@wayai/cli 0.3.223 → 0.3.225

package/dist/index.js

@@ -488,6 +488,67 @@ var init_sentry = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-DHPUPI4Y.js
+function normalizeAuthType(raw) {
+  if (VALID_AUTH_TYPES.has(raw)) return raw;
+  return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
+}
+var AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, PILOT_TRACK_ROLES, COPILOT_TRACK_ROLES, CUSTOMER_FACING_AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SKILL_INSTALL_COMMAND;
+var init_chunk_DHPUPI4Y = __esm({
+  "../../packages/core/dist/chunk-DHPUPI4Y.js"() {
+    "use strict";
+    AUTH_TYPE = {
+      OAUTH: "oauth",
+      API_KEY: "api_key",
+      BASIC_AUTH: "basic_auth",
+      BEARER: "bearer",
+      NONE: "none"
+    };
+    ORG_CREDENTIAL_AUTH_TYPES = [
+      AUTH_TYPE.API_KEY,
+      AUTH_TYPE.BEARER,
+      AUTH_TYPE.BASIC_AUTH
+    ];
+    AUTH_TYPE_DISPLAY = {
+      [AUTH_TYPE.OAUTH]: "OAuth",
+      [AUTH_TYPE.API_KEY]: "API Key",
+      [AUTH_TYPE.BASIC_AUTH]: "Basic Auth",
+      [AUTH_TYPE.BEARER]: "Bearer Token",
+      [AUTH_TYPE.NONE]: "No Authentication"
+    };
+    LEGACY_AUTH_TYPE_MAP = {
+      "OAuth": AUTH_TYPE.OAUTH,
+      "API Key": AUTH_TYPE.API_KEY,
+      "Basic Auth": AUTH_TYPE.BASIC_AUTH,
+      "Bearer Token": AUTH_TYPE.BEARER,
+      "No authentication": AUTH_TYPE.NONE,
+      // Also handle the old DISPLAY_TO_CODE bug where 'basic' was used instead of 'basic_auth'
+      "basic": AUTH_TYPE.BASIC_AUTH
+    };
+    VALID_AUTH_TYPES = new Set(Object.values(AUTH_TYPE));
+    AGENT_ROLES = [
+      "pilot",
+      "copilot",
+      "pilot_specialist",
+      "copilot_specialist",
+      "pilot_advisor",
+      "copilot_advisor",
+      "monitor",
+      "conversation_evaluator",
+      "message_evaluator",
+      "summarizer",
+      "consultant",
+      "pilot_voice"
+    ];
+    PILOT_TRACK_ROLES = ["pilot", "pilot_specialist"];
+    COPILOT_TRACK_ROLES = ["copilot", "copilot_specialist"];
+    CUSTOMER_FACING_AGENT_ROLES = [...PILOT_TRACK_ROLES, "pilot_advisor"];
+    SAFE_USER_ID_REGEX = /^[A-Za-z0-9_-]{1,64}$/;
+    SUPPORTED_LOCALES = ["en", "pt", "es"];
+    SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
+  }
+});
+
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType;
 var init_util = __esm({
@@ -4604,6 +4665,47 @@ var init_zod = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-SXDX4GHS.js
+var orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody;
+var init_chunk_SXDX4GHS = __esm({
+  "../../packages/core/dist/chunk-SXDX4GHS.js"() {
+    "use strict";
+    init_chunk_DHPUPI4Y();
+    init_zod();
+    orgCredentialIdParam = external_exports.object({
+      id: external_exports.string().uuid()
+    });
+    listOrgCredentialsQuery = external_exports.object({
+      organization_id: external_exports.string().uuid(),
+      hub_id: external_exports.string().uuid().optional()
+    });
+    createOrgCredentialBody = external_exports.object({
+      organization_id: external_exports.string().uuid(),
+      credential_display_name: external_exports.string().min(1).max(255),
+      credential_description: external_exports.string().max(1e3).nullish(),
+      authentication_type: external_exports.enum(["api_key", "bearer", "basic_auth"]).or(
+        external_exports.enum(["API Key", "Bearer Token", "Basic Auth"]).transform((v) => normalizeAuthType(v))
+      ),
+      api_key: external_exports.string().optional(),
+      access_token: external_exports.string().optional(),
+      username: external_exports.string().optional(),
+      password: external_exports.string().optional(),
+      tags: external_exports.array(external_exports.string().uuid()).optional(),
+      environment: external_exports.enum(["preview", "production", "all"]).optional()
+    });
+    updateOrgCredentialBody = external_exports.object({
+      credential_display_name: external_exports.string().min(1).max(255).optional(),
+      credential_description: external_exports.string().max(1e3).nullish(),
+      api_key: external_exports.string().optional(),
+      access_token: external_exports.string().optional(),
+      username: external_exports.string().optional(),
+      password: external_exports.string().optional(),
+      tags: external_exports.array(external_exports.string().uuid()).optional(),
+      environment: external_exports.enum(["preview", "production", "all"]).optional()
+    });
+  }
+});
+
 // ../../packages/core/dist/chunk-FK6HBXM7.js
 var orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody;
 var init_chunk_FK6HBXM7 = __esm({
@@ -5011,10 +5113,10 @@ var init_chunk_Q7KIQHAZ = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-2U4BTOR7.js
-var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery;
-var init_chunk_2U4BTOR7 = __esm({
-  "../../packages/core/dist/chunk-2U4BTOR7.js"() {
+// ../../packages/core/dist/chunk-WBFLPPDI.js
+var connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, BESIDE_LINK_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery;
+var init_chunk_WBFLPPDI = __esm({
+  "../../packages/core/dist/chunk-WBFLPPDI.js"() {
     "use strict";
     init_chunk_HZ6CADSY();
     init_zod();
@@ -5044,7 +5146,8 @@ var init_chunk_2U4BTOR7 = __esm({
       hub_id: uuidSchema,
       sync_credentials_to_production: external_exports.boolean().optional()
     }).passthrough();
