@wayai/cli 0.3.221 → 0.3.223

package/dist/index.js

@@ -4604,6 +4604,137 @@ var init_zod = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-FK6HBXM7.js
+var orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody;
+var init_chunk_FK6HBXM7 = __esm({
+  "../../packages/core/dist/chunk-FK6HBXM7.js"() {
+    "use strict";
+    init_zod();
+    orgResourceIdParam = external_exports.object({
+      id: external_exports.string().uuid()
+    });
+    orgResourceFileIdParam = external_exports.object({
+      file_id: external_exports.string().uuid()
+    });
+    orgResourceFolderIdParam = external_exports.object({
+      folder_id: external_exports.string().uuid()
+    });
+    hubOrgResourceParam = external_exports.object({
+      id: external_exports.string().uuid(),
+      org_resource_id: external_exports.string().uuid()
+    });
+    listOrgResourcesQuery = external_exports.object({
+      organization_id: external_exports.string().uuid(),
+      hub_id: external_exports.string().uuid().optional()
+    });
+    orgIdQuery = external_exports.object({
+      organization_id: external_exports.string().uuid()
+    });
+    createOrgResourceBody = external_exports.object({
+      organization_id: external_exports.string().uuid(),
+      resource_name: external_exports.string().min(1).max(255),
+      resource_description: external_exports.string().max(1e3).nullish(),
+      resource_type: external_exports.enum(["knowledge", "skill"]).default("knowledge"),
+      // Skill-only fields. Required for `resource_type = 'skill'` (validated in
+      // the route layer since cross-field refinement complicates the inferred
+      // input type for callers). Ignored for `knowledge`.
+      skill_name: external_exports.string().min(1).max(255).nullish(),
+      skill_version: external_exports.string().max(50).nullish(),
+      folder_metadata_schema: external_exports.record(external_exports.unknown()).optional(),
+      file_metadata_schema: external_exports.record(external_exports.unknown()).optional(),
+      enabled: external_exports.boolean().optional(),
+      tags: external_exports.array(external_exports.string().uuid()).optional(),
+      environment: external_exports.enum(["preview", "production", "all"]).optional()
+    });
+    updateOrgResourceBody = external_exports.object({
+      resource_name: external_exports.string().min(1).max(255).optional(),
+      resource_description: external_exports.string().max(1e3).nullish(),
+      skill_name: external_exports.string().min(1).max(255).nullish(),
+      skill_version: external_exports.string().max(50).nullish(),
+      folder_metadata_schema: external_exports.record(external_exports.unknown()).optional(),
+      file_metadata_schema: external_exports.record(external_exports.unknown()).optional(),
+      enabled: external_exports.boolean().optional(),
+      tags: external_exports.array(external_exports.string().uuid()).optional(),
+      environment: external_exports.enum(["preview", "production", "all"]).optional()
+    });
+    createOrgResourceFolderBody = external_exports.object({
+      org_resource_id: external_exports.string().uuid(),
+      folder_name: external_exports.string().min(1).max(255),
+      folder_description: external_exports.string().max(1e3).nullish(),
+      parent_folder_id: external_exports.string().uuid().nullish(),
+      order_index: external_exports.number().int().nonnegative().optional(),
+      enabled: external_exports.boolean().optional(),
+      metadata: external_exports.record(external_exports.unknown()).optional()
+    });
+    updateOrgResourceFolderBody = external_exports.object({
+      folder_name: external_exports.string().min(1).max(255).optional(),
+      folder_description: external_exports.string().max(1e3).nullish(),
+      parent_folder_id: external_exports.string().uuid().nullish(),
+      order_index: external_exports.number().int().nonnegative().optional(),
+      enabled: external_exports.boolean().optional(),
+      metadata: external_exports.record(external_exports.unknown()).optional()
+    });
+    uploadOrgResourceFileBody = external_exports.object({
+      org_resource_id: external_exports.string().uuid(),
+      folder_id: external_exports.string().uuid().nullish(),
+      file_name: external_exports.string().min(1).max(255),
+      file_data: external_exports.string(),
+      // base64
+      mime_type: external_exports.string().optional(),
+      file_size: external_exports.number().int().nonnegative().optional(),
+      resource_file_tags: external_exports.array(external_exports.string()).optional(),
+      metadata: external_exports.record(external_exports.unknown()).optional()
+    });
+    updateOrgResourceFileBody = external_exports.object({
+      resource_file_title: external_exports.string().min(1).max(255).optional(),
+      folder_id: external_exports.string().uuid().nullish(),
+      order_index: external_exports.number().int().nonnegative().optional(),
+      enabled: external_exports.boolean().optional(),
+      resource_file_tags: external_exports.array(external_exports.string()).optional(),
+      metadata: external_exports.record(external_exports.unknown()).optional()
+    });
+    uploadOrgSkillZipBody = external_exports.object({
+      zip_data: external_exports.string().min(1),
+      replace_existing: external_exports.boolean().optional()
+    });
+    linkOrgResourceBody = external_exports.object({
+      org_resource_id: external_exports.string().uuid()
+    });
+  }
+});
+
+// ../../packages/core/dist/chunk-VXEAR36B.js
+var orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody;
+var init_chunk_VXEAR36B = __esm({
+  "../../packages/core/dist/chunk-VXEAR36B.js"() {
+    "use strict";
+    init_zod();
+    orgTagIdParam = external_exports.object({
+      id: external_exports.string().uuid()
+    });
+    listOrgTagsQuery = external_exports.object({
+      organization_id: external_exports.string().uuid()
+    });
+    ORG_TAG_NAME_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+    ORG_TAG_NAME_MAX_LENGTH = 50;
+    createOrgTagBody = external_exports.object({
+      organization_id: external_exports.string().uuid(),
+      name: external_exports.string().min(1).max(ORG_TAG_NAME_MAX_LENGTH).regex(ORG_TAG_NAME_REGEX, {
+        message: 'Must be lowercase alphanumeric with hyphens (e.g. "my-tag")'
+      }),
+      display_name: external_exports.string().max(100).nullish(),
+      color: external_exports.string().max(20).nullish()
+    });
+    updateOrgTagBody = external_exports.object({
+      // Required so the route targets the org the UI is managing (which may differ
+      // from the token's default `auth.org_id` for multi-org users) — mirrors create/list.
+      organization_id: external_exports.string().uuid(),
+      display_name: external_exports.string().max(100).nullish(),
+      color: external_exports.string().max(20).nullish()
+    });
+  }
+});
+
 // ../../packages/core/dist/chunk-HZ6CADSY.js
 function optionalTrimmedText(max) {
   return external_exports.string().trim().max(max).optional().transform((value) => value ? value : void 0);
@@ -5152,133 +5283,21 @@ var init_chunk_SXDX4GHS = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-FK6HBXM7.js
-var orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody;
-var init_chunk_FK6HBXM7 = __esm({
-  "../../packages/core/dist/chunk-FK6HBXM7.js"() {
-    "use strict";
-    init_zod();
-    orgResourceIdParam = external_exports.object({
-      id: external_exports.string().uuid()
-    });
-    orgResourceFileIdParam = external_exports.object({
-      file_id: external_exports.string().uuid()
-    });
-    orgResourceFolderIdParam = external_exports.object({
-      folder_id: external_exports.string().uuid()
-    });
-    hubOrgResourceParam = external_exports.object({
-      id: external_exports.string().uuid(),
-      org_resource_id: external_exports.string().uuid()
-    });
-    listOrgResourcesQuery = external_exports.object({
-      organization_id: external_exports.string().uuid(),
-      hub_id: external_exports.string().uuid().optional()
-    });
-    orgIdQuery = external_exports.object({
-      organization_id: external_exports.string().uuid()
-    });
-    createOrgResourceBody = external_exports.object({
-      organization_id: external_exports.string().uuid(),
-      resource_name: external_exports.string().min(1).max(255),
-      resource_description: external_exports.string().max(1e3).nullish(),
-      resource_type: external_exports.enum(["knowledge", "skill"]).default("knowledge"),
-      // Skill-only fields. Required for `resource_type = 'skill'` (validated in
-      // the route layer since cross-field refinement complicates the inferred
-      // input type for callers). Ignored for `knowledge`.
-      skill_name: external_exports.string().min(1).max(255).nullish(),
-      skill_version: external_exports.string().max(50).nullish(),
-      folder_metadata_schema: external_exports.record(external_exports.unknown()).optional(),
-      file_metadata_schema: external_exports.record(external_exports.unknown()).optional(),
-      enabled: external_exports.boolean().optional(),
-      tags: external_exports.array(external_exports.string().uuid()).optional(),
-      environment: external_exports.enum(["preview", "production", "all"]).optional()
-    });
-    updateOrgResourceBody = external_exports.object({
-      resource_name: external_exports.string().min(1).max(255).optional(),
-      resource_description: external_exports.string().max(1e3).nullish(),
-      skill_name: external_exports.string().min(1).max(255).nullish(),
-      skill_version: external_exports.string().max(50).nullish(),
-      folder_metadata_schema: external_exports.record(external_exports.unknown()).optional(),
-      file_metadata_schema: external_exports.record(external_exports.unknown()).optional(),
-      enabled: external_exports.boolean().optional(),
-      tags: external_exports.array(external_exports.string().uuid()).optional(),
-      environment: external_exports.enum(["preview", "production", "all"]).optional()
-    });
-    createOrgResourceFolderBody = external_exports.object({
-      org_resource_id: external_exports.string().uuid(),
-      folder_name: external_exports.string().min(1).max(255),
-      folder_description: external_exports.string().max(1e3).nullish(),
-      parent_folder_id: external_exports.string().uuid().nullish(),
-      order_index: external_exports.number().int().nonnegative().optional(),
-      enabled: external_exports.boolean().optional(),
-      metadata: external_exports.record(external_exports.unknown()).optional()
-    });
-    updateOrgResourceFolderBody = external_exports.object({
-      folder_name: external_exports.string().min(1).max(255).optional(),
-      folder_description: external_exports.string().max(1e3).nullish(),
-      parent_folder_id: external_exports.string().uuid().nullish(),
-      order_index: external_exports.number().int().nonnegative().optional(),
-      enabled: external_exports.boolean().optional(),
-      metadata: external_exports.record(external_exports.unknown()).optional()
-    });
-    uploadOrgResourceFileBody = external_exports.object({
-      org_resource_id: external_exports.string().uuid(),
-      folder_id: external_exports.string().uuid().nullish(),
-      file_name: external_exports.string().min(1).max(255),
-      file_data: external_exports.string(),
-      // base64
-      mime_type: external_exports.string().optional(),
-      file_size: external_exports.number().int().nonnegative().optional(),
-      resource_file_tags: external_exports.array(external_exports.string()).optional(),
-      metadata: external_exports.record(external_exports.unknown()).optional()
-    });
-    updateOrgResourceFileBody = external_exports.object({
-      resource_file_title: external_exports.string().min(1).max(255).optional(),
-      folder_id: external_exports.string().uuid().nullish(),
-      order_index: external_exports.number().int().nonnegative().optional(),
-      enabled: external_exports.boolean().optional(),
-      resource_file_tags: external_exports.array(external_exports.string()).optional(),
-      metadata: external_exports.record(external_exports.unknown()).optional()
-    });
-    uploadOrgSkillZipBody = external_exports.object({
-      zip_data: external_exports.string().min(1),
-      replace_existing: external_exports.boolean().optional()
-    });
-    linkOrgResourceBody = external_exports.object({
-      org_resource_id: external_exports.string().uuid()
-    });
-  }
-});
-
-// ../../packages/core/dist/chunk-VXEAR36B.js
-var orgTagIdParam, listOrgTagsQuery, ORG_TAG_NAME_REGEX, ORG_TAG_NAME_MAX_LENGTH, createOrgTagBody, updateOrgTagBody;
-var init_chunk_VXEAR36B = __esm({
-  "../../packages/core/dist/chunk-VXEAR36B.js"() {
+// ../../packages/core/dist/chunk-GPM7PE44.js
+var bootstrapQuery;
+var init_chunk_GPM7PE44 = __esm({
+  "../../packages/core/dist/chunk-GPM7PE44.js"() {
     "use strict";
     init_zod();
-    orgTagIdParam = external_exports.object({
-      id: external_exports.string().uuid()
-    });
-    listOrgTagsQuery = external_exports.object({
-      organization_id: external_exports.string().uuid()
-    });
-    ORG_TAG_NAME_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-    ORG_TAG_NAME_MAX_LENGTH = 50;
-    createOrgTagBody = external_exports.object({
-      organization_id: external_exports.string().uuid(),
-      name: external_exports.string().min(1).max(ORG_TAG_NAME_MAX_LENGTH).regex(ORG_TAG_NAME_REGEX, {
-        message: 'Must be lowercase alphanumeric with hyphens (e.g. "my-tag")'
-      }),
-      display_name: external_exports.string().max(100).nullish(),
-      color: external_exports.string().max(20).nullish()
-    });
-    updateOrgTagBody = external_exports.object({
-      // Required so the route targets the org the UI is managing (which may differ
-      // from the token's default `auth.org_id` for multi-org users) — mirrors create/list.
-      organization_id: external_exports.string().uuid(),
-      display_name: external_exports.string().max(100).nullish(),
-      color: external_exports.string().max(20).nullish()
+    bootstrapQuery = external_exports.object({
+      active_hub_id: external_exports.string().uuid().optional(),
+      active_conversation_id: external_exports.string().uuid().optional(),
+      active_nav: external_exports.enum(["chat", "task", "support"]).optional(),
+      /**
+       * The people thread the URL names (`/chat/threads/:threadId`, gh #4661): the snapshot
+       * preloads it as `people.active_thread` when the viewer is a member.
+       */
+      active_thread_id: external_exports.string().uuid().optional()
     });
   }
 });
@@ -5553,6 +5572,583 @@ var init_chunk_5DGHIY7L = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-F3JHI4Y4.js
+var DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, AUTOMATION_WEBHOOK_MOUNT;
+var init_chunk_F3JHI4Y4 = __esm({
+  "../../packages/core/dist/chunk-F3JHI4Y4.js"() {
+    "use strict";
+    DATA_PROXY_MOUNT = "/data";
+    DATA_PROXY_PREFIX = `/api${DATA_PROXY_MOUNT}`;
+    BASE_DESTRUCTION_MOUNT = "/bases";
+    BASE_DESTRUCTION_PREFIX = `/api${BASE_DESTRUCTION_MOUNT}`;
+    BASE_DESTRUCTION_CONFIRM_PATH = `${BASE_DESTRUCTION_PREFIX}/destruction/confirm`;
+    COMMUNITY_EMAIL_UNSUBSCRIBE_PATH = "/api/communities/email-unsubscribe";
+    CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH = "/api/contact-book/email-unsubscribe";
+    AUTOMATION_WEBHOOK_MOUNT = "/webhooks/automations";
+  }
+});
+
+// ../../packages/core/dist/chunk-IEWJ5MZH.js
+function matchPath(pattern, path42) {
+  const normalizedPath = path42.replace(/\/$/, "");
+  if (pattern.endsWith("/*")) {
+    const prefix = pattern.slice(0, -2);
+    return normalizedPath === prefix || normalizedPath.startsWith(prefix + "/");
+  }
+  return pattern === normalizedPath;
+}
+function getEndpointConfig(path42) {
+  for (const excluded of EXCLUDED_PATHS) {
+    if (matchPath(excluded, path42)) {
+      return null;
+    }
+  }
+  const normalizedPath = path42.replace(/\/$/, "");
+  if (!normalizedPath.endsWith("/*") && Object.prototype.hasOwnProperty.call(ENDPOINT_CONFIGS, normalizedPath)) {
+    return ENDPOINT_CONFIGS[normalizedPath];
+  }
+  const sortedPatterns = Object.keys(ENDPOINT_CONFIGS).sort((a, b) => b.length - a.length);
+  for (const pattern of sortedPatterns) {
+    if (matchPath(pattern, path42)) {
+      return ENDPOINT_CONFIGS[pattern];
+    }
+  }
+  return { tier: "STANDARD" };
+}
+var ENDPOINT_CONFIGS, EXCLUDED_PATHS;
+var init_chunk_IEWJ5MZH = __esm({
+  "../../packages/core/dist/chunk-IEWJ5MZH.js"() {
+    "use strict";
+    init_chunk_F3JHI4Y4();
+    ENDPOINT_CONFIGS = {
+      // OAuth callbacks - strict, fail-closed (prevent brute force)
+      "/oauth/callback/*": { tier: "STRICT", failClosed: true },
+      // Auth endpoints - strict, fail-closed
+      "/auth/phone": { tier: "STRICT", failClosed: true },
+      "/auth/mcp/exchange": { tier: "MODERATE", failClosed: true },
+      // Native magic-code login (pre-auth) — STRICT per-IP bounds a single host; WorkOS owns
+      // the per-email lockout / TTL / single-use guarantees.
+      "/api/auth/magic-code/*": { tier: "STRICT", failClosed: true },
+      // Native password login (pre-auth) — same posture as magic-code above. STRICT per-IP bounds a
+      // single host but FAILS OPEN on a binding error (like every IP limit); the `failClosed` flag
+      // here is inert on a pre-auth route (it's only enforced on the per-user branch, which needs an
+      // authenticated caller). The fail-CLOSED brute-force guarantee for the static credential comes
+      // from the route's per-email caps (burst + cumulative hourly), not this flag.
+      "/api/auth/password/*": { tier: "STRICT", failClosed: true },
+      // Every `/api/*` group whose paths carry ids pins `userLimitKey` (gh #4756), held there by
+      // `security/endpoint-invariants.test.ts`.
+      // Billing - moderate, fail-closed with user limits
+      "/api/billing/*": {
+        tier: "MODERATE",
+        userLimit: 100,
+        failClosed: true,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/billing/*"
+      },
+      "/webhooks/stripe": { tier: "MODERATE", failClosed: true },
+      "/webhooks/workos": { tier: "MODERATE", failClosed: true },
+      // API endpoints - standard with user limits
+      // 500 because the web's settings live updates refetch per hub in every open tab, whatever page
+      // it shows (`settingsLiveUpdateStore.ts`): one batch of changes costs about 10 + 4 per agent
+      // whose tools were opened + 2 per loaded resource, so a CLI push and publish (both hubs) with
+      // two tabs open passes 150 in a minute. A multi-file resource upload adds 2–5 per file.
+      "/api/setup/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/setup/*"
+      },
+      // 500 because an eval run's drill-down (`SessionResults.tsx`) fetches its list and then every
+      // LLM turn's record at once: up to 201 requests (`OBSERVABILITY_LIST_CAP`, 200). Sending keeps
+      // the 150 it had when each path held its own budget, on the exact key below.
+      "/api/conversations/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/conversations/*"
+      },
+      "/api/conversations/send-message": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      "/api/users/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      "/api/analytics/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/analytics/*"
+      },
+      // 500 because `wayai eval-results --eval` reads completed sessions one by one, newest first,
+      // until one holds the eval (up to the 1000 the list returns). Tenant SQL keeps the 150 it had
+      // when each path held its own budget: each query may run 30 s on shared-tenant ClickHouse
+      // after its caller has gone (`sql-validator.ts`, stage 10b).
+      "/api/evals/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/evals/*"
+      },
+      "/api/evals/sql": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      // An eval run's calls (gh #4418), kept off the end user's call budgets below. Create keeps the
+      // 150 it had: it opens a provider session on the org's own key, billed per second. The routes
+      // on one call take a budget of their own so no eval read can spend it: a refused hang-up
+      // leaves the call running, and billing. 500 because a call suite polls each run's record
+      // every second, about 64 requests a minute per suite.
+      "/api/evals/calls": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      "/api/evals/calls/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/evals/calls/*"
+      },
+      "/api/files/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      // The org contact book (wayai#4931 PR 2b). A CSV import sends one request per
+      // `CONTACT_IMPORT_BATCH_MAX` rows, so 150 a minute imports 75,000 rows a minute.
+      "/api/contact-book/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/contact-book/*"
+      },
+      // An automation email's one-click unsubscribe (wayai#4931 PR 2d) — public: its token is its one
+      // credential, so this per-IP limit is its one bound, and runs before the route reads anything.
+      // MODERATE (30/min per IP), as the community email's unsubscribe, for the same reason: mail
+      // clients' one-click unsubscribe POSTs it from their own servers, which many recipients' clicks
+      // share. An exact key, so it wins over the wildcard above.
+      [CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
+      "/api/automations/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/automations/*"
+      },
+      // A hub's own contact lists (wayai#4931 PR 2c): config edits, at the automations' rate.
+      "/api/hub-contact-lists/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/hub-contact-lists/*"
+      },
+      "/api/message-templates/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/message-templates/*"
+      },
+      "/api/live-updates/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
+      "/api/hub-users/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/hub-users/*"
+      },
+      "/api/conversation-state/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/conversation-state/*"
+      },
+      // The authenticated byte route (`routes/files/r2.ts`), mounted after its `authMiddleware` so
+      // the caller is known: each request reads the HubDO its key names, and a hub id never created
+      // still wakes a Durable Object (gh #4747; since gh #4775 T5 one that writes nothing). The key is pinned
+      // because the paths are file keys, which would otherwise each get a fresh budget (and one
+      // over 256 characters would be refused outright, `checkUserLimitNative`).
+      //
+      // 500 a minute because the web chat fetches every attachment of every loaded message at
+      // once, with no list virtualization: up to 50 per 50-message page, 200 per ended
+      // conversation or history entry at one file per message, and 4 per message at most in its
+      // image grid. Repeats come from the browser's HTTP cache (`private, max-age=3600`); mobile
+      // renders through a disk cache and plays audio from `/files/signed`. The budget is shared by
+      // a caller's tabs and devices. The other two byte routes, `/files/signed/*` and
+      // `/files/public/*`, mount no limiter (the reason is at their entries in
+      // `security/endpoint-invariants.test.ts`'s route registry).
+      "/files/auth/*": {
+        tier: "STANDARD",
+        userLimit: 500,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/files/auth/*"
+      },
+      // Channel webhooks - high throughput (external systems, never authenticated)
+      "/webhooks/whatsapp/*": { tier: "HIGH" },
+      "/webhooks/instagram/*": { tier: "HIGH" },
+      // An automation's webhook deliveries (wayai#4931 D13) — no bearer token: the automation's
+      // secret is the credential, checked against one HubDO read. This per-IP limit runs first, before
+      // anything is read. HIGH, as the channel webhooks: senders are servers, and an integration
+      // platform's egress addresses carry many tenants' deliveries. The per-automation budget is
+      // `AUTOMATION_WEBHOOK_PER_AUTOMATION_LIMIT`, counted after the delivery is verified.
+      [`${AUTOMATION_WEBHOOK_MOUNT}/*`]: { tier: "HIGH" },
+      // Reports (CLI → platform_report triage queue). One per-user budget covers intake
+      // (POST), the content edit (PATCH /:id), the reporter read-back (GET, GET /:id), and the
+      // verification loop (POST /:id/accept, /:id/contest). The limiter is path-based, so a
+      // method-level split (loose reads, strict writes) isn't expressible — GET /:id and PATCH
+      // /:id share a path. So the budget is sized for the read-heavy poll loop (a reporter agent
+      // polling `report get`/`list` while it waits for the fix), at 60/hour. Intake-flooding stays
+      // bounded regardless: identical reports collapse on `fingerprint` (ON CONFLICT DO NOTHING),
+      // so a runaway create loop merges rather than floods. Still STRICT tier + failClosed so a
+      // genuinely runaway distinct-report loop surfaces as 429. The `/*` is load-bearing — an
+      // exact `/api/reports` key would leave the `/:id` paths unmatched (→ unthrottled).
+      // `userLimitKey` is equally load-bearing: without it, middleware falls back to each request's
+      // path and report IDs/actions receive independent counters instead of this shared budget.
+      "/api/reports/*": {
+        tier: "STRICT",
+        userLimit: 60,
+        userWindow: 3600,
+        failClosed: true,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/reports/*"
+      },
+      // Admin report mutations (transition/group/ungroup/edit) — platform-admin
+      // gated at the route, rate-limited here as defense-in-depth. Generous STANDARD
+      // cap so legitimate triage bursts aren't throttled (grouping is one request
+      // even for many members); deliberately NOT failClosed so a Redis blip never
+      // blocks an admin's triage. The bare GET reads share this budget harmlessly.
+      "/api/admin/reports/*": { tier: "STANDARD", userLimit: 150, userLimitKey: "/api/admin/reports/*" },
+      // GitHub webhook (issues.closed → platform_report addressed). MODERATE +
+      // fail-closed; GitHub retries on transient failures so a brief Redis blip
+      // doesn't lose state.
+      "/webhooks/github": { tier: "MODERATE", failClosed: true },
+      // Account deletion — strict on the destructive POST + public undo. The
+      // /api/users/* default tier above ALSO matches these, but `getEndpointConfig`
+      // returns the longest-prefix match, so the more specific entries here win.
+      // `skipAuthenticatedUsers` deliberately omitted: every caller is authenticated,
+      // so including it would make `userLimit` a no-op — the per-user cap IS the gate.
+      "/api/users/me/deletion": { tier: "STRICT", userLimit: 3, userWindow: 3600, failClosed: true },
+      "/api/users/me/deletion/preflight": { tier: "STANDARD", userLimit: 30, failClosed: true },
+      "/api/users/deletion/undo": { tier: "STRICT", failClosed: true },
+      // Production-base destruction.
+      //
+      // Keyed off the CONTRACT constants, not literals: `BASE_DESTRUCTION_CONFIRM_PATH`'s own
+      // docstring promises that the mount, the `AUTH_BYPASS_PATHS` entry, the rate-limit key and
+      // the URL the email embeds move together, and a literal here is exactly how that promise
+      // goes quietly false — leaving an unauthenticated HMAC endpoint on the default tier.
+      //
+      // The emailed GET is PUBLIC, so it gets the IP-tier bound the pre-auth routes get.
+      // `failClosed` is deliberately NOT set: it is only consulted on the per-USER branch, which
+      // needs an authenticated caller, so on a pre-auth route it is inert — the same thing
+      // `/api/auth/magic-code/send` above says about itself. The IP limiter fails OPEN on a
+      // limiter error by design (`packages/runtime/src/rate-limiter.ts`), and claiming otherwise
+      // would tell the next auditor a protection exists that does not.
+      [BASE_DESTRUCTION_CONFIRM_PATH]: { tier: "STRICT" },
+      // The console's read, which every production base's settings pane issues on mount. Without
+      // its own entry it inherits the mount-wide budget below, and an admin clicking through
+      // thirty bases in an hour would be 429'd by a limit sized for irreversible writes.
+      [`${BASE_DESTRUCTION_PREFIX}/destructions`]: { tier: "STANDARD", userLimit: 150 },
+      // The mutating routes: initiate, the authenticated confirm, and cancel. Per user rather than
+      // per IP — all three are authenticated and org-admin gated — and hourly, since a single human
+      // touching thirty production-deletion operations in an hour is already far past normal.
+      // Longest-prefix wins, so the two entries above are not widened by this one. The key is
+      // pinned so those thirty are counted across every base the caller touches (gh #4756).
+      [`${BASE_DESTRUCTION_PREFIX}/*`]: {
+        tier: "STANDARD",
+        userLimit: 30,
+        userWindow: 3600,
+        failClosed: true,
+        userLimitKey: `${BASE_DESTRUCTION_PREFIX}/*`
+      },
+      // Email-invite preview — public, fail-closed. MODERATE (30/min IP) leaves
+      // headroom for the signup-page server-fetch + reloads + prefetches; STRICT
+      // would throttle legitimate users opening the link in multiple tabs.
+      "/api/invites/preview": { tier: "MODERATE", failClosed: true },
+      // "Don't email me again" (gh #4661) — public; one POST per click on its confirm page. STRICT
+      // per IP. No `failClosed`: it is consulted only on the per-user branch, which a pre-auth route
+      // never reaches (see `BASE_DESTRUCTION_CONFIRM_PATH` above).
+      "/api/invites/unsubscribe": { tier: "STRICT" },
+      // Admin DO debug reads — the ONE deliberate deviation from the Data Explorer
+      // catch-all below, and the only reason a per-route key still exists here.
+      // Platform-admin is enforced at the route; this is the independent
+      // defense-in-depth signal so a runaway investigation script surfaces as 429.
+      //
+      // STRICT is kept ON PURPOSE even though the catch-all moved off it: per IP, at 5/min vs
+      // STANDARD's 100/min, walking 10k ids takes ~33h instead of ~100min — a detection window
+      // worth keeping on the routes that return RAW DO ROWS.
+      //
+      // The cost, stated rather than elided: STRICT is one bucket shared with
+      // `/oauth/callback/*` and `/api/auth/magic-code/*`, so a debug session from a
+      // NAT'd office IP can 429 a colleague's login for up to a minute. That trade is
+      // accepted for a rare, deliberate investigation surface — and is exactly why the
