `/api/auth/magic-code/*`, which on a NAT'd office IP
+      // means all admins. The per-user hourly cap is the leg that matters here.
+      //
+      // The canonical key is deliberate: request paths contain DO ids and arbitrary
+      // malformed requests can contain credential material. Keying on the request path
+      // both stores that material in Redis/logs and gives every target a fresh counter.
+      // One stable identity makes every browse request consume the same per-admin
+      // budget without storing request targets.
+      //
+      // 600/hour preserves the original pagination requirement (about 30k rows at
+      // 50/page) while now genuinely bounding id/key enumeration across the surface.
+      "/api/admin/data-explorer/*": {
+        tier: "STANDARD",
+        userLimit: 600,
+        userWindow: 3600,
+        failClosed: true,
+        userLimitKey: "/api/admin/data-explorer/*"
+      },
+      // Admin harness incident-response (harness-agents PR 2.9b) — mass-destroy reaps
+      // EVERY live harness session/token/slot in scope, so it gets a strict budget
+      // (STRICT + a low per-user hourly cap + fail-closed). Platform-admin is enforced
+      // at the route; this is the independent defense-in-depth signal so a runaway
+      // reap loop surfaces as 429. The break-glass disable/enable rides through
+      // `/api/admin/config` (its own STANDARD budget), not this key.
+      "/api/admin/harness/*": {
+        tier: "STRICT",
+        userLimit: 10,
+        userWindow: 3600,
+        failClosed: true,
+        userLimitKey: "/api/admin/harness/*"
+      },
+      // Platform-wide team-orphan repair — a single call can WRITE across every hub of
+      // every org (HubDO purge + UserDO mirror fan-out), so it gets the same strict,
+      // fail-closed budget as the other cross-platform admin write. Exact path (not a
+      // prefix): the sibling `/api/admin/hubs/:hubId/harness` flag flips stay on the
+      // default admin budget. Platform-admin is enforced at the route; this is the
+      // defense-in-depth signal that a repair loop surfaces as 429.
+      "/api/admin/hubs/repair-team-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
+      // Branching-orphan repair (#4577) — deletes named production rows, and its report mode
+      // fans out over every production hub of every org, so it takes the same strict,
+      // fail-closed budget as the team-orphan repair. Exact path, for the same reason.
+      "/api/admin/hubs/repair-branching-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
+      // CI/GitOps endpoints - standard with user limits. 500 because `wayai push` makes four requests
+      // (pull, diff, push, pull) and a GitOps job may push every hub at once with one token; when
+      // each path held its own 100, that ran to 100 hubs a minute.
+      "/api/ci/*": { tier: "STANDARD", userLimit: 500, skipAuthenticatedUsers: true, userLimitKey: "/api/ci/*" },
+      // Attested `/v1` proxy onto the Rekor Worker. `userLimitKey` is load-bearing here: the
+      // per-user budget defaults to the full request path, and this surface's paths carry base,
+      // record, and file ids — so without a pinned key every distinct resource would get its own
+      // fresh budget and the per-user limit would bound nothing. One shared budget across the
+      // whole data surface is the intent.
+      [`${DATA_PROXY_PREFIX}/*`]: {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: `${DATA_PROXY_PREFIX}/*`
+      },
+      // Voice calls — the end user's call routes (`routes/api/calls`). Every caller is signed
+      // in, so the per-IP tier is skipped for them: Brazilian mobile carriers put many callers
+      // behind one IP, and a shared bucket would refuse one caller for another's traffic.
+      //
+      // Create is the only route that spends: it opens a provider session on the org's own
+      // key, billed per second. So it takes its own exact key and an hourly per-user cap, which
+      // lives on Redis and is fail-closed like the other hourly caps. The exact key wins over
+      // the wildcard below, which also matches `/api/calls` (see `getEndpointConfig`).
+      "/api/calls": {
+        tier: "STANDARD",
+        userLimit: 30,
+        userWindow: 3600,
+        failClosed: true,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/calls"
+      },
+      // The routes on one call: `ready`, hang-up, the delegation report and the status read; and
+      // the opening read (`/api/calls/openings/:language`), one per call, before it exists.
+      // NEVER fail-closed: a refused hang-up leaves the call running, and billing, until a
+      // limit ends it. The 60 s budget runs on the native binding, which fails open. The key is
+      // pinned because the paths carry the call id, which would otherwise give every call a
+      // fresh budget.
+      "/api/calls/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/calls/*"
+      },
+      // Contacts between accounts (gh #4661, `routes/api/contacts`). Every caller is signed in, so
+      // the per-IP tier is skipped. The keys are pinned because the paths carry user and invite
+      // ids, which would otherwise give each id a fresh budget. Blocks take their own, lower
+      // budget (#4661 Limits: blocks are rate-limited). The invites-per-day cap and every list
+      // cap are counted in the caller's UserDO, in the same write they bound, not here.
+      "/api/contacts/*": {
+        tier: "STANDARD",
+        userLimit: 60,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/contacts/*"
+      },
+      "/api/contacts/blocks/*": {
+        tier: "STANDARD",
+        userLimit: 30,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/contacts/blocks/*"
+      },
+      // Person-to-person threads (gh #4661, `routes/api/threads`): the per-user send limit, 60 a
+      // minute on the native binding. Every thread route shares the one budget, reads included:
+      // the paths carry thread and message ids, so the key is pinned, and a pattern here cannot
+      // tell a send from a read of the same path. Like every 60 s budget it fails open on a
+      // binding error, so it bounds sends in the steady state only.
+      "/api/threads/*": {
+        tier: "STANDARD",
+        userLimit: 60,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/threads/*"
+      },
+      // An org admin's erasure of one person's thread messages (gh #4661 owner decision 7): any user
+      // can own a free org, so each request arms that org's alarm, and this caps how fast one person
+      // can ask. The org's own daily cap (`PEOPLE_ORG_ERASURES_PER_DAY`, counted in its OrgDO in the
+      // write it bounds) is the fail-closed bound; this budget, on the native binding, fails open.
+      "/api/threads/org-erasures": {
+        tier: "STANDARD",
+        userLimit: 10,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/threads/org-erasures"
+      },
+      // A person's report of a message, thread or person (`people-reports.ts`): each one written
+      // arms the PlatformDO's alarm and emails the platform admins, so it takes its own, lower
+      // budget. The reporter's daily cap (`PEOPLE_REPORTS_PER_DAY`, counted in the report store in
+      // the write it bounds) is the fail-closed bound; this budget, on the native binding, fails open.
+      "/api/threads/reports": {
+        tier: "STANDARD",
+        userLimit: 10,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/threads/reports"
+      },
+      // Communities (gh #4872, `routes/api/communities`): every signed-in route under the mount (the
+      // preview below excepted) shares one per-user budget, which is also each member's send limit and
+      // bounds the reads that scan a community's rows (a title search, the stats); a community's own
+      // limits (its rate, the daily caps, slow mode) are counted in its CommunityDO, in the write they
+      // bound. Every caller is signed in, so the per-IP tier is skipped; the key is pinned because the
+      // paths carry community, room and message ids.
+      "/api/communities/*": {
+        tier: "STANDARD",
+        userLimit: 60,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/communities/*"
+      },
+      // The join page's preview of a link — public, fetched from the visitor's browser, so this
+      // per-IP limit is its one bound and runs before the route reads anything (#4872
+      // owner-delegated decision 9). MODERATE (30/min per IP) leaves room for reloads and several
+      // tabs. An exact key, so it wins over the wildcard above.
+      "/api/communities/join-preview": { tier: "MODERATE" },
+      // An announcement email's unsubscribe (#4872 PR 8a) — public: its token is its one credential, so
+      // this per-IP limit is its one bound, and runs before the route reads anything. MODERATE (30/min
+      // per IP), not STRICT: mail clients' one-click unsubscribe POSTs it from their own servers, which
+      // many members' clicks share, and STRICT's 5/min bucket is shared with sign-in. An exact key, so
+      // it wins over the wildcard above.
+      [COMMUNITY_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
+      // The WayAI Guide's help entry (wayai#4948, `routes/api/guide.ts`): one POST per click by a viewer
+      // the snapshot does not show enrolled, which reads the person's row on the Guide hub and writes only
+      // what is missing (an enrolled viewer's click opens the hub without a request). Every caller is
+      // signed in, so the per-IP tier is skipped; 10 a minute per person on the native binding (fails
+      // open, like every 60 s budget) bounds what a looping client costs the one Guide HubDO.