-    PRODUCTION_DIRECT_FIELDS = ["username", "api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "webhook_signing_secret"];
+    PRODUCTION_DIRECT_FIELDS = ["username", "api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "webhook_signing_secret", "github_app_id", "github_app_private_key"];
+    BESIDE_LINK_FIELDS = /* @__PURE__ */ new Set(["webhook_secret_token", "github_app_id", "github_app_private_key"]);
     setProductionCredentialBody = external_exports.object({
       hub_id: uuidSchema,
       organization_credential_id: external_exports.string().nullable().optional(),
@@ -5055,11 +5158,15 @@ var init_chunk_2U4BTOR7 = __esm({
       password: external_exports.string().optional(),
       refresh_token: external_exports.string().optional(),
       webhook_secret_token: external_exports.string().optional(),
-      webhook_signing_secret: external_exports.string().optional()
+      webhook_signing_secret: external_exports.string().optional(),
+      github_app_id: external_exports.string().optional(),
+      github_app_private_key: external_exports.string().optional()
     }).strict().superRefine((data, ctx) => {
       const hasOrgLink = !!data.organization_credential_id || !!data.organization_credential_token_id;
-      const hasDirect = PRODUCTION_DIRECT_FIELDS.some((f) => data[f] != null);
-      if (hasOrgLink && hasDirect) {
+      const sets = (f) => data[f] != null && data[f] !== `__USE_EXISTING_${f.toUpperCase()}__`;
+      const hasDirect = PRODUCTION_DIRECT_FIELDS.some(sets);
+      const hasDirectBesideLink = PRODUCTION_DIRECT_FIELDS.some((f) => !BESIDE_LINK_FIELDS.has(f) && sets(f));
+      if (hasOrgLink && hasDirectBesideLink) {
         ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Provide either an organization credential link or direct credential fields, not both" });
       }
       if (!hasOrgLink && !hasDirect) {
@@ -5181,108 +5288,6 @@ var init_chunk_GK27ENTT = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-DHPUPI4Y.js
-function normalizeAuthType(raw) {
-  if (VALID_AUTH_TYPES.has(raw)) return raw;
-  return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
-}
-var AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, PILOT_TRACK_ROLES, COPILOT_TRACK_ROLES, CUSTOMER_FACING_AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SKILL_INSTALL_COMMAND;
-var init_chunk_DHPUPI4Y = __esm({
-  "../../packages/core/dist/chunk-DHPUPI4Y.js"() {
-    "use strict";
-    AUTH_TYPE = {
-      OAUTH: "oauth",
-      API_KEY: "api_key",
-      BASIC_AUTH: "basic_auth",
-      BEARER: "bearer",
-      NONE: "none"
-    };
-    ORG_CREDENTIAL_AUTH_TYPES = [
-      AUTH_TYPE.API_KEY,
-      AUTH_TYPE.BEARER,
-      AUTH_TYPE.BASIC_AUTH
-    ];
-    AUTH_TYPE_DISPLAY = {
-      [AUTH_TYPE.OAUTH]: "OAuth",
-      [AUTH_TYPE.API_KEY]: "API Key",
-      [AUTH_TYPE.BASIC_AUTH]: "Basic Auth",
-      [AUTH_TYPE.BEARER]: "Bearer Token",
-      [AUTH_TYPE.NONE]: "No Authentication"
-    };
-    LEGACY_AUTH_TYPE_MAP = {
-      "OAuth": AUTH_TYPE.OAUTH,
-      "API Key": AUTH_TYPE.API_KEY,
-      "Basic Auth": AUTH_TYPE.BASIC_AUTH,
-      "Bearer Token": AUTH_TYPE.BEARER,
-      "No authentication": AUTH_TYPE.NONE,
-      // Also handle the old DISPLAY_TO_CODE bug where 'basic' was used instead of 'basic_auth'
-      "basic": AUTH_TYPE.BASIC_AUTH
-    };
-    VALID_AUTH_TYPES = new Set(Object.values(AUTH_TYPE));
-    AGENT_ROLES = [
-      "pilot",
-      "copilot",
-      "pilot_specialist",
-      "copilot_specialist",
-      "pilot_advisor",
-      "copilot_advisor",
-      "monitor",
-      "conversation_evaluator",
-      "message_evaluator",
-      "summarizer",
-      "consultant",
-      "pilot_voice"
-    ];
-    PILOT_TRACK_ROLES = ["pilot", "pilot_specialist"];
-    COPILOT_TRACK_ROLES = ["copilot", "copilot_specialist"];
-    CUSTOMER_FACING_AGENT_ROLES = [...PILOT_TRACK_ROLES, "pilot_advisor"];
-    SAFE_USER_ID_REGEX = /^[A-Za-z0-9_-]{1,64}$/;
-    SUPPORTED_LOCALES = ["en", "pt", "es"];
-    SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
-  }
-});
-
-// ../../packages/core/dist/chunk-SXDX4GHS.js
-var orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody;
-var init_chunk_SXDX4GHS = __esm({
-  "../../packages/core/dist/chunk-SXDX4GHS.js"() {
-    "use strict";
-    init_chunk_DHPUPI4Y();
-    init_zod();
-    orgCredentialIdParam = external_exports.object({
-      id: external_exports.string().uuid()
-    });
-    listOrgCredentialsQuery = external_exports.object({
-      organization_id: external_exports.string().uuid(),
-      hub_id: external_exports.string().uuid().optional()
-    });
-    createOrgCredentialBody = external_exports.object({
-      organization_id: external_exports.string().uuid(),
-      credential_display_name: external_exports.string().min(1).max(255),
-      credential_description: external_exports.string().max(1e3).nullish(),
-      authentication_type: external_exports.enum(["api_key", "bearer", "basic_auth"]).or(
-        external_exports.enum(["API Key", "Bearer Token", "Basic Auth"]).transform((v) => normalizeAuthType(v))
-      ),
-      api_key: external_exports.string().optional(),
-      access_token: external_exports.string().optional(),
-      username: external_exports.string().optional(),
-      password: external_exports.string().optional(),
-      tags: external_exports.array(external_exports.string().uuid()).optional(),