+      // browse routes below are NOT here.
+      //
+      // The key is pinned, so a sweep of `/debug/do/hub/<id>/tables` across ids spends one
+      // per-admin budget (gh #4756). 120 an hour: an agent's investigation of a dozen
+      // conversations made 37 debug reads in its busiest hour.
+      "/api/admin/data-explorer/debug/*": {
+        tier: "STRICT",
+        userLimit: 120,
+        userWindow: 3600,
+        failClosed: true,
+        userLimitKey: "/api/admin/data-explorer/debug/*"
+      },
+      // Catch-all for the rest of the Data Explorer (`/search`, `/entity/*`, `/do/*`,
+      // `/kv/*`, the DELETE routes). Added as a catch-all rather than another per-route
+      // key because this budget kept lagging behind routes joining the debug boundary:
+      // with no match the path falls to the default, which sets no `userLimit`, so the
+      // per-user layer never runs at all. `getEndpointConfig` takes the longest match,
+      // so `debug/*` above still wins.
+      //
+      // `/entity/*` deliberately has NO key of its own: it needs precisely this config,
+      // and a duplicate entry is how the two drift apart on the next edit.
+      //
+      // `tier` is deliberately STANDARD, not STRICT. `tier` is the per-IP knob and
+      // STRICT is 5/min keyed on IP ALONE — one bucket shared across every STRICT
+      // endpoint. On these browse routes that breaks the console (open Browse KV and
+      // inspect four values = 6 requests; expand six org rows in the search results =
+      // 6 `/entity/org/:id` calls) and would drain the same IP's budget for
+      // `/oauth/callback/*` and `/api/auth/magic-code/*`, which on a NAT'd office IP
+      // means all admins. The per-user hourly cap is the leg that matters here.
+      //
+      // The canonical key is deliberate: request paths contain DO ids and arbitrary
+      // malformed requests can contain credential material. Keying on the request path
+      // both stores that material in Redis/logs and gives every target a fresh counter.
+      // One stable identity makes every browse request consume the same per-admin
+      // budget without storing request targets.
+      //
+      // 600/hour preserves the original pagination requirement (about 30k rows at
+      // 50/page) while now genuinely bounding id/key enumeration across the surface.
+      "/api/admin/data-explorer/*": {
+        tier: "STANDARD",
+        userLimit: 600,
+        userWindow: 3600,
+        failClosed: true,
+        userLimitKey: "/api/admin/data-explorer/*"
+      },
+      // Admin harness incident-response (harness-agents PR 2.9b) — mass-destroy reaps
+      // EVERY live harness session/token/slot in scope, so it gets a strict budget
+      // (STRICT + a low per-user hourly cap + fail-closed). Platform-admin is enforced
+      // at the route; this is the independent defense-in-depth signal so a runaway
+      // reap loop surfaces as 429. The break-glass disable/enable rides through
+      // `/api/admin/config` (its own STANDARD budget), not this key.
+      "/api/admin/harness/*": {
+        tier: "STRICT",
+        userLimit: 10,
+        userWindow: 3600,
+        failClosed: true,
+        userLimitKey: "/api/admin/harness/*"
+      },
+      // Platform-wide team-orphan repair — a single call can WRITE across every hub of
+      // every org (HubDO purge + UserDO mirror fan-out), so it gets the same strict,
+      // fail-closed budget as the other cross-platform admin write. Exact path (not a
+      // prefix): the sibling `/api/admin/hubs/:hubId/harness` flag flips stay on the
+      // default admin budget. Platform-admin is enforced at the route; this is the
+      // defense-in-depth signal that a repair loop surfaces as 429.
+      "/api/admin/hubs/repair-team-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
+      // Branching-orphan repair (#4577) — deletes named production rows, and its report mode
+      // fans out over every production hub of every org, so it takes the same strict,
+      // fail-closed budget as the team-orphan repair. Exact path, for the same reason.
+      "/api/admin/hubs/repair-branching-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
+      // CI/GitOps endpoints - standard with user limits. 500 because `wayai push` makes four requests
+      // (pull, diff, push, pull) and a GitOps job may push every hub at once with one token; when
+      // each path held its own 100, that ran to 100 hubs a minute.
+      "/api/ci/*": { tier: "STANDARD", userLimit: 500, skipAuthenticatedUsers: true, userLimitKey: "/api/ci/*" },
+      // Attested `/v1` proxy onto the Rekor Worker. `userLimitKey` is load-bearing here: the
+      // per-user budget defaults to the full request path, and this surface's paths carry base,
+      // record, and file ids — so without a pinned key every distinct resource would get its own
+      // fresh budget and the per-user limit would bound nothing. One shared budget across the
+      // whole data surface is the intent.
+      [`${DATA_PROXY_PREFIX}/*`]: {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: `${DATA_PROXY_PREFIX}/*`
+      },
+      // Voice calls — the end user's call routes (`routes/api/calls`). Every caller is signed
+      // in, so the per-IP tier is skipped for them: Brazilian mobile carriers put many callers
+      // behind one IP, and a shared bucket would refuse one caller for another's traffic.
+      //
+      // Create is the only route that spends: it opens a provider session on the org's own
+      // key, billed per second. So it takes its own exact key and an hourly per-user cap, which
+      // lives on Redis and is fail-closed like the other hourly caps. The exact key wins over
+      // the wildcard below, which also matches `/api/calls` (see `getEndpointConfig`).
+      "/api/calls": {
+        tier: "STANDARD",
+        userLimit: 30,
+        userWindow: 3600,
+        failClosed: true,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/calls"
+      },
+      // The routes on one call: `ready`, hang-up, the delegation report and the status read; and
+      // the opening read (`/api/calls/openings/:language`), one per call, before it exists.
+      // NEVER fail-closed: a refused hang-up leaves the call running, and billing, until a
+      // limit ends it. The 60 s budget runs on the native binding, which fails open. The key is
+      // pinned because the paths carry the call id, which would otherwise give every call a
+      // fresh budget.
+      "/api/calls/*": {
+        tier: "STANDARD",
+        userLimit: 150,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/calls/*"
+      },
+      // Contacts between accounts (gh #4661, `routes/api/contacts`). Every caller is signed in, so
+      // the per-IP tier is skipped. The keys are pinned because the paths carry user and invite
+      // ids, which would otherwise give each id a fresh budget. Blocks take their own, lower
+      // budget (#4661 Limits: blocks are rate-limited). The invites-per-day cap and every list
+      // cap are counted in the caller's UserDO, in the same write they bound, not here.
+      "/api/contacts/*": {
+        tier: "STANDARD",
+        userLimit: 60,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/contacts/*"
+      },
+      "/api/contacts/blocks/*": {
+        tier: "STANDARD",
+        userLimit: 30,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/contacts/blocks/*"
+      },
+      // Person-to-person threads (gh #4661, `routes/api/threads`): the per-user send limit, 60 a
+      // minute on the native binding. Every thread route shares the one budget, reads included:
+      // the paths carry thread and message ids, so the key is pinned, and a pattern here cannot
+      // tell a send from a read of the same path. Like every 60 s budget it fails open on a
+      // binding error, so it bounds sends in the steady state only.
+      "/api/threads/*": {
+        tier: "STANDARD",
+        userLimit: 60,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/threads/*"
+      },
+      // An org admin's erasure of one person's thread messages (gh #4661 owner decision 7): any user
+      // can own a free org, so each request arms that org's alarm, and this caps how fast one person
+      // can ask. The org's own daily cap (`PEOPLE_ORG_ERASURES_PER_DAY`, counted in its OrgDO in the
+      // write it bounds) is the fail-closed bound; this budget, on the native binding, fails open.
+      "/api/threads/org-erasures": {
+        tier: "STANDARD",
+        userLimit: 10,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/threads/org-erasures"
+      },
+      // A person's report of a message, thread or person (`people-reports.ts`): each one written
+      // arms the PlatformDO's alarm and emails the platform admins, so it takes its own, lower
+      // budget. The reporter's daily cap (`PEOPLE_REPORTS_PER_DAY`, counted in the report store in
+      // the write it bounds) is the fail-closed bound; this budget, on the native binding, fails open.
+      "/api/threads/reports": {
+        tier: "STANDARD",
+        userLimit: 10,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/threads/reports"
+      },
+      // Communities (gh #4872, `routes/api/communities`): every signed-in route under the mount (the
+      // preview below excepted) shares one per-user budget, which is also each member's send limit and
+      // bounds the reads that scan a community's rows (a title search, the stats); a community's own
+      // limits (its rate, the daily caps, slow mode) are counted in its CommunityDO, in the write they
+      // bound. Every caller is signed in, so the per-IP tier is skipped; the key is pinned because the
+      // paths carry community, room and message ids.
+      "/api/communities/*": {
+        tier: "STANDARD",
+        userLimit: 60,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/communities/*"
+      },
+      // The join page's preview of a link — public, fetched from the visitor's browser, so this
+      // per-IP limit is its one bound and runs before the route reads anything (#4872
+      // owner-delegated decision 9). MODERATE (30/min per IP) leaves room for reloads and several
+      // tabs. An exact key, so it wins over the wildcard above.
+      "/api/communities/join-preview": { tier: "MODERATE" },
+      // An announcement email's unsubscribe (#4872 PR 8a) — public: its token is its one credential, so
+      // this per-IP limit is its one bound, and runs before the route reads anything. MODERATE (30/min
+      // per IP), not STRICT: mail clients' one-click unsubscribe POSTs it from their own servers, which
+      // many members' clicks share, and STRICT's 5/min bucket is shared with sign-in. An exact key, so
+      // it wins over the wildcard above.
+      [COMMUNITY_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
+      // The WayAI Guide's help entry (wayai#4948, `routes/api/guide.ts`): one POST per click by a viewer
+      // the snapshot does not show enrolled, which reads the person's row on the Guide hub and writes only
+      // what is missing (an enrolled viewer's click opens the hub without a request). Every caller is
+      // signed in, so the per-IP tier is skipped; 10 a minute per person on the native binding (fails
+      // open, like every 60 s budget) bounds what a looping client costs the one Guide HubDO.
+      "/api/guide/access": {
+        tier: "STANDARD",
+        userLimit: 10,
+        skipAuthenticatedUsers: true,
+        userLimitKey: "/api/guide/access"
+      },
+      // App channel - high throughput with user limits
+      "/channels/app/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
+      // API channel (api-channel-connector) - machine-to-machine, high throughput
+      "/channels/api/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
+      // System/scheduled - high throughput (internal)
+      "/channels/system/*": { tier: "HIGH", skipAuthenticatedUsers: true },
+      "/scheduled/*": { tier: "HIGH", skipAuthenticatedUsers: true },
+      // WebSocket - standard with user limit to prevent connection spam
+      "/live-updates/ws": { tier: "STANDARD", userLimit: 100, failClosed: true },
+      // A community's live socket (gh #4872 PR 5, `GET /communities/:communityId/live`): outside
+      // `/api/*`, with no bearer token, so its per-IP tier is its one bound before the CommunityDO
+      // checks the ticket. STANDARD, as `/live-updates/ws`: a client opens one per community it shows
+      // and reconnects within the hour.
+      "/communities/*": { tier: "STANDARD" },
+      // WS ticket mint - per-user 60/min accommodates aggressive reconnect patterns
+      // without opening abuse vectors; fail-closed so Redis outages don't let
+      // runaway clients mint unbounded tickets.
+      "/api/auth/ws-ticket": { tier: "MODERATE", userLimit: 60, failClosed: true, skipAuthenticatedUsers: true },
+      "/api/auth/session-check": { tier: "STANDARD", userLimit: 120, skipAuthenticatedUsers: true },
+      "/api/auth/logout": { tier: "MODERATE", userLimit: 10, failClosed: true, skipAuthenticatedUsers: true }
+    };
+    EXCLUDED_PATHS = /* @__PURE__ */ new Set(["/health"]);
+  }
+});
+
+// ../../packages/core/dist/chunk-CGOLULK2.js
+function fileSnapshotChanged(run) {
+  return run.written + run.removed > 0;
+}
+async function runFileSnapshot(opts) {
+  const run = { pages: 0, written: 0, removed: 0, unchanged: 0 };
+  const seen = /* @__PURE__ */ new Set();
+  let cursor;
+  while (run.pages < FILE_SNAPSHOT_MAX_PAGES) {
+    const page = await sendWithRetry(opts, cursor);
+    run.pages++;
+    run.written += page.written;
+    run.removed += page.removed;
+    run.unchanged += page.unchanged;
+    opts.onPage?.(page, run.pages);
+    if (page.next_cursor === null) return run;
+    if (seen.has(page.next_cursor)) {
+      throw new Error(`The preview file snapshot repeated its cursor after page ${run.pages}, so it would never end.`);
+    }
+    seen.add(page.next_cursor);
+    cursor = page.next_cursor;
+  }
+  throw new Error(`The preview file snapshot did not end after ${FILE_SNAPSHOT_MAX_PAGES} pages.`);
+}
+async function sendWithRetry(opts, cursor) {
+  for (let attempt = 1; ; attempt++) {
+    let body;
+    try {
+      body = await opts.sendPage(cursor);
+    } catch (error) {
+      if (attempt < FILE_SNAPSHOT_CONFLICT_ATTEMPTS && opts.isConflict(error)) continue;
+      throw error;
+    }
+    const parsed = rekorFileSnapshotAnswerSchema.safeParse(body);
+    if (!parsed.success) {
+      throw new Error("The data product answered a preview file snapshot page WayAI cannot read: nothing more was sent.");
+    }
+    return parsed.data.data;
+  }
+}
+var rekorFileSnapshotAnswerSchema, FILE_SNAPSHOT_MAX_PAGES, FILE_SNAPSHOT_CONFLICT_ATTEMPTS, FILE_SNAPSHOT_PAGE_SPACING_MS, FILE_SNAPSHOT_CONFLICT_STATUS;
+var init_chunk_CGOLULK2 = __esm({
+  "../../packages/core/dist/chunk-CGOLULK2.js"() {
+    "use strict";
+    init_chunk_IEWJ5MZH();
+    init_chunk_F3JHI4Y4();
+    init_zod();
+    rekorFileSnapshotAnswerSchema = external_exports.object({
+      data: external_exports.object({
+        next_cursor: external_exports.string().nullable(),
+        /** Files the page created or replaced on the preview. */
+        written: external_exports.number().int(),
+        /** The preview's own files, ones production does not hold, the page removed. */
+        removed: external_exports.number().int(),
+        /** Files the page found already equal to production's. */
+        unchanged: external_exports.number().int()
+      })
+    });
+    FILE_SNAPSHOT_MAX_PAGES = 1e4;
+    FILE_SNAPSHOT_CONFLICT_ATTEMPTS = 3;
+    FILE_SNAPSHOT_PAGE_SPACING_MS = Math.ceil(
+      6e4 / Math.max(1, Math.floor((getEndpointConfig(`${DATA_PROXY_PREFIX}/files/snapshot`)?.userLimit ?? 60) * 4 / 5))
+    );
+    FILE_SNAPSHOT_CONFLICT_STATUS = 409;
+  }
+});
+
 // ../../packages/core/dist/chunk-BEOHBREG.js
 var REKOR_ACTOR_TYPE_HEADER, REKOR_ACTOR_ID_HEADER, REKOR_ACTOR_LABEL_HEADER, REKOR_ACTOR_ORG_HEADER, REKOR_ACTOR_ADMIN_HEADER, REKOR_CLIENT_HEADER, REKOR_TOOL_ID_HEADER, REKOR_CLIENTS, rekorClientSchema, MAX_REKOR_TOOL_ID_LENGTH, rekorToolIdSchema, REKOR_V1_PREFIX, DATA_PROXY_ORG_QUERY_PARAM, MAX_PROVISIONING_BODY_BYTES, dataProxyQuery, rekorAttestation, REQUIRED_REKOR_ATTESTATION_HEADERS, REKOR_BOUND_BASE_HEADER, REKOR_BOUND_TOOLSET_HEADER, REKOR_BOUND_TOKEN_HEADER, REKOR_BOUND_CUSTOMER_HEADER, DATA_BASE_GENERATION_HEADER, REKOR_MAX_ACTOR_ID_LENGTH, REKOR_MAX_ACTOR_LABEL_LENGTH;
 var init_chunk_BEOHBREG = __esm({
@@ -5596,14 +6192,20 @@ var init_chunk_BEOHBREG = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-BVQE66I2.js
-var TOOLSET_SLUG_PATTERN, REKOR_STRUCTURAL_ID_PATTERN, baseEnvironmentSchema, TOOLSET_FILE_OPERATIONS, toolsetFileToolSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorToolsetToolsSchema, rekorBoundAttestation, rekorResolvedToolsetSchema, resolvedFileToolSchema, rekorToolsetFileSchema, rekorToolsetFileListSchema, rekorToolsetFileGetSchema, rekorToolsetFilePutSchema, TOOLSET_CUSTOMER_FACING_REFUSAL_MARK, TOOLSET_CUSTOMER_FACING_REFUSAL;
-var init_chunk_BVQE66I2 = __esm({
-  "../../packages/core/dist/chunk-BVQE66I2.js"() {
+// ../../packages/core/dist/chunk-4MRBBR5L.js
+function toolsetFileToolName(entry, op) {
+  const names = entry.names;
+  const stated = names?.[op];
+  return stated !== void 0 && stated !== null ? String(stated) : `${op}_${entry.name ?? entry.file_type}`;
+}
+var TOOLSET_SLUG_SETTING, TOOLSET_SLUG_PATTERN, REKOR_STRUCTURAL_ID_PATTERN, baseEnvironmentSchema, TOOLSET_FILE_OPERATIONS, toolsetFileToolSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorToolsetToolsSchema, rekorBoundAttestation, rekorResolvedToolsetSchema, resolvedFileToolSchema, rekorToolsetFileSchema, rekorToolsetFileListSchema, rekorToolsetFileGetSchema, rekorToolsetFilePutSchema, TOOLSET_CUSTOMER_FACING_REFUSAL_MARK, TOOLSET_CUSTOMER_FACING_REFUSAL;
+var init_chunk_4MRBBR5L = __esm({
+  "../../packages/core/dist/chunk-4MRBBR5L.js"() {
     "use strict";
     init_chunk_BEOHBREG();
     init_chunk_DHPUPI4Y();
     init_zod();
+    TOOLSET_SLUG_SETTING = "toolset";
     TOOLSET_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
     REKOR_STRUCTURAL_ID_PATTERN = TOOLSET_SLUG_PATTERN;
     baseEnvironmentSchema = external_exports.enum(["preview", "production"]);
@@ -5900,25 +6502,6 @@ var init_chunk_IPDOHAZ5 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-GPM7PE44.js
-var bootstrapQuery;
-var init_chunk_GPM7PE44 = __esm({
-  "../../packages/core/dist/chunk-GPM7PE44.js"() {
-    "use strict";
-    init_zod();
-    bootstrapQuery = external_exports.object({
-      active_hub_id: external_exports.string().uuid().optional(),
-      active_conversation_id: external_exports.string().uuid().optional(),
-      active_nav: external_exports.enum(["chat", "task", "support"]).optional(),
-      /**
-       * The people thread the URL names (`/chat/threads/:threadId`, gh #4661): the snapshot
-       * preloads it as `people.active_thread` when the viewer is a member.
-       */
-      active_thread_id: external_exports.string().uuid().optional()
-    });
-  }
-});
-
 // ../../packages/core/dist/chunk-YUZFHVB2.js
 var invitePreviewQuery, inviteRolePreviewResponse, inviteContactPreviewResponse, invitePreviewResponse, inviteUnsubscribeBody;
 var init_chunk_YUZFHVB2 = __esm({
@@ -6206,7 +6789,7 @@ var init_chunk_E4DIIOOE = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-FMXFEZN4.js
+// ../../packages/core/dist/chunk-4MXPUC6I.js
 function spokenLineField(label, description2) {
   return { type: "text", label, maxLength: SPOKEN_LINE_MAX_CHARS, default: "", description: description2 };
 }
@@ -6216,8 +6799,8 @@ function byLowercaseName(a, b) {
   return x < y ? -1 : x > y ? 1 : 0;
 }
 var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, SANDBOX_AGENT_FIELDS, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, REKOR_TOOLSET_SERVICE_NAME, rekorToolset, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeManagedAgents, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
-var init_chunk_FMXFEZN4 = __esm({
-  "../../packages/core/dist/chunk-FMXFEZN4.js"() {
+var init_chunk_4MXPUC6I = __esm({
+  "../../packages/core/dist/chunk-4MXPUC6I.js"() {
     "use strict";
     CALLER_LANGUAGE = "caller";
     TTS_VOICE_REPLY_ENABLED_FIELD = {
@@ -6245,7 +6828,17 @@ var init_chunk_FMXFEZN4 = __esm({
         type: "toggle",
         label: "Code Execution Sandbox",
         default: false,
-        description: "Let this agent run code in a WayAI sandbox with the sandbox tools, bash, copy_to_sandbox and copy_from_sandbox (add them under Tools): one disposable Linux container per conversation, started on first use and ended after 10 minutes without use or 60 minutes in all."
+        description: "Let this agent run code in a WayAI sandbox with the sandbox tools, bash, copy_to_sandbox and copy_from_sandbox (add them under Tools): a disposable Linux container, shared with the conversation's other agents or private to this agent (Sandbox Scope), started on first use and ended after 10 minutes without use, 60 minutes in all, or when the conversation closes."
+      },
+      sandbox_scope: {
+        type: "select",
+        label: "Sandbox Scope",
+        options: [
+          { value: "conversation", label: "Conversation (shared with the conversation's other agents)" },
+          { value: "agent", label: "Agent (private to this agent)" }
+        ],
+        default: "conversation",
+        description: "Whose sandbox this agent uses. Conversation: shared with the conversation's other agents; every agent sharing it sees its files, and agents sharing it need the same Sandbox Network setting, or a command from one ends the sandbox and starts an empty one. Agent: private to this agent; no other agent sees its files. Set Agent for an agent that handles files others must not see, such as a copilot with internal documents. Each agent sandbox is its own container, counts toward the organization's limit on running sandboxes, and ends with the conversation."
       },
       sandbox_network: {
         type: "select",
@@ -7171,13 +7764,13 @@ var init_chunk_FMXFEZN4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-VOC3AGY4.js
+// ../../packages/core/dist/chunk-NTJMGSSO.js
 var evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse;
-var init_chunk_VOC3AGY4 = __esm({
-  "../../packages/core/dist/chunk-VOC3AGY4.js"() {
+var init_chunk_NTJMGSSO = __esm({
+  "../../packages/core/dist/chunk-NTJMGSSO.js"() {
     "use strict";
     init_chunk_E4DIIOOE();
-    init_chunk_FMXFEZN4();
+    init_chunk_4MXPUC6I();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
     init_zod();
@@ -7544,15 +8137,15 @@ var init_chunk_MH4O3YEX = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-LDSABSRL.js
+// ../../packages/core/dist/chunk-CWUV6NL3.js
 function catalogToolSideEffects(toolName) {
   const sideEffects = CATALOG_SIDE_EFFECTS.get(toolName);
   if (sideEffects === void 0) return "unknown";
   return sideEffects ? "side_effects" : "none";
 }
 var NATIVE_TOOL_SCHEMAS, WAYAI_CONNECTOR, SANDBOX_AGENT_ROLES, BASE_NATIVE_TOOLS, NATIVE_TOOLS, CATALOG_SIDE_EFFECTS;
-var init_chunk_LDSABSRL = __esm({
-  "../../packages/core/dist/chunk-LDSABSRL.js"() {
+var init_chunk_CWUV6NL3 = __esm({
+  "../../packages/core/dist/chunk-CWUV6NL3.js"() {
     "use strict";
     init_chunk_DHPUPI4Y();
     NATIVE_TOOL_SCHEMAS = {
@@ -7900,14 +8493,14 @@ var init_chunk_LDSABSRL = __esm({
       "copy_to_sandbox": {
         "tool_config": {
           "name": "copy_to_sandbox",
-          "description": `Copy one of this conversation's files into the code sandbox, so commands run with bash can read or edit it there. path names the file as read_file does: this conversation's attachments under "conversation/" (e.g. "conversation/report.xlsx"), or an earlier conversation's under "conversations/<conversation_id>/<name>". Hub resource files cannot be copied. The copy lands at sandbox_path, replacing any file there; a file larger than 25 MiB is refused. If no sandbox is running, the copy starts an empty one.`,
+          "description": `Copy one of this conversation's files, or one of your documents, into the code sandbox, so commands run with bash can read or edit it there. path names the file as read_file does: this conversation's attachments under "conversation/" (e.g. "conversation/report.xlsx"), an earlier conversation's under "conversations/<conversation_id>/<name>", or a document under "data/<file-type>/" (e.g. "data/contracts/acme/msa.docx"), whose result gives the version you copied: pass it to copy_from_sandbox to copy the document back. Hub resource files cannot be copied. The copy lands at sandbox_path, replacing any file there; a file larger than 25 MiB is refused, and a document larger than 1 MiB. If no sandbox is running, the copy starts an empty one.`,
           "strict": false,
           "parameters": {
             "type": "object",
             "properties": {
               "path": {
                 "type": "string",
-                "description": `The file to copy, as read_file names it: "conversation/<name>" (a shorter unambiguous form or the file's id also works) or "conversations/<conversation_id>/<name>".`
+                "description": `The file to copy, as read_file names it: "conversation/<name>" (a shorter unambiguous form or the file's id also works), "conversations/<conversation_id>/<name>", or a document's full path "data/<file-type>/<path>".`
               },
               "sandbox_path": {
                 "type": "string",
@@ -7925,7 +8518,7 @@ var init_chunk_LDSABSRL = __esm({
       "copy_from_sandbox": {
         "tool_config": {
           "name": "copy_from_sandbox",
-          "description": 'Copy a file out of the code sandbox into this conversation, so what your commands produced (a chart, a converted document) is kept after the sandbox ends. The file is stored for the support team on an internal note and is NOT sent to the customer: the result gives its path under "conversation/", and send_files with that path delivers it when it should reach them. A file larger than 25 MiB is refused.',
+          "description": `Copy a file out of the code sandbox into this conversation, so what your commands produced (a chart, a converted document) is kept after the sandbox ends. The file is stored for the support team on an internal note and is NOT sent to the customer: the result gives its path under "conversation/", and send_files with that path delivers it when it should reach them. A file larger than 25 MiB is refused. With path, the file is written instead to one of your documents under "data/<file-type>/", with the version you copied it in at: the write goes through only while that is still the document's current version, so a document changed since is refused, and only where you may write documents. A document holds at most 1 MiB.`,
           "strict": false,
           "parameters": {
             "type": "object",
@@ -7936,7 +8529,15 @@ var init_chunk_LDSABSRL = __esm({
               },
               "name": {
                 "type": "string",
-                "description": `The stored file's name, with no folders (e.g. "q3-report.xlsx"). Defaults to the file's name in the sandbox.`
+                "description": `The stored file's name, with no folders (e.g. "q3-report.xlsx"). Defaults to the file's name in the sandbox. Not with path.`
+              },
+              "path": {
+                "type": "string",
+                "description": 'A document to write the file to instead, by its full path, e.g. "data/contracts/acme/msa.docx", as copy_to_sandbox or list_files gives it. Leave it out to keep the file with this conversation.'
+              },
+              "version": {
+                "type": "integer",
+                "description": "With path: the version copy_to_sandbox (or read_file) gave for the document, to replace it. Leave it out to create a new document."
               }
             },
             "required": [
@@ -8524,11 +9125,18 @@ var init_chunk_LDSABSRL = __esm({
       // setting is on, on any provider. Side effects: under an Allowlist or Web network setting, the
       // code it runs can send data out of the conversation.
       { tool_native_id: "nt-030", tool_name: "bash", tool_display_name: "Run Code (Bash)", tool_description: "Run a Bash command in the conversation's code sandbox", connector_id: WAYAI_CONNECTOR, operation: "bash", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: true, replay: "reconcile", assignable_roles: SANDBOX_AGENT_ROLES },
-      // Copies a conversation file INTO the sandbox: the sandbox is conversation state, so nothing
-      // leaves the conversation.
+      // Copies a conversation file, or a toolset document (`data/`, read through the toolset's `get`),
+      // INTO the sandbox: the sandbox is conversation state, so nothing leaves the conversation. The
+      // conversation's sandbox is shared by its agents whose `sandbox_scope` is `conversation`, so a
+      // document copied in is there for each of them, as anything else an agent leaves in it; an agent
+      // set to `agent` copies into its own, which no other agent reaches (decision 147).
       { tool_native_id: "nt-031", tool_name: "copy_to_sandbox", tool_display_name: "Copy File to Sandbox", tool_description: "Copy one of the conversation's files into its code sandbox", connector_id: WAYAI_CONNECTOR, operation: "copy_to_sandbox", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", assignable_roles: SANDBOX_AGENT_ROLES },
       // Copies a sandbox file OUT into the conversation, as an internal note for the team: nothing
-      // reaches the customer until `send_files` sends it.
+      // reaches the customer until `send_files` sends it. With `path`, it writes a toolset document
+      // instead, through the toolset's `put` with its version check: such a call is `reconcile`, not
+      // `keyed`, as `write_file` is (`toolCallReplay` reads its arguments). Its side effects stay `false`:
+      // only an agent holding a toolset `put` can write one, never a customer-facing role (premise 8),
+      // and a voice call's turns, which read this flag, run the pilot track, which is customer-facing.
       { tool_native_id: "nt-032", tool_name: "copy_from_sandbox", tool_display_name: "Copy File from Sandbox", tool_description: "Copy a file out of the code sandbox into the conversation, for the team", connector_id: WAYAI_CONNECTOR, operation: "copy_from_sandbox", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "keyed", assignable_roles: SANDBOX_AGENT_ROLES },
       // The `data/` mount's writes (#5142 step 2): a document of the agent's Base Toolset, written
       // through the toolset's own `put` tool with its version check. `reconcile`, not `keyed`: a re-run
@@ -8569,11 +9177,104 @@ var init_chunk_IBL7FANV = __esm({
 });
 