+      "/api/guide/access": {
+        tier: "STANDARD",
+        userLimit: 10,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/guide/access"
+      },
+      // App channel - high throughput with user limits
+      "/channels/app/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
+      // API channel (api-channel-connector) - machine-to-machine, high throughput
+      "/channels/api/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
+      // System/scheduled - high throughput (internal)
+      "/channels/system/*": { tier: "HIGH", skipAuthenticatedUsers: true },
+      "/scheduled/*": { tier: "HIGH", skipAuthenticatedUsers: true },
+      // WebSocket - standard with user limit to prevent connection spam
+      "/live-updates/ws": { tier: "STANDARD", userLimit: 100, failClosed: true },
+      // A community's live socket (gh #4872 PR 5, `GET /communities/:communityId/live`): outside
+      // `/api/*`, with no bearer token, so its per-IP tier is its one bound before the CommunityDO
+      // checks the ticket. STANDARD, as `/live-updates/ws`: a client opens one per community it shows
+      // and reconnects within the hour.
+      "/communities/*": { tier: "STANDARD" },
+      // WS ticket mint - per-user 60/min accommodates aggressive reconnect patterns
+      // without opening abuse vectors; fail-closed so Redis outages don't let
+      // runaway clients mint unbounded tickets.
+      "/api/auth/ws-ticket": { tier: "MODERATE", userLimit: 60, failClosed: true, skipAuthenticatedUsers: true },
+      "/api/auth/session-check": { tier: "STANDARD", userLimit: 120, skipAuthenticatedUsers: true },
+      "/api/auth/logout": { tier: "MODERATE", userLimit: 10, failClosed: true, skipAuthenticatedUsers: true }
+    };
+    EXCLUDED_PATHS = /* @__PURE__ */ new Set(["/health"]);
+  }
+});
+
+// ../../packages/core/dist/chunk-CGOLULK2.js
+function fileSnapshotChanged(run) {
+  return run.written + run.removed > 0;
+}
+async function runFileSnapshot(opts) {
+  const run = { pages: 0, written: 0, removed: 0, unchanged: 0 };
+  const seen = /* @__PURE__ */ new Set();
+  let cursor;
+  while (run.pages < FILE_SNAPSHOT_MAX_PAGES) {
+    const page = await sendWithRetry(opts, cursor);
+    run.pages++;
+    run.written += page.written;
+    run.removed += page.removed;
+    run.unchanged += page.unchanged;
+    opts.onPage?.(page, run.pages);
+    if (page.next_cursor === null) return run;
+    if (seen.has(page.next_cursor)) {
+      throw new Error(`The preview file snapshot repeated its cursor after page ${run.pages}, so it would never end.`);
+    }
+    seen.add(page.next_cursor);
+    cursor = page.next_cursor;
+  }
+  throw new Error(`The preview file snapshot did not end after ${FILE_SNAPSHOT_MAX_PAGES} pages.`);
+}
+async function sendWithRetry(opts, cursor) {
+  for (let attempt = 1; ; attempt++) {
+    let body;
+    try {
+      body = await opts.sendPage(cursor);
+    } catch (error) {
+      if (attempt < FILE_SNAPSHOT_CONFLICT_ATTEMPTS && opts.isConflict(error)) continue;
+      throw error;
+    }
+    const parsed = rekorFileSnapshotAnswerSchema.safeParse(body);
+    if (!parsed.success) {
+      throw new Error("The data product answered a preview file snapshot page WayAI cannot read: nothing more was sent.");
+    }
+    return parsed.data.data;
+  }
+}
+var rekorFileSnapshotAnswerSchema, FILE_SNAPSHOT_MAX_PAGES, FILE_SNAPSHOT_CONFLICT_ATTEMPTS, FILE_SNAPSHOT_PAGE_SPACING_MS, FILE_SNAPSHOT_CONFLICT_STATUS;
+var init_chunk_CGOLULK2 = __esm({
+  "../../packages/core/dist/chunk-CGOLULK2.js"() {
+    "use strict";
+    init_chunk_IEWJ5MZH();
+    init_chunk_F3JHI4Y4();
+    init_zod();
+    rekorFileSnapshotAnswerSchema = external_exports.object({
+      data: external_exports.object({
+        next_cursor: external_exports.string().nullable(),
+        /** Files the page created or replaced on the preview. */
+        written: external_exports.number().int(),
+        /** The preview's own files, ones production does not hold, the page removed. */
+        removed: external_exports.number().int(),
+        /** Files the page found already equal to production's. */
+        unchanged: external_exports.number().int()
+      })
+    });
+    FILE_SNAPSHOT_MAX_PAGES = 1e4;
+    FILE_SNAPSHOT_CONFLICT_ATTEMPTS = 3;
+    FILE_SNAPSHOT_PAGE_SPACING_MS = Math.ceil(
+      6e4 / Math.max(1, Math.floor((getEndpointConfig(`${DATA_PROXY_PREFIX}/files/snapshot`)?.userLimit ?? 60) * 4 / 5))
+    );
+    FILE_SNAPSHOT_CONFLICT_STATUS = 409;
+  }
+});
+
 // ../../packages/core/dist/chunk-BEOHBREG.js
 var REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, REKOR_BOUND_BASE_HEADER, REKOR_BOUND_TOOLSET_HEADER, REKOR_BOUND_TOKEN_HEADER, REKOR_BOUND_CUSTOMER_HEADER, DATA_BASE_GENERATION_HEADER, REKOR_MAX_ACTOR_ID_LENGTH, REKOR_MAX_ACTOR_LABEL_LENGTH;
 var init_chunk_BEOHBREG = __esm({
@@ -5596,10 +6192,10 @@ var init_chunk_BEOHBREG = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-BVQE66I2.js
+// ../../packages/core/dist/chunk-4MRBBR5L.js
 var TOOLSET_SLUG_PATTERN, REKOR_STRUCTURAL_ID_PATTERN, baseEnvironmentSchema, TOOLSET_FILE_OPERATIONS, toolsetFileToolSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorToolsetToolsSchema, rekorBoundAttestation, rekorResolvedToolsetSchema, resolvedFileToolSchema, rekorToolsetFileSchema, rekorToolsetFileListSchema, rekorToolsetFileGetSchema, rekorToolsetFilePutSchema, TOOLSET_CUSTOMER_FACING_REFUSAL_MARK, TOOLSET_CUSTOMER_FACING_REFUSAL;
-var init_chunk_BVQE66I2 = __esm({
-  "../../packages/core/dist/chunk-BVQE66I2.js"() {
+var init_chunk_4MRBBR5L = __esm({
+  "../../packages/core/dist/chunk-4MRBBR5L.js"() {
     "use strict";
     init_chunk_BEOHBREG();
     init_chunk_DHPUPI4Y();
@@ -5900,25 +6496,6 @@ var init_chunk_IPDOHAZ5 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-GPM7PE44.js
-var bootstrapQuery;
-var init_chunk_GPM7PE44 = __esm({
-  "../../packages/core/dist/chunk-GPM7PE44.js"() {
-    "use strict";
-    init_zod();
-    bootstrapQuery = external_exports.object({
-      active_hub_id: external_exports.string().uuid().optional(),
-      active_conversation_id: external_exports.string().uuid().optional(),
-      active_nav: external_exports.enum(["chat", "task", "support"]).optional(),
-      /**
-       * The people thread the URL names (`/chat/threads/:threadId`, gh #4661): the snapshot
-       * preloads it as `people.active_thread` when the viewer is a member.