-      environment: external_exports.enum(["preview", "production", "all"]).optional()
-    });
-    updateOrgCredentialBody = external_exports.object({
-      credential_display_name: external_exports.string().min(1).max(255).optional(),
-      credential_description: external_exports.string().max(1e3).nullish(),
-      api_key: external_exports.string().optional(),
-      access_token: external_exports.string().optional(),
-      username: external_exports.string().optional(),
-      password: external_exports.string().optional(),
-      tags: external_exports.array(external_exports.string().uuid()).optional(),
-      environment: external_exports.enum(["preview", "production", "all"]).optional()
-    });
-  }
-});
-
 // ../../packages/core/dist/chunk-GPM7PE44.js
 var bootstrapQuery;
 var init_chunk_GPM7PE44 = __esm({
@@ -5517,6 +5522,34 @@ var init_chunk_ZVXO3XL6 = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-ZXK6N2HN.js
+var PEOPLE_MODERATION_NOTE_MAX_LENGTH, ADMIN_PEOPLE_REPORTS_PAGE_MAX, ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT, PEOPLE_SUSPENDED_REASON, peopleModerationActionSchema, moderationNoteSchema, adminPeopleReportListQuery, adminPeopleReportIdParam, adminPeopleMessageRemovalBody, adminPeopleSuspendBody, adminPeopleNoteBody;
+var init_chunk_ZXK6N2HN = __esm({
+  "../../packages/core/dist/chunk-ZXK6N2HN.js"() {
+    "use strict";
+    init_chunk_ZVXO3XL6();
+    init_chunk_HZ6CADSY();
+    init_zod();
+    PEOPLE_MODERATION_NOTE_MAX_LENGTH = 500;
+    ADMIN_PEOPLE_REPORTS_PAGE_MAX = 100;
+    ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT = 50;
+    PEOPLE_SUSPENDED_REASON = "suspended";
+    peopleModerationActionSchema = external_exports.enum(["remove_message", "suspend", "unsuspend", "dismiss"]);
+    moderationNoteSchema = optionalTrimmedText(PEOPLE_MODERATION_NOTE_MAX_LENGTH);
+    adminPeopleReportListQuery = external_exports.object({
+      pending: external_exports.enum(["true", "false"]).optional().transform((value) => value === "true"),
+      /** Lower bound on `created_at`. */
+      since: timestampSchema.optional(),
+      limit: external_exports.coerce.number().int().min(1).max(ADMIN_PEOPLE_REPORTS_PAGE_MAX).default(ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT),
+      offset: external_exports.coerce.number().int().min(0).default(0)
+    });
+    adminPeopleReportIdParam = external_exports.object({ reportId: uuidSchema });
+    adminPeopleMessageRemovalBody = external_exports.object({ report_id: uuidSchema, message_id: uuidSchema.optional(), note: moderationNoteSchema }).strict();
+    adminPeopleSuspendBody = external_exports.object({ report_id: uuidSchema.optional(), note: moderationNoteSchema }).strict();
+    adminPeopleNoteBody = external_exports.object({ note: moderationNoteSchema }).strict();
+  }
+});
+
 // ../../packages/core/dist/chunk-Y7CFCYX4.js
 var PEOPLE_REPORT_DETAILS_MAX_LENGTH, peopleReportReasonSchema, reportDetailsSchema, reportFields, peopleReportBody;
 var init_chunk_Y7CFCYX4 = __esm({
@@ -5572,10 +5605,10 @@ var init_chunk_5DGHIY7L = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-F3JHI4Y4.js
-var DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, AUTOMATION_WEBHOOK_MOUNT;
-var init_chunk_F3JHI4Y4 = __esm({
-  "../../packages/core/dist/chunk-F3JHI4Y4.js"() {
+// ../../packages/core/dist/chunk-5XEJSR22.js
+var DATA_PROXY_MOUNT, DATA_PROXY_PREFIX, BASE_DESTRUCTION_MOUNT, BASE_DESTRUCTION_PREFIX, BASE_DESTRUCTION_CONFIRM_PATH, COMMUNITY_EMAIL_UNSUBSCRIBE_PATH, CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH, AUTOMATION_WEBHOOK_MOUNT, MANAGED_AGENTS_WEBHOOK_MOUNT;
+var init_chunk_5XEJSR22 = __esm({
+  "../../packages/core/dist/chunk-5XEJSR22.js"() {
     "use strict";
     DATA_PROXY_MOUNT = "/data";
     DATA_PROXY_PREFIX = `/api${DATA_PROXY_MOUNT}`;
@@ -5585,10 +5618,11 @@ var init_chunk_F3JHI4Y4 = __esm({
     COMMUNITY_EMAIL_UNSUBSCRIBE_PATH = "/api/communities/email-unsubscribe";
     CONTACT_BOOK_EMAIL_UNSUBSCRIBE_PATH = "/api/contact-book/email-unsubscribe";
     AUTOMATION_WEBHOOK_MOUNT = "/webhooks/automations";
+    MANAGED_AGENTS_WEBHOOK_MOUNT = "/webhooks/managed-agents";
   }
 });
 
-// ../../packages/core/dist/chunk-IEWJ5MZH.js
+// ../../packages/core/dist/chunk-ISFDR7SP.js
 function matchPath(pattern, path42) {
   const normalizedPath = path42.replace(/\/$/, "");
   if (pattern.endsWith("/*")) {
@@ -5616,10 +5650,10 @@ function getEndpointConfig(path42) {
   return { tier: "STANDARD" };
 }
 var ENDPOINT_CONFIGS, EXCLUDED_PATHS;
-var init_chunk_IEWJ5MZH = __esm({
-  "../../packages/core/dist/chunk-IEWJ5MZH.js"() {
+var init_chunk_ISFDR7SP = __esm({
+  "../../packages/core/dist/chunk-ISFDR7SP.js"() {
     "use strict";
-    init_chunk_F3JHI4Y4();
+    init_chunk_5XEJSR22();
     ENDPOINT_CONFIGS = {
       // OAuth callbacks - strict, fail-closed (prevent brute force)
       "/oauth/callback/*": { tier: "STRICT", failClosed: true },
@@ -5774,6 +5808,8 @@ var init_chunk_IEWJ5MZH = __esm({
       // platform's egress addresses carry many tenants' deliveries. The per-automation budget is
       // `AUTOMATION_WEBHOOK_PER_AUTOMATION_LIMIT`, counted after the delivery is verified.
       [`${AUTOMATION_WEBHOOK_MOUNT}/*`]: { tier: "HIGH" },
+      // Managed Agents session events (#5083 Phase 4): HIGH, one vendor address carries many tenants'.