 // ../../packages/core/dist/chunk-PFDZEKDE.js
-var PREVIOUS_CONVERSATIONS_MAX;
+function parseExpr(expr) {
+  const fnMatch = expr.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\s*\((.*?)\)\s*(?:\.(.*))?$/);
+  if (!fnMatch) return null;
+  const [, fn, rawArgs, rawPath] = fnMatch;
+  const args2 = splitArgs(rawArgs);
+  const path42 = rawPath ? rawPath.split(".").flatMap((seg) => {
+    const indexed = [];
+    seg.replace(/([^\[\]]+)|\[(\d+)\]/g, (_, prop, idx) => {
+      if (prop) indexed.push(prop);
+      else if (idx !== void 0) indexed.push(idx);
+      return "";
+    });
+    return indexed;
+  }) : [];
+  return { fn, args: args2, path: path42 };
+}
+function splitArgs(rawArgs) {
+  const trimmed = rawArgs.trim();
+  return trimmed ? trimmed.split(",").map((s) => stripQuotes(s.trim())) : [];
+}
+function stripQuotes(s) {
+  if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+function parseCatalogArgs(args2) {
+  let kind = null;
+  let tree = false;
+  for (const token of args2) {
+    if (token === "tree") tree = true;
+    else if ((token === "kb" || token === "skill") && kind === null) kind = token;
+  }
+  return { kind, tree };
+}
+function widenKinds(kinds) {
+  if (kinds.has("all") || kinds.size > 1) return "all";
+  return [...kinds][0] ?? null;
+}
+function* parseCalls(template) {
+  for (const match of template.matchAll(PLACEHOLDER_RE)) {
+    const parsed = parseExpr(match[1].trim());
+    if (parsed) yield parsed;
+  }
+}
+function scanTemplateResources(template) {
+  if (!template || !template.includes("{{")) return EMPTY_SCAN;
+  const scan = { ...EMPTY_SCAN };
+  const names = /* @__PURE__ */ new Set();
+  const paths = /* @__PURE__ */ new Set();
+  const treeKinds = /* @__PURE__ */ new Set();
+  const legacyKinds = /* @__PURE__ */ new Set();
+  for (const { fn, args: args2 } of parseCalls(template)) {
+    switch (fn) {
+      case CATALOG_FN:
+      case LEGACY_CATALOG_FN: {
+        scan.needs_catalog = true;
+        scan.has_catalog_call = true;
+        const { kind, tree } = parseCatalogArgs(args2);
+        if (fn === LEGACY_CATALOG_FN) legacyKinds.add(kind ?? "all");
+        if (tree) treeKinds.add(kind ?? "all");
+        break;
+      }
+      case "agent_skills":
+        scan.needs_catalog = true;
+        break;
+      case "resource_content":
+        if (args2[0]) names.add(args2[0]);
+        break;
+      case "file_content":
+        if (args2[0]) paths.add(args2[0]);
+        break;
+      default:
+        break;
+    }
+  }
+  scan.tree_kinds = widenKinds(treeKinds);
+  scan.legacy_kinds = widenKinds(legacyKinds);
+  scan.resource_content_names = [...names];
+  scan.file_content_paths = [...paths];
+  return scan;
+}
+var PREVIOUS_CONVERSATIONS_MAX, PLACEHOLDER_RE, CATALOG_FN, LEGACY_CATALOG_FN, EMPTY_SCAN;
 var init_chunk_PFDZEKDE = __esm({
   "../../packages/core/dist/chunk-PFDZEKDE.js"() {
     "use strict";
     PREVIOUS_CONVERSATIONS_MAX = 20;
+    PLACEHOLDER_RE = /\{\{\s*([^{}]+?)\s*\}\}/g;
+    CATALOG_FN = "files";
+    LEGACY_CATALOG_FN = "resources";
+    EMPTY_SCAN = {
+      needs_catalog: false,
+      has_catalog_call: false,
+      legacy_kinds: null,
+      tree_kinds: null,
+      resource_content_names: [],
+      file_content_paths: []
+    };
   }
 });
 
@@ -8764,7 +9465,7 @@ var init_chunk_T7KQKDET = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-7EGDXEYG.js
+// ../../packages/core/dist/chunk-7PJOBY4O.js
 function resolveMonitorTrigger(monitorConfig) {
   if (!monitorConfig || typeof monitorConfig !== "object") return "idle";
   const raw = monitorConfig.trigger;
@@ -9070,10 +9771,10 @@ function refineMonitorRulesStructuredOutput(body, ctx) {
   if (refusal2) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["response_format"], message: refusal2 });
 }
 var NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, AUTOMATION_GATE_TRIGGERS, NON_FIRING_TRIGGERS, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, MONITOR_GATE_AGENT_NAME_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, MONITOR_AUTOMATION_FIRE_ACTION_KINDS, MONITOR_AUTOMATION_ITEM_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE, AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE, AUTOMATION_GATE_KEY_MESSAGES, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody;
-var init_chunk_7EGDXEYG = __esm({
-  "../../packages/core/dist/chunk-7EGDXEYG.js"() {
+var init_chunk_7PJOBY4O = __esm({
+  "../../packages/core/dist/chunk-7PJOBY4O.js"() {
     "use strict";
-    init_chunk_LDSABSRL();
+    init_chunk_CWUV6NL3();
     init_chunk_IBL7FANV();
     init_chunk_PFDZEKDE();
     init_chunk_HZ6CADSY();
@@ -9296,12 +9997,12 @@ var init_chunk_7EGDXEYG = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-3OWAWA5B.js
+// ../../packages/core/dist/chunk-CYBQP65X.js
 var conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody;
-var init_chunk_3OWAWA5B = __esm({
-  "../../packages/core/dist/chunk-3OWAWA5B.js"() {
+var init_chunk_CYBQP65X = __esm({
+  "../../packages/core/dist/chunk-CYBQP65X.js"() {
     "use strict";
-    init_chunk_7EGDXEYG();
+    init_chunk_7PJOBY4O();
     init_chunk_HZ6CADSY();
     init_chunk_DHPUPI4Y();
     init_zod();
@@ -9757,7 +10458,7 @@ var init_chunk_BPCNB5RT = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-ROS7PLDY.js
+// ../../packages/core/dist/chunk-NRJINQVD.js
 function idempotencyHeaderRefusal(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(value)) {
     return "idempotency_header must be a header name: letters, digits and dashes, at most 64";
@@ -9768,10 +10469,10 @@ function idempotencyHeaderRefusal(value) {
   return null;
 }
 var CATALOG_REPLAY, REPLAY_OVERRIDES, RESERVED_HEADERS;
-var init_chunk_ROS7PLDY = __esm({
-  "../../packages/core/dist/chunk-ROS7PLDY.js"() {
+var init_chunk_NRJINQVD = __esm({
+  "../../packages/core/dist/chunk-NRJINQVD.js"() {
     "use strict";
-    init_chunk_LDSABSRL();
+    init_chunk_CWUV6NL3();
     CATALOG_REPLAY = new Map(
       NATIVE_TOOLS.map((tool) => [tool.tool_name, tool.replay])
     );
@@ -10004,7 +10705,7 @@ var init_chunk_WEXVYJ5H = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-AFIQ3FEW.js
+// ../../packages/core/dist/chunk-QXHWCZ74.js
 function refineToolConfig(value, ctx) {
   const raw = value.tool_config;
   if (raw == null) return;
@@ -10040,10 +10741,10 @@ function refineToolConfig(value, ctx) {
   }
 }
 var toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, toolReplaySettingsFields, toolReplaySettingsSchema, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody;
-var init_chunk_AFIQ3FEW = __esm({
-  "../../packages/core/dist/chunk-AFIQ3FEW.js"() {
+var init_chunk_QXHWCZ74 = __esm({
+  "../../packages/core/dist/chunk-QXHWCZ74.js"() {
     "use strict";
-    init_chunk_ROS7PLDY();
+    init_chunk_NRJINQVD();
     init_chunk_WEXVYJ5H();
     init_chunk_HZ6CADSY();
     init_zod();
@@ -11415,7 +12116,7 @@ var init_chunk_6NI5RAM4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-NYIIBG23.js
+// ../../packages/core/dist/chunk-QJTHNMWD.js
 function refineHubAsCodeCustomTools(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -11951,12 +12652,12 @@ function refineHubAsCodeMonitorRulesOutput(config, ctx) {
   });
 }
 var MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
-var init_chunk_NYIIBG23 = __esm({
-  "../../packages/core/dist/chunk-NYIIBG23.js"() {
+var init_chunk_QJTHNMWD = __esm({
+  "../../packages/core/dist/chunk-QJTHNMWD.js"() {
     "use strict";
-    init_chunk_AFIQ3FEW();
+    init_chunk_QXHWCZ74();
     init_chunk_623SRYWZ();
-    init_chunk_7EGDXEYG();
+    init_chunk_7PJOBY4O();
     init_chunk_LBDH7LCG();
     init_chunk_4LXDRTO4();
     init_chunk_T4Q5COKJ();
@@ -12965,29 +13666,13 @@ var init_chunk_LQY2OCQL = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-F3JHI4Y4.js
-var DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, AUTOMATION_WEBHOOK_MOUNT;
-var init_chunk_F3JHI4Y4 = __esm({
-  "../../packages/core/dist/chunk-F3JHI4Y4.js"() {
-    "use strict";
-    DATA_PROXY_MOUNT = "/data";
-    DATA_PROXY_PREFIX = `/api${DATA_PROXY_MOUNT}`;
-    BASE_DESTRUCTION_MOUNT = "/bases";
-    BASE_DESTRUCTION_PREFIX = `/api${BASE_DESTRUCTION_MOUNT}`;
-    BASE_DESTRUCTION_CONFIRM_PATH = `${BASE_DESTRUCTION_PREFIX}/destruction/confirm`;
-    COMMUNITY_EMAIL_UNSUBSCRIBE_PATH = "/api/communities/email-unsubscribe";
-    CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH = "/api/contact-book/email-unsubscribe";
-    AUTOMATION_WEBHOOK_MOUNT = "/webhooks/automations";
-  }
-});
-
-// ../../packages/core/dist/chunk-GCKAPAPC.js
+// ../../packages/core/dist/chunk-UWFYCJCK.js
 var AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam;
-var init_chunk_GCKAPAPC = __esm({
-  "../../packages/core/dist/chunk-GCKAPAPC.js"() {
+var init_chunk_UWFYCJCK = __esm({
+  "../../packages/core/dist/chunk-UWFYCJCK.js"() {
     "use strict";
     init_chunk_LQY2OCQL();
-    init_chunk_7EGDXEYG();
+    init_chunk_7PJOBY4O();
     init_chunk_3HSB6J4J();
     init_chunk_F3JHI4Y4();
     init_chunk_DHPUPI4Y();
@@ -14232,28 +14917,29 @@ var init_chunk_TS4EYU3W = __esm({
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
+    init_chunk_FK6HBXM7();
+    init_chunk_VXEAR36B();
     init_chunk_TIZ57ZBA();
     init_chunk_Q7KIQHAZ();
     init_chunk_2U4BTOR7();
     init_chunk_IPXBFWUU();
     init_chunk_GK27ENTT();
     init_chunk_SXDX4GHS();
-    init_chunk_FK6HBXM7();
-    init_chunk_VXEAR36B();
+    init_chunk_GPM7PE44();
     init_chunk_DGKMMFIR();
     init_chunk_ZC6YGHNX();
     init_chunk_ACKF2MVU();
     init_chunk_Y7CFCYX4();
     init_chunk_5DGHIY7L();
-    init_chunk_BVQE66I2();
+    init_chunk_CGOLULK2();
+    init_chunk_4MRBBR5L();
     init_chunk_BEOHBREG();
     init_chunk_IPDOHAZ5();
-    init_chunk_GPM7PE44();
     init_chunk_YUZFHVB2();
     init_chunk_34LE6P7E();
     init_chunk_FPSDNS2E();
     init_chunk_ZXK6N2HN();
-    init_chunk_VOC3AGY4();
+    init_chunk_NTJMGSSO();
     init_chunk_C4HEZ7ZI();
     init_chunk_IR2NOSI3();
     init_chunk_EA23LSDS();
@@ -14261,12 +14947,12 @@ var init_contracts = __esm({
     init_chunk_LWMLR2WI();
     init_chunk_ACGAI25T();
     init_chunk_MH4O3YEX();
-    init_chunk_3OWAWA5B();
+    init_chunk_CYBQP65X();
     init_chunk_KSTYTQ7I();
     init_chunk_LKBSHANA();
     init_chunk_BPCNB5RT();
-    init_chunk_NYIIBG23();
-    init_chunk_AFIQ3FEW();
+    init_chunk_QJTHNMWD();
+    init_chunk_QXHWCZ74();
     init_chunk_623SRYWZ();
     init_chunk_JDJ4EUOL();
     init_chunk_3KYTITOR();
@@ -14276,9 +14962,9 @@ var init_contracts = __esm({
     init_chunk_YULHXJ5M();
     init_chunk_V4FRPRH5();
     init_chunk_ZHJEQBXJ();
-    init_chunk_GCKAPAPC();
+    init_chunk_UWFYCJCK();
     init_chunk_LQY2OCQL();
-    init_chunk_7EGDXEYG();
+    init_chunk_7PJOBY4O();
     init_chunk_3HSB6J4J();
     init_chunk_IG6QBZMA();
     init_chunk_ZJJ5ODOD();
@@ -14287,9 +14973,9 @@ var init_contracts = __esm({
     init_chunk_4LXDRTO4();
     init_chunk_E4DIIOOE();
     init_chunk_7CYHPF35();
-    init_chunk_FMXFEZN4();
-    init_chunk_ROS7PLDY();
-    init_chunk_LDSABSRL();
+    init_chunk_4MXPUC6I();
+    init_chunk_NRJINQVD();
+    init_chunk_CWUV6NL3();
     init_chunk_NVKU5PPQ();
     init_chunk_2FCLSQSQ();
     init_chunk_FECLIZTY();
@@ -14302,6 +14988,7 @@ var init_contracts = __esm({
     init_chunk_OMPT4ZHR();
     init_chunk_2PZIF56U();
     init_chunk_UEJOG2Q7();
+    init_chunk_IEWJ5MZH();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
     init_chunk_LZDVDC2S();
@@ -14709,6 +15396,61 @@ var init_api_client = __esm({
         }
         return new Uint8Array(await response.arrayBuffer());
       }
+      // ---- A preview hub's knowledge cut-over (`wayai knowledge cut-over`) ----
+      //
+      // The setup routes the web console writes through, so each write takes the same checks: the
+      // as-code push never sees a hub's copies of organization resources or their agent links.
+      async listAgents(hubId) {
+        const params = new URLSearchParams({ hub_id: hubId });
+        return this.request("GET", `/api/setup/agents?${params}`);
+      }
+      /** Patch an agent of a preview hub: the text it reads (`updateAgentBody` takes more). */
+      async updateAgent(hubId, agentId, patch) {
+        const params = new URLSearchParams({ hub_id: hubId });
+        await this.request("PATCH", `/api/setup/agents/${encodeURIComponent(agentId)}?${params}`, patch);
+      }
+      async listAgentResources(hubId, agentId) {
+        const params = new URLSearchParams({ hub_id: hubId, agent_id: agentId });
+        return this.request("GET", `/api/setup/resources/agent-resources?${params}`);
+      }
+      async updateAgentResource(body) {
+        return this.request("PATCH", "/api/setup/resources/agent-resources", body);
+      }
+      /** An agent's tools, and the native and connection tools it could add (`available_action: 'Add'`). */
+      async listAgentTools(hubId, agentId) {
+        const params = new URLSearchParams({ hub_id: hubId, agent_id: agentId });
+        return this.request("GET", `/api/setup/tools?${params}`);
+      }
+      async addNativeTool(hubId, agentId, toolNativeId) {
+        return this.request("POST", "/api/setup/tools/native", {
+          hub_id: hubId,
+          agent_id: agentId,
+          tool_native_id: toolNativeId
+        });
+      }
+      async addMcpTool(hubId, agentId, mcpToolId) {
+        return this.request("POST", "/api/setup/tools/mcp", { hub_id: hubId, agent_id: agentId, mcp_tool_id: mcpToolId });
+      }
+      async enableTool(hubId, agentId, toolId) {
+        const params = new URLSearchParams({ hub_id: hubId, agent_id: agentId });
+        await this.request("POST", `/api/setup/tools/${encodeURIComponent(toolId)}/enable?${params}`);
+      }
+      /** Add a token-holding connection (a Base Toolset's) to a preview hub; the answer lists the hub's connections. */
+      async addConnection(body) {
+        return this.request("POST", "/api/setup/connections", body);
+      }
+      async listAutomations(hubId) {
+        const params = new URLSearchParams({ hub_id: hubId });
+        return this.request("GET", `/api/automations?${params}`);
+      }
+      async updateAutomation(hubId, automationId, body) {
+        const params = new URLSearchParams({ hub_id: hubId });
+        await this.request("PATCH", `/api/automations/${encodeURIComponent(automationId)}?${params}`, body);
+      }
+      /** Record one knowledge resource's move into the org's knowledge base (#5142 step 4). */
+      async recordKnowledgeMove(body) {
+        return this.request("POST", "/api/setup/knowledge/moves", body);
+      }
       async me() {
         return this.request("GET", "/api/auth/me");
       }
@@ -15523,32 +16265,6 @@ var init_chunk_BF4WRSOQ = __esm({
 });
 