-       */
-      active_thread_id: external_exports.string().uuid().optional()
-    });
-  }
-});
-
 // ../../packages/core/dist/chunk-YUZFHVB2.js
 var invitePreviewQuery, inviteRolePreviewResponse, inviteContactPreviewResponse, invitePreviewResponse, inviteUnsubscribeBody;
 var init_chunk_YUZFHVB2 = __esm({
@@ -7544,15 +8121,15 @@ var init_chunk_MH4O3YEX = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-LDSABSRL.js
+// ../../packages/core/dist/chunk-HX2LNKHX.js
 function catalogToolSideEffects(toolName) {
   const sideEffects = CATALOG_SIDE_EFFECTS.get(toolName);
   if (sideEffects === void 0) return "unknown";
   return sideEffects ? "side_effects" : "none";
 }
 var NATIVE_TOOL_SCHEMAS, WAYAI_CONNECTOR, SANDBOX_AGENT_ROLES, BASE_NATIVE_TOOLS, NATIVE_TOOLS, CATALOG_SIDE_EFFECTS;
-var init_chunk_LDSABSRL = __esm({
-  "../../packages/core/dist/chunk-LDSABSRL.js"() {
+var init_chunk_HX2LNKHX = __esm({
+  "../../packages/core/dist/chunk-HX2LNKHX.js"() {
     "use strict";
     init_chunk_DHPUPI4Y();
     NATIVE_TOOL_SCHEMAS = {
@@ -7900,14 +8477,14 @@ var init_chunk_LDSABSRL = __esm({
       "copy_to_sandbox": {
         "tool_config": {
           "name": "copy_to_sandbox",
-          "description": `Copy one of this conversation's files into the code sandbox, so commands run with bash can read or edit it there. path names the file as read_file does: this conversation's attachments under "conversation/" (e.g. "conversation/report.xlsx"), or an earlier conversation's under "conversations/<conversation_id>/<name>". Hub resource files cannot be copied. The copy lands at sandbox_path, replacing any file there; a file larger than 25 MiB is refused. If no sandbox is running, the copy starts an empty one.`,
+          "description": `Copy one of this conversation's files, or one of your documents, into the code sandbox, so commands run with bash can read or edit it there. path names the file as read_file does: this conversation's attachments under "conversation/" (e.g. "conversation/report.xlsx"), an earlier conversation's under "conversations/<conversation_id>/<name>", or a document under "data/<file-type>/" (e.g. "data/contracts/acme/msa.docx"), whose result gives the version you copied: pass it to copy_from_sandbox to copy the document back. Hub resource files cannot be copied. The copy lands at sandbox_path, replacing any file there; a file larger than 25 MiB is refused, and a document larger than 1 MiB. If no sandbox is running, the copy starts an empty one.`,
           "strict": false,
           "parameters": {
             "type": "object",
             "properties": {
               "path": {
                 "type": "string",
-                "description": `The file to copy, as read_file names it: "conversation/<name>" (a shorter unambiguous form or the file's id also works) or "conversations/<conversation_id>/<name>".`
+                "description": `The file to copy, as read_file names it: "conversation/<name>" (a shorter unambiguous form or the file's id also works), "conversations/<conversation_id>/<name>", or a document's full path "data/<file-type>/<path>".`
               },
               "sandbox_path": {
                 "type": "string",
@@ -7925,7 +8502,7 @@ var init_chunk_LDSABSRL = __esm({
       "copy_from_sandbox": {
         "tool_config": {
           "name": "copy_from_sandbox",
-          "description": 'Copy a file out of the code sandbox into this conversation, so what your commands produced (a chart, a converted document) is kept after the sandbox ends. The file is stored for the support team on an internal note and is NOT sent to the customer: the result gives its path under "conversation/", and send_files with that path delivers it when it should reach them. A file larger than 25 MiB is refused.',
+          "description": `Copy a file out of the code sandbox into this conversation, so what your commands produced (a chart, a converted document) is kept after the sandbox ends. The file is stored for the support team on an internal note and is NOT sent to the customer: the result gives its path under "conversation/", and send_files with that path delivers it when it should reach them. A file larger than 25 MiB is refused. With path, the file is written instead to one of your documents under "data/<file-type>/", with the version you copied it in at: the write goes through only while that is still the document's current version, so a document changed since is refused, and only where you may write documents. A document holds at most 1 MiB.`,
           "strict": false,
           "parameters": {
             "type": "object",
@@ -7936,7 +8513,15 @@ var init_chunk_LDSABSRL = __esm({
               },
               "name": {
                 "type": "string",
-                "description": `The stored file's name, with no folders (e.g. "q3-report.xlsx"). Defaults to the file's name in the sandbox.`
+                "description": `The stored file's name, with no folders (e.g. "q3-report.xlsx"). Defaults to the file's name in the sandbox. Not with path.`
+              },
+              "path": {
+                "type": "string",
+                "description": 'A document to write the file to instead, by its full path, e.g. "data/contracts/acme/msa.docx", as copy_to_sandbox or list_files gives it. Leave it out to keep the file with this conversation.'
+              },
+              "version": {
+                "type": "integer",
+                "description": "With path: the version copy_to_sandbox (or read_file) gave for the document, to replace it. Leave it out to create a new document."
               }
             },
             "required": [
@@ -8524,11 +9109,17 @@ var init_chunk_LDSABSRL = __esm({
       // setting is on, on any provider. Side effects: under an Allowlist or Web network setting, the
       // code it runs can send data out of the conversation.
       { tool_native_id: "nt-030", tool_name: "bash", tool_display_name: "Run Code (Bash)", tool_description: "Run a Bash command in the conversation's code sandbox", connector_id: WAYAI_CONNECTOR, operation: "bash", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: true, replay: "reconcile", assignable_roles: SANDBOX_AGENT_ROLES },
-      // Copies a conversation file INTO the sandbox: the sandbox is conversation state, so nothing
-      // leaves the conversation.
+      // Copies a conversation file, or a toolset document (`data/`, read through the toolset's `get`),
+      // INTO the sandbox: the sandbox is conversation state, so nothing leaves the conversation. It is
+      // shared by the conversation's agents that use it, so a document copied in is there for each of
+      // them, as anything else an agent leaves in it.
       { tool_native_id: "nt-031", tool_name: "copy_to_sandbox", tool_display_name: "Copy File to Sandbox", tool_description: "Copy one of the conversation's files into its code sandbox", connector_id: WAYAI_CONNECTOR, operation: "copy_to_sandbox", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", assignable_roles: SANDBOX_AGENT_ROLES },
       // Copies a sandbox file OUT into the conversation, as an internal note for the team: nothing
-      // reaches the customer until `send_files` sends it.
+      // reaches the customer until `send_files` sends it. With `path`, it writes a toolset document
+      // instead, through the toolset's `put` with its version check: such a call is `reconcile`, not
+      // `keyed`, as `write_file` is (`toolCallReplay` reads its arguments). Its side effects stay `false`:
+      // only an agent holding a toolset `put` can write one, never a customer-facing role (premise 8),
+      // and a voice call's turns, which read this flag, run the pilot track, which is customer-facing.
       { tool_native_id: "nt-032", tool_name: "copy_from_sandbox", tool_display_name: "Copy File from Sandbox", tool_description: "Copy a file out of the code sandbox into the conversation, for the team", connector_id: WAYAI_CONNECTOR, operation: "copy_from_sandbox", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "keyed", assignable_roles: SANDBOX_AGENT_ROLES },
       // The `data/` mount's writes (#5142 step 2): a document of the agent's Base Toolset, written
       // through the toolset's own `put` tool with its version check. `reconcile`, not `keyed`: a re-run
@@ -8764,7 +9355,7 @@ var init_chunk_T7KQKDET = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-7EGDXEYG.js
+// ../../packages/core/dist/chunk-BUXNYLB7.js
 function resolveMonitorTrigger(monitorConfig) {
   if (!monitorConfig || typeof monitorConfig !== "object") return "idle";
   const raw = monitorConfig.trigger;
@@ -9070,10 +9661,10 @@ function refineMonitorRulesStructuredOutput(body, ctx) {
   if (refusal2) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["response_format"], message: refusal2 });
 }
 var NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, AUTOMATION_GATE_TRIGGERS, NON_FIRING_TRIGGERS, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, MONITOR_GATE_AGENT_NAME_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, MONITOR_AUTOMATION_FIRE_ACTION_KINDS, MONITOR_AUTOMATION_ITEM_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE, AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE, AUTOMATION_GATE_KEY_MESSAGES, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody;