+      [`${MANAGED_AGENTS_WEBHOOK_MOUNT}/*`]: { tier: "HIGH" },
       // Reports (CLI → platform_report triage queue). One per-user budget covers intake
       // (POST), the content edit (PATCH /:id), the reporter read-back (GET, GET /:id), and the
       // verification loop (POST /:id/accept, /:id/contest). The limiter is path-based, so a
@@ -6082,7 +6118,7 @@ var init_chunk_IEWJ5MZH = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-CGOLULK2.js
+// ../../packages/core/dist/chunk-FNNHGL7K.js
 function fileSnapshotChanged(run) {
   return run.written + run.removed > 0;
 }
@@ -6123,11 +6159,11 @@ async function sendWithRetry(opts, cursor) {
   }
 }
 var rekorFileSnapshotAnswerSchema, FILE_SNAPSHOT_MAX_PAGES, FILE_SNAPSHOT_CONFLICT_ATTEMPTS, FILE_SNAPSHOT_PAGE_SPACING_MS, FILE_SNAPSHOT_CONFLICT_STATUS;
-var init_chunk_CGOLULK2 = __esm({
-  "../../packages/core/dist/chunk-CGOLULK2.js"() {
+var init_chunk_FNNHGL7K = __esm({
+  "../../packages/core/dist/chunk-FNNHGL7K.js"() {
     "use strict";
-    init_chunk_IEWJ5MZH();
-    init_chunk_F3JHI4Y4();
+    init_chunk_ISFDR7SP();
+    init_chunk_5XEJSR22();
     init_zod();
     rekorFileSnapshotAnswerSchema = external_exports.object({
       data: external_exports.object({
@@ -6531,6 +6567,20 @@ var init_chunk_YUZFHVB2 = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-I3O2RACG.js
+var managedAgentsWebhookParams, MANAGED_AGENTS_WEBHOOK_BODY_MAX_BYTES;
+var init_chunk_I3O2RACG = __esm({
+  "../../packages/core/dist/chunk-I3O2RACG.js"() {
+    "use strict";
+    init_zod();
+    managedAgentsWebhookParams = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      connection_id: external_exports.string().uuid()
+    });
+    MANAGED_AGENTS_WEBHOOK_BODY_MAX_BYTES = 16 * 1024;
+  }
+});
+
 // ../../packages/core/dist/chunk-34LE6P7E.js
 var templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody;
 var init_chunk_34LE6P7E = __esm({
@@ -6606,34 +6656,6 @@ var init_chunk_FPSDNS2E = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-ZXK6N2HN.js
-var PEOPLE_MODERATION_NOTE_MAX_LENGTH, ADMIN_PEOPLE_REPORTS_PAGE_MAX, ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT, PEOPLE_SUSPENDED_REASON, peopleModerationActionSchema, moderationNoteSchema, adminPeopleReportListQuery, adminPeopleReportIdParam, adminPeopleMessageRemovalBody, adminPeopleSuspendBody, adminPeopleNoteBody;
-var init_chunk_ZXK6N2HN = __esm({
-  "../../packages/core/dist/chunk-ZXK6N2HN.js"() {
-    "use strict";
-    init_chunk_ZVXO3XL6();
-    init_chunk_HZ6CADSY();
-    init_zod();
-    PEOPLE_MODERATION_NOTE_MAX_LENGTH = 500;
-    ADMIN_PEOPLE_REPORTS_PAGE_MAX = 100;
-    ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT = 50;
-    PEOPLE_SUSPENDED_REASON = "suspended";
-    peopleModerationActionSchema = external_exports.enum(["remove_message", "suspend", "unsuspend", "dismiss"]);
-    moderationNoteSchema = optionalTrimmedText(PEOPLE_MODERATION_NOTE_MAX_LENGTH);
-    adminPeopleReportListQuery = external_exports.object({
-      pending: external_exports.enum(["true", "false"]).optional().transform((value) => value === "true"),
-      /** Lower bound on `created_at`. */
-      since: timestampSchema.optional(),
-      limit: external_exports.coerce.number().int().min(1).max(ADMIN_PEOPLE_REPORTS_PAGE_MAX).default(ADMIN_PEOPLE_REPORTS_PAGE_DEFAULT),
-      offset: external_exports.coerce.number().int().min(0).default(0)
-    });
-    adminPeopleReportIdParam = external_exports.object({ reportId: uuidSchema });
-    adminPeopleMessageRemovalBody = external_exports.object({ report_id: uuidSchema, message_id: uuidSchema.optional(), note: moderationNoteSchema }).strict();
-    adminPeopleSuspendBody = external_exports.object({ report_id: uuidSchema.optional(), note: moderationNoteSchema }).strict();
-    adminPeopleNoteBody = external_exports.object({ note: moderationNoteSchema }).strict();
-  }
-});
-
 // ../../packages/core/dist/chunk-MIWZOSPI.js
 function toIso(epochMs) {
   return new Date(epochMs).toISOString();
@@ -6789,7 +6811,7 @@ var init_chunk_E4DIIOOE = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-4MXPUC6I.js
+// ../../packages/core/dist/chunk-OGXIPFQY.js
 function spokenLineField(label, description2) {
   return { type: "text", label, maxLength: SPOKEN_LINE_MAX_CHARS, default: "", description: description2 };
 }
@@ -6799,8 +6821,8 @@ function byLowercaseName(a, b) {
   return x < y ? -1 : x > y ? 1 : 0;
 }
 var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, SANDBOX_AGENT_FIELDS, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, REKOR_TOOLSET_SERVICE_NAME, rekorToolset, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeManagedAgents, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
-var init_chunk_4MXPUC6I = __esm({
-  "../../packages/core/dist/chunk-4MXPUC6I.js"() {
+var init_chunk_OGXIPFQY = __esm({
+  "../../packages/core/dist/chunk-OGXIPFQY.js"() {
     "use strict";
     CALLER_LANGUAGE = "caller";
     TTS_VOICE_REPLY_ENABLED_FIELD = {
@@ -6838,7 +6860,7 @@ var init_chunk_4MXPUC6I = __esm({
           { value: "agent", label: "Agent (private to this agent)" }
         ],
         default: "conversation",
-        description: "Whose sandbox this agent uses. Conversation: shared with the conversation's other agents; every agent sharing it sees its files, and agents sharing it need the same Sandbox Network setting, or a command from one ends the sandbox and starts an empty one. Agent: private to this agent; no other agent sees its files. Set Agent for an agent that handles files others must not see, such as a copilot with internal documents. Each agent sandbox is its own container, counts toward the organization's limit on running sandboxes, and ends with the conversation."
+        description: "Whose sandbox this agent uses. Conversation: shared with the conversation's other agents; every agent sharing it sees its files, and agents sharing it need the same Sandbox Network setting, or a command from one ends the sandbox and starts a new one, which keeps its /workspace files but none of its running processes. Agent: private to this agent; no other agent sees its files. Set Agent for an agent that handles files others must not see, such as a copilot with internal documents. Each agent sandbox is its own container, counts toward the organization's limit on running sandboxes, and ends with the conversation."
       },
       sandbox_network: {
         type: "select",
@@ -7664,12 +7686,12 @@ var init_chunk_4MXPUC6I = __esm({
         // The managed session is conversation-lifetime and is NOT reaped at this deadline.
         max_session_minutes: { type: "number", label: "Max Turn (minutes)", min: 1, max: 480, default: 60, description: "Hard cap on a single turn's drain wall-clock, and the bound on the per-turn harness token TTL. The managed session itself lives for the conversation \u2014 it is not reaped at this deadline." },
         ...HARNESS_EGRESS_FIELDS,
-        // repo_url only, with no `repo_branch`. The Managed Agents
-        // `github_repository` resource exposes no branch/ref/checkout field, so a
-        // `repo_branch` setting could not be honoured; per this connector's own rule it is
-        // ABSENT rather than silently ignored. Working on a non-default branch is an
-        // agent-instruction concern (the agent checks out via git / the GitHub MCP server).
-        repo_url: { type: "text", label: "Repository URL", description: "Optional git repository cloned into the managed workspace at session start. The managed API clones the DEFAULT branch and exposes no branch setting \u2014 to work on another branch, instruct the agent to check it out." },
+        // repo_url only, with no `repo_branch`: the session clones the default branch. The
+        // vendor's `github_repository` resource now takes a `checkout` (branch or commit,
+        // platform.claude.com/docs/en/managed-agents/github, 2026-10-19); a branch setting is
+        // left to the "work on a repository" agent template (wayai-pro/wayai#5083 Phase 4).