 // ../../packages/core/dist/index.js
-function matchPath(pattern, path42) {
-  const normalizedPath = path42.replace(/\/$/, "");
-  if (pattern.endsWith("/*")) {
-    const prefix = pattern.slice(0, -2);
-    return normalizedPath === prefix || normalizedPath.startsWith(prefix + "/");
-  }
-  return pattern === normalizedPath;
-}
-function getEndpointConfig(path42) {
-  for (const excluded of EXCLUDED_PATHS) {
-    if (matchPath(excluded, path42)) {
-      return null;
-    }
-  }
-  const normalizedPath = path42.replace(/\/$/, "");
-  if (!normalizedPath.endsWith("/*") && Object.prototype.hasOwnProperty.call(ENDPOINT_CONFIGS, normalizedPath)) {
-    return ENDPOINT_CONFIGS[normalizedPath];
-  }
-  const sortedPatterns = Object.keys(ENDPOINT_CONFIGS).sort((a, b) => b.length - a.length);
-  for (const pattern of sortedPatterns) {
-    if (matchPath(pattern, path42)) {
-      return ENDPOINT_CONFIGS[pattern];
-    }
-  }
-  return { tier: "STANDARD" };
-}
 function bytesToUuid(bytes) {
   const hex = [];
   for (let i = 0; i < 16; i++) hex.push(bytes[i].toString(16).padStart(2, "0"));
@@ -15596,10 +16312,11 @@ function markdownToPlainText(text) {
   result = result.replace(/^[-*_]{3,}$/gm, "");
   return result;
 }
-var ENDPOINT_CONFIGS, EXCLUDED_PATHS, UUID_RE2, WAYAI_WORKSPACE_LAYOUT;
+var UUID_RE2, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
+    init_chunk_IEWJ5MZH();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
     init_chunk_LZDVDC2S();
@@ -15624,465 +16341,6 @@ var init_dist = __esm({
     init_chunk_L5F7ZOUJ();
     init_chunk_TS4EYU3W();
     init_chunk_R7VSUKKX();
-    ENDPOINT_CONFIGS = {
-      // OAuth callbacks - strict, fail-closed (prevent brute force)
-      "/oauth/callback/*": { tier: "STRICT", failClosed: true },
-      // Auth endpoints - strict, fail-closed
-      "/auth/phone": { tier: "STRICT", failClosed: true },
-      "/auth/mcp/exchange": { tier: "MODERATE", failClosed: true },
-      // Native magic-code login (pre-auth) — STRICT per-IP bounds a single host; WorkOS owns
-      // the per-email lockout / TTL / single-use guarantees.
-      "/api/auth/magic-code/*": { tier: "STRICT", failClosed: true },
-      // Native password login (pre-auth) — same posture as magic-code above. STRICT per-IP bounds a
-      // single host but FAILS OPEN on a binding error (like every IP limit); the `failClosed` flag
-      // here is inert on a pre-auth route (it's only enforced on the per-user branch, which needs an
-      // authenticated caller). The fail-CLOSED brute-force guarantee for the static credential comes
-      // from the route's per-email caps (burst + cumulative hourly), not this flag.
-      "/api/auth/password/*": { tier: "STRICT", failClosed: true },
-      // Every `/api/*` group whose paths carry ids pins `userLimitKey` (gh #4756), held there by
-      // `security/endpoint-invariants.test.ts`.
-      // Billing - moderate, fail-closed with user limits
-      "/api/billing/*": {
-        tier: "MODERATE",
-        userLimit: 100,
-        failClosed: true,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/billing/*"
-      },
-      "/webhooks/stripe": { tier: "MODERATE", failClosed: true },
-      "/webhooks/workos": { tier: "MODERATE", failClosed: true },
-      // API endpoints - standard with user limits
-      // 500 because the web's settings live updates refetch per hub in every open tab, whatever page
-      // it shows (`settingsLiveUpdateStore.ts`): one batch of changes costs about 10 + 4 per agent
-      // whose tools were opened + 2 per loaded resource, so a CLI push and publish (both hubs) with
-      // two tabs open passes 150 in a minute. A multi-file resource upload adds 2–5 per file.
-      "/api/setup/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/setup/*"
-      },
-      // 500 because an eval run's drill-down (`SessionResults.tsx`) fetches its list and then every
-      // LLM turn's record at once: up to 201 requests (`OBSERVABILITY_LIST_CAP`, 200). Sending keeps
-      // the 150 it had when each path held its own budget, on the exact key below.
-      "/api/conversations/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/conversations/*"
-      },
-      "/api/conversations/send-message": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      "/api/users/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      "/api/analytics/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/analytics/*"
-      },
-      // 500 because `wayai eval-results --eval` reads completed sessions one by one, newest first,
-      // until one holds the eval (up to the 1000 the list returns). Tenant SQL keeps the 150 it had
-      // when each path held its own budget: each query may run 30 s on shared-tenant ClickHouse
-      // after its caller has gone (`sql-validator.ts`, stage 10b).
-      "/api/evals/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/evals/*"
-      },
-      "/api/evals/sql": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      // An eval run's calls (gh #4418), kept off the end user's call budgets below. Create keeps the
-      // 150 it had: it opens a provider session on the org's own key, billed per second. The routes
-      // on one call take a budget of their own so no eval read can spend it: a refused hang-up
-      // leaves the call running, and billing. 500 because a call suite polls each run's record
-      // every second, about 64 requests a minute per suite.
-      "/api/evals/calls": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      "/api/evals/calls/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/evals/calls/*"
-      },
-      "/api/files/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      // The org contact book (wayai#4931 PR 2b). A CSV import sends one request per
-      // `CONTACT_IMPORT_BATCH_MAX` rows, so 150 a minute imports 75,000 rows a minute.
-      "/api/contact-book/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/contact-book/*"
-      },
-      // An automation email's one-click unsubscribe (wayai#4931 PR 2d) — public: its token is its one
-      // credential, so this per-IP limit is its one bound, and runs before the route reads anything.
-      // MODERATE (30/min per IP), as the community email's unsubscribe, for the same reason: mail
-      // clients' one-click unsubscribe POSTs it from their own servers, which many recipients' clicks
-      // share. An exact key, so it wins over the wildcard above.
-      [CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
-      "/api/automations/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/automations/*"
-      },
-      // A hub's own contact lists (wayai#4931 PR 2c): config edits, at the automations' rate.
-      "/api/hub-contact-lists/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/hub-contact-lists/*"
-      },
-      "/api/message-templates/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/message-templates/*"
-      },
-      "/api/live-updates/*": { tier: "STANDARD", userLimit: 150, skipAuthenticatedUsers: true },
-      "/api/hub-users/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/hub-users/*"
-      },
-      "/api/conversation-state/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/conversation-state/*"
-      },
-      // The authenticated byte route (`routes/files/r2.ts`), mounted after its `authMiddleware` so
-      // the caller is known: each request reads the HubDO its key names, and a hub id never created
-      // still wakes a Durable Object (gh #4747; since gh #4775 T5 one that writes nothing). The key is pinned
-      // because the paths are file keys, which would otherwise each get a fresh budget (and one
-      // over 256 characters would be refused outright, `checkUserLimitNative`).
-      //
-      // 500 a minute because the web chat fetches every attachment of every loaded message at
-      // once, with no list virtualization: up to 50 per 50-message page, 200 per ended
-      // conversation or history entry at one file per message, and 4 per message at most in its
-      // image grid. Repeats come from the browser's HTTP cache (`private, max-age=3600`); mobile
-      // renders through a disk cache and plays audio from `/files/signed`. The budget is shared by
-      // a caller's tabs and devices. The other two byte routes, `/files/signed/*` and
-      // `/files/public/*`, mount no limiter (the reason is at their entries in
-      // `security/endpoint-invariants.test.ts`'s route registry).
-      "/files/auth/*": {
-        tier: "STANDARD",
-        userLimit: 500,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/files/auth/*"
-      },
-      // Channel webhooks - high throughput (external systems, never authenticated)
-      "/webhooks/whatsapp/*": { tier: "HIGH" },
-      "/webhooks/instagram/*": { tier: "HIGH" },
-      // An automation's webhook deliveries (wayai#4931 D13) — no bearer token: the automation's
-      // secret is the credential, checked against one HubDO read. This per-IP limit runs first, before
-      // anything is read. HIGH, as the channel webhooks: senders are servers, and an integration
-      // platform's egress addresses carry many tenants' deliveries. The per-automation budget is
-      // `AUTOMATION_WEBHOOK_PER_AUTOMATION_LIMIT`, counted after the delivery is verified.
-      [`${AUTOMATION_WEBHOOK_MOUNT}/*`]: { tier: "HIGH" },
-      // Reports (CLI → platform_report triage queue). One per-user budget covers intake
-      // (POST), the content edit (PATCH /:id), the reporter read-back (GET, GET /:id), and the
-      // verification loop (POST /:id/accept, /:id/contest). The limiter is path-based, so a
-      // method-level split (loose reads, strict writes) isn't expressible — GET /:id and PATCH
-      // /:id share a path. So the budget is sized for the read-heavy poll loop (a reporter agent
-      // polling `report get`/`list` while it waits for the fix), at 60/hour. Intake-flooding stays
-      // bounded regardless: identical reports collapse on `fingerprint` (ON CONFLICT DO NOTHING),
-      // so a runaway create loop merges rather than floods. Still STRICT tier + failClosed so a
-      // genuinely runaway distinct-report loop surfaces as 429. The `/*` is load-bearing — an
-      // exact `/api/reports` key would leave the `/:id` paths unmatched (→ unthrottled).
-      // `userLimitKey` is equally load-bearing: without it, middleware falls back to each request's
-      // path and report IDs/actions receive independent counters instead of this shared budget.
-      "/api/reports/*": {
-        tier: "STRICT",
-        userLimit: 60,
-        userWindow: 3600,
-        failClosed: true,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/reports/*"
-      },
-      // Admin report mutations (transition/group/ungroup/edit) — platform-admin
-      // gated at the route, rate-limited here as defense-in-depth. Generous STANDARD
-      // cap so legitimate triage bursts aren't throttled (grouping is one request
-      // even for many members); deliberately NOT failClosed so a Redis blip never
-      // blocks an admin's triage. The bare GET reads share this budget harmlessly.
-      "/api/admin/reports/*": { tier: "STANDARD", userLimit: 150, userLimitKey: "/api/admin/reports/*" },
-      // GitHub webhook (issues.closed → platform_report addressed). MODERATE +
-      // fail-closed; GitHub retries on transient failures so a brief Redis blip
-      // doesn't lose state.
-      "/webhooks/github": { tier: "MODERATE", failClosed: true },
-      // Account deletion — strict on the destructive POST + public undo. The
-      // /api/users/* default tier above ALSO matches these, but `getEndpointConfig`
-      // returns the longest-prefix match, so the more specific entries here win.
-      // `skipAuthenticatedUsers` deliberately omitted: every caller is authenticated,
-      // so including it would make `userLimit` a no-op — the per-user cap IS the gate.
-      "/api/users/me/deletion": { tier: "STRICT", userLimit: 3, userWindow: 3600, failClosed: true },
-      "/api/users/me/deletion/preflight": { tier: "STANDARD", userLimit: 30, failClosed: true },
-      "/api/users/deletion/undo": { tier: "STRICT", failClosed: true },
-      // Production-base destruction.
-      //
-      // Keyed off the CONTRACT constants, not literals: `BASE_DESTRUCTION_CONFIRM_PATH`'s own
-      // docstring promises that the mount, the `AUTH_BYPASS_PATHS` entry, the rate-limit key and
-      // the URL the email embeds move together, and a literal here is exactly how that promise
-      // goes quietly false — leaving an unauthenticated HMAC endpoint on the default tier.
-      //
-      // The emailed GET is PUBLIC, so it gets the IP-tier bound the pre-auth routes get.
-      // `failClosed` is deliberately NOT set: it is only consulted on the per-USER branch, which
-      // needs an authenticated caller, so on a pre-auth route it is inert — the same thing
-      // `/api/auth/magic-code/send` above says about itself. The IP limiter fails OPEN on a
-      // limiter error by design (`packages/runtime/src/rate-limiter.ts`), and claiming otherwise
-      // would tell the next auditor a protection exists that does not.
-      [BASE_DESTRUCTION_CONFIRM_PATH]: { tier: "STRICT" },
-      // The console's read, which every production base's settings pane issues on mount. Without
-      // its own entry it inherits the mount-wide budget below, and an admin clicking through
-      // thirty bases in an hour would be 429'd by a limit sized for irreversible writes.
-      [`${BASE_DESTRUCTION_PREFIX}/destructions`]: { tier: "STANDARD", userLimit: 150 },
-      // The mutating routes: initiate, the authenticated confirm, and cancel. Per user rather than
-      // per IP — all three are authenticated and org-admin gated — and hourly, since a single human
-      // touching thirty production-deletion operations in an hour is already far past normal.
-      // Longest-prefix wins, so the two entries above are not widened by this one. The key is
-      // pinned so those thirty are counted across every base the caller touches (gh #4756).
-      [`${BASE_DESTRUCTION_PREFIX}/*`]: {
-        tier: "STANDARD",
-        userLimit: 30,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: `${BASE_DESTRUCTION_PREFIX}/*`
-      },
-      // Email-invite preview — public, fail-closed. MODERATE (30/min IP) leaves
-      // headroom for the signup-page server-fetch + reloads + prefetches; STRICT
-      // would throttle legitimate users opening the link in multiple tabs.
-      "/api/invites/preview": { tier: "MODERATE", failClosed: true },
-      // "Don't email me again" (gh #4661) — public; one POST per click on its confirm page. STRICT
-      // per IP. No `failClosed`: it is consulted only on the per-user branch, which a pre-auth route
-      // never reaches (see `BASE_DESTRUCTION_CONFIRM_PATH` above).
-      "/api/invites/unsubscribe": { tier: "STRICT" },
-      // Admin DO debug reads — the ONE deliberate deviation from the Data Explorer
-      // catch-all below, and the only reason a per-route key still exists here.
-      // Platform-admin is enforced at the route; this is the independent
-      // defense-in-depth signal so a runaway investigation script surfaces as 429.
-      //
-      // STRICT is kept ON PURPOSE even though the catch-all moved off it: per IP, at 5/min vs
-      // STANDARD's 100/min, walking 10k ids takes ~33h instead of ~100min — a detection window
-      // worth keeping on the routes that return RAW DO ROWS.
-      //
-      // The cost, stated rather than elided: STRICT is one bucket shared with
-      // `/oauth/callback/*` and `/api/auth/magic-code/*`, so a debug session from a
-      // NAT'd office IP can 429 a colleague's login for up to a minute. That trade is
-      // accepted for a rare, deliberate investigation surface — and is exactly why the
-      // browse routes below are NOT here.
-      //
-      // The key is pinned, so a sweep of `/debug/do/hub/<id>/tables` across ids spends one
-      // per-admin budget (gh #4756). 120 an hour: an agent's investigation of a dozen
-      // conversations made 37 debug reads in its busiest hour.
-      "/api/admin/data-explorer/debug/*": {
-        tier: "STRICT",
-        userLimit: 120,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: "/api/admin/data-explorer/debug/*"
-      },
-      // Catch-all for the rest of the Data Explorer (`/search`, `/entity/*`, `/do/*`,
-      // `/kv/*`, the DELETE routes). Added as a catch-all rather than another per-route
-      // key because this budget kept lagging behind routes joining the debug boundary:
-      // with no match the path falls to the default, which sets no `userLimit`, so the
-      // per-user layer never runs at all. `getEndpointConfig` takes the longest match,
-      // so `debug/*` above still wins.
-      //
-      // `/entity/*` deliberately has NO key of its own: it needs precisely this config,
-      // and a duplicate entry is how the two drift apart on the next edit.
-      //
-      // `tier` is deliberately STANDARD, not STRICT. `tier` is the per-IP knob and
-      // STRICT is 5/min keyed on IP ALONE — one bucket shared across every STRICT
-      // endpoint. On these browse routes that breaks the console (open Browse KV and
-      // inspect four values = 6 requests; expand six org rows in the search results =
-      // 6 `/entity/org/:id` calls) and would drain the same IP's budget for
-      // `/oauth/callback/*` and `/api/auth/magic-code/*`, which on a NAT'd office IP
-      // means all admins. The per-user hourly cap is the leg that matters here.
-      //
-      // The canonical key is deliberate: request paths contain DO ids and arbitrary
-      // malformed requests can contain credential material. Keying on the request path
-      // both stores that material in Redis/logs and gives every target a fresh counter.
-      // One stable identity makes every browse request consume the same per-admin
-      // budget without storing request targets.
-      //
-      // 600/hour preserves the original pagination requirement (about 30k rows at
-      // 50/page) while now genuinely bounding id/key enumeration across the surface.
-      "/api/admin/data-explorer/*": {
-        tier: "STANDARD",
-        userLimit: 600,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: "/api/admin/data-explorer/*"
-      },
-      // Admin harness incident-response (harness-agents PR 2.9b) — mass-destroy reaps
-      // EVERY live harness session/token/slot in scope, so it gets a strict budget
-      // (STRICT + a low per-user hourly cap + fail-closed). Platform-admin is enforced
-      // at the route; this is the independent defense-in-depth signal so a runaway
-      // reap loop surfaces as 429. The break-glass disable/enable rides through
-      // `/api/admin/config` (its own STANDARD budget), not this key.
-      "/api/admin/harness/*": {
-        tier: "STRICT",
-        userLimit: 10,
-        userWindow: 3600,
-        failClosed: true,
-        userLimitKey: "/api/admin/harness/*"
-      },
-      // Platform-wide team-orphan repair — a single call can WRITE across every hub of
-      // every org (HubDO purge + UserDO mirror fan-out), so it gets the same strict,
-      // fail-closed budget as the other cross-platform admin write. Exact path (not a
-      // prefix): the sibling `/api/admin/hubs/:hubId/harness` flag flips stay on the
-      // default admin budget. Platform-admin is enforced at the route; this is the
-      // defense-in-depth signal that a repair loop surfaces as 429.
-      "/api/admin/hubs/repair-team-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
-      // Branching-orphan repair (#4577) — deletes named production rows, and its report mode
-      // fans out over every production hub of every org, so it takes the same strict,
-      // fail-closed budget as the team-orphan repair. Exact path, for the same reason.
-      "/api/admin/hubs/repair-branching-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
-      // CI/GitOps endpoints - standard with user limits. 500 because `wayai push` makes four requests
-      // (pull, diff, push, pull) and a GitOps job may push every hub at once with one token; when
-      // each path held its own 100, that ran to 100 hubs a minute.
-      "/api/ci/*": { tier: "STANDARD", userLimit: 500, skipAuthenticatedUsers: true, userLimitKey: "/api/ci/*" },
-      // Attested `/v1` proxy onto the Rekor Worker. `userLimitKey` is load-bearing here: the
-      // per-user budget defaults to the full request path, and this surface's paths carry base,
-      // record, and file ids — so without a pinned key every distinct resource would get its own
-      // fresh budget and the per-user limit would bound nothing. One shared budget across the
-      // whole data surface is the intent.
-      [`${DATA_PROXY_PREFIX}/*`]: {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: `${DATA_PROXY_PREFIX}/*`
-      },
-      // Voice calls — the end user's call routes (`routes/api/calls`). Every caller is signed
-      // in, so the per-IP tier is skipped for them: Brazilian mobile carriers put many callers
-      // behind one IP, and a shared bucket would refuse one caller for another's traffic.
-      //
-      // Create is the only route that spends: it opens a provider session on the org's own
-      // key, billed per second. So it takes its own exact key and an hourly per-user cap, which
-      // lives on Redis and is fail-closed like the other hourly caps. The exact key wins over
-      // the wildcard below, which also matches `/api/calls` (see `getEndpointConfig`).
-      "/api/calls": {
-        tier: "STANDARD",
-        userLimit: 30,
-        userWindow: 3600,
-        failClosed: true,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/calls"
-      },
-      // The routes on one call: `ready`, hang-up, the delegation report and the status read; and
-      // the opening read (`/api/calls/openings/:language`), one per call, before it exists.
-      // NEVER fail-closed: a refused hang-up leaves the call running, and billing, until a
-      // limit ends it. The 60 s budget runs on the native binding, which fails open. The key is
-      // pinned because the paths carry the call id, which would otherwise give every call a
-      // fresh budget.
-      "/api/calls/*": {
-        tier: "STANDARD",
-        userLimit: 150,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/calls/*"
-      },
-      // Contacts between accounts (gh #4661, `routes/api/contacts`). Every caller is signed in, so
-      // the per-IP tier is skipped. The keys are pinned because the paths carry user and invite
-      // ids, which would otherwise give each id a fresh budget. Blocks take their own, lower
-      // budget (#4661 Limits: blocks are rate-limited). The invites-per-day cap and every list
-      // cap are counted in the caller's UserDO, in the same write they bound, not here.
-      "/api/contacts/*": {
-        tier: "STANDARD",
-        userLimit: 60,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/contacts/*"
-      },
-      "/api/contacts/blocks/*": {
-        tier: "STANDARD",
-        userLimit: 30,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/contacts/blocks/*"
-      },
-      // Person-to-person threads (gh #4661, `routes/api/threads`): the per-user send limit, 60 a
-      // minute on the native binding. Every thread route shares the one budget, reads included:
-      // the paths carry thread and message ids, so the key is pinned, and a pattern here cannot
-      // tell a send from a read of the same path. Like every 60 s budget it fails open on a
-      // binding error, so it bounds sends in the steady state only.
-      "/api/threads/*": {
-        tier: "STANDARD",
-        userLimit: 60,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/threads/*"
-      },
-      // An org admin's erasure of one person's thread messages (gh #4661 owner decision 7): any user
-      // can own a free org, so each request arms that org's alarm, and this caps how fast one person
-      // can ask. The org's own daily cap (`PEOPLE_ORG_ERASURES_PER_DAY`, counted in its OrgDO in the
-      // write it bounds) is the fail-closed bound; this budget, on the native binding, fails open.
-      "/api/threads/org-erasures": {
-        tier: "STANDARD",
-        userLimit: 10,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/threads/org-erasures"
-      },
-      // A person's report of a message, thread or person (`people-reports.ts`): each one written
-      // arms the PlatformDO's alarm and emails the platform admins, so it takes its own, lower
-      // budget. The reporter's daily cap (`PEOPLE_REPORTS_PER_DAY`, counted in the report store in
-      // the write it bounds) is the fail-closed bound; this budget, on the native binding, fails open.
-      "/api/threads/reports": {
-        tier: "STANDARD",
-        userLimit: 10,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/threads/reports"
-      },
-      // Communities (gh #4872, `routes/api/communities`): every signed-in route under the mount (the
-      // preview below excepted) shares one per-user budget, which is also each member's send limit and
-      // bounds the reads that scan a community's rows (a title search, the stats); a community's own
-      // limits (its rate, the daily caps, slow mode) are counted in its CommunityDO, in the write they
-      // bound. Every caller is signed in, so the per-IP tier is skipped; the key is pinned because the
-      // paths carry community, room and message ids.
-      "/api/communities/*": {
-        tier: "STANDARD",
-        userLimit: 60,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/communities/*"
-      },
-      // The join page's preview of a link — public, fetched from the visitor's browser, so this
-      // per-IP limit is its one bound and runs before the route reads anything (#4872
-      // owner-delegated decision 9). MODERATE (30/min per IP) leaves room for reloads and several
-      // tabs. An exact key, so it wins over the wildcard above.
-      "/api/communities/join-preview": { tier: "MODERATE" },
-      // An announcement email's unsubscribe (#4872 PR 8a) — public: its token is its one credential, so
-      // this per-IP limit is its one bound, and runs before the route reads anything. MODERATE (30/min
-      // per IP), not STRICT: mail clients' one-click unsubscribe POSTs it from their own servers, which
-      // many members' clicks share, and STRICT's 5/min bucket is shared with sign-in. An exact key, so
-      // it wins over the wildcard above.
-      [COMMUNITY_EMAIL_UNSUBSCRIBE_PATH]: { tier: "MODERATE" },
-      // The WayAI Guide's help entry (wayai#4948, `routes/api/guide.ts`): one POST per click by a viewer
-      // the snapshot does not show enrolled, which reads the person's row on the Guide hub and writes only
-      // what is missing (an enrolled viewer's click opens the hub without a request). Every caller is
-      // signed in, so the per-IP tier is skipped; 10 a minute per person on the native binding (fails
-      // open, like every 60 s budget) bounds what a looping client costs the one Guide HubDO.
-      "/api/guide/access": {
-        tier: "STANDARD",
-        userLimit: 10,
-        skipAuthenticatedUsers: true,
-        userLimitKey: "/api/guide/access"
-      },
-      // App channel - high throughput with user limits
-      "/channels/app/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
-      // API channel (api-channel-connector) - machine-to-machine, high throughput
-      "/channels/api/*": { tier: "HIGH", userLimit: 500, skipAuthenticatedUsers: true },
-      // System/scheduled - high throughput (internal)
-      "/channels/system/*": { tier: "HIGH", skipAuthenticatedUsers: true },
-      "/scheduled/*": { tier: "HIGH", skipAuthenticatedUsers: true },
-      // WebSocket - standard with user limit to prevent connection spam
-      "/live-updates/ws": { tier: "STANDARD", userLimit: 100, failClosed: true },
-      // A community's live socket (gh #4872 PR 5, `GET /communities/:communityId/live`): outside
-      // `/api/*`, with no bearer token, so its per-IP tier is its one bound before the CommunityDO
-      // checks the ticket. STANDARD, as `/live-updates/ws`: a client opens one per community it shows
-      // and reconnects within the hour.
-      "/communities/*": { tier: "STANDARD" },
-      // WS ticket mint - per-user 60/min accommodates aggressive reconnect patterns
-      // without opening abuse vectors; fail-closed so Redis outages don't let
-      // runaway clients mint unbounded tickets.
-      "/api/auth/ws-ticket": { tier: "MODERATE", userLimit: 60, failClosed: true, skipAuthenticatedUsers: true },
-      "/api/auth/session-check": { tier: "STANDARD", userLimit: 120, skipAuthenticatedUsers: true },
-      "/api/auth/logout": { tier: "MODERATE", userLimit: 10, failClosed: true, skipAuthenticatedUsers: true }
-    };
-    EXCLUDED_PATHS = /* @__PURE__ */ new Set(["/health"]);
     UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     WAYAI_WORKSPACE_LAYOUT = {
       /** Product-namespaced root dir at the git root. */
@@ -33235,7 +33493,7 @@ token (\`wayai login --token\`, or WAYAI_TOKEN) is refused.
 var init_rekor_toolset = __esm({
   "../../packages/core/dist/contracts/rekor-toolset.js"() {
     "use strict";
-    init_chunk_BVQE66I2();
+    init_chunk_4MRBBR5L();
     init_chunk_BEOHBREG();
     init_chunk_DHPUPI4Y();
   }
@@ -33450,6 +33708,12 @@ var init_resource_paths = __esm({
 });
 