-var init_chunk_7EGDXEYG = __esm({
-  "../../packages/core/dist/chunk-7EGDXEYG.js"() {
+var init_chunk_BUXNYLB7 = __esm({
+  "../../packages/core/dist/chunk-BUXNYLB7.js"() {
     "use strict";
-    init_chunk_LDSABSRL();
+    init_chunk_HX2LNKHX();
     init_chunk_IBL7FANV();
     init_chunk_PFDZEKDE();
     init_chunk_HZ6CADSY();
@@ -9296,12 +9887,12 @@ var init_chunk_7EGDXEYG = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-3OWAWA5B.js
+// ../../packages/core/dist/chunk-7YJWGPAR.js
 var conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody;
-var init_chunk_3OWAWA5B = __esm({
-  "../../packages/core/dist/chunk-3OWAWA5B.js"() {
+var init_chunk_7YJWGPAR = __esm({
+  "../../packages/core/dist/chunk-7YJWGPAR.js"() {
     "use strict";
-    init_chunk_7EGDXEYG();
+    init_chunk_BUXNYLB7();
     init_chunk_HZ6CADSY();
     init_chunk_DHPUPI4Y();
     init_zod();
@@ -9757,7 +10348,7 @@ var init_chunk_BPCNB5RT = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-ROS7PLDY.js
+// ../../packages/core/dist/chunk-AR73HGPH.js
 function idempotencyHeaderRefusal(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(value)) {
     return "idempotency_header must be a header name: letters, digits and dashes, at most 64";
@@ -9768,10 +10359,10 @@ function idempotencyHeaderRefusal(value) {
   return null;
 }
 var CATALOG_REPLAY, REPLAY_OVERRIDES, RESERVED_HEADERS;
-var init_chunk_ROS7PLDY = __esm({
-  "../../packages/core/dist/chunk-ROS7PLDY.js"() {
+var init_chunk_AR73HGPH = __esm({
+  "../../packages/core/dist/chunk-AR73HGPH.js"() {
     "use strict";
-    init_chunk_LDSABSRL();
+    init_chunk_HX2LNKHX();
     CATALOG_REPLAY = new Map(
       NATIVE_TOOLS.map((tool) => [tool.tool_name, tool.replay])
     );
@@ -10004,7 +10595,7 @@ var init_chunk_WEXVYJ5H = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-AFIQ3FEW.js
+// ../../packages/core/dist/chunk-MK6D4I2Q.js
 function refineToolConfig(value, ctx) {
   const raw = value.tool_config;
   if (raw == null) return;
@@ -10040,10 +10631,10 @@ function refineToolConfig(value, ctx) {
   }
 }
 var toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, toolReplaySettingsFields, toolReplaySettingsSchema, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody;
-var init_chunk_AFIQ3FEW = __esm({
-  "../../packages/core/dist/chunk-AFIQ3FEW.js"() {
+var init_chunk_MK6D4I2Q = __esm({
+  "../../packages/core/dist/chunk-MK6D4I2Q.js"() {
     "use strict";
-    init_chunk_ROS7PLDY();
+    init_chunk_AR73HGPH();
     init_chunk_WEXVYJ5H();
     init_chunk_HZ6CADSY();
     init_zod();
@@ -11415,7 +12006,7 @@ var init_chunk_6NI5RAM4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-NYIIBG23.js
+// ../../packages/core/dist/chunk-EAT2SP4E.js
 function refineHubAsCodeCustomTools(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -11951,12 +12542,12 @@ function refineHubAsCodeMonitorRulesOutput(config, ctx) {
   });
 }
 var MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
-var init_chunk_NYIIBG23 = __esm({
-  "../../packages/core/dist/chunk-NYIIBG23.js"() {
+var init_chunk_EAT2SP4E = __esm({
+  "../../packages/core/dist/chunk-EAT2SP4E.js"() {
     "use strict";
-    init_chunk_AFIQ3FEW();
+    init_chunk_MK6D4I2Q();
     init_chunk_623SRYWZ();
-    init_chunk_7EGDXEYG();
+    init_chunk_BUXNYLB7();
     init_chunk_LBDH7LCG();
     init_chunk_4LXDRTO4();
     init_chunk_T4Q5COKJ();
@@ -12965,29 +13556,13 @@ var init_chunk_LQY2OCQL = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-F3JHI4Y4.js
-var DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, AUTOMATION_WEBHOOK_MOUNT;
-var init_chunk_F3JHI4Y4 = __esm({
-  "../../packages/core/dist/chunk-F3JHI4Y4.js"() {
-    "use strict";
-    DATA_PROXY_MOUNT = "/data";
-    DATA_PROXY_PREFIX = `/api${DATA_PROXY_MOUNT}`;
-    BASE_DESTRUCTION_MOUNT = "/bases";
-    BASE_DESTRUCTION_PREFIX = `/api${BASE_DESTRUCTION_MOUNT}`;
-    BASE_DESTRUCTION_CONFIRM_PATH = `${BASE_DESTRUCTION_PREFIX}/destruction/confirm`;
-    COMMUNITY_EMAIL_UNSUBSCRIBE_PATH = "/api/communities/email-unsubscribe";
-    CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH = "/api/contact-book/email-unsubscribe";
-    AUTOMATION_WEBHOOK_MOUNT = "/webhooks/automations";
-  }
-});
-
-// ../../packages/core/dist/chunk-GCKAPAPC.js
+// ../../packages/core/dist/chunk-6N2QIHHQ.js
 var AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam;
-var init_chunk_GCKAPAPC = __esm({
-  "../../packages/core/dist/chunk-GCKAPAPC.js"() {
+var init_chunk_6N2QIHHQ = __esm({
+  "../../packages/core/dist/chunk-6N2QIHHQ.js"() {
     "use strict";
     init_chunk_LQY2OCQL();
-    init_chunk_7EGDXEYG();
+    init_chunk_BUXNYLB7();
     init_chunk_3HSB6J4J();
     init_chunk_F3JHI4Y4();
     init_chunk_DHPUPI4Y();
@@ -14232,6 +14807,7 @@ var init_chunk_TS4EYU3W = __esm({
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
+    init_chunk_VXEAR36B();
     init_chunk_TIZ57ZBA();
     init_chunk_Q7KIQHAZ();
     init_chunk_2U4BTOR7();
@@ -14239,16 +14815,16 @@ var init_contracts = __esm({
     init_chunk_GK27ENTT();
     init_chunk_SXDX4GHS();
     init_chunk_FK6HBXM7();
-    init_chunk_VXEAR36B();
+    init_chunk_GPM7PE44();
     init_chunk_DGKMMFIR();
     init_chunk_ZC6YGHNX();
     init_chunk_ACKF2MVU();
     init_chunk_Y7CFCYX4();
     init_chunk_5DGHIY7L();
-    init_chunk_BVQE66I2();
+    init_chunk_CGOLULK2();
+    init_chunk_4MRBBR5L();
     init_chunk_BEOHBREG();
     init_chunk_IPDOHAZ5();
-    init_chunk_GPM7PE44();
     init_chunk_YUZFHVB2();
     init_chunk_34LE6P7E();
     init_chunk_FPSDNS2E();
@@ -14261,12 +14837,12 @@ var init_contracts = __esm({
     init_chunk_LWMLR2WI();
     init_chunk_ACGAI25T();
     init_chunk_MH4O3YEX();
-    init_chunk_3OWAWA5B();
+    init_chunk_7YJWGPAR();
     init_chunk_KSTYTQ7I();
     init_chunk_LKBSHANA();
     init_chunk_BPCNB5RT();
-    init_chunk_NYIIBG23();
-    init_chunk_AFIQ3FEW();
+    init_chunk_EAT2SP4E();
+    init_chunk_MK6D4I2Q();
     init_chunk_623SRYWZ();
     init_chunk_JDJ4EUOL();
     init_chunk_3KYTITOR();
@@ -14276,9 +14852,9 @@ var init_contracts = __esm({
     init_chunk_YULHXJ5M();
     init_chunk_V4FRPRH5();
     init_chunk_ZHJEQBXJ();
-    init_chunk_GCKAPAPC();
+    init_chunk_6N2QIHHQ();
     init_chunk_LQY2OCQL();
-    init_chunk_7EGDXEYG();
+    init_chunk_BUXNYLB7();
     init_chunk_3HSB6J4J();
     init_chunk_IG6QBZMA();
     init_chunk_ZJJ5ODOD();
@@ -14288,8 +14864,8 @@ var init_contracts = __esm({
     init_chunk_E4DIIOOE();
     init_chunk_7CYHPF35();
     init_chunk_FMXFEZN4();
-    init_chunk_ROS7PLDY();
-    init_chunk_LDSABSRL();
+    init_chunk_AR73HGPH();
+    init_chunk_HX2LNKHX();
     init_chunk_NVKU5PPQ();
     init_chunk_2FCLSQSQ();
     init_chunk_FECLIZTY();
@@ -14302,6 +14878,7 @@ var init_contracts = __esm({
     init_chunk_OMPT4ZHR();
     init_chunk_2PZIF56U();
     init_chunk_UEJOG2Q7();
+    init_chunk_IEWJ5MZH();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
     init_chunk_LZDVDC2S();
@@ -15523,32 +16100,6 @@ var init_chunk_BF4WRSOQ = __esm({
 });
 
 // ../../packages/core/dist/index.js
-function matchPath(pattern, path42) {
-  const normalizedPath = path42.replace(/\/$/, "");
-  if (pattern.endsWith("/*")) {
-    const prefix = pattern.slice(0, -2);
-    return normalizedPath === prefix || normalizedPath.startsWith(prefix + "/");
-  }
-  return pattern === normalizedPath;
-}
-function getEndpointConfig(path42) {
-  for (const excluded of EXCLUDED_PATHS) {
-    if (matchPath(excluded, path42)) {
-      return null;
-    }
-  }
-  const normalizedPath = path42.replace(/\/$/, "");
-  if (!normalizedPath.endsWith("/*") && Object.prototype.hasOwnProperty.call(ENDPOINT_CONFIGS, normalizedPath)) {
-    return ENDPOINT_CONFIGS[normalizedPath];
-  }
-  const sortedPatterns = Object.keys(ENDPOINT_CONFIGS).sort((a, b) => b.length - a.length);
-  for (const pattern of sortedPatterns) {
-    if (matchPath(pattern, path42)) {
-      return ENDPOINT_CONFIGS[pattern];
-    }
-  }
-  return { tier: "STANDARD" };
-}
 function bytesToUuid(bytes) {
   const hex = [];
   for (let i = 0; i < 16; i++) hex.push(bytes[i].toString(16).padStart(2, "0"));
@@ -15596,10 +16147,11 @@ function markdownToPlainText(text) {
   result = result.replace(/^[-*_]{3,}$/gm, "");
   return result;
 }
-var ENDPOINT_CONFIGS, EXCLUDED_PATHS, UUID_RE2, WAYAI_WORKSPACE_LAYOUT;
+var UUID_RE2, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
+    init_chunk_IEWJ5MZH();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
     init_chunk_LZDVDC2S();
@@ -15624,465 +16176,6 @@ var init_dist = __esm({
     init_chunk_L5F7ZOUJ();
     init_chunk_TS4EYU3W();
     init_chunk_R7VSUKKX();
-    ENDPOINT_CONFIGS = {
-      // OAuth callbacks - strict, fail-closed (prevent brute force)
-      "/oauth/callback/*": { tier: "STRICT", failClosed: true },
-      // Auth endpoints - strict, fail-closed
-      "/auth/phone": { tier: "STRICT", failClosed: true },
-      "/auth/mcp/exchange": { tier: "MODERATE", failClosed: true },
-      // Native magic-code login (pre-auth) — STRICT per-IP bounds a single host; WorkOS owns
-      // the per-email lockout / TTL / single-use guarantees.