+        // Until then, working on another branch is an agent-instruction concern.
+        repo_url: { type: "text", label: "Repository URL", description: "Optional GitHub repository (https://github.com/<owner>/<repo>) cloned into the managed workspace at session start. Needs the connection's GitHub App installed on it. The DEFAULT branch is cloned \u2014 to work on another branch, instruct the agent to check it out." },
         ...COPILOT_TRIGGER_FIELD
       },
       channel_settings_schema: null,
@@ -7678,7 +7700,9 @@ var init_chunk_4MXPUC6I = __esm({
         api_key: {
           connection_display_name: { type: "text", label: "Connection Name", placeholder: "Enter a name for this connection", description: "This name will be used to identify the connection in the system", required: true },
           api_key: { type: "password", label: "API Key", placeholder: "Enter your Anthropic API key", description: "Anthropic API key for the Managed Agents API. Used only from the WayAI Worker \u2014 no sandbox ever sees it.", required: true, maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_API_KEY__" },
-          access_token: { type: "password", label: "GitHub Token (Optional)", placeholder: "Enter a GitHub personal access token", description: "Optional: personal access token for the repo_url checkout. Anthropic's git proxy injects it after requests leave the sandbox \u2014 it never enters the sandbox.", maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_ACCESS_TOKEN__" }
+          github_app_id: { type: "password", label: "GitHub App ID (Optional)", placeholder: "Your GitHub App's App ID", description: "Optional: the App ID of your organization's GitHub App, for agents with a Repository URL. Each session gets a one-hour token for its one repository, with contents and pull requests access only.", maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_GITHUB_APP_ID__" },
+          github_app_private_key: { type: "password", label: "GitHub App Private Key (Optional)", placeholder: "-----BEGIN RSA PRIVATE KEY-----", description: "Optional: the private key (.pem) GitHub generated for that App. It stays in WayAI: only each session's one-hour token reaches Anthropic.", maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_GITHUB_APP_PRIVATE_KEY__" },
+          webhook_secret_token: { type: "password", label: "Webhook Signing Secret", placeholder: "whsec_\u2026", description: "Signing secret of this connection's webhook endpoint in the Claude Console. Without it, a finished turn is picked up only by a check every 5 minutes.", maskInEdit: true, useExistingPlaceholder: "__USE_EXISTING_WEBHOOK_SECRET_TOKEN__" }
         }
       },
       token_refresh_config: { api_key: { strategy: "none" } },
@@ -7764,13 +7788,13 @@ var init_chunk_4MXPUC6I = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-NTJMGSSO.js
+// ../../packages/core/dist/chunk-QZZ3OHLV.js
 var evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse;
-var init_chunk_NTJMGSSO = __esm({
-  "../../packages/core/dist/chunk-NTJMGSSO.js"() {
+var init_chunk_QZZ3OHLV = __esm({
+  "../../packages/core/dist/chunk-QZZ3OHLV.js"() {
     "use strict";
     init_chunk_E4DIIOOE();
-    init_chunk_4MXPUC6I();
+    init_chunk_OGXIPFQY();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
     init_zod();
@@ -8137,15 +8161,15 @@ var init_chunk_MH4O3YEX = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-CWUV6NL3.js
+// ../../packages/core/dist/chunk-UZ7SPBM3.js
 function catalogToolSideEffects(toolName) {
   const sideEffects = CATALOG_SIDE_EFFECTS.get(toolName);
   if (sideEffects === void 0) return "unknown";
   return sideEffects ? "side_effects" : "none";
 }
 var NATIVE_TOOL_SCHEMAS, WAYAI_CONNECTOR, SANDBOX_AGENT_ROLES, BASE_NATIVE_TOOLS, NATIVE_TOOLS, CATALOG_SIDE_EFFECTS;
-var init_chunk_CWUV6NL3 = __esm({
-  "../../packages/core/dist/chunk-CWUV6NL3.js"() {
+var init_chunk_UZ7SPBM3 = __esm({
+  "../../packages/core/dist/chunk-UZ7SPBM3.js"() {
     "use strict";
     init_chunk_DHPUPI4Y();
     NATIVE_TOOL_SCHEMAS = {
@@ -8466,7 +8490,7 @@ var init_chunk_CWUV6NL3 = __esm({
       "bash": {
         "tool_config": {
           "name": "bash",
-          "description": "Run a Bash command in this conversation's sandbox: a disposable Linux container (Debian, with Python 3, curl, jq, zip and other common tools) whose working directory is /workspace. The sandbox starts on the first command and keeps its files between commands in this conversation, but it ends after 10 minutes without use or 60 minutes in all; the next command then starts an empty one, and its result says so. What the sandbox can reach over the network is set for this agent by a hub admin; with no network, nothing leaves it. A command runs for at most timeout_seconds and never past the turn's own time limit. Long output keeps only its first and last parts. The result gives the exit code, stdout and stderr.",
+          "description": "Run a Bash command in this conversation's sandbox: a disposable Linux container (Debian, with Python 3, curl, jq, zip and other common tools) whose working directory is /workspace. The sandbox starts on the first command and keeps its files between commands in this conversation, but it ends after 10 minutes without use or 60 minutes in all; the next command then starts a new one with the /workspace files from the last save, made when a sandbox stopped and at the end of each turn that ran a command, and its result says what came back. Only files under /workspace are kept, never a running process: a long job should write its progress to files under /workspace, so the work can go on from them. HOME is /workspace, so a pip install --user, or a virtual environment under /workspace, is kept too; a plain pip install is not. Installs count toward the saved workspace's size, and when it is too large to keep, what is under /workspace/.local is left out first. What the sandbox can reach over the network is set for this agent by a hub admin; with no network, nothing leaves it. A command runs for at most timeout_seconds and never past the turn's own time limit. Long output keeps only its first and last parts. The result gives the exit code, stdout and stderr.",
           "strict": false,