 // src/knowledge/source.ts
+function orgSourceKey(orgResourceId) {
+  return `organization resource ${orgResourceId}`;
+}
+function hubSourceKey(productionHubId, resourceId) {
+  return `hub ${productionHubId} resource ${resourceId}`;
+}
 function movesFromOrg(resource) {
   return resource.resource_type === "knowledge";
 }
@@ -33499,7 +33763,7 @@ function orgSources(resources, rows) {
       skill_name: r.skill_name,
       resource_type: r.resource_type,
       created_at: r.created_at,
-      sourceKey: `organization resource ${r.org_resource_id}`,
+      sourceKey: orgSourceKey(r.org_resource_id),
       description: r.resource_description ?? "",
       folderSchema: r.folder_metadata_schema,
       fileSchema: r.file_metadata_schema,
@@ -33548,7 +33812,7 @@ function hubSources(hubId, resources, rows) {
       skill_name: r.skill_name,
       resource_type: r.resource_type,
       created_at: r.created_at,
-      sourceKey: `hub ${hubId} resource ${r.resource_id}`,
+      sourceKey: hubSourceKey(hubId, r.resource_id),
       description: r.resource_description ?? "",
       folderSchema: r.folder_metadata_schema,
       fileSchema: r.file_metadata_schema,
@@ -33619,7 +33883,10 @@ function orgFileTypeId(resource) {
   return resource.slug;
 }
 function hubFileTypeId(hubSlug, resource) {
-  return `${hubSlug}--${resource.slug}`;
+  return `${hubSlug}${HUB_PART_SEPARATOR}${resource.slug}`;
+}
+function hubPartOf(fileTypeId) {
+  return fileTypeId.split(HUB_PART_SEPARATOR)[0];
 }
 function toolAlias(id) {
   const hash = createHash5("sha256").update(id).digest("hex").slice(0, 6);
@@ -34158,7 +34425,7 @@ function describeSkip(skip) {
       return `${skip.fileType}: folder "${skip.folder}" has a description but no path, so it gets no ${INDEX_FILE}.`;
   }
 }
-var MAX_TOOL_BASE_LENGTH, INDEX_FILE, PROVENANCE_PREFIX, MAX_NAME_LENGTH3, MAX_PATH_LENGTH, TITLE_SCHEMA, TAGS_SCHEMA, MAX_NOTE_VALUES, DEFINITION_KEYS, DRAFT, MAX_PATTERNED_VALUE_LENGTH, SUBSCHEMA_KEYS, SUBSCHEMA_MAP_KEYS;
+var MAX_TOOL_BASE_LENGTH, INDEX_FILE, PROVENANCE_PREFIX, MAX_NAME_LENGTH3, MAX_PATH_LENGTH, TITLE_SCHEMA, TAGS_SCHEMA, MAX_NOTE_VALUES, HUB_PART_SEPARATOR, DEFINITION_KEYS, DRAFT, MAX_PATTERNED_VALUE_LENGTH, SUBSCHEMA_KEYS, SUBSCHEMA_MAP_KEYS;
 var init_plan = __esm({
   "src/knowledge/plan.ts"() {
     "use strict";
@@ -34173,6 +34440,7 @@ var init_plan = __esm({
     TITLE_SCHEMA = { type: "string" };
     TAGS_SCHEMA = { type: "array", items: { type: "string" } };
     MAX_NOTE_VALUES = 3;
+    HUB_PART_SEPARATOR = "--";
     DEFINITION_KEYS = ["$defs", "definitions"];
     DRAFT = "2020-12";
     MAX_PATTERNED_VALUE_LENGTH = 1024;
@@ -34200,7 +34468,10 @@ var init_plan = __esm({
 
 // src/knowledge/migrate.ts
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
-async function resolveBases(kb, baseId2) {
+function refreshPreviewCommand(orgId, base) {
+  return `wayai knowledge refresh-preview --org ${orgId} --base ${safe(base)}`;
+}
+async function resolveBases(kb, baseId2, orgId) {
   const base = await kb.getBase(baseId2);
   if (!base || base.deleted) throw expected(`Base "${safe(baseId2)}" not found in this organization.`);
   if (base.environment === "preview") {
@@ -34220,7 +34491,7 @@ async function resolveBases(kb, baseId2) {
   }
   if (previews.length !== 1) {
     throw expected(
-      previews.length === 0 ? `Base "${safe(baseId2)}" has no preview to write its file types in. Create one with \`wayai bases create-preview ${safe(baseId2)} --name <name>\`.` : `Base "${safe(baseId2)}" has ${previews.length} previews (${previews.map(safe).join(", ")}). Pass the one to write its file types in as --base.`
+      previews.length === 0 ? `Base "${safe(baseId2)}" has no preview. Create one with \`wayai bases create-preview ${safe(baseId2)} --name <name>\`, then copy production's files into it with \`${refreshPreviewCommand(orgId, baseId2)}\`.` : `Base "${safe(baseId2)}" has ${previews.length} previews (${previews.map(safe).join(", ")}). Pass the one to use as --base.`
     );
   }
   return { production: base.id, preview: previews[0] };
@@ -34277,17 +34548,17 @@ function sameFileType(remote, spec) {
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function promotionProblems(result, ids) {
+function promotionProblems(result, ids, section = "file_types") {
   const answer = isObject(result) ? result : {};
   const problems2 = [];
-  for (const [section, bucket2] of Object.entries(isObject(answer.diff) ? answer.diff : {})) {
+  for (const [kind, bucket2] of Object.entries(isObject(answer.diff) ? answer.diff : {})) {
     if (!isObject(bucket2)) continue;
     for (const change of ["added", "modified", "removed"]) {
       for (const entry of Array.isArray(bucket2[change]) ? bucket2[change] : []) {
         const row = isObject(entry) ? isObject(entry.after) ? entry.after : entry : {};
         const id = typeof row.id === "string" ? row.id : JSON.stringify(row).slice(0, 80);
-        if (section === "file_types" && change !== "removed" && ids.has(id)) continue;
-        problems2.push(`it would also apply ${section} ${change}: "${id}"`);
+        if (kind === section && change !== "removed" && ids.has(id)) continue;
+        problems2.push(`it would also apply ${kind} ${change}: "${id}"`);
       }
     }
   }
@@ -34326,7 +34597,7 @@ function printNotes(io, notes) {
   }
 }
 async function migrateKnowledge(reader, kb, opts, io) {
-  const { production: productionId, preview } = await resolveBases(kb, opts.base);
+  const { production: productionId, preview } = await resolveBases(kb, opts.base, opts.orgId);
   const hubs = opts.hubId === void 0 ? [] : await reader.listHubs();
   const hub = opts.hubId === void 0 ? void 0 : productionHub(hubs, opts.hubId);
   const production = await Production.read(kb, productionId);
@@ -34465,7 +34736,7 @@ Dry run: nothing written (${writes === 0 ? "nothing to write" : `${writes} write
   for (const file of creates) await kb.putFile(productionId, file, await bodyBytes(reader, file));
   io.log(
     `
-Done: ${toWrite.length} file type(s) written, ${toPromote.length} promoted, ${creates.length} file(s) written. The preview holds none of these files.`
+Done: ${toWrite.length} file type(s) written, ${toPromote.length} promoted, ${creates.length} file(s) written. The preview holds none of these files: copy them with \`${refreshPreviewCommand(opts.orgId, opts.base)}\`.`
   );
   return { ...result, written: true };
 }
@@ -34556,6 +34827,253 @@ var init_headers = __esm({
   }
 });
 