-      "/api/auth/magic-code/*": { tier: "STRICT", failClosed: true },
-      // Native password login (pre-auth) — same posture as magic-code above. STRICT per-IP bounds a
-      // single host but FAILS OPEN on a binding error (like every IP limit); the `failClosed` flag
-      // here is inert on a pre-auth route (it's only enforced on the per-user branch, which needs an
-      // authenticated caller). The fail-CLOSED brute-force guarantee for the static credential comes
-      // from the route's per-email caps (burst + cumulative hourly), not this flag.
-      "/api/auth/password/*": { tier: "STRICT", failClosed: true },
-      // Every `/api/*` group whose paths carry ids pins `userLimitKey` (gh #4756), held there by
-      // `security/endpoint-invariants.test.ts`.
-      // Billing - moderate, fail-closed with user limits
-      "/api/billing/*": {
-        tier: "MODERATE",
-        userLimit: 100,
-        failClosed: true,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/billing/*"
-      },
-      "/webhooks/stripe": { tier: "MODERATE", failClosed: true },
-      "/webhooks/workos": { tier: "MODERATE", failClosed: true },
-      // API endpoints - standard with user limits
-      // 500 because the web's settings live updates refetch per hub in every open tab, whatever page
-      // it shows (`settingsLiveUpdateStore.ts`): one batch of changes costs about 10 + 4 per agent
-      // whose tools were opened + 2 per loaded resource, so a CLI push and publish (both hubs) with
-      // two tabs open passes 150 in a minute. A multi-file resource upload adds 2–5 per file.
-      "/api/setup/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/setup/*"
-      },
-      // 500 because an eval run's drill-down (`SessionResults.tsx`) fetches its list and then every
-      // LLM turn's record at once: up to 201 requests (`OBSERVABILITY_LIST_CAP`, 200). Sending keeps
-      // the 150 it had when each path held its own budget, on the exact key below.
-      "/api/conversations/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/conversations/*"
-      },
-      "/api/conversations/send-message": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      "/api/users/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      "/api/analytics/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/analytics/*"
-      },
-      // 500 because `wayai eval-results --eval` reads completed sessions one by one, newest first,
-      // until one holds the eval (up to the 1000 the list returns). Tenant SQL keeps the 150 it had
-      // when each path held its own budget: each query may run 30 s on shared-tenant ClickHouse
-      // after its caller has gone (`sql-validator.ts`, stage 10b).
-      "/api/evals/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/evals/*"
-      },
-      "/api/evals/sql": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      // An eval run's calls (gh #4418), kept off the end user's call budgets below. Create keeps the
-      // 150 it had: it opens a provider session on the org's own key, billed per second. The routes
-      // on one call take a budget of their own so no eval read can spend it: a refused hang-up
-      // leaves the call running, and billing. 500 because a call suite polls each run's record
-      // every second, about 64 requests a minute per suite.
-      "/api/evals/calls": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      "/api/evals/calls/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/evals/calls/*"
-      },
-      "/api/files/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      // The org contact book (wayai#4931 PR 2b). A CSV import sends one request per
-      // `CONTACT_IMPORT_BATCH_MAX` rows, so 150 a minute imports 75,000 rows a minute.
-      "/api/contact-book/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/contact-book/*"
-      },
-      // An automation email's one-click unsubscribe (wayai#4931 PR 2d) — public: its token is its one
-      // credential, so this per-IP limit is its one bound, and runs before the route reads anything.
-      // MODERATE (30/min per IP), as the community email's unsubscribe, for the same reason: mail
-      // clients' one-click unsubscribe POSTs it from their own servers, which many recipients' clicks
-      // share. An exact key, so it wins over the wildcard above.
-      [CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
-      "/api/automations/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/automations/*"
-      },
-      // A hub's own contact lists (wayai#4931 PR 2c): config edits, at the automations' rate.
-      "/api/hub-contact-lists/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/hub-contact-lists/*"
-      },
-      "/api/message-templates/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/message-templates/*"
-      },
-      "/api/live-updates/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      "/api/hub-users/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/hub-users/*"
-      },
-      "/api/conversation-state/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/conversation-state/*"
-      },
-      // The authenticated byte route (`routes/files/r2.ts`), mounted after its `authMiddleware` so
-      // the caller is known: each request reads the HubDO its key names, and a hub id never created
-      // still wakes a Durable Object (gh #4747; since gh #4775 T5 one that writes nothing). The key is pinned
-      // because the paths are file keys, which would otherwise each get a fresh budget (and one
-      // over 256 characters would be refused outright, `checkUserLimitNative`).
-      //
-      // 500 a minute because the web chat fetches every attachment of every loaded message at
-      // once, with no list virtualization: up to 50 per 50-message page, 200 per ended
-      // conversation or history entry at one file per message, and 4 per message at most in its
-      // image grid. Repeats come from the browser's HTTP cache (`private, max-age=3600`); mobile
-      // renders through a disk cache and plays audio from `/files/signed`. The budget is shared by
-      // a caller's tabs and devices. The other two byte routes, `/files/signed/*` and
-      // `/files/public/*`, mount no limiter (the reason is at their entries in
-      // `security/endpoint-invariants.test.ts`'s route registry).
-      "/files/auth/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/files/auth/*"
-      },
-      // Channel webhooks - high throughput (external systems, never authenticated)
-      "/webhooks/whatsapp/*": { tier: "HIGH" },
-      "/webhooks/instagram/*": { tier: "HIGH" },
-      // An automation's webhook deliveries (wayai#4931 D13) — no bearer token: the automation's
-      // secret is the credential, checked against one HubDO read. This per-IP limit runs first, before
-      // anything is read. HIGH, as the channel webhooks: senders are servers, and an integration
-      // platform's egress addresses carry many tenants' deliveries. The per-automation budget is
-      // `AUTOMATION_WEBHOOK_PER_AUTOMATION_LIMIT`, counted after the delivery is verified.
-      [`${AUTOMATION_WEBHOOK_MOUNT}/*`]: { tier: "HIGH" },
-      // Reports (CLI → platform_report triage queue). One per-user budget covers intake
-      // (POST), the content edit (PATCH /:id), the reporter read-back (GET, GET /:id), and the
-      // verification loop (POST /:id/accept, /:id/contest). The limiter is path-based, so a
-      // method-level split (loose reads, strict writes) isn't expressible — GET /:id and PATCH
-      // /:id share a path. So the budget is sized for the read-heavy poll loop (a reporter agent
-      // polling `report get`/`list` while it waits for the fix), at 60/hour. Intake-flooding stays
-      // bounded regardless: identical reports collapse on `fingerprint` (ON CONFLICT DO NOTHING),
-      // so a runaway create loop merges rather than floods. Still STRICT tier + failClosed so a
-      // genuinely runaway distinct-report loop surfaces as 429. The `/*` is load-bearing — an
-      // exact `/api/reports` key would leave the `/:id` paths unmatched (→ unthrottled).
-      // `userLimitKey` is equally load-bearing: without it, middleware falls back to each request's
-      // path and report IDs/actions receive independent counters instead of this shared budget.
-      "/api/reports/*": {
-        tier: "STRICT",
-        userLimit: 60,
-        userWindow: 3600,
-        failClosed: true,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/reports/*"
-      },
-      // Admin report mutations (transition/group/ungroup/edit) — platform-admin
-      // gated at the route, rate-limited here as defense-in-depth. Generous STANDARD
-      // cap so legitimate triage bursts aren't throttled (grouping is one request
-      // even for many members); deliberately NOT failClosed so a Redis blip never
-      // blocks an admin's triage. The bare GET reads share this budget harmlessly.