           "parameters": {
             "type": "object",
@@ -8493,7 +8517,7 @@ var init_chunk_CWUV6NL3 = __esm({
       "copy_to_sandbox": {
         "tool_config": {
           "name": "copy_to_sandbox",
-          "description": `Copy one of this conversation's files, or one of your documents, into the code sandbox, so commands run with bash can read or edit it there. path names the file as read_file does: this conversation's attachments under "conversation/" (e.g. "conversation/report.xlsx"), an earlier conversation's under "conversations/<conversation_id>/<name>", or a document under "data/<file-type>/" (e.g. "data/contracts/acme/msa.docx"), whose result gives the version you copied: pass it to copy_from_sandbox to copy the document back. Hub resource files cannot be copied. The copy lands at sandbox_path, replacing any file there; a file larger than 25 MiB is refused, and a document larger than 1 MiB. If no sandbox is running, the copy starts an empty one.`,
+          "description": `Copy one of this conversation's files, or one of your documents, into the code sandbox, so commands run with bash can read or edit it there. path names the file as read_file does: this conversation's attachments under "conversation/" (e.g. "conversation/report.xlsx"), an earlier conversation's under "conversations/<conversation_id>/<name>", or a document under "data/<file-type>/" (e.g. "data/contracts/acme/msa.docx"), whose result gives the version you copied: pass it to copy_from_sandbox to copy the document back. Hub resource files cannot be copied. The copy lands at sandbox_path, replacing any file there; a file larger than 25 MiB is refused, and a document larger than 1 MiB. If no sandbox is running, the copy starts one, with the /workspace files from the last save.`,
           "strict": false,
           "parameters": {
             "type": "object",
@@ -9465,7 +9489,7 @@ var init_chunk_T7KQKDET = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-7PJOBY4O.js
+// ../../packages/core/dist/chunk-XOGFONTQ.js
 function resolveMonitorTrigger(monitorConfig) {
   if (!monitorConfig || typeof monitorConfig !== "object") return "idle";
   const raw = monitorConfig.trigger;
@@ -9771,10 +9795,10 @@ function refineMonitorRulesStructuredOutput(body, ctx) {
   if (refusal2) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["response_format"], message: refusal2 });
 }
 var NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, AUTOMATION_GATE_TRIGGERS, NON_FIRING_TRIGGERS, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, MONITOR_GATE_AGENT_NAME_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, MONITOR_AUTOMATION_FIRE_ACTION_KINDS, MONITOR_AUTOMATION_ITEM_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE, AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE, AUTOMATION_GATE_KEY_MESSAGES, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody;
-var init_chunk_7PJOBY4O = __esm({
-  "../../packages/core/dist/chunk-7PJOBY4O.js"() {
+var init_chunk_XOGFONTQ = __esm({
+  "../../packages/core/dist/chunk-XOGFONTQ.js"() {
     "use strict";
-    init_chunk_CWUV6NL3();
+    init_chunk_UZ7SPBM3();
     init_chunk_IBL7FANV();
     init_chunk_PFDZEKDE();
     init_chunk_HZ6CADSY();
@@ -9997,12 +10021,12 @@ var init_chunk_7PJOBY4O = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-CYBQP65X.js
+// ../../packages/core/dist/chunk-TUP5Y6ZB.js
 var conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody;
-var init_chunk_CYBQP65X = __esm({
-  "../../packages/core/dist/chunk-CYBQP65X.js"() {
+var init_chunk_TUP5Y6ZB = __esm({
+  "../../packages/core/dist/chunk-TUP5Y6ZB.js"() {
     "use strict";
-    init_chunk_7PJOBY4O();
+    init_chunk_XOGFONTQ();
     init_chunk_HZ6CADSY();
     init_chunk_DHPUPI4Y();
     init_zod();
@@ -10458,7 +10482,7 @@ var init_chunk_BPCNB5RT = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-NRJINQVD.js
+// ../../packages/core/dist/chunk-LQSENJ26.js
 function idempotencyHeaderRefusal(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(value)) {
     return "idempotency_header must be a header name: letters, digits and dashes, at most 64";
@@ -10469,10 +10493,10 @@ function idempotencyHeaderRefusal(value) {
   return null;
 }
 var CATALOG_REPLAY, REPLAY_OVERRIDES, RESERVED_HEADERS;
-var init_chunk_NRJINQVD = __esm({
-  "../../packages/core/dist/chunk-NRJINQVD.js"() {
+var init_chunk_LQSENJ26 = __esm({
+  "../../packages/core/dist/chunk-LQSENJ26.js"() {
     "use strict";
-    init_chunk_CWUV6NL3();
+    init_chunk_UZ7SPBM3();
     CATALOG_REPLAY = new Map(
       NATIVE_TOOLS.map((tool) => [tool.tool_name, tool.replay])
     );
@@ -10705,7 +10729,7 @@ var init_chunk_WEXVYJ5H = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-QXHWCZ74.js
+// ../../packages/core/dist/chunk-KRGVB7U6.js
 function refineToolConfig(value, ctx) {
   const raw = value.tool_config;
   if (raw == null) return;
@@ -10741,10 +10765,10 @@ function refineToolConfig(value, ctx) {
   }
 }
 var toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, toolReplaySettingsFields, toolReplaySettingsSchema, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody;
-var init_chunk_QXHWCZ74 = __esm({
-  "../../packages/core/dist/chunk-QXHWCZ74.js"() {
+var init_chunk_KRGVB7U6 = __esm({
+  "../../packages/core/dist/chunk-KRGVB7U6.js"() {
     "use strict";
-    init_chunk_NRJINQVD();
+    init_chunk_LQSENJ26();
     init_chunk_WEXVYJ5H();
     init_chunk_HZ6CADSY();
     init_zod();
@@ -12116,7 +12140,7 @@ var init_chunk_6NI5RAM4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-QJTHNMWD.js
+// ../../packages/core/dist/chunk-RT35VFUY.js
 function refineHubAsCodeCustomTools(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -12652,12 +12676,12 @@ function refineHubAsCodeMonitorRulesOutput(config, ctx) {
   });
 }
 var MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
-var init_chunk_QJTHNMWD = __esm({
-  "../../packages/core/dist/chunk-QJTHNMWD.js"() {
+var init_chunk_RT35VFUY = __esm({
+  "../../packages/core/dist/chunk-RT35VFUY.js"() {
     "use strict";
-    init_chunk_QXHWCZ74();
+    init_chunk_KRGVB7U6();
     init_chunk_623SRYWZ();
-    init_chunk_7PJOBY4O();
+    init_chunk_XOGFONTQ();
     init_chunk_LBDH7LCG();