+// src/data/commands/tokens.ts
+import { Command } from "commander";
+function rawTokenFrom(data) {
+  const token = typeof data === "object" && data !== null && "token" in data ? data.token : void 0;
+  if (typeof token !== "string" || !RAW_TOKEN_PATTERN.test(token)) {
+    throw new Error("Token creation response did not contain a valid rec_ token");
+  }
+  return token;
+}
+function addTokenLifecycleOptions(cmd) {
+  return cmd.option("--expires-at <date>", "Expiration date (ISO 8601, e.g. 2026-06-01T00:00:00Z)").option(
+    "--ttl <duration>",
+    "Relative expiry, e.g. 10m, 2h, 7d (use for disposable probe/test tokens)"
+  ).option(
+    "--description <text>",
+    'What holds this token (e.g. "behind credential X"); shown in list and revoke warnings'
+  ).addHelpText("after", TOKEN_OUTPUT_HELP);
+}
+function tokenCreationOutput(cmd, opts) {
+  return opts.tokenOnly ? "token" : outputFormat(cmd);
+}
+function printCreatedToken(data, output) {
+  if (output !== "token") {
+    printOutput(data, output);
+    return;
+  }
+  console.log(rawTokenFrom(data));
+}
+function resolveExpiresAt(opts) {
+  if (opts.ttl && opts.expiresAt) {
+    throw expected("--ttl and --expires-at are mutually exclusive \u2014 pass one.");
+  }
+  if (opts.ttl) return new Date(Date.now() + parseDuration(opts.ttl, "--ttl")).toISOString();
+  return opts.expiresAt;
+}
+function applyTokenLifecycleOpts(body, opts) {
+  const expiresAt = resolveExpiresAt(opts);
+  if (expiresAt) body.expires_at = expiresAt;
+  if (opts.description) body.description = opts.description;
+}
+function listAllTokens(client) {
+  return client.collectPages(
+    (cursor) => `/v1/tokens?limit=${TOKEN_LIST_PAGE_LIMIT}${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`
+  );
+}
+function pruneRow(t, reason) {
+  return {
+    token_id: t.token_id,
+    name: t.name,
+    reason,
+    last_used: t.last_used_at ?? "never"
+  };
+}
+function buildBasesTokensCommand() {
+  const tokens2 = new Command("tokens").description("Manage API tokens");
+  addTokenLifecycleOptions(
+    tokens2.command("create").description("Create a scoped API token").requiredOption("--name <name>", "Token name").requiredOption("--grants <json>", "Grant definitions as JSON array").option(
+      "--token-only",
+      "Print only the raw rec_ token for secure command substitution (shown once)"
+    )
+  ).action(async function(opts) {
+    const grants = parseData(opts.grants, "--grants");
+    const body = { name: opts.name, grants };
+    applyTokenLifecycleOpts(body, opts);
+    const client = await createDataClient();
+    const data = await client.request("POST", "/v1/tokens", body);
+    printCreatedToken(data, tokenCreationOutput(this, opts));
+  });
+  addTokenLifecycleOptions(
+    // The only token verb that addresses a base, so it alone declares `--base`.
+    // Putting it on the `tokens` group would advertise a flag that does nothing
+    // on `list`, `revoke` and `prune` — the defect `withBaseOption` exists to
+    // avoid.
+    withBaseOption(tokens2.command("create-for-toolset <slug>")).description(
+      "Create a toolset-bound (consumer) token whose authorization IS the toolset tool surface \u2014 it can call exactly the tools that toolset exposes (those record types + operations, relationships, batch, and sql only if enabled) and nothing else. Binds to the configured --base."
+    ).option("--name <name>", 'Token name (default: "<slug> consumer")').option(
+      "--token-only",
+      "Print only the raw rec_ token for secure command substitution (shown once)"
+    )
+  ).action(async function(slug, opts) {
+    const base = requireBase(this);
+    const body = {
+      name: opts.name ?? `${slug} consumer`,
+      toolset_binding: { base_id: base, toolset_id: slug }
+    };
+    applyTokenLifecycleOpts(body, opts);
+    const client = await createDataClient();
+    const data = await client.request("POST", "/v1/tokens", body);
+    const output = tokenCreationOutput(this, opts);
+    printCreatedToken(data, output);
+    if (output === "table") {
+      console.log(`
+MCP URL: ${toolsetMcpUrl(slug)}`);
+    }
+  });
+  tokens2.command("list").description("List API tokens (status, last_used_at, expires_at, description)").action(async function() {
+    const client = await createDataClient();
+    printOutput(await listAllTokens(client), outputFormat(this));
+  });
+  tokens2.command("revoke <token_id>").description(
+    "Revoke an API token (permanent). A recently-used or toolset-bound token requires --force."
+  ).option("--force", "Revoke even if the token appears to be in live use").action(async function(tokenId, opts) {
+    const client = await createDataClient();
+    const id = pathSegment(tokenId, "token id");
+    const path42 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
+    const format = outputFormat(this);
+    const revoked = (forced) => printOutput({ token_id: tokenId, revoked: true, forced }, format);
+    if (opts.force) {
+      await client.request("DELETE", path42(true));
+      revoked(true);
+      return;
+    }
+    try {
+      await client.request("DELETE", path42(false));
+      revoked(false);
+    } catch (err) {
+      if (!(err instanceof ApiError) || err.status !== 409 || dataErrorDetails(err)?.requires_force !== true) {
+        throw err;
+      }
+      console.error(err.message);
+      if (!isInteractive()) {
+        console.error("\nRe-run with --force to revoke anyway.");
+        return process.exit(1);
+      }
+      if (!await confirm("Revoke anyway?")) {
+        console.error("Aborted.");
+        return process.exit(1);
+      }
+      await client.request("DELETE", path42(true));
+      revoked(true);
+    }
+  });
+  tokens2.command("prune").description(
+    "Revoke stale tokens, selected by staleness only (expired, or unused past --unused-since) \u2014 never by name. Previews by default; revoking requires --yes or an interactive confirmation."
+  ).option(
+    "--unused-since <duration>",
+    "Also prune tokens with no activity for this long (e.g. 30d). Skips toolset-bound and legacy usage-untracked tokens."
+  ).option("--include-bound", "Allow pruning stale toolset-bound (consumer) tokens").option("-y, --yes", "Revoke without prompting (required when non-interactive)").action(async function(opts) {
+    const staleMs = opts.unusedSince ? parseDuration(opts.unusedSince, "--unused-since") : void 0;
+    const client = await createDataClient();
+    const allTokens = await listAllTokens(client);
+    const now = Date.now();
+    const targets = [];
+    const skipped = [];
+    for (const t of allTokens) {
+      const expired = t.status ? t.status === "expired" : !!t.expires_at && Date.parse(t.expires_at) <= now;
+      if (expired) {
+        targets.push(pruneRow(t, "expired"));
+        continue;
+      }
+      if (staleMs === void 0) continue;
+      const lastActivity = Date.parse(t.last_used_at ?? t.created_at);
+      if (!(now - lastActivity > staleMs)) continue;
+      if (t.usage_tracked !== true) {
+        skipped.push(
+          pruneRow(
+            t,
+            "usage untracked (legacy token) \u2014 revoke individually if truly unused"
+          )
+        );
+      } else if (t.toolset_binding && !opts.includeBound) {
+        skipped.push(
+          pruneRow(
+            t,
+            `toolset-bound ('${t.toolset_binding.toolset_id}') \u2014 pass --include-bound to prune`
+          )
+        );
+      } else {
+        targets.push(pruneRow(t, `unused for over ${opts.unusedSince}`));
+      }
+    }
+    const format = outputFormat(this);
+    const json = format === "json";
+    const note = (line) => json ? console.error(line) : console.log(line);
+    const printPreview = () => {
+      if (targets.length === 0) {
+        note("Nothing to prune.");
+      } else {
+        note(`Would revoke ${targets.length} token(s):`);
+        if (!json) printOutput(targets, format);
+      }
+      if (skipped.length === 0) return;
+      note(`
+Skipped ${skipped.length} stale token(s):`);
+      if (!json) printOutput(skipped, format);
+    };
+    printPreview();
+    if (targets.length === 0) {
+      if (json) printOutput({ revoked: 0, failed: 0, targets, skipped }, format);
+      return;
+    }
+    if (!opts.yes) {
+      if (!isInteractive()) {
+        console.error("\nPreview only \u2014 re-run with --yes to revoke these tokens.");
+        if (json) printOutput({ preview: true, revoked: 0, failed: 0, targets, skipped }, format);
+        return process.exit(1);
+      }
+      if (!await confirm(`
+Revoke ${targets.length} token(s)?`)) {
+        console.error("Aborted.");
+        return process.exit(1);
+      }
+    }
+    let revoked = 0;
+    let failed = 0;
+    for (const t of targets) {
+      try {
+        await client.request(
+          "DELETE",
+          `/v1/tokens/${pathSegment(t.token_id, "token id")}?force=true`
+        );
+        revoked++;
+      } catch (err) {
+        failed++;
+        console.error(
+          `Failed to revoke ${t.token_id} ('${sanitizeTerminalText(t.name)}'): ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    if (json) printOutput({ revoked, failed, targets, skipped }, format);
+    else console.log(`Revoked ${revoked} token(s)${failed > 0 ? `, ${failed} failed` : ""}.`);
+    if (failed > 0) return process.exit(1);
+  });
+  return tokens2;
+}
+var RAW_TOKEN_PATTERN, TOKEN_OUTPUT_HELP, TOKEN_LIST_PAGE_LIMIT;
+var init_tokens = __esm({
+  "src/data/commands/tokens.ts"() {
+    "use strict";
+    init_client();
+    init_output();
+    init_helpers();
+    init_api_client();
+    init_terminal_output();
+    init_utils();
+    init_expected();
+    RAW_TOKEN_PATTERN = /^rec_[A-Za-z0-9_-]{43}$/;
+    TOKEN_OUTPUT_HELP = `
+Output:
+  --json prints the unwrapped response object; the secret is at top-level .token, never .data.token.
+  --token-only prints only a validated rec_ token and overrides table/JSON formatting.
+  The raw token is shown once. Capture it securely and do not log it.
+`;
+    TOKEN_LIST_PAGE_LIMIT = 250;
+  }
+});
+
 // src/knowledge/remote.ts
 function pacedRequestsPerMinute(path42, fallback) {
   const budget = getEndpointConfig(path42)?.userLimit;
@@ -34606,6 +35124,14 @@ function knowledgeBase(client) {
   const request = (method, path42, body) => pacer.run(() => client.request(method, path42, body));
   const baseSeg = (id) => pathSegment(id, "--base");
   const typeSeg = (id) => pathSegment(id, "file type");
+  const toolsetSeg = (id) => pathSegment(id, "toolset slug");
+  const promoteOnly = (production, preview, section, ids, dryRun) => request("POST", `/v1/${baseSeg(production)}/promote`, {
+    source_base_id: preview,
+    dry_run: dryRun,
+    ...Object.fromEntries(ENTITY_KINDS.map((kind) => [kind, []])),
+    file_types: [],
+    [section]: ids
+  });
   return {
     getBase: (id) => unlessMissing(() => pacer.run(() => getBaseRecord(client, id))),
     listPreviews: (id) => pacer.run(
@@ -34617,14 +35143,7 @@ function knowledgeBase(client) {
       const { id, ...body } = spec;
       await request("PUT", `/v1/${baseSeg(base)}/file-types/${typeSeg(id)}`, body);
     },
-    async promoteFileTypes(production, preview, ids, dryRun) {
-      return request("POST", `/v1/${baseSeg(production)}/promote`, {
-        source_base_id: preview,
-        dry_run: dryRun,
-        ...Object.fromEntries(ENTITY_KINDS.map((kind) => [kind, []])),
-        file_types: ids
-      });
-    },
+    promoteFileTypes: (production, preview, ids, dryRun) => promoteOnly(production, preview, "file_types", ids, dryRun),
     async listFiles(base, fileType) {
       const rows = [];
       for (let page = 0; page < MAX_LIST_PAGES; page++) {
@@ -34635,6 +35154,16 @@ function knowledgeBase(client) {
       }
       throw expected(`The listing of file type "${fileType}" on base "${base}" did not end after ${MAX_LIST_PAGES} pages.`);
     },
+    getToolset: (base, slug) => unlessMissing(() => request("GET", `/v1/${baseSeg(base)}/toolsets/${toolsetSeg(slug)}`)),
+    async putToolset(base, spec) {
+      const { id, ...body } = spec;
+      await request("PUT", `/v1/${baseSeg(base)}/toolsets/${toolsetSeg(id)}`, { ...body, actions: [] });
+    },
+    promoteToolsets: (production, preview, slugs, dryRun) => promoteOnly(production, preview, "toolsets", slugs, dryRun),
+    mintToolsetToken: async (base, slug, name) => rawTokenFrom(await request("POST", "/v1/tokens", { name, toolset_binding: { base_id: base, toolset_id: slug } })),
+    // `requestRaw`: the page is read whole, `{ data: … }`, as WayAI's copy of its answer declares it
+    // (`@wayai/core/contracts` `rekorFileSnapshotAnswerSchema`).
+    snapshotPage: (preview, cursor) => pacer.run(() => client.requestRaw("POST", `/v1/${baseSeg(preview)}/files/snapshot`, cursor === void 0 ? {} : { cursor })),
     async putFile(base, file, bytes) {
       await pacer.run(
         () => client.upload(
@@ -34647,7 +35176,70 @@ function knowledgeBase(client) {
     }
   };
 }
-var LIST_PAGE, MAX_LIST_PAGES, MIGRATION_LABEL, READER_BUDGETS;
+function connectionsOf(rows) {
+  return (rows ?? []).flatMap(
+    (c) => c.connection_id ? [{ connection_id: c.connection_id, connection_display_name: c.connection_display_name, connector_id: c.connector_id, settings: c.settings }] : []
+  );
+}
+function hubSetup(api, orgId, pacers = {
+  setup: pacerFor(CUT_OVER_BUDGETS.setup, "setup"),
+  automations: pacerFor(CUT_OVER_BUDGETS.automations, "automations")
+}) {
+  const run = (send) => pacers.setup.run(send);
+  const auto = (send) => pacers.automations.run(send);
+  return {
+    listHubs: async () => hubsOf(await run(() => api.getUserSchema()), orgId),
+    hubDiff: async (hubId) => (await run(() => api.getHubDiff(hubId))).data,
+    // The rows are the hub's `resource` rows whole, the move's mark (`moved_file_type`) among them.
+    listResources: async (hubId) => (await run(() => api.listHubResources(hubId))).data ?? [],
+    listAgents: async (hubId) => (await run(() => api.listAgents(hubId))).data ?? [],
+    listAgentLinks: async (hubId, agentId) => (await run(() => api.listAgentResources(hubId, agentId))).resources ?? [],
+    listAgentTools: async (hubId, agentId) => {
+      const tools = await run(() => api.listAgentTools(hubId, agentId));
+      return { native: tools.tools ?? [], connection: (tools.mcp_tools ?? []).map((t) => ({ ...t, tool_id: t.tool_id ?? null })) };
+    },
+    listConnections: async (hubId) => connectionsOf((await run(() => api.listConnections(hubId))).connections),
+    listAutomations: async (hubId) => (await auto(() => api.listAutomations(hubId))).automations ?? [],
+    // The answer lists the hub's connections, the new one among them.
+    addToolsetConnection: async (hubId, input) => connectionsOf(
+      (await run(
+        () => api.addConnection({
+          hub_id: hubId,
+          connector_id: input.connectorId,
+          connection_display_name: input.name,
+          settings: { [TOOLSET_SLUG_SETTING]: input.toolset },
+          access_token: input.token
+        })
+      )).connections
+    ),
+    async syncConnection(hubId, connectionId) {
+      const answer = await run(() => api.syncMcp(hubId, connectionId));
+      if (!answer.success) {
+        throw expected(`Syncing connection ${connectionId}'s tools failed: ${sanitizeTerminalText(answer.message ?? "no reason given")}`);
+      }
+    },
+    async addNativeTool(hubId, agentId, toolNativeId) {
+      await run(() => api.addNativeTool(hubId, agentId, toolNativeId));
+    },
+    async addConnectionTool(hubId, agentId, mcpToolId) {
+      await run(() => api.addMcpTool(hubId, agentId, mcpToolId));
+    },
+    async enableTool(hubId, agentId, toolId) {
+      await run(() => api.enableTool(hubId, agentId, toolId));
+    },
+    async updateAgentText(hubId, agentId, patch) {
+      await run(() => api.updateAgent(hubId, agentId, patch));
+    },
+    async updateAutomationAction(hubId, automationId, action) {
+      await auto(() => api.updateAutomation(hubId, automationId, { action }));
+    },
+    async disableLink(hubId, agentId, resourceId) {
+      await run(() => api.updateAgentResource({ hub_id: hubId, agent_id: agentId, resource_id: resourceId, enabled: false }));
+    },
+    recordMove: async (body) => (await run(() => api.recordKnowledgeMove(body))).data.recorded
+  };
+}
+var LIST_PAGE, MAX_LIST_PAGES, MIGRATION_LABEL, READER_BUDGETS, CUT_OVER_BUDGETS;
 var init_remote = __esm({
   "src/knowledge/remote.ts"() {
     "use strict";
@@ -34660,10 +35252,559 @@ var init_remote = __esm({
     init_types2();
     init_headers();
     init_helpers();
+    init_terminal_output();
+    init_tokens();
+    init_rekor_toolset();
     LIST_PAGE = 1e3;
     MAX_LIST_PAGES = 1e3;
     MIGRATION_LABEL = "wayai knowledge migrate";
     READER_BUDGETS = { setup: "/api/setup/organization-resources", sign: "/api/files/sign" };
+    CUT_OVER_BUDGETS = { setup: "/api/setup/agents", automations: "/api/automations" };
+  }
+});
+
+// src/knowledge/refresh-preview.ts
+async function refreshPreviewKnowledge(kb, opts, io) {
+  const { production, preview } = await resolveBases(kb, opts.base, opts.orgId);
+  const question = `Make the files of preview "${sanitizeTerminalText(preview)}" equal production "${sanitizeTerminalText(production)}"'s? Files the preview changed are replaced, and files only it holds are removed.`;
+  if (!opts.yes && !await io.confirm(question)) {
+    io.log("Cancelled.");
+    return null;
+  }
+  io.log(`Copying the files of production base "${sanitizeTerminalText(production)}" into its preview "${sanitizeTerminalText(preview)}".`);
+  const run = await runFileSnapshot({
+    sendPage: (cursor) => kb.snapshotPage(preview, cursor),
+    // The data product refuses a page whose preview file changed while it was being copied, and
+    // asks for the same cursor again.
+    isConflict: (error) => error instanceof ApiError && error.status === FILE_SNAPSHOT_CONFLICT_STATUS,
+    onPage: (page, n) => io.log(`  Page ${n}: ${page.written} written, ${page.removed} removed, ${page.unchanged} unchanged.`)
+  });
+  io.log(
+    !fileSnapshotChanged(run) ? `Nothing changed in ${run.pages} page(s): the preview's ${run.unchanged} file(s) already equal production's.` : `Done in ${run.pages} page(s): ${run.written} written, ${run.removed} removed, ${run.unchanged} unchanged. The preview's files now equal production's.`
+  );
+  return run;
+}
+var init_refresh_preview = __esm({
+  "src/knowledge/refresh-preview.ts"() {
+    "use strict";
+    init_contracts();
+    init_api_client();
+    init_terminal_output();
+    init_migrate2();
+  }
+});
+
+// ../../packages/core/dist/catalog/index.js
+function getConnectors(filter) {
+  if (!filter?.connector_type && !filter?.service_name) return CONNECTORS;
+  return CONNECTORS.filter(
+    (c) => (!filter.connector_type || c.connector_type === filter.connector_type) && (!filter.service_name || c.service_name === filter.service_name)
+  );
+}
+function getConnectorById(id) {
+  return connectorById.get(id) ?? null;
+}
+function isRekorToolsetConnector(connector) {
+  return connector?.service_name === REKOR_TOOLSET_SERVICE_NAME;
+}
+function isRekorToolsetConnectorId(connectorId) {
+  return typeof connectorId === "string" && isRekorToolsetConnector(connectorById.get(connectorId));
+}
+var COUNTER_KEYS, STT_PRICING, CONTAINER_PRICING, connectorById, nativeToolById;
+var init_catalog = __esm({
+  "../../packages/core/dist/catalog/index.js"() {
+    "use strict";
+    init_chunk_4MXPUC6I();
+    init_chunk_NRJINQVD();
+    init_chunk_CWUV6NL3();
+    init_chunk_MIWZOSPI();
+    init_chunk_DHPUPI4Y();
+    COUNTER_KEYS = Object.keys({
+      input_tokens: true,
+      output_tokens: true,
+      cache_read_input_tokens: true,
+      cache_creation_input_tokens: true,
+      cache_creation_1h_input_tokens: true
+    });
+    STT_PRICING = {
+      "Openai/whisper-1": { per_second: 6e-3 / 60 },
+      "Openai/gpt-4o-mini-transcribe": { per_second: 3e-3 / 60 },
+      "Groq/whisper-large-v3-turbo": { per_second: 0.04 / 3600 },
+      "ElevenLabs/scribe_v2": { per_second: 0.22 / 3600 }
+    };
+    CONTAINER_PRICING = {
+      anthropic_per_request_usd: 0.05 * 10 / 3600,
+      // $0.05/hr × ~10s/request ≈ $0.000139
+      openai_per_session_usd: 0.03
+      // 1GB tier, 20-min session
+    };
+    connectorById = new Map(CONNECTORS.map((c) => [c.connector_id, c]));
+    nativeToolById = new Map(NATIVE_TOOLS.map((t) => [t.tool_native_id, t]));
+  }
+});
+
+// src/knowledge/cut-over.ts
+import { createHash as createHash6 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
+function toolsetSlug(productionHubId, fileTypes) {
+  const hash = createHash6("sha256").update([productionHubId, ...fileTypes].join("\n")).digest("hex").slice(0, 12);
+  return `${CUT_OVER_TOOLSET_PREFIX}${hash}`;
+}
+function toolsetEntry(fileType) {
+  const base = toolBase(fileType);
+  return { file_type: fileType, operations: [...FILE_OPERATIONS], ...base === fileType ? {} : { name: base } };
+}
+function toolsetToolName(op, fileType) {
+  return toolsetFileToolName(toolsetEntry(fileType), op);
+}
+function rewriteCitations(text, fileTypeBySlug) {
+  return text.replace(CITATION_RE, (whole, slash, slug) => {
+    const fileType = fileTypeBySlug.get(slug.toLowerCase());
+    return fileType ? `${slash}${DATA_NAMESPACE}/${fileType}` : whole;
+  });
+}
+function knowledgePlaceholders(template, losing) {
+  if (losing.length === 0 || !template.includes("{{")) return [];
+  const scan = scanTemplateResources(template);
+  const kinds = scanTemplateResources(template.replace(/\{\{(\s*)files(\s*\()/g, "{{$1resources$2")).legacy_kinds;
+  const uses = [];
+  if (kinds === "all" || kinds === "kb") uses.push("a {{files()}} catalog that lists knowledge");
+  const names = new Set(losing.map((r) => r.name));
+  for (const name of scan.resource_content_names) if (names.has(name)) uses.push(`{{resource_content(${name})}}`);
+  const slugs = new Set(losing.map((r) => r.slug));
+  for (const path42 of scan.file_content_paths) {
+    const [namespace, slug] = cleanRelativePath(path42).split("/");
+    if (namespace?.toLowerCase() === RESOURCE_NAMESPACE && slug && slugs.has(slug.toLowerCase())) {
+      uses.push(`{{file_content(${path42})}}`);
+    }
+  }
+  return uses;
+}
+function sameToolset(remote, spec) {
+  if (!remote) return false;
+  const files = (entries) => [...entries ?? []].map((e) => ({ file_type: e.file_type, operations: [...e.operations].sort(), name: e.name ?? null, path_prefix: e.path_prefix || null })).sort((a, b) => a.file_type.localeCompare(b.file_type));
+  return remote.name === spec.name && (remote.description ?? "") === spec.description && (remote.actions ?? []).length === 0 && (remote.relationships ?? []).length === 0 && !remote.batch && !remote.sql_query && isDeepStrictEqual4(files(remote.files), files(spec.files));
+}
+function toolsetConnectorId() {
+  const connector = getConnectors().find((c) => isRekorToolsetConnector(c));
+  if (!connector) throw new Error("The Base Toolset connector is missing from the catalog");
+  return connector.connector_id;
+}
+function cutOverToolsetOf(connection) {
+  const toolset = connection.settings?.[TOOLSET_SLUG_SETTING];
+  return isRekorToolsetConnectorId(connection.connector_id) && typeof toolset === "string" && CUT_OVER_TOOLSET_RE.test(toolset) ? toolset : null;
+}
+function wantedConnectionTools(fileTypes) {
+  return fileTypes.flatMap((ft) => FILE_OPERATIONS.map((op) => toolsetToolName(op, ft)));
+}
+function toolWork(tools, wanted, connectionId) {
+  const native = [];
+  const unavailable = [];
+  for (const name of MOUNT_TOOLS) {
+    const row = tools.native.find((t) => t.tool_name === name);
+    if (!row) unavailable.push(name);
+    else if (row.available_action !== "Disable") native.push(row);
+  }
+  const connection = [];
+  const uncatalogued = [];
+  for (const name of wanted) {
+    const row = connectionId ? tools.connection.find((t) => t.connection_id === connectionId && t.tool_name === name) : void 0;
+    if (!row) uncatalogued.push(name);
+    else if (row.available_action !== "Disable") connection.push(row);
+  }
+  return { native, connection, uncatalogued, unavailable };
+}
+function describeToolWork(work) {
+  return [
+    ...work.native.map((t) => `${t.available_action === "Enable" ? "enable" : "add"} ${t.tool_name}`),
+    ...work.connection.map((t) => `${t.available_action === "Enable" ? "enable" : "add"} ${t.tool_name}`),
+    ...work.uncatalogued.map((name) => `add ${name}`)
+  ];
+}
+async function cutOverHub(hub, kb, opts, io) {
+  const { production, preview } = await resolveBases(kb, opts.base, opts.orgId);
+  const stops = [];
+  const hubs = await hub.listHubs();
+  const previewHub = hubs.find((h) => h.hub_id === opts.hubId);
+  if (!previewHub) throw expected(`Hub ${safe2(opts.hubId)} not found in this organization, or you cannot read it.`);
+  if (previewHub.hub_environment !== "preview") {
+    throw expected(`Hub ${safe2(opts.hubId)} is a production hub. A hub is cut over on its preview; publishing carries it to production.`);
+  }
+  const productionHub2 = previewHub.production_hub_id ? hubs.find((h) => h.hub_id === previewHub.production_hub_id) : void 0;
+  if (!productionHub2) {
+    throw expected(`Hub ${safe2(opts.hubId)} has not been published, and its knowledge moved from its production hub. Publish it, then migrate its knowledge first.`);
+  }
+  const productionHubId = productionHub2.hub_id;
+  const fileTypes = await kb.listFileTypes(production);
+  const fileTypeBySource = /* @__PURE__ */ new Map();
+  for (const ft of fileTypes) {
+    const source = provenanceOf(ft.metadata_schema);
+    if (source) fileTypeBySource.set(source, ft.id);
+  }
+  const resources = await hub.listResources(opts.hubId);
+  const ownKnowledge = (rows) => rows.filter((r) => r.resource_type === "knowledge" && !r.org_resource_id);
+  const productionOwn = ownKnowledge(await hub.listResources(productionHubId));
+  const previewOwn = ownKnowledge(resources);
+  const diff = await hub.hubDiff(opts.hubId);
+  const marked = new Set(previewOwn.filter((r) => r.moved_file_type).map((r) => r.resource_name));
+  const knowledgeNames = new Set([...previewOwn, ...productionOwn].map((r) => r.resource_name).filter((name) => !marked.has(name)));
+  const changed = [
+    ...diff.resources.filter((e) => knowledgeNames.has(e.name)).map((e) => `resource "${e.name}" (${e.status})`),
+    ...(diff.resource_folders ?? []).filter((e) => e.type && knowledgeNames.has(e.type)).map((e) => `a folder of "${e.type}"`),
+    ...(diff.resource_files ?? []).filter((e) => e.type && knowledgeNames.has(e.type)).map((e) => `a file of "${e.type}"`)
+  ];
+  if (changed.length > 0) {
+    stops.push(
+      `The preview's knowledge resources differ from production's, which moved (${[...new Set(changed)].join(", ")}): sync or discard those changes first, so its agents are cut over to what they read.`
+    );
+  }
+  const fileTypeOf = /* @__PURE__ */ new Map();
+  for (const resource of resources) {
+    if (resource.resource_type !== "knowledge") continue;
+    if (resource.org_resource_id) {
+      const ft2 = fileTypeBySource.get(orgSourceKey(resource.org_resource_id));
+      if (ft2) fileTypeOf.set(resource.resource_id, ft2);
+      continue;
+    }
+    if (resource.moved_file_type) {
+      fileTypeOf.set(resource.resource_id, resource.moved_file_type);
+      continue;
+    }
+    const twins = productionOwn.filter((r) => r.resource_name === resource.resource_name);
+    const previewTwins = previewOwn.filter((r) => r.resource_name === resource.resource_name);
+    if (twins.length > 1 || previewTwins.length > 1) {
+      stops.push(`Two knowledge resources are named "${resource.resource_name}": rename one (in the preview, then sync), so each pairs with its production copy.`);
+      continue;
+    }
+    const ft = twins[0] ? fileTypeBySource.get(hubSourceKey(productionHubId, twins[0].resource_id)) : void 0;
+    if (ft) fileTypeOf.set(resource.resource_id, ft);
+  }
+  const productionHubs = hubs.filter((h) => h.hub_environment === "production");
+  for (const resource of previewOwn) {
+    const ft = fileTypeOf.get(resource.resource_id);
+    if (!ft || resource.moved_file_type) continue;
+    const hubPart = hubPartOf(ft);
+    const holders = productionHubs.filter((h) => slugifySkillName(h.hub_name) === hubPart);
+    if (holders.length > 1) {
+      stops.push(
+        `File type "${ft}" names the hub slug "${hubPart}", which ${holders.length} production hubs share (${holders.map((h) => `"${h.hub_name}"`).join(", ")}): its move can't be recorded until all but one are renamed.`
+      );
+    }
+  }
+  const slugById = buildResourceSlugMap(resources);
+  const fileTypeBySlug = /* @__PURE__ */ new Map();
+  for (const [resourceId, ft] of fileTypeOf) {
+    const slug = slugById.get(resourceId);
+    if (slug) fileTypeBySlug.set(slug, ft);
+  }
+  const byId = new Map(resources.map((r) => [r.resource_id, r]));
+  const connections = await hub.listConnections(opts.hubId);
+  const previewToolsets = /* @__PURE__ */ new Map();
+  const connectionBySlug = /* @__PURE__ */ new Map();
+  for (const connection of connections) {
+    const slug = cutOverToolsetOf(connection);
+    if (!slug) continue;
+    connectionBySlug.set(slug, connection);
+    if (!previewToolsets.has(slug)) previewToolsets.set(slug, await kb.getToolset(preview, slug));
+  }
+  const toolsetTypes = (slug) => (previewToolsets.get(slug)?.files ?? []).map((e) => e.file_type);
+  const slugByConnection = new Map([...connectionBySlug].map(([slug, c]) => [c.connection_id, slug]));
+  const agents = await hub.listAgents(opts.hubId);
+  const plans = [];
+  for (const agent of agents) {
+    const links2 = (await hub.listAgentLinks(opts.hubId, agent.agent_id)).filter((l) => l.resource_type === "knowledge");
+    const enabled = links2.filter((l) => l.enabled);
+    const tools = await hub.listAgentTools(opts.hubId, agent.agent_id);
+    const set = /* @__PURE__ */ new Set();
+    for (const link of enabled) {
+      const ft = fileTypeOf.get(link.resource_id);
+      const resource = byId.get(link.resource_id);
+      if (!ft) {
+        stops.push(
+          `Agent "${agent.agent_name}" reads knowledge resource "${resource?.resource_name ?? link.resource_id}", which has not moved: move it first (\`wayai knowledge migrate --org ${opts.orgId} --base ${opts.base}${resource?.org_resource_id ? "" : ` --hub ${productionHubId}`}\`).`
+        );
+        continue;
+      }
+      set.add(ft);
+    }
+    for (const tool of tools.connection) {
+      const slug = tool.connection_id ? slugByConnection.get(tool.connection_id) : void 0;
+      if (slug && tool.available_action === "Disable") for (const ft of toolsetTypes(slug)) set.add(ft);
+    }
+    const runner = connections.find((c) => c.connection_id === agent.connection_id);
+    if (enabled.length > 0 && runner && getConnectorById(runner.connector_id)?.is_harness === true) {
+      stops.push(
+        `Agent "${agent.agent_name}" runs on a hosted harness, which takes no Base Toolset's tools yet, so it would lose its knowledge: connect it to a toolset through an MCP Server connection, or detach its knowledge links, then run again.`
+      );
+    }
+    const losing = enabled.flatMap((link) => {
+      const resource = byId.get(link.resource_id);
+      const slug = slugById.get(link.resource_id);
+      return resource && slug ? [{ slug, name: resourceDisplayName(resource) }] : [];
+    });
+    for (const [field, template] of [
+      ["instructions", agent.instructions],
+      ["additional context", agent.additional_context_template]
+    ]) {
+      for (const use of knowledgePlaceholders(template ?? "", losing)) {
+        stops.push(
+          `Agent "${agent.agent_name}" uses ${use} in its ${field}, which reads nothing once its knowledge moves (K19): move that text into its instructions or a skill, then run again.`
+        );
+      }
+    }
+    if (set.size > 0 || enabled.length > 0) plans.push({ agent, fileTypes: [...set].sort(), linksToDisable: enabled, tools });
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const plan of plans) {
+    if (plan.fileTypes.length === 0) continue;
+    const slug = toolsetSlug(productionHubId, plan.fileTypes);
+    const group = groups.get(slug);
+    if (group) {
+      group.agents.push(plan.agent);
+      plan.group = group;
+      continue;
+    }
+    plan.group = {
+      slug,
+      fileTypes: plan.fileTypes,
+      agents: [plan.agent],
+      connection: connectionBySlug.get(slug),
+      created: !connectionBySlug.has(slug),
+      spec: {
+        id: slug,
+        name: `Knowledge of ${previewHub.hub_name}`.slice(0, 200),
+        description: `Read-only knowledge for agents of hub ${productionHubId}, written by wayai knowledge cut-over: list and get on ${plan.fileTypes.join(", ")}.`,
+        files: plan.fileTypes.map(toolsetEntry)
+      }
+    };
+    groups.set(slug, plan.group);
+  }
+  const plannedTypes = [...new Set([...groups.values()].flatMap((g) => g.fileTypes))].sort();
+  const missing = [];
+  for (const ft of plannedTypes) {
+    const [inProduction, inPreview] = await Promise.all([kb.listFiles(production, ft), filesOrNone(kb, preview, ft)]);
+    const there = new Set(inPreview.map((f) => f.path));
+    for (const file of inProduction) if (!there.has(file.path)) missing.push(`${ft}/${file.path}`);
+  }
+  if (missing.length > 0) {
+    stops.push(
+      `The preview base "${preview}" lacks ${missing.length} file(s) production holds (${missing.slice(0, 5).join(", ")}${missing.length > 5 ? ", \u2026" : ""}), so the preview's agents would read none of them: copy them in with \`${refreshPreviewCommand(opts.orgId, opts.base)}\`, then run again.`
+    );
+  }
+  const toolsetsToWrite = [];
+  const toolsetsToPromote = [];
+  for (const group of groups.values()) {
+    const [inPreview, inProduction] = await Promise.all([
+      previewToolsets.has(group.slug) ? previewToolsets.get(group.slug) : kb.getToolset(preview, group.slug),
+      kb.getToolset(production, group.slug)
+    ]);
+    if (!sameToolset(inPreview, group.spec)) toolsetsToWrite.push(group.spec);
+    if (!sameToolset(inProduction, group.spec)) toolsetsToPromote.push(group.spec);
+  }
+  const connectionsToCreate = [...groups.values()].filter((g) => g.created);
+  const toolLines = [];
+  let toolWrites = 0;
+  for (const plan of plans) {
+    const group = plan.group;
+    if (!group) continue;
+    const work = toolWork(plan.tools, wantedConnectionTools(group.fileTypes), group.connection?.connection_id);
+    for (const name of work.unavailable) stops.push(`Agent "${plan.agent.agent_name}" can't be given ${name}: the hub offers it no such tool.`);
+    const lines = describeToolWork(work);
+    toolWrites += lines.length;
+    if (lines.length > 0) toolLines.push(`  ${safe2(plan.agent.agent_name)}: ${lines.map(safe2).join(", ")} (${group.slug})`);
+  }
+  const agentRewrites = [];
+  for (const agent of agents) {
+    const patch = {};
+    const instructions = rewriteCitations(agent.instructions ?? "", fileTypeBySlug);
+    if (instructions !== (agent.instructions ?? "")) patch.instructions = instructions;
+    const context = rewriteCitations(agent.additional_context_template ?? "", fileTypeBySlug);
+    if (context !== (agent.additional_context_template ?? "")) patch.additional_context_template = context;
+    if (Object.keys(patch).length > 0) agentRewrites.push({ agent, patch });
+  }
+  const automationRewrites = [];
+  for (const automation of await hub.listAutomations(opts.hubId)) {
+    const text = automation.action.type === "run_agent" ? automation.action.instructions : null;
+    if (!text) continue;
+    const rewritten = rewriteCitations(text, fileTypeBySlug);
+    if (rewritten !== text) automationRewrites.push({ automation, action: { ...automation.action, instructions: rewritten } });
+  }
+  const moves = [];
+  for (const resource of previewOwn) {
+    const ft = fileTypeOf.get(resource.resource_id);
+    if (!ft || resource.moved_file_type) continue;
+    moves.push({
+      body: { scope: "hub", hub_id: opts.hubId, resource_id: resource.resource_id, file_type: ft, base_id: production },
+      label: `hub resource "${resource.resource_name}" \u2192 ${ft}`
+    });
+  }
+  const orgRecorded = /* @__PURE__ */ new Set();
+  for (const plan of plans) {
+    for (const link of plan.linksToDisable) {
+      const resource = byId.get(link.resource_id);
+      const ft = fileTypeOf.get(link.resource_id);
+      if (!resource?.org_resource_id || !ft || orgRecorded.has(resource.org_resource_id)) continue;
+      orgRecorded.add(resource.org_resource_id);
+      moves.push({
+        body: { scope: "organization", organization_id: opts.orgId, org_resource_id: resource.org_resource_id, file_type: ft, base_id: production },
+        label: `organization resource "${resource.resource_name}" \u2192 ${ft}`
+      });
+    }
+  }
+  const links = plans.flatMap((plan) => plan.linksToDisable.map((link) => ({ plan, link })));
+  const result = {
+    toolsets: [...groups.values()].map((g) => ({ slug: g.slug, fileTypes: g.fileTypes, agents: g.agents.map((a) => a.agent_name) })),
+    toolsetsWritten: toolsetsToWrite.map((s) => s.id),
+    toolsetsPromoted: toolsetsToPromote.map((s) => s.id),
+    connectionsCreated: connectionsToCreate.map((g) => g.slug),
+    toolsAssigned: toolLines,
+    agentsRewritten: agentRewrites.map((r) => r.agent.agent_name),
+    automationsRewritten: automationRewrites.map((r) => r.automation.name),
+    movesRecorded: moves.map((m) => m.label),
+    linksDisabled: links.map(({ plan, link }) => `${plan.agent.agent_name}: ${byId.get(link.resource_id)?.resource_name ?? link.resource_id}`),
+    written: false
+  };
+  io.log(`Cut-over of hub "${safe2(previewHub.hub_name)}" (${opts.hubId}) to base "${safe2(production)}" (toolsets written in "${safe2(preview)}")`);
+  io.log("\nToolsets (read-only: list and get):");
+  if (groups.size === 0) io.log("  (none: no agent reads moved knowledge)");
+  for (const group of groups.values()) {
+    const mark = toolsetsToPromote.includes(group.spec) || toolsetsToWrite.includes(group.spec) ? "+" : "=";
+    io.log(`  ${mark} ${group.slug}: ${group.fileTypes.map(safe2).join(", ")} \u2014 ${group.agents.map((a) => safe2(a.agent_name)).join(", ")}`);
+  }
+  io.log("\nConnections:");
+  for (const group of groups.values()) {
+    io.log(`  ${group.connection ? "=" : "+"} Base Toolset "${group.slug}"${group.connection ? "" : ", with a new token bound to it on the preview base"}`);
+  }
+  io.log("\nAgent tools:");
+  if (toolLines.length === 0) io.log("  (nothing to assign)");
+  for (const line of toolLines) io.log(line);
+  io.log("\nPaths rewritten to data/ (K13):");
+  if (agentRewrites.length + automationRewrites.length === 0) io.log("  (none)");
+  for (const { agent, patch } of agentRewrites) io.log(`  agent "${safe2(agent.agent_name)}": ${Object.keys(patch).join(", ")}`);
+  for (const { automation } of automationRewrites) io.log(`  automation "${safe2(automation.name)}": instructions`);
+  io.log("\nMoves recorded:");
+  if (moves.length === 0) io.log("  (none)");
+  for (const move of moves) io.log(`  + ${safe2(move.label)}`);
+  io.log("\nKnowledge links disabled:");
+  if (links.length === 0) io.log("  (none)");
+  for (const line of result.linksDisabled) io.log(`  - ${safe2(line)}`);
+  if (stops.length > 0) {
+    io.log("\nStopped:");
+    for (const stop of stops) io.log(`  ${safe2(stop)}`);
+    throw expected(`The cut-over stops on ${stops.length} reason(s) above; nothing was written.`);
+  }
+  const writes = toolsetsToWrite.length + toolsetsToPromote.length + connectionsToCreate.length + toolWrites + agentRewrites.length + automationRewrites.length + moves.length + links.length;
+  const printProduction = () => printProductionSteps(io, opts, production, productionHubId, [...groups.values()]);
+  if (opts.dryRun) {
+    io.log(`
+Dry run: nothing written (${writes === 0 ? "nothing to write" : `${writes} write(s) planned`}).`);
+    printProduction();
+    return result;
+  }
+  if (writes === 0) {
+    io.log("\nNothing to write: this hub is cut over.");
+    printProduction();
+    return result;
+  }
+  if (!opts.yes && !await io.confirm(`Make these ${writes} change(s) to the preview hub and its knowledge base?`)) {
+    io.log("Cancelled.");
+    return result;
+  }
+  for (const move of moves) await hub.recordMove(move.body);
+  for (const spec of toolsetsToWrite) await kb.putToolset(preview, spec);
+  if (toolsetsToPromote.length > 0) {
+    const slugs = toolsetsToPromote.map((s) => s.id);
+    const problems2 = promotionProblems(await kb.promoteToolsets(production, preview, slugs, true), new Set(slugs), "toolsets");
+    if (problems2.length > 0) {
+      throw expected(
+        `The promotion into "${safe2(production)}" would not apply as planned (${problems2.map(safe2).join("; ")}). The toolsets are written in "${safe2(preview)}"; nothing reached production, and the hub's agents are unchanged.`
+      );
+    }
+    await kb.promoteToolsets(production, preview, slugs, false);
+  }
+  if (connectionsToCreate.length > 0) {
+    const connectorId = toolsetConnectorId();
+    for (const group of connectionsToCreate) {
+      const token = await kb.mintToolsetToken(preview, group.slug, `${group.slug} (hub ${opts.hubId})`);
+      const after = await hub.addToolsetConnection(opts.hubId, { connectorId, name: group.slug, toolset: group.slug, token });
+      group.connection = after.find((c) => cutOverToolsetOf(c) === group.slug);
+      if (!group.connection) throw new Error(`The Base Toolset connection "${group.slug}" was not found after it was created.`);
+    }
+  }
+  const synced2 = /* @__PURE__ */ new Set();
+  for (const plan of plans) {
+    const group = plan.group;
+    if (!group?.connection) continue;
+    const connectionId = group.connection.connection_id;
+    const wanted = wantedConnectionTools(group.fileTypes);
+    const stale = group.created || synced2.has(connectionId);
+    let tools = stale ? await hub.listAgentTools(opts.hubId, plan.agent.agent_id) : plan.tools;
+    let work = toolWork(tools, wanted, connectionId);
+    if (work.uncatalogued.length > 0 && !synced2.has(connectionId)) {
+      await hub.syncConnection(opts.hubId, connectionId);
+      synced2.add(connectionId);
+      tools = await hub.listAgentTools(opts.hubId, plan.agent.agent_id);
+      work = toolWork(tools, wanted, connectionId);
+    }
+    if (work.uncatalogued.length > 0) {
+      throw new Error(
+        `Connection "${group.slug}" catalogs no ${safe2(work.uncatalogued.join(", "))} after a sync, so agent "${safe2(plan.agent.agent_name)}" can't be given them.`
+      );
+    }
+    for (const tool of [...work.native, ...work.connection]) {
+      if (tool.available_action === "Enable" && tool.tool_id) await hub.enableTool(opts.hubId, plan.agent.agent_id, tool.tool_id);
+      else if (tool.tool_native_id) await hub.addNativeTool(opts.hubId, plan.agent.agent_id, tool.tool_native_id);
+      else if (tool.mcp_tool_id) await hub.addConnectionTool(opts.hubId, plan.agent.agent_id, tool.mcp_tool_id);
+    }
+  }
+  for (const { agent, patch } of agentRewrites) await hub.updateAgentText(opts.hubId, agent.agent_id, patch);
+  for (const { automation, action } of automationRewrites) await hub.updateAutomationAction(opts.hubId, automation.automation_id, action);
+  for (const { plan, link } of links) await hub.disableLink(opts.hubId, plan.agent.agent_id, link.resource_id);
+  io.log(`
+Done: the preview hub's agents read their knowledge from "${safe2(preview)}" through ${groups.size} toolset(s).`);
+  printProduction();
+  return { ...result, written: true };
+}
+async function filesOrNone(kb, base, fileType) {
+  try {
+    return await kb.listFiles(base, fileType);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) return [];
+    throw err;
+  }
+}
+function printProductionSteps(io, opts, production, productionHubId, groups) {
+  if (groups.length === 0) return;
+  io.log("\nProduction (not run by this command), once the preview passes its evals:");
+  io.log(`  1. Publish the preview: wayai publish --hub ${opts.hubId}`);
+  io.log("  2. For each toolset, mint a token bound to it on the production base, and save it on production's connection:");
+  for (const group of groups) {
+    io.log(
+      `     wayai bases tokens create-for-toolset ${group.slug} --base ${safe2(production)} --token-only | wayai set-connection-credential --hub ${productionHubId} --connection "${group.slug}" --field access_token --stdin`
+    );
+  }
+}
+var CUT_OVER_TOOLSET_PREFIX, CUT_OVER_TOOLSET_RE, FILE_OPERATIONS, MOUNT_TOOLS, DATA_NAMESPACE, safe2, CITATION_RE;
+var init_cut_over = __esm({
+  "src/knowledge/cut-over.ts"() {
+    "use strict";
+    init_dist();
+    init_catalog();
+    init_rekor_toolset();
+    init_resource_paths();
+    init_expected();
+    init_terminal_output();
+    init_api_client();
+    init_migrate2();
+    init_plan();
+    init_source();
+    CUT_OVER_TOOLSET_PREFIX = "knowledge-";
+    CUT_OVER_TOOLSET_RE = /^knowledge-[0-9a-f]{12}$/;
+    FILE_OPERATIONS = ["list", "get"];
+    MOUNT_TOOLS = ["list_files", "read_file"];
+    DATA_NAMESPACE = "data";
+    safe2 = (text) => sanitizeTerminalText(text);
+    CITATION_RE = /(?<![\w./-])(\/?)resources\/([a-z0-9]+(?:-[a-z0-9]+)*)(?![a-z0-9_]|-[a-z0-9]|\.\w)/gi;
   }
 });
 