-      "/api/admin/reports/*": { tier: "STANDARD", userLimit: 150, userLimitKey: "/api/admin/reports/*" },
-      // GitHub webhook (issues.closed → platform_report addressed). MODERATE +
-      // fail-closed; GitHub retries on transient failures so a brief Redis blip
-      // doesn't lose state.
-      "/webhooks/github": { tier: "MODERATE", failClosed: true },
-      // Account deletion — strict on the destructive POST + public undo. The
-      // /api/users/* default tier above ALSO matches these, but `getEndpointConfig`
-      // returns the longest-prefix match, so the more specific entries here win.
-      // `skipAuthenticatedUsers` deliberately omitted: every caller is authenticated,
-      // so including it would make `userLimit` a no-op — the per-user cap IS the gate.
-      "/api/users/me/deletion": { tier: "STRICT", userLimit: 3, userWindow: 3600, failClosed: true },
-      "/api/users/me/deletion/preflight": { tier: "STANDARD", userLimit: 30, failClosed: true },
-      "/api/users/deletion/undo": { tier: "STRICT", failClosed: true },
-      // Production-base destruction.
-      //
-      // Keyed off the CONTRACT constants, not literals: `BASE_DESTRUCTION_CONFIRM_PATH`'s own
-      // docstring promises that the mount, the `AUTH_BYPASS_PATHS` entry, the rate-limit key and
-      // the URL the email embeds move together, and a literal here is exactly how that promise
-      // goes quietly false — leaving an unauthenticated HMAC endpoint on the default tier.
-      //
-      // The emailed GET is PUBLIC, so it gets the IP-tier bound the pre-auth routes get.
-      // `failClosed` is deliberately NOT set: it is only consulted on the per-USER branch, which
-      // needs an authenticated caller, so on a pre-auth route it is inert — the same thing
-      // `/api/auth/magic-code/send` above says about itself. The IP limiter fails OPEN on a
-      // limiter error by design (`packages/runtime/src/rate-limiter.ts`), and claiming otherwise
-      // would tell the next auditor a protection exists that does not.
-      [BASE_DESTRUCTION_CONFIRM_PATH]: { tier: "STRICT" },
-      // The console's read, which every production base's settings pane issues on mount. Without
-      // its own entry it inherits the mount-wide budget below, and an admin clicking through
-      // thirty bases in an hour would be 429'd by a limit sized for irreversible writes.
-      [`${BASE_DESTRUCTION_PREFIX}/destructions`]: { tier: "STANDARD", userLimit: 150 },
-      // The mutating routes: initiate, the authenticated confirm, and cancel. Per user rather than
-      // per IP — all three are authenticated and org-admin gated — and hourly, since a single human
-      // touching thirty production-deletion operations in an hour is already far past normal.
-      // Longest-prefix wins, so the two entries above are not widened by this one. The key is
-      // pinned so those thirty are counted across every base the caller touches (gh #4756).
-      [`${BASE_DESTRUCTION_PREFIX}/*`]: {
-        tier: "STANDARD",
-        userLimit: 30,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: `${BASE_DESTRUCTION_PREFIX}/*`
-      },
-      // Email-invite preview — public, fail-closed. MODERATE (30/min IP) leaves
-      // headroom for the signup-page server-fetch + reloads + prefetches; STRICT
-      // would throttle legitimate users opening the link in multiple tabs.
-      "/api/invites/preview": { tier: "MODERATE", failClosed: true },
-      // "Don't email me again" (gh #4661) — public; one POST per click on its confirm page. STRICT
-      // per IP. No `failClosed`: it is consulted only on the per-user branch, which a pre-auth route
-      // never reaches (see `BASE_DESTRUCTION_CONFIRM_PATH` above).
-      "/api/invites/unsubscribe": { tier: "STRICT" },
-      // Admin DO debug reads — the ONE deliberate deviation from the Data Explorer
-      // catch-all below, and the only reason a per-route key still exists here.
-      // Platform-admin is enforced at the route; this is the independent
-      // defense-in-depth signal so a runaway investigation script surfaces as 429.
-      //
-      // STRICT is kept ON PURPOSE even though the catch-all moved off it: per IP, at 5/min vs
-      // STANDARD's 100/min, walking 10k ids takes ~33h instead of ~100min — a detection window
-      // worth keeping on the routes that return RAW DO ROWS.
-      //
-      // The cost, stated rather than elided: STRICT is one bucket shared with
-      // `/oauth/callback/*` and `/api/auth/magic-code/*`, so a debug session from a
-      // NAT'd office IP can 429 a colleague's login for up to a minute. That trade is
-      // accepted for a rare, deliberate investigation surface — and is exactly why the
-      // browse routes below are NOT here.
-      //
-      // The key is pinned, so a sweep of `/debug/do/hub/<id>/tables` across ids spends one
-      // per-admin budget (gh #4756). 120 an hour: an agent's investigation of a dozen
-      // conversations made 37 debug reads in its busiest hour.
-      "/api/admin/data-explorer/debug/*": {
-        tier: "STRICT",
-        userLimit: 120,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: "/api/admin/data-explorer/debug/*"
-      },
-      // Catch-all for the rest of the Data Explorer (`/search`, `/entity/*`, `/do/*`,
-      // `/kv/*`, the DELETE routes). Added as a catch-all rather than another per-route
-      // key because this budget kept lagging behind routes joining the debug boundary:
-      // with no match the path falls to the default, which sets no `userLimit`, so the
-      // per-user layer never runs at all. `getEndpointConfig` takes the longest match,
-      // so `debug/*` above still wins.
-      //
-      // `/entity/*` deliberately has NO key of its own: it needs precisely this config,
-      // and a duplicate entry is how the two drift apart on the next edit.
-      //
-      // `tier` is deliberately STANDARD, not STRICT. `tier` is the per-IP knob and
-      // STRICT is 5/min keyed on IP ALONE — one bucket shared across every STRICT
-      // endpoint. On these browse routes that breaks the console (open Browse KV and
-      // inspect four values = 6 requests; expand six org rows in the search results =
-      // 6 `/entity/org/:id` calls) and would drain the same IP's budget for
-      // `/oauth/callback/*` and `/api/auth/magic-code/*`, which on a NAT'd office IP
-      // means all admins. The per-user hourly cap is the leg that matters here.
-      //
-      // The canonical key is deliberate: request paths contain DO ids and arbitrary
-      // malformed requests can contain credential material. Keying on the request path
-      // both stores that material in Redis/logs and gives every target a fresh counter.
-      // One stable identity makes every browse request consume the same per-admin
-      // budget without storing request targets.
-      //
-      // 600/hour preserves the original pagination requirement (about 30k rows at
-      // 50/page) while now genuinely bounding id/key enumeration across the surface.
-      "/api/admin/data-explorer/*": {
-        tier: "STANDARD",
-        userLimit: 600,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: "/api/admin/data-explorer/*"
-      },
-      // Admin harness incident-response (harness-agents PR 2.9b) — mass-destroy reaps
-      // EVERY live harness session/token/slot in scope, so it gets a strict budget
-      // (STRICT + a low per-user hourly cap + fail-closed). Platform-admin is enforced
-      // at the route; this is the independent defense-in-depth signal so a runaway
-      // reap loop surfaces as 429. The break-glass disable/enable rides through
-      // `/api/admin/config` (its own STANDARD budget), not this key.
-      "/api/admin/harness/*": {
-        tier: "STRICT",
-        userLimit: 10,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: "/api/admin/harness/*"
-      },
-      // Platform-wide team-orphan repair — a single call can WRITE across every hub of
-      // every org (HubDO purge + UserDO mirror fan-out), so it gets the same strict,
-      // fail-closed budget as the other cross-platform admin write. Exact path (not a
-      // prefix): the sibling `/api/admin/hubs/:hubId/harness` flag flips stay on the
-      // default admin budget. Platform-admin is enforced at the route; this is the
-      // defense-in-depth signal that a repair loop surfaces as 429.
-      "/api/admin/hubs/repair-team-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
-      // Branching-orphan repair (#4577) — deletes named production rows, and its report mode
-      // fans out over every production hub of every org, so it takes the same strict,
-      // fail-closed budget as the team-orphan repair. Exact path, for the same reason.
-      "/api/admin/hubs/repair-branching-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
-      // CI/GitOps endpoints - standard with user limits. 500 because `wayai push` makes four requests
-      // (pull, diff, push, pull) and a GitOps job may push every hub at once with one token; when
-      // each path held its own 100, that ran to 100 hubs a minute.
-      "/api/ci/*": { tier: "STANDARD", userLimit: 500, skipAuthenticatedUsers: true, userLimitKey: "/api/ci/*" },
-      // Attested `/v1` proxy onto the Rekor Worker. `userLimitKey` is load-bearing here: the
-      // per-user budget defaults to the full request path, and this surface's paths carry base,
-      // record, and file ids — so without a pinned key every distinct resource would get its own
-      // fresh budget and the per-user limit would bound nothing. One shared budget across the
-      // whole data surface is the intent.