     init_chunk_4LXDRTO4();
     init_chunk_T4Q5COKJ();
@@ -13666,15 +13690,15 @@ var init_chunk_LQY2OCQL = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-UWFYCJCK.js
+// ../../packages/core/dist/chunk-2VTDOH67.js
 var AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam;
-var init_chunk_UWFYCJCK = __esm({
-  "../../packages/core/dist/chunk-UWFYCJCK.js"() {
+var init_chunk_2VTDOH67 = __esm({
+  "../../packages/core/dist/chunk-2VTDOH67.js"() {
     "use strict";
     init_chunk_LQY2OCQL();
-    init_chunk_7PJOBY4O();
+    init_chunk_XOGFONTQ();
     init_chunk_3HSB6J4J();
-    init_chunk_F3JHI4Y4();
+    init_chunk_5XEJSR22();
     init_chunk_DHPUPI4Y();
     init_chunk_T7KQKDET();
     init_zod();
@@ -14917,29 +14941,30 @@ var init_chunk_TS4EYU3W = __esm({
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
+    init_chunk_SXDX4GHS();
     init_chunk_FK6HBXM7();
     init_chunk_VXEAR36B();
     init_chunk_TIZ57ZBA();
     init_chunk_Q7KIQHAZ();
-    init_chunk_2U4BTOR7();
+    init_chunk_WBFLPPDI();
     init_chunk_IPXBFWUU();
     init_chunk_GK27ENTT();
-    init_chunk_SXDX4GHS();
     init_chunk_GPM7PE44();
     init_chunk_DGKMMFIR();
     init_chunk_ZC6YGHNX();
     init_chunk_ACKF2MVU();
+    init_chunk_ZXK6N2HN();
     init_chunk_Y7CFCYX4();
     init_chunk_5DGHIY7L();
-    init_chunk_CGOLULK2();
+    init_chunk_FNNHGL7K();
     init_chunk_4MRBBR5L();
     init_chunk_BEOHBREG();
     init_chunk_IPDOHAZ5();
     init_chunk_YUZFHVB2();
+    init_chunk_I3O2RACG();
     init_chunk_34LE6P7E();
     init_chunk_FPSDNS2E();
-    init_chunk_ZXK6N2HN();
-    init_chunk_NTJMGSSO();
+    init_chunk_QZZ3OHLV();
     init_chunk_C4HEZ7ZI();
     init_chunk_IR2NOSI3();
     init_chunk_EA23LSDS();
@@ -14947,12 +14972,12 @@ var init_contracts = __esm({
     init_chunk_LWMLR2WI();
     init_chunk_ACGAI25T();
     init_chunk_MH4O3YEX();
-    init_chunk_CYBQP65X();
+    init_chunk_TUP5Y6ZB();
     init_chunk_KSTYTQ7I();
     init_chunk_LKBSHANA();
     init_chunk_BPCNB5RT();
-    init_chunk_QJTHNMWD();
-    init_chunk_QXHWCZ74();
+    init_chunk_RT35VFUY();
+    init_chunk_KRGVB7U6();
     init_chunk_623SRYWZ();
     init_chunk_JDJ4EUOL();
     init_chunk_3KYTITOR();
@@ -14962,9 +14987,9 @@ var init_contracts = __esm({
     init_chunk_YULHXJ5M();
     init_chunk_V4FRPRH5();
     init_chunk_ZHJEQBXJ();
-    init_chunk_UWFYCJCK();
+    init_chunk_2VTDOH67();
     init_chunk_LQY2OCQL();
-    init_chunk_7PJOBY4O();
+    init_chunk_XOGFONTQ();
     init_chunk_3HSB6J4J();
     init_chunk_IG6QBZMA();
     init_chunk_ZJJ5ODOD();
@@ -14973,9 +14998,9 @@ var init_contracts = __esm({
     init_chunk_4LXDRTO4();
     init_chunk_E4DIIOOE();
     init_chunk_7CYHPF35();
-    init_chunk_4MXPUC6I();
-    init_chunk_NRJINQVD();
-    init_chunk_CWUV6NL3();
+    init_chunk_OGXIPFQY();
+    init_chunk_LQSENJ26();
+    init_chunk_UZ7SPBM3();
     init_chunk_NVKU5PPQ();
     init_chunk_2FCLSQSQ();
     init_chunk_FECLIZTY();
@@ -14988,11 +15013,11 @@ var init_contracts = __esm({
     init_chunk_OMPT4ZHR();
     init_chunk_2PZIF56U();
     init_chunk_UEJOG2Q7();
-    init_chunk_IEWJ5MZH();
+    init_chunk_ISFDR7SP();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
     init_chunk_LZDVDC2S();
-    init_chunk_F3JHI4Y4();
+    init_chunk_5XEJSR22();
     init_chunk_IBL7FANV();
     init_chunk_PFDZEKDE();
     init_chunk_VORPHGDT();
@@ -16316,11 +16341,11 @@ var UUID_RE2, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
-    init_chunk_IEWJ5MZH();
+    init_chunk_ISFDR7SP();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
     init_chunk_LZDVDC2S();
-    init_chunk_F3JHI4Y4();
+    init_chunk_5XEJSR22();
     init_chunk_IBL7FANV();
     init_chunk_PFDZEKDE();
     init_chunk_P3AWZG3N();
@@ -21859,6 +21884,7 @@ var init_types2 = __esm({
     ENTITY_KINDS = [
       "record_types",
       "relationship_types",
+      "file_types",
       "inbound_webhooks",
       "triggers",
       "toolsets",
@@ -21868,6 +21894,7 @@ var init_types2 = __esm({
     ENTITY_DIRS = {
       record_types: "record-types",
       relationship_types: "relationship-types",
+      file_types: "file-types",
       inbound_webhooks: "inbound-webhooks",
       triggers: "triggers",
       toolsets: "toolsets",
@@ -22004,6 +22031,7 @@ var init_config_writer = __esm({
         "target_record_types",
         "cascade"
       ],
+      file_types: ["id", "name", "description", "icon", "color", "max_size", "allowed_content_types", "metadata_schema"],
       inbound_webhooks: [
         "id",
         "name",
@@ -22157,9 +22185,12 @@ function parseBaseFolder(folder) {
     );
   }
   const read = (kind) => readEntityDir(folder, path22.join(folder, ENTITY_DIRS[kind]));
+  const fileTypesDir = path22.join(folder, ENTITY_DIRS.file_types);
+  const fileTypes = readEntityDir(folder, fileTypesDir);
   const config = {
     record_types: read("record_types"),
     relationship_types: read("relationship_types"),
+    ...isDirectory(fileTypesDir) ? { file_types: fileTypes } : {},
     inbound_webhooks: read("inbound_webhooks"),
     triggers: read("triggers"),
     toolsets: read("toolsets"),
@@ -22189,10 +22220,15 @@ function isEmptyBucket(b) {
 function isDiffEmpty(diff) {
   return ENTITY_KINDS.every((kind) => isEmptyBucket(bucket(diff, kind)));
 }
+function isPrunable(id) {
+  return isPathSafeId(id);
+}
 function collectRemovals(diff) {
   const out = [];
   for (const kind of ENTITY_KINDS) {
-    for (const entity of bucket(diff, kind)?.removed ?? []) out.push({ kind, id: entity.id });
+    for (const entity of bucket(diff, kind)?.removed ?? []) {
+      if (isPrunable(entity.id)) out.push({ kind, id: entity.id });
+    }
   }
   return out;
 }
@@ -22205,7 +22241,7 @@ function countChanges(diff) {
     if (!b) continue;
     added += b.added.length;
     modified += b.modified.length;
-    removed += b.removed.length;
+    removed += b.removed.filter((e) => isPrunable(e.id)).length;
   }
   return { added, modified, removed };
 }
@@ -22217,7 +22253,11 @@ function renderDiff(diff) {
     lines.push(`${BOLD}${LABELS[kind]}s${RESET}`);
     for (const e of b.added) lines.push(`${GREEN}  + ${sanitizeTerminalText(e.id)}${RESET}`);
     for (const m of b.modified) lines.push(`${YELLOW}  ~ ${sanitizeTerminalText(m.after.id)}${RESET}`);