@@ -34688,15 +35829,27 @@ function readArgs(args2) {
 function parseKnowledgeArgs(args2) {
   const { values, positionals } = readArgs(args2);
   const [verb, ...extra] = positionals;
-  if (verb !== "migrate") throw usageError3(verb === void 0 ? "No subcommand given." : `Unknown subcommand ${JSON.stringify(verb)}.`);
+  if (verb !== "migrate" && verb !== "refresh-preview" && verb !== "cut-over") {
+    throw usageError3(verb === void 0 ? "No subcommand given." : `Unknown subcommand ${JSON.stringify(verb)}.`);
+  }
   if (extra.length > 0) throw usageError3(`Unexpected argument ${JSON.stringify(extra[0])}.`);
   if (!values.org) throw usageError3("--org <org_id> is required.");
   if (!UUID_RE3.test(values.org)) throw usageError3(`Invalid --org ${JSON.stringify(values.org)}: expected an organization id (a UUID).`);
   if (!values.base) throw usageError3("--base <knowledge base> is required.");
+  if (verb === "refresh-preview") {
+    if (values.hub !== void 0) throw usageError3("--hub is migrate's and cut-over's: a refresh copies the whole knowledge base.");
+    if (values["dry-run"] !== void 0) throw usageError3("--dry-run is migrate's and cut-over's: a refresh has none.");
+    return { verb, orgId: values.org, base: values.base, yes: values.yes === true };
+  }
   if (values.hub !== void 0 && !UUID_RE3.test(values.hub)) {
     throw usageError3(`Invalid --hub ${JSON.stringify(values.hub)}: expected a hub id (a UUID).`);
   }
+  if (verb === "cut-over") {
+    if (values.hub === void 0) throw usageError3("--hub <preview hub_id> is required: a cut-over is one preview hub's.");
+    return { verb, orgId: values.org, base: values.base, hubId: values.hub, dryRun: values["dry-run"] === true, yes: values.yes === true };
+  }
   return {
+    verb,
     orgId: values.org,
     base: values.base,
     hubId: values.hub,
@@ -34710,16 +35863,24 @@ async function knowledgeCommand(args2) {
     return;
   }
   const options = parseKnowledgeArgs(args2);
+  if (options.verb === "refresh-preview") {
+    if (!options.yes && !isInteractive()) throw usageError3("It asks before it copies; pass -y when not running in a terminal.");
+    const data2 = await createDataClient(options.orgId, { refreshLogin: true });
+    await refreshPreviewKnowledge(knowledgeBase(data2), options, { log: (line) => console.log(line), confirm });
+    return;
+  }
   if (!options.dryRun && !options.yes && !isInteractive()) {
     throw usageError3("It asks before it writes; pass -y when not running in a terminal, or --dry-run.");
   }
   const { config, accessToken } = await requireAuth();
   const api = new ApiClient({ apiUrl: config.api_url, accessToken, onUnauthorized: () => getAccessToken(config) });
   const data = await createDataClient(options.orgId, { refreshLogin: true });
-  await migrateKnowledge(knowledgeReader(api, options.orgId), knowledgeBase(data), options, {
-    log: (line) => console.log(line),
-    confirm
-  });
+  const io = { log: (line) => console.log(line), confirm };
+  if (options.verb === "cut-over") {
+    await cutOverHub(hubSetup(api, options.orgId), knowledgeBase(data), options, io);
+    return;
+  }
+  await migrateKnowledge(knowledgeReader(api, options.orgId), knowledgeBase(data), options, io);
 }
 var USAGE4, OPTIONS;
 var init_knowledge = __esm({
@@ -34733,11 +35894,17 @@ var init_knowledge = __esm({
     init_helpers();
     init_migrate2();
     init_remote();
+    init_refresh_preview();
+    init_cut_over();
     USAGE4 = `
-wayai knowledge migrate \u2014 move knowledge resources into the organization's knowledge base
+wayai knowledge \u2014 the organization's knowledge base
 
 Usage:
   wayai knowledge migrate --org <org_id> --base <knowledge base> [--hub <hub_id>] [--dry-run] [-y]
+  wayai knowledge refresh-preview --org <org_id> --base <knowledge base> [-y]
+  wayai knowledge cut-over --org <org_id> --base <knowledge base> --hub <preview hub_id> [--dry-run] [-y]
+
+migrate: move knowledge resources into the organization's knowledge base.
 
   Without --hub, it moves the organization's knowledge resources; with --hub, that hub's own
   (read from its production hub), once the organization's have moved. Each resource becomes a
@@ -34748,6 +35915,30 @@ Usage:
                written in production.
   --dry-run    List what it would write, and every reason it would stop, without writing.
   -y, --yes    Skip the question before writing.
+
+refresh-preview: make the knowledge base's preview hold its production base's files \u2014 after
+  creating the preview, and whenever it should be current again. Files the preview changed are
+  replaced and files only it holds are removed; nothing else on it changes, and production is
+  only read. It prints what each page copied, removed and left alone; a re-run of a current
+  preview changes nothing.
+
+  --base       The production knowledge base, or its preview.
+  -y, --yes    Skip the question before copying.
+
+cut-over: switch a preview hub's agents from their knowledge resources to the knowledge base, once
+  its knowledge has moved. Each distinct set of knowledge its agents read gets one read-only
+  toolset on the knowledge base, reached through a Base Toolset connection; each agent is given
+  list_files, read_file and its toolset's list_ and get_ tools, its resources/<slug>/ paths become
+  data/<file type>/, its knowledge links are disabled, and each move is recorded. It changes the
+  preview only, and prints the production steps. The preview base must hold production's files
+  first (refresh-preview): the preview's agents read them there. It stops before writing on a resource placeholder
+  ({{files()}}, {{resource_content()}}, {{file_content()}}) that reads knowledge an agent is about
+  to lose: move that text into its instructions or a skill first.
+
+  --hub        The preview hub.
+  --base       The production knowledge base, or its preview.
+  --dry-run    List every change, and every reason it would stop, without writing.
+  -y, --yes    Skip the question before writing.
 `;
     OPTIONS = {
       org: { type: "string" },
@@ -34803,17 +35994,17 @@ async function adminCommand(args2) {
     process.exit(1);
   }
   if (group === "archive") {
-    const { positional: positional2, flagArgs: flagArgs2 } = splitArgs(afterGroup);
+    const { positional: positional2, flagArgs: flagArgs2 } = splitArgs2(afterGroup);
     await runArchiveRead(positional2, flagArgs2);
     return;
   }
   if (group === "observability") {
-    const { positional: positional2, flagArgs: flagArgs2 } = splitArgs(afterGroup);
+    const { positional: positional2, flagArgs: flagArgs2 } = splitArgs2(afterGroup);
     await runObservabilityRead(positional2, flagArgs2);
     return;
   }
   const [sub, ...rest] = afterGroup;
-  const { positional, flagArgs } = splitArgs(rest);
+  const { positional, flagArgs } = splitArgs2(rest);
   if (group === "do") {
     if (!sub) {
       printHelp2();
@@ -35101,7 +36292,7 @@ async function adminCommand(args2) {
   printHelp2();
   process.exit(1);
 }
-function splitArgs(args2) {
+function splitArgs2(args2) {
   const positional = [];
   const flagArgs = [];
   for (const a of args2) {
@@ -37226,9 +38417,9 @@ var init_update = __esm({
 });
 
 // src/data/commands/actions.ts
-import { Command } from "commander";
+import { Command as Command2 } from "commander";
 function buildActionsCommand() {
-  const actions = new Command("actions").description(
+  const actions = new Command2("actions").description(
     "Manage Actions \u2014 reusable, named definitions: one record_type + one operation, or a composite of atomic write steps (--config with `steps`)"
   );
   actions.command("upsert <id>").description(
@@ -37297,7 +38488,7 @@ var init_actions = __esm({
 });
 
 // src/data/commands/attachments.ts
-import { Command as Command2 } from "commander";
+import { Command as Command3 } from "commander";
 import { readFileSync as readFileSync19 } from "fs";
 function findAttachmentByFilename(attachments, filename) {
   return attachments.find((a) => a.key.endsWith(`/${filename}`)) ?? null;
@@ -37324,7 +38515,7 @@ function uploadPathFrom(uploadUrl) {
   return uploadUrl;
 }
 function buildAttachmentsCommand() {
-  const attachments = new Command2("attachments").description("Manage record attachments");
+  const attachments = new Command3("attachments").description("Manage record attachments");
   attachments.command("upload <record_type> <id>").description(
     "Get a presigned upload URL for a record attachment. With --file, uploads the file content in one step."
   ).requiredOption("--filename <name>", "File name or path (e.g. docs/guide.md)").option("--content-type <type>", "MIME type", "application/octet-stream").option("--file <path>", "Local file to upload (skips presigned URL output, uploads directly)").action(async function(recordType2, id, opts) {
@@ -37404,9 +38595,9 @@ var init_attachments = __esm({
 });
 