-      [`${DATA_PROXY_PREFIX}/*`]: {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: `${DATA_PROXY_PREFIX}/*`
-      },
-      // Voice calls — the end user's call routes (`routes/api/calls`). Every caller is signed
-      // in, so the per-IP tier is skipped for them: Brazilian mobile carriers put many callers
-      // behind one IP, and a shared bucket would refuse one caller for another's traffic.
-      //
-      // Create is the only route that spends: it opens a provider session on the org's own
-      // key, billed per second. So it takes its own exact key and an hourly per-user cap, which
-      // lives on Redis and is fail-closed like the other hourly caps. The exact key wins over
-      // the wildcard below, which also matches `/api/calls` (see `getEndpointConfig`).
-      "/api/calls": {
-        tier: "STANDARD",
-        userLimit: 30,
-        userWindow: 3600,
-        failClosed: true,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/calls"
-      },
-      // The routes on one call: `ready`, hang-up, the delegation report and the status read; and
-      // the opening read (`/api/calls/openings/:language`), one per call, before it exists.
-      // NEVER fail-closed: a refused hang-up leaves the call running, and billing, until a
-      // limit ends it. The 60 s budget runs on the native binding, which fails open. The key is
-      // pinned because the paths carry the call id, which would otherwise give every call a
-      // fresh budget.
-      "/api/calls/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/calls/*"
-      },
-      // Contacts between accounts (gh #4661, `routes/api/contacts`). Every caller is signed in, so
-      // the per-IP tier is skipped. The keys are pinned because the paths carry user and invite
-      // ids, which would otherwise give each id a fresh budget. Blocks take their own, lower
-      // budget (#4661 Limits: blocks are rate-limited). The invites-per-day cap and every list
-      // cap are counted in the caller's UserDO, in the same write they bound, not here.
-      "/api/contacts/*": {
-        tier: "STANDARD",
-        userLimit: 60,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/contacts/*"
-      },
-      "/api/contacts/blocks/*": {
-        tier: "STANDARD",
-        userLimit: 30,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/contacts/blocks/*"
-      },
-      // Person-to-person threads (gh #4661, `routes/api/threads`): the per-user send limit, 60 a
-      // minute on the native binding. Every thread route shares the one budget, reads included:
-      // the paths carry thread and message ids, so the key is pinned, and a pattern here cannot
-      // tell a send from a read of the same path. Like every 60 s budget it fails open on a
-      // binding error, so it bounds sends in the steady state only.
-      "/api/threads/*": {
-        tier: "STANDARD",
-        userLimit: 60,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/threads/*"
-      },
-      // An org admin's erasure of one person's thread messages (gh #4661 owner decision 7): any user
-      // can own a free org, so each request arms that org's alarm, and this caps how fast one person
-      // can ask. The org's own daily cap (`PEOPLE_ORG_ERASURES_PER_DAY`, counted in its OrgDO in the
-      // write it bounds) is the fail-closed bound; this budget, on the native binding, fails open.
-      "/api/threads/org-erasures": {
-        tier: "STANDARD",
-        userLimit: 10,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/threads/org-erasures"
-      },
-      // A person's report of a message, thread or person (`people-reports.ts`): each one written
-      // arms the PlatformDO's alarm and emails the platform admins, so it takes its own, lower
-      // budget. The reporter's daily cap (`PEOPLE_REPORTS_PER_DAY`, counted in the report store in
-      // the write it bounds) is the fail-closed bound; this budget, on the native binding, fails open.
-      "/api/threads/reports": {
-        tier: "STANDARD",
-        userLimit: 10,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/threads/reports"
-      },
-      // Communities (gh #4872, `routes/api/communities`): every signed-in route under the mount (the
-      // preview below excepted) shares one per-user budget, which is also each member's send limit and
-      // bounds the reads that scan a community's rows (a title search, the stats); a community's own
-      // limits (its rate, the daily caps, slow mode) are counted in its CommunityDO, in the write they
-      // bound. Every caller is signed in, so the per-IP tier is skipped; the key is pinned because the
-      // paths carry community, room and message ids.
-      "/api/communities/*": {
-        tier: "STANDARD",
-        userLimit: 60,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/communities/*"
-      },
-      // The join page's preview of a link — public, fetched from the visitor's browser, so this
-      // per-IP limit is its one bound and runs before the route reads anything (#4872
-      // owner-delegated decision 9). MODERATE (30/min per IP) leaves room for reloads and several
-      // tabs. An exact key, so it wins over the wildcard above.
-      "/api/communities/join-preview": { tier: "MODERATE" },
-      // An announcement email's unsubscribe (#4872 PR 8a) — public: its token is its one credential, so
-      // this per-IP limit is its one bound, and runs before the route reads anything. MODERATE (30/min
-      // per IP), not STRICT: mail clients' one-click unsubscribe POSTs it from their own servers, which
-      // many members' clicks share, and STRICT's 5/min bucket is shared with sign-in. An exact key, so
-      // it wins over the wildcard above.
-      [COMMUNITY_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
-      // The WayAI Guide's help entry (wayai#4948, `routes/api/guide.ts`): one POST per click by a viewer
-      // the snapshot does not show enrolled, which reads the person's row on the Guide hub and writes only
-      // what is missing (an enrolled viewer's click opens the hub without a request). Every caller is
-      // signed in, so the per-IP tier is skipped; 10 a minute per person on the native binding (fails
-      // open, like every 60 s budget) bounds what a looping client costs the one Guide HubDO.
-      "/api/guide/access": {
-        tier: "STANDARD",
-        userLimit: 10,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/guide/access"
-      },
-      // App channel - high throughput with user limits
-      "/channels/app/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
-      // API channel (api-channel-connector) - machine-to-machine, high throughput
-      "/channels/api/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
-      // System/scheduled - high throughput (internal)
-      "/channels/system/*": { tier: "HIGH", skipAuthenticatedUsers: true },
-      "/scheduled/*": { tier: "HIGH", skipAuthenticatedUsers: true },
-      // WebSocket - standard with user limit to prevent connection spam
-      "/live-updates/ws": { tier: "STANDARD", userLimit: 100, failClosed: true },
-      // A community's live socket (gh #4872 PR 5, `GET /communities/:communityId/live`): outside
-      // `/api/*`, with no bearer token, so its per-IP tier is its one bound before the CommunityDO
-      // checks the ticket. STANDARD, as `/live-updates/ws`: a client opens one per community it shows
-      // and reconnects within the hour.
-      "/communities/*": { tier: "STANDARD" },
-      // WS ticket mint - per-user 60/min accommodates aggressive reconnect patterns
-      // without opening abuse vectors; fail-closed so Redis outages don't let
-      // runaway clients mint unbounded tickets.
-      "/api/auth/ws-ticket": { tier: "MODERATE", userLimit: 60, failClosed: true, skipAuthenticatedUsers: true },
-      "/api/auth/session-check": { tier: "STANDARD", userLimit: 120, skipAuthenticatedUsers: true },
-      "/api/auth/logout": { tier: "MODERATE", userLimit: 10, failClosed: true, skipAuthenticatedUsers: true }
-    };
-    EXCLUDED_PATHS = /* @__PURE__ */ new Set(["/health"]);
     UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     WAYAI_WORKSPACE_LAYOUT = {
       /** Product-namespaced root dir at the git root. */
@@ -33235,7 +33328,7 @@ token (\`wayai login --token\`, or WAYAI_TOKEN) is refused.