-    for (const e of b.removed) lines.push(`${RED}  - ${sanitizeTerminalText(e.id)}${RESET}`);
+    for (const e of b.removed) {
+      lines.push(
+        isPrunable(e.id) ? `${RED}  - ${sanitizeTerminalText(e.id)}${RESET}` : `${YELLOW}  = ${sanitizeTerminalText(e.id)} (kept: pull cannot write its id to a file)${RESET}`
+      );
+    }
   }
   const { added, modified, removed } = countChanges(diff);
   lines.push("");
@@ -22226,7 +22266,7 @@ function renderDiff(diff) {
   );
   if (removed > 0) {
     lines.push(
-      `${RED}  ${removed} entit${removed === 1 ? "y" : "ies"} exist on the base but not in your files \u2014 re-run with --prune to delete (record types cascade to their records).${RESET}`
+      `${RED}  ${removed} entit${removed === 1 ? "y" : "ies"} exist on the base but not in your files \u2014 re-run with --prune to delete (record types cascade to their records, file types to their files).${RESET}`
     );
   }
   return lines.join("\n");
@@ -22236,10 +22276,12 @@ var init_diff_format = __esm({
   "src/data/config-as-code/diff-format.ts"() {
     "use strict";
     init_terminal_output();
+    init_base_id();
     init_types2();
     LABELS = {
       record_types: "record type",
       relationship_types: "relationship type",
+      file_types: "file type",
       inbound_webhooks: "inbound webhook",
       triggers: "trigger",
       toolsets: "toolset",
@@ -22461,7 +22503,7 @@ ${RED}${removals.length} ${word} not in your files were left on the base. Re-run
       );
     } else if (autoConfirm || await confirm(
       `
-Delete ${removals.length} server ${word} not in your files? Record types cascade to their records.`
+Delete ${removals.length} server ${word} not in your files? Record types cascade to their records, file types to their files.`
     )) {
       for (const removal of removals) {
         await deleteEntity(client, baseId2, removal.kind, removal.id);
@@ -32585,7 +32627,7 @@ var init_set_connection_credential = __esm({
     init_workspace();
     init_utils();
     init_push();
-    VALID_FIELDS = ["api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "username"];
+    VALID_FIELDS = ["api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "username", "github_app_id", "github_app_private_key"];
   }
 });
 
@@ -34816,6 +34858,7 @@ function metadataValue(value) {
 function fileWriteHeaders(opts) {
   const headers = {};
   if (opts.ifMatch !== void 0) headers["If-Match"] = ifMatchValue(opts.ifMatch);
+  if (opts.createOnly) headers["If-None-Match"] = "*";
   if (opts.label !== void 0) headers["X-Data-Label"] = labelValue(opts.label);
   if (opts.metadata !== void 0) headers["X-Data-Metadata"] = metadataValue(opts.metadata);
   return headers;
@@ -35314,9 +35357,9 @@ var COUNTER_KEYS, STT_PRICING, CONTAINER_PRICING, connectorById, nativeToolById;
 var init_catalog = __esm({
   "../../packages/core/dist/catalog/index.js"() {
     "use strict";
-    init_chunk_4MXPUC6I();
-    init_chunk_NRJINQVD();
-    init_chunk_CWUV6NL3();
+    init_chunk_OGXIPFQY();
+    init_chunk_LQSENJ26();
+    init_chunk_UZ7SPBM3();
     init_chunk_MIWZOSPI();
     init_chunk_DHPUPI4Y();
     COUNTER_KEYS = Object.keys({
@@ -40547,7 +40590,7 @@ Push ${n} change${n === 1 ? "" : "s"} to ${describeSync(target)}?`, opts.yes)) {
           path42,
           bytes,
           contentType,
-          fileWriteHeaders({ ifMatch: step.op === "update" ? step.ifMatch : void 0, label })
+          fileWriteHeaders({ ...step.op === "update" ? { ifMatch: step.ifMatch } : { createOnly: true }, label })
         );
         record.files[step.rel] = {
           version: typeof row?.version === "number" ? row.version : 0,
@@ -40561,7 +40604,8 @@ Push ${n} change${n === 1 ? "" : "s"} to ${describeSync(target)}?`, opts.yes)) {
         delete record.files[step.rel];
       } else if (isConflict(err)) {
         if (step.op === "delete") refusedDeletes.add(step.rel);
-        const conflict = { rel: step.rel, reason: "changed_while_pushing" };
+        const reason = step.op === "create" && err.status === 412 ? "created_while_pushing" : "changed_while_pushing";
+        const conflict = { rel: step.rel, reason };
         conflicts.push(conflict);
         console.log(`  ! ${conflictLine(conflict, PUSH_CONFLICT)}`);
         continue;
@@ -40624,7 +40668,8 @@ var init_sync3 = __esm({
       exists_on_base: "created on the base since your last pull",
       case_twin: "differs only in case from the base's",
       file_folder: "would make one path both a file and a folder with the base's",
-      changed_while_pushing: "changed on the base while pushing \u2014 not written"
+      changed_while_pushing: "changed on the base while pushing \u2014 not written",
+      created_while_pushing: "created on the base while pushing \u2014 not written"
     };
   }
 });
@@ -40808,7 +40853,7 @@ function buildFilesCommand() {
     });
   });
   files.command("push <file_type>").description(
-    "Push the local changes of a folder pulled with `files pull` to the base, after showing the diff. A file changed, deleted or created on the base since your pull is a conflict, not written; an update or delete also carries the version pulled, so the base refuses it if the file changed meanwhile"
+    "Push the local changes of a folder pulled with `files pull` to the base, after showing the diff. A file changed, deleted or created on the base since your pull is a conflict, not written; an update or delete also carries the version pulled and a new file is sent create-only, so the base refuses a write to a file changed or created meanwhile"
   ).option("--folder <path>", "The folder of the file type the local folder was pulled from").option("--dir <local>", "Local folder to push (default ./<file_type>, or ./<file_type>/<folder>)").option("--dry-run", "Show the diff and push nothing").option("--prune", "Also delete files you deleted locally \u2014 only those unchanged on the base since your pull").option("--label <text>", "Label for every content version the push creates (printable ASCII)").option("-y, --yes", "Push without asking").action(async function(fileType, opts) {
     const base = requireBase(this);
     await pushFiles({