 // src/data/commands/batch.ts
-import { Command as Command3 } from "commander";
+import { Command as Command4 } from "commander";
 function buildBasesBatchCommand() {
-  return withBaseOption(new Command3("batch")).description("Execute atomic batch operations (up to 1,000 operations)").requiredOption("--operations <json>", "Operations array (inline JSON or @filename)").action(async function(opts) {
+  return withBaseOption(new Command4("batch")).description("Execute atomic batch operations (up to 1,000 operations)").requiredOption("--operations <json>", "Operations array (inline JSON or @filename)").action(async function(opts) {
     const base = pathSegment(requireBase(this), "--base");
     const operations = parseData(opts.operations, "--operations");
     const client = await createDataClient();
@@ -37435,7 +38626,7 @@ import { createReadStream } from "fs";
 import { access, constants, stat } from "fs/promises";
 import { createInterface as createInterface3 } from "readline";
 import { randomUUID } from "crypto";
-import { Command as Command4 } from "commander";
+import { Command as Command5 } from "commander";
 function isRetryable(err) {
   if (isNetworkError(err)) return true;
   if (!(err instanceof ApiError)) return false;
@@ -37511,7 +38702,7 @@ async function beginSession(state, client, base, recordType2, requestKey) {
   return res.session;
 }
 function buildBasesImportCommand() {
-  const importCmd = withBaseOption(new Command4("import")).description(
+  const importCmd = withBaseOption(new Command5("import")).description(
     "Bulk historical import: load an NDJSON backfill, list sessions, or undo one"
   );
   importCmd.command("run <record_type>").description(
@@ -37738,7 +38929,7 @@ var init_import = __esm({
 });
 
 // src/data/commands/providers.ts
-import { Command as Command5 } from "commander";
+import { Command as Command6 } from "commander";
 import { writeFileSync as writeFileSync10 } from "fs";
 function providerSegment(provider) {
   if (!VALID_PROVIDERS.includes(provider)) {
@@ -37747,7 +38938,7 @@ function providerSegment(provider) {
   return pathSegment(provider, "provider");
 }
 function buildBasesProvidersCommand() {
-  const providers = withBaseOption(new Command5("providers")).description(
+  const providers = withBaseOption(new Command6("providers")).description(
     "Import/export tool definitions between LLM providers and record types"
   );
   providers.command("import <provider>").description(`Import tool definitions as record types. Providers: ${VALID_PROVIDERS_HELP}`).requiredOption("--tools <json>", "Tool definitions (inline JSON or @filename)").action(async function(provider, opts) {
@@ -37818,7 +39009,7 @@ var init_providers = __esm({
 });
 
 // src/data/commands/report.ts
-import { Command as Command6 } from "commander";
+import { Command as Command7 } from "commander";
 import { readFileSync as readFileSync20 } from "fs";
 import { dirname as dirname15, join as join36 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -37862,7 +39053,7 @@ function reportActionError2(err) {
   throw err;
 }
 function buildBasesReportCommand() {
-  const report2 = new Command6("report").description(
+  const report2 = new Command7("report").description(
     "File a report to the Data triage queue and verify the outcome"
   );
   report2.command("create").description("Submit a report to the Data triage queue (deduplicated)").requiredOption("--title <title>", "Short summary").requiredOption("--description <text>", "What happened").option("--source <source>", "Origin: cli_report (default) | review | security_audit").option("--classification <c>", "Nature: bug (default) | flaky_test | security | enhancement").option(
@@ -38029,7 +39220,7 @@ var init_report3 = __esm({
 });
 
 // src/data/commands/credentials.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 import { readFileSync as readFileSync21 } from "fs";
 function withValueSourceOptions(cmd, what) {
   return cmd.option(
@@ -38064,7 +39255,7 @@ function credentialPath(base, id) {
 }
 function buildBasesCredentialsCommand() {
   const credentials = withBaseOption(
-    new Command7("credentials").description("Manage a base's integration credentials")
+    new Command8("credentials").description("Manage a base's integration credentials")
   );
   withValueSourceOptions(
     credentials.command("create").description("Store a credential on this base (value read from stdin, a masked prompt, or --file)").requiredOption("--name <name>", "Credential name \u2014 what a credential:<name> reference resolves").option("--content-type <mime>", "MIME type of the value (e.g. application/x-pkcs12)").option(
@@ -38191,10 +39382,10 @@ var init_credentials = __esm({
 });
 
 // src/data/commands/sql.ts
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 import { readFileSync as readFileSync22 } from "fs";
 function buildBasesSqlCommand() {
-  return withBaseOption(new Command8("sql")).description("Execute a read-only SQL query against base data").argument("[query]", "SQL query (SELECT only)").option("--file <path>", "Read SQL from a file instead of the argument").option(
+  return withBaseOption(new Command9("sql")).description("Execute a read-only SQL query against base data").argument("[query]", "SQL query (SELECT only)").option("--file <path>", "Read SQL from a file instead of the argument").option(
     "--param <kv...>",
     "Named parameters as key=value pairs (e.g. --param status=issued)"
   ).action(async function(queryArg, opts) {
@@ -38236,250 +39427,6 @@ var init_sql = __esm({
   }
 });
 
-// src/data/commands/tokens.ts
-import { Command as Command9 } from "commander";
-function addTokenLifecycleOptions(cmd) {
-  return cmd.option("--expires-at <date>", "Expiration date (ISO 8601, e.g. 2026-06-01T00:00:00Z)").option(
-    "--ttl <duration>",
-    "Relative expiry, e.g. 10m, 2h, 7d (use for disposable probe/test tokens)"
-  ).option(
-    "--description <text>",
-    'What holds this token (e.g. "behind credential X"); shown in list and revoke warnings'
-  ).addHelpText("after", TOKEN_OUTPUT_HELP);
-}
-function tokenCreationOutput(cmd, opts) {
-  return opts.tokenOnly ? "token" : outputFormat(cmd);
-}
-function printCreatedToken(data, output) {
-  if (output !== "token") {
-    printOutput(data, output);
-    return;
-  }
-  const token = typeof data === "object" && data !== null && "token" in data ? data.token : void 0;
-  if (typeof token !== "string" || !RAW_TOKEN_PATTERN.test(token)) {
-    throw new Error("Token creation response did not contain a valid rec_ token");
-  }
-  console.log(token);
-}
-function resolveExpiresAt(opts) {
-  if (opts.ttl && opts.expiresAt) {
-    throw expected("--ttl and --expires-at are mutually exclusive \u2014 pass one.");
-  }
-  if (opts.ttl) return new Date(Date.now() + parseDuration(opts.ttl, "--ttl")).toISOString();
-  return opts.expiresAt;
-}
-function applyTokenLifecycleOpts(body, opts) {
-  const expiresAt = resolveExpiresAt(opts);
-  if (expiresAt) body.expires_at = expiresAt;
-  if (opts.description) body.description = opts.description;
-}
-function listAllTokens(client) {
-  return client.collectPages(
-    (cursor) => `/v1/tokens?limit=${TOKEN_LIST_PAGE_LIMIT}${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`
-  );
-}
-function pruneRow(t, reason) {
-  return {
-    token_id: t.token_id,
-    name: t.name,
-    reason,
-    last_used: t.last_used_at ?? "never"
-  };
-}
-function buildBasesTokensCommand() {
-  const tokens2 = new Command9("tokens").description("Manage API tokens");
-  addTokenLifecycleOptions(
-    tokens2.command("create").description("Create a scoped API token").requiredOption("--name <name>", "Token name").requiredOption("--grants <json>", "Grant definitions as JSON array").option(
-      "--token-only",
-      "Print only the raw rec_ token for secure command substitution (shown once)"
-    )
-  ).action(async function(opts) {
-    const grants = parseData(opts.grants, "--grants");
-    const body = { name: opts.name, grants };
-    applyTokenLifecycleOpts(body, opts);
-    const client = await createDataClient();
-    const data = await client.request("POST", "/v1/tokens", body);
-    printCreatedToken(data, tokenCreationOutput(this, opts));
-  });
-  addTokenLifecycleOptions(
-    // The only token verb that addresses a base, so it alone declares `--base`.
-    // Putting it on the `tokens` group would advertise a flag that does nothing
-    // on `list`, `revoke` and `prune` — the defect `withBaseOption` exists to
-    // avoid.
-    withBaseOption(tokens2.command("create-for-toolset <slug>")).description(
-      "Create a toolset-bound (consumer) token whose authorization IS the toolset tool surface \u2014 it can call exactly the tools that toolset exposes (those record types + operations, relationships, batch, and sql only if enabled) and nothing else. Binds to the configured --base."
-    ).option("--name <name>", 'Token name (default: "<slug> consumer")').option(
-      "--token-only",
-      "Print only the raw rec_ token for secure command substitution (shown once)"
-    )
-  ).action(async function(slug, opts) {
-    const base = requireBase(this);
-    const body = {
-      name: opts.name ?? `${slug} consumer`,
-      toolset_binding: { base_id: base, toolset_id: slug }
-    };
-    applyTokenLifecycleOpts(body, opts);
-    const client = await createDataClient();
-    const data = await client.request("POST", "/v1/tokens", body);
-    const output = tokenCreationOutput(this, opts);
-    printCreatedToken(data, output);
-    if (output === "table") {
-      console.log(`
-MCP URL: ${toolsetMcpUrl(slug)}`);
-    }
-  });
-  tokens2.command("list").description("List API tokens (status, last_used_at, expires_at, description)").action(async function() {
-    const client = await createDataClient();
-    printOutput(await listAllTokens(client), outputFormat(this));
-  });
-  tokens2.command("revoke <token_id>").description(
-    "Revoke an API token (permanent). A recently-used or toolset-bound token requires --force."
-  ).option("--force", "Revoke even if the token appears to be in live use").action(async function(tokenId, opts) {
-    const client = await createDataClient();
-    const id = pathSegment(tokenId, "token id");
-    const path42 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
-    const format = outputFormat(this);
-    const revoked = (forced) => printOutput({ token_id: tokenId, revoked: true, forced }, format);
-    if (opts.force) {
-      await client.request("DELETE", path42(true));
-      revoked(true);
-      return;
-    }
-    try {
-      await client.request("DELETE", path42(false));
-      revoked(false);
-    } catch (err) {
-      if (!(err instanceof ApiError) || err.status !== 409 || dataErrorDetails(err)?.requires_force !== true) {
-        throw err;
-      }
-      console.error(err.message);
-      if (!isInteractive()) {
-        console.error("\nRe-run with --force to revoke anyway.");
-        return process.exit(1);
-      }
-      if (!await confirm("Revoke anyway?")) {
-        console.error("Aborted.");
-        return process.exit(1);
-      }
-      await client.request("DELETE", path42(true));
-      revoked(true);
-    }
-  });
-  tokens2.command("prune").description(
-    "Revoke stale tokens, selected by staleness only (expired, or unused past --unused-since) \u2014 never by name. Previews by default; revoking requires --yes or an interactive confirmation."
-  ).option(
-    "--unused-since <duration>",
-    "Also prune tokens with no activity for this long (e.g. 30d). Skips toolset-bound and legacy usage-untracked tokens."
-  ).option("--include-bound", "Allow pruning stale toolset-bound (consumer) tokens").option("-y, --yes", "Revoke without prompting (required when non-interactive)").action(async function(opts) {
-    const staleMs = opts.unusedSince ? parseDuration(opts.unusedSince, "--unused-since") : void 0;
-    const client = await createDataClient();
-    const allTokens = await listAllTokens(client);
-    const now = Date.now();
-    const targets = [];
-    const skipped = [];
-    for (const t of allTokens) {
-      const expired = t.status ? t.status === "expired" : !!t.expires_at && Date.parse(t.expires_at) <= now;
-      if (expired) {
-        targets.push(pruneRow(t, "expired"));
-        continue;
-      }
-      if (staleMs === void 0) continue;
-      const lastActivity = Date.parse(t.last_used_at ?? t.created_at);
-      if (!(now - lastActivity > staleMs)) continue;
-      if (t.usage_tracked !== true) {
-        skipped.push(
-          pruneRow(
-            t,
-            "usage untracked (legacy token) \u2014 revoke individually if truly unused"
-          )
-        );
-      } else if (t.toolset_binding && !opts.includeBound) {
-        skipped.push(
-          pruneRow(
-            t,
-            `toolset-bound ('${t.toolset_binding.toolset_id}') \u2014 pass --include-bound to prune`
-          )
-        );
-      } else {
-        targets.push(pruneRow(t, `unused for over ${opts.unusedSince}`));
-      }
-    }
-    const format = outputFormat(this);
-    const json = format === "json";
-    const note = (line) => json ? console.error(line) : console.log(line);
-    const printPreview = () => {
-      if (targets.length === 0) {
-        note("Nothing to prune.");
-      } else {
-        note(`Would revoke ${targets.length} token(s):`);
-        if (!json) printOutput(targets, format);
-      }
-      if (skipped.length === 0) return;
-      note(`
-Skipped ${skipped.length} stale token(s):`);
-      if (!json) printOutput(skipped, format);
-    };
-    printPreview();
-    if (targets.length === 0) {
-      if (json) printOutput({ revoked: 0, failed: 0, targets, skipped }, format);
-      return;
-    }
-    if (!opts.yes) {
-      if (!isInteractive()) {
-        console.error("\nPreview only \u2014 re-run with --yes to revoke these tokens.");
-        if (json) printOutput({ preview: true, revoked: 0, failed: 0, targets, skipped }, format);
-        return process.exit(1);
-      }
-      if (!await confirm(`
-Revoke ${targets.length} token(s)?`)) {
-        console.error("Aborted.");
-        return process.exit(1);
-      }
-    }
-    let revoked = 0;
-    let failed = 0;
-    for (const t of targets) {
-      try {
-        await client.request(
-          "DELETE",
-          `/v1/tokens/${pathSegment(t.token_id, "token id")}?force=true`
-        );
-        revoked++;
-      } catch (err) {
-        failed++;
-        console.error(
-          `Failed to revoke ${t.token_id} ('${sanitizeTerminalText(t.name)}'): ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-    if (json) printOutput({ revoked, failed, targets, skipped }, format);
-    else console.log(`Revoked ${revoked} token(s)${failed > 0 ? `, ${failed} failed` : ""}.`);
-    if (failed > 0) return process.exit(1);
-  });
-  return tokens2;
-}
-var RAW_TOKEN_PATTERN, TOKEN_OUTPUT_HELP, TOKEN_LIST_PAGE_LIMIT;
-var init_tokens = __esm({
-  "src/data/commands/tokens.ts"() {
-    "use strict";
-    init_client();
-    init_output();
-    init_helpers();
-    init_api_client();
-    init_terminal_output();
-    init_utils();
-    init_expected();
-    RAW_TOKEN_PATTERN = /^rec_[A-Za-z0-9_-]{43}$/;
-    TOKEN_OUTPUT_HELP = `
-Output:
-  --json prints the unwrapped response object; the secret is at top-level .token, never .data.token.
-  --token-only prints only a validated rec_ token and overrides table/JSON formatting.
-  The raw token is shown once. Capture it securely and do not log it.
-`;
-    TOKEN_LIST_PAGE_LIMIT = 250;
-  }
-});
-
 // src/data/base-tags.ts
 async function resolveBaseTags(rawTags, client) {
   const refs = splitList(rawTags);
@@ -39393,7 +40340,7 @@ function isConflict(err) {
   return err instanceof ApiError && (err.status === 409 || err.status === 412);
 }
 function conflictLine(c, texts) {
-  return `${safe2(c.rel)}: ${texts[c.reason]}${c.other === void 0 ? "" : ` "${safe2(c.other)}"`}`;
+  return `${safe3(c.rel)}: ${texts[c.reason]}${c.other === void 0 ? "" : ` "${safe3(c.other)}"`}`;
 }
 function remedy(conflicts, overwriteCommand) {
   const isClash = (c) => c.reason === "case_twin" || c.reason === "file_folder";
@@ -39414,7 +40361,7 @@ async function pullFiles(opts) {
   const plan = planPull({ synced: existing?.files ?? {}, local, remote, overwrite: opts.overwrite });
   if (plan.replacedLocal.length > 0) {
     console.log("These local changes would be replaced with the base's copies:");
-    for (const rel of plan.replacedLocal) console.log(`  ${safe2(rel)}`);
+    for (const rel of plan.replacedLocal) console.log(`  ${safe3(rel)}`);
     if (!await agree(`Replace ${plan.replacedLocal.length} locally changed file(s)?`, opts.yes)) {
       console.log("Cancelled.");
       return;
@@ -39435,7 +40382,7 @@ async function pullFiles(opts) {
       }
       removeLocal(dir, rel);
       delete record.files[rel];
-      changes.push(`${MARK.delete} ${safe2(rel)}`);
+      changes.push(`${MARK.delete} ${safe3(rel)}`);
     }
     for (const w of plan.writes) {
       const clash = diskClash(dir, w.rel);
@@ -39468,7 +40415,7 @@ async function pullFiles(opts) {
       const hash = computeHash(bytes);
       writeLocal(dir, w.rel, bytes);
       record.files[w.rel] = { version, content_sha256: hash };
-      changes.push(`${local.has(w.rel) ? MARK.update : MARK.create} ${safe2(w.rel)}`);
+      changes.push(`${local.has(w.rel) ? MARK.update : MARK.create} ${safe3(w.rel)}`);
     }
   } finally {
     writeRecord(dir, record);
@@ -39476,13 +40423,13 @@ async function pullFiles(opts) {
   const count = Object.keys(record.files).length;
   console.log(sanitizeTerminalText(`Pulled ${describeSync(target)} \u2192 ${dir} (${count} file${count === 1 ? "" : "s"}).`));
   printSection("Changes:", changes);
-  printSection("Kept \u2014 your local changes:", plan.kept.map((k) => `${safe2(k.rel)}: ${PULL_KEPT[k.reason]}`));
+  printSection("Kept \u2014 your local changes:", plan.kept.map((k) => `${safe3(k.rel)}: ${PULL_KEPT[k.reason]}`));
   printSection(
     `Conflicts \u2014 your copy is kept; to settle them, ${remedy(conflicts, pullCommand2(target, opts.dir, true))}:`,
     conflicts.map((c) => conflictLine(c, PULL_CONFLICT))
   );
-  printSection("Changed or deleted on the base while pulling \u2014 left as is; pull again to take it:", changedWhilePulling.map(safe2));
-  printSection(`Not synced \u2014 names a synced folder leaves out (${OUTSIDE_SYNC.join(", ")}):`, excluded.map(safe2));
+  printSection("Changed or deleted on the base while pulling \u2014 left as is; pull again to take it:", changedWhilePulling.map(safe3));
+  printSection(`Not synced \u2014 names a synced folder leaves out (${OUTSIDE_SYNC.join(", ")}):`, excluded.map(safe3));
 }
 function isTextType(contentType) {
   const ct = contentType.split(";")[0].trim().toLowerCase();
@@ -39500,7 +40447,7 @@ function changedLines(before, after) {
 async function describeSteps(client, t, dir, steps) {
   const lines = [];
   for (const step of steps) {
-    const rel = safe2(step.rel);
+    const rel = safe3(step.rel);
     if (step.op === "create") {
       lines.push(`${MARK.create} ${rel} (new, ${step.local.size} bytes)`);
     } else if (step.op === "delete") {
@@ -39527,10 +40474,10 @@ async function describeSteps(client, t, dir, steps) {
   return lines;
 }
 function printPushNotes(plan) {
-  printSection("Changed on the base since your last pull \u2014 left as is; pull to take it:", plan.changedOnBase.map(safe2));
-  printSection("Deleted on the base since your last pull \u2014 left as is; pull to remove your copy:", plan.deletedOnBase.map(safe2));
-  printSection("On the base, not in your files \u2014 left as is; pull to fetch it:", plan.onlyOnBase.map(safe2));
-  printSection("Deleted in your files \u2014 kept on the base; push with --prune to delete it:", plan.keptOnBase.map(safe2));
+  printSection("Changed on the base since your last pull \u2014 left as is; pull to take it:", plan.changedOnBase.map(safe3));
+  printSection("Deleted on the base since your last pull \u2014 left as is; pull to remove your copy:", plan.deletedOnBase.map(safe3));
+  printSection("On the base, not in your files \u2014 left as is; pull to fetch it:", plan.onlyOnBase.map(safe3));
+  printSection("Deleted in your files \u2014 kept on the base; push with --prune to delete it:", plan.keptOnBase.map(safe3));
 }
 async function pushFiles(opts) {
   const label = opts.label === void 0 ? void 0 : labelValue(opts.label);
@@ -39593,7 +40540,7 @@ Push ${n} change${n === 1 ? "" : "s"} to ${describeSync(target)}?`, opts.yes)) {
       } else {
         const bytes = readLocal(dir, step.rel);
         if (computeHash(bytes) !== step.local.content_sha256) {
-          throw expected(`${safe2(step.rel)} changed while the push ran. Nothing more was pushed; run the push again.`);
+          throw expected(`${safe3(step.rel)} changed while the push ran. Nothing more was pushed; run the push again.`);
         }
         const contentType = step.op === "update" ? step.remote.content_type : guessMimeType(step.rel) ?? "application/octet-stream";
         const row = await client.upload(
@@ -39608,7 +40555,7 @@ Push ${n} change${n === 1 ? "" : "s"} to ${describeSync(target)}?`, opts.yes)) {
         };
       }
       pushed++;
-      console.log(`  ${MARK[step.op]} ${safe2(step.rel)}`);
+      console.log(`  ${MARK[step.op]} ${safe3(step.rel)}`);
     } catch (err) {
       if (step.op === "delete" && err instanceof ApiError && err.status === 404) {
         delete record.files[step.rel];
@@ -39635,7 +40582,7 @@ function finishWithConflicts(t, dir, conflicts) {
     `${count} conflict${count === 1 ? "" : "s"} not pushed \u2014 the base's copies of those files were left as they are. To settle them, ${remedy(conflicts, pullCommand2(t, dir, true))}, then push again.`
   );
 }
-var LIST_PAGE2, MAX_LIST_PAGES2, MAX_DIFF_BYTES, MARK, safe2, PULL_KEPT, PULL_CONFLICT, PUSH_CONFLICT;
+var LIST_PAGE2, MAX_LIST_PAGES2, MAX_DIFF_BYTES, MARK, safe3, PULL_KEPT, PULL_CONFLICT, PUSH_CONFLICT;
 var init_sync3 = __esm({
   "src/data/files-sync/sync.ts"() {
     "use strict";
@@ -39657,7 +40604,7 @@ var init_sync3 = __esm({
     MAX_LIST_PAGES2 = 1e3;
     MAX_DIFF_BYTES = 256 * 1024;
     MARK = { create: "+", update: "~", delete: "-" };
-    safe2 = (rel) => sanitizeTerminalText(rel);
+    safe3 = (rel) => sanitizeTerminalText(rel);
     PULL_KEPT = {
       edited: "edited in your files, not pushed yet",
       deleted: "deleted in your files, not pushed yet (push --prune deletes it from the base)"
@@ -41278,6 +42225,8 @@ Commands:
   communities        An organization's communities: list, join link (get/rotate/off), stats, access list (list/add/remove) \u2014 \`wayai communities --help\`
   contacts           Link a contact to its customer record in a base, or unlink it (browser sign-in only) \u2014 \`wayai contacts --help\`
   knowledge migrate  Move an organization's knowledge resources, then a hub's (--hub), into its knowledge base as file types and files \u2014 \`wayai knowledge --help\`
+  knowledge refresh-preview  Make the knowledge base's preview hold its production base's files \u2014 \`wayai knowledge --help\`
+  knowledge cut-over  Switch a preview hub's agents from their knowledge resources to the knowledge base \u2014 \`wayai knowledge --help\`
   report create      Report a platform bug (submits to the triage queue)
   report edit        Amend your own pending report (title/description/error/steps/context)
   update             Update CLI to the latest version