 var init_rekor_toolset = __esm({
   "../../packages/core/dist/contracts/rekor-toolset.js"() {
     "use strict";
-    init_chunk_BVQE66I2();
+    init_chunk_4MRBBR5L();
     init_chunk_BEOHBREG();
     init_chunk_DHPUPI4Y();
   }
@@ -34200,7 +34293,10 @@ var init_plan = __esm({
 
 // src/knowledge/migrate.ts
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
-async function resolveBases(kb, baseId2) {
+function refreshPreviewCommand(orgId, base) {
+  return `wayai knowledge refresh-preview --org ${orgId} --base ${safe(base)}`;
+}
+async function resolveBases(kb, baseId2, orgId) {
   const base = await kb.getBase(baseId2);
   if (!base || base.deleted) throw expected(`Base "${safe(baseId2)}" not found in this organization.`);
   if (base.environment === "preview") {
@@ -34220,7 +34316,7 @@ async function resolveBases(kb, baseId2) {
   }
   if (previews.length !== 1) {
     throw expected(
-      previews.length === 0 ? `Base "${safe(baseId2)}" has no preview to write its file types in. Create one with \`wayai bases create-preview ${safe(baseId2)} --name <name>\`.` : `Base "${safe(baseId2)}" has ${previews.length} previews (${previews.map(safe).join(", ")}). Pass the one to write its file types in as --base.`
+      previews.length === 0 ? `Base "${safe(baseId2)}" has no preview. Create one with \`wayai bases create-preview ${safe(baseId2)} --name <name>\`, then copy production's files into it with \`${refreshPreviewCommand(orgId, baseId2)}\`.` : `Base "${safe(baseId2)}" has ${previews.length} previews (${previews.map(safe).join(", ")}). Pass the one to use as --base.`
     );
   }
   return { production: base.id, preview: previews[0] };
@@ -34326,7 +34422,7 @@ function printNotes(io, notes) {
   }
 }
 async function migrateKnowledge(reader, kb, opts, io) {
-  const { production: productionId, preview } = await resolveBases(kb, opts.base);
+  const { production: productionId, preview } = await resolveBases(kb, opts.base, opts.orgId);
   const hubs = opts.hubId === void 0 ? [] : await reader.listHubs();
   const hub = opts.hubId === void 0 ? void 0 : productionHub(hubs, opts.hubId);
   const production = await Production.read(kb, productionId);
@@ -34465,7 +34561,7 @@ Dry run: nothing written (${writes === 0 ? "nothing to write" : `${writes} write
   for (const file of creates) await kb.putFile(productionId, file, await bodyBytes(reader, file));
   io.log(
     `
-Done: ${toWrite.length} file type(s) written, ${toPromote.length} promoted, ${creates.length} file(s) written. The preview holds none of these files.`
+Done: ${toWrite.length} file type(s) written, ${toPromote.length} promoted, ${creates.length} file(s) written. The preview holds none of these files: copy them with \`${refreshPreviewCommand(opts.orgId, opts.base)}\`.`
   );
   return { ...result, written: true };
 }
@@ -34635,6 +34731,9 @@ function knowledgeBase(client) {
       }
       throw expected(`The listing of file type "${fileType}" on base "${base}" did not end after ${MAX_LIST_PAGES} pages.`);
     },
+    // `requestRaw`: the page is read whole, `{ data: … }`, as WayAI's copy of its answer declares it
+    // (`@wayai/core/contracts` `rekorFileSnapshotAnswerSchema`).
+    snapshotPage: (preview, cursor) => pacer.run(() => client.requestRaw("POST", `/v1/${baseSeg(preview)}/files/snapshot`, cursor === void 0 ? {} : { cursor })),
     async putFile(base, file, bytes) {
       await pacer.run(
         () => client.upload(
@@ -34667,6 +34766,37 @@ var init_remote = __esm({
   }
 });
 
+// src/knowledge/refresh-preview.ts
+async function refreshPreviewKnowledge(kb, opts, io) {
+  const { production, preview } = await resolveBases(kb, opts.base, opts.orgId);
+  const question = `Make the files of preview "${sanitizeTerminalText(preview)}" equal production "${sanitizeTerminalText(production)}"'s? Files the preview changed are replaced, and files only it holds are removed.`;
+  if (!opts.yes && !await io.confirm(question)) {
+    io.log("Cancelled.");
+    return null;
+  }
+  io.log(`Copying the files of production base "${sanitizeTerminalText(production)}" into its preview "${sanitizeTerminalText(preview)}".`);
+  const run = await runFileSnapshot({
+    sendPage: (cursor) => kb.snapshotPage(preview, cursor),
+    // The data product refuses a page whose preview file changed while it was being copied, and
+    // asks for the same cursor again.
+    isConflict: (error) => error instanceof ApiError && error.status === FILE_SNAPSHOT_CONFLICT_STATUS,
+    onPage: (page, n) => io.log(`  Page ${n}: ${page.written} written, ${page.removed} removed, ${page.unchanged} unchanged.`)
+  });
+  io.log(
+    !fileSnapshotChanged(run) ? `Nothing changed in ${run.pages} page(s): the preview's ${run.unchanged} file(s) already equal production's.` : `Done in ${run.pages} page(s): ${run.written} written, ${run.removed} removed, ${run.unchanged} unchanged. The preview's files now equal production's.`
+  );
+  return run;
+}
+var init_refresh_preview = __esm({
+  "src/knowledge/refresh-preview.ts"() {
+    "use strict";
+    init_contracts();
+    init_api_client();
+    init_terminal_output();
+    init_migrate2();
+  }
+});
+
 // src/commands/knowledge.ts
 var knowledge_exports = {};
 __export(knowledge_exports, {
@@ -34688,15 +34818,23 @@ function readArgs(args2) {
 function parseKnowledgeArgs(args2) {
   const { values, positionals } = readArgs(args2);
   const [verb, ...extra] = positionals;
-  if (verb !== "migrate") throw usageError3(verb === void 0 ? "No subcommand given." : `Unknown subcommand ${JSON.stringify(verb)}.`);
+  if (verb !== "migrate" && verb !== "refresh-preview") {
+    throw usageError3(verb === void 0 ? "No subcommand given." : `Unknown subcommand ${JSON.stringify(verb)}.`);
+  }
   if (extra.length > 0) throw usageError3(`Unexpected argument ${JSON.stringify(extra[0])}.`);
   if (!values.org) throw usageError3("--org <org_id> is required.");
   if (!UUID_RE3.test(values.org)) throw usageError3(`Invalid --org ${JSON.stringify(values.org)}: expected an organization id (a UUID).`);
   if (!values.base) throw usageError3("--base <knowledge base> is required.");
+  if (verb === "refresh-preview") {
+    if (values.hub !== void 0) throw usageError3("--hub is migrate's: a refresh copies the whole knowledge base.");
+    if (values["dry-run"] !== void 0) throw usageError3("--dry-run is migrate's: a refresh has none.");
+    return { verb, orgId: values.org, base: values.base, yes: values.yes === true };
+  }
   if (values.hub !== void 0 && !UUID_RE3.test(values.hub)) {
     throw usageError3(`Invalid --hub ${JSON.stringify(values.hub)}: expected a hub id (a UUID).`);
   }
   return {
+    verb,
     orgId: values.org,
     base: values.base,
     hubId: values.hub,
@@ -34710,6 +34848,12 @@ async function knowledgeCommand(args2) {
     return;
   }
   const options = parseKnowledgeArgs(args2);
+  if (options.verb === "refresh-preview") {
+    if (!options.yes && !isInteractive()) throw usageError3("It asks before it copies; pass -y when not running in a terminal.");
+    const data2 = await createDataClient(options.orgId, { refreshLogin: true });
+    await refreshPreviewKnowledge(knowledgeBase(data2), options, { log: (line) => console.log(line), confirm });
+    return;
+  }
   if (!options.dryRun && !options.yes && !isInteractive()) {
     throw usageError3("It asks before it writes; pass -y when not running in a terminal, or --dry-run.");
   }
@@ -34733,11 +34877,15 @@ var init_knowledge = __esm({
     init_helpers();
     init_migrate2();
     init_remote();
+    init_refresh_preview();
     USAGE4 = `
-wayai knowledge migrate \u2014 move knowledge resources into the organization's knowledge base
+wayai knowledge \u2014 the organization's knowledge base
 
 Usage:
   wayai knowledge migrate --org <org_id> --base <knowledge base> [--hub <hub_id>] [--dry-run] [-y]
+  wayai knowledge refresh-preview --org <org_id> --base <knowledge base> [-y]
+
+migrate: move knowledge resources into the organization's knowledge base.
 
   Without --hub, it moves the organization's knowledge resources; with --hub, that hub's own
   (read from its production hub), once the organization's have moved. Each resource becomes a
@@ -34748,6 +34896,15 @@ Usage:
                written in production.
   --dry-run    List what it would write, and every reason it would stop, without writing.
   -y, --yes    Skip the question before writing.
+
+refresh-preview: make the knowledge base's preview hold its production base's files \u2014 after
+  creating the preview, and whenever it should be current again. Files the preview changed are
+  replaced and files only it holds are removed; nothing else on it changes, and production is
+  only read. It prints what each page copied, removed and left alone; a re-run of a current
+  preview changes nothing.
+
+  --base       The production knowledge base, or its preview.
+  -y, --yes    Skip the question before copying.
 `;
     OPTIONS = {
       org: { type: "string" },
@@ -41278,6 +41435,7 @@ Commands:
   communities        An organization's communities: list, join link (get/rotate/off), stats, access list (list/add/remove) \u2014 \`wayai communities --help\`
   contacts           Link a contact to its customer record in a base, or unlink it (browser sign-in only) \u2014 \`wayai contacts --help\`
   knowledge migrate  Move an organization's knowledge resources, then a hub's (--hub), into its knowledge base as file types and files \u2014 \`wayai knowledge --help\`
+  knowledge refresh-preview  Make the knowledge base's preview hold its production base's files \u2014 \`wayai knowledge --help\`
   report create      Report a platform bug (submits to the triage queue)
   report edit        Amend your own pending report (title/description/error/steps/context)
   update             Update CLI to the latest version