@wayai/cli 0.3.229 → 0.3.231

package/dist/index.js

@@ -488,67 +488,6 @@ var init_sentry = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-DHPUPI4Y.js
-function normalizeAuthType(raw) {
-  if (VALID_AUTH_TYPES.has(raw)) return raw;
-  return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
-}
-var AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, PILOT_TRACK_ROLES, COPILOT_TRACK_ROLES, CUSTOMER_FACING_AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SKILL_INSTALL_COMMAND;
-var init_chunk_DHPUPI4Y = __esm({
-  "../../packages/core/dist/chunk-DHPUPI4Y.js"() {
-    "use strict";
-    AUTH_TYPE = {
-      OAUTH: "oauth",
-      API_KEY: "api_key",
-      BASIC_AUTH: "basic_auth",
-      BEARER: "bearer",
-      NONE: "none"
-    };
-    ORG_CREDENTIAL_AUTH_TYPES = [
-      AUTH_TYPE.API_KEY,
-      AUTH_TYPE.BEARER,
-      AUTH_TYPE.BASIC_AUTH
-    ];
-    AUTH_TYPE_DISPLAY = {
-      [AUTH_TYPE.OAUTH]: "OAuth",
-      [AUTH_TYPE.API_KEY]: "API Key",
-      [AUTH_TYPE.BASIC_AUTH]: "Basic Auth",
-      [AUTH_TYPE.BEARER]: "Bearer Token",
-      [AUTH_TYPE.NONE]: "No Authentication"
-    };
-    LEGACY_AUTH_TYPE_MAP = {
-      "OAuth": AUTH_TYPE.OAUTH,
-      "API Key": AUTH_TYPE.API_KEY,
-      "Basic Auth": AUTH_TYPE.BASIC_AUTH,
-      "Bearer Token": AUTH_TYPE.BEARER,
-      "No authentication": AUTH_TYPE.NONE,
-      // Also handle the old DISPLAY_TO_CODE bug where 'basic' was used instead of 'basic_auth'
-      "basic": AUTH_TYPE.BASIC_AUTH
-    };
-    VALID_AUTH_TYPES = new Set(Object.values(AUTH_TYPE));
-    AGENT_ROLES = [
-      "pilot",
-      "copilot",
-      "pilot_specialist",
-      "copilot_specialist",
-      "pilot_advisor",
-      "copilot_advisor",
-      "monitor",
-      "conversation_evaluator",
-      "message_evaluator",
-      "summarizer",
-      "consultant",
-      "pilot_voice"
-    ];
-    PILOT_TRACK_ROLES = ["pilot", "pilot_specialist"];
-    COPILOT_TRACK_ROLES = ["copilot", "copilot_specialist"];
-    CUSTOMER_FACING_AGENT_ROLES = [...PILOT_TRACK_ROLES, "pilot_advisor"];
-    SAFE_USER_ID_REGEX = /^[A-Za-z0-9_-]{1,64}$/;
-    SUPPORTED_LOCALES = ["en", "pt", "es"];
-    SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
-  }
-});
-
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType;
 var init_util = __esm({
@@ -4665,6 +4604,99 @@ var init_zod = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-GK27ENTT.js
+var BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery;
+var init_chunk_GK27ENTT = __esm({
+  "../../packages/core/dist/chunk-GK27ENTT.js"() {
+    "use strict";
+    init_zod();
+    BASE_CREDENTIAL_MANAGED_BY = {
+      DIRECT: "direct",
+      ORG_LINK: "org-link"
+    };
+    BASE_CREDENTIAL_NAME_MAX = 100;
+    baseCredentialNameSchema = external_exports.string().min(1).max(BASE_CREDENTIAL_NAME_MAX).regex(
+      /^[A-Za-z0-9][A-Za-z0-9._:@+~=-]*$/,
+      "name must use letters, digits and '. _ : @ + ~ = -', starting with a letter or digit"
+    );
+    createBaseCredentialLinkBody = external_exports.object({
+      organization_id: external_exports.string().uuid(),
+      base_id: external_exports.string().min(1),
+      /** Defaults to a slug derived from the credential's display name. */
+      name: baseCredentialNameSchema.optional()
+    });
+    baseCredentialLinkParams = external_exports.object({
+      id: external_exports.string().uuid(),
+      base_credential_id: external_exports.string().min(1)
+    });
+    baseCredentialLinkQuery = external_exports.object({
+      organization_id: external_exports.string().uuid(),
+      base_id: external_exports.string().min(1)
+    });
+  }
+});
+
+// ../../packages/core/dist/chunk-DHPUPI4Y.js
+function normalizeAuthType(raw) {
+  if (VALID_AUTH_TYPES.has(raw)) return raw;
+  return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
+}
+var AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, PILOT_TRACK_ROLES, COPILOT_TRACK_ROLES, CUSTOMER_FACING_AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, SKILL_INSTALL_COMMAND;
+var init_chunk_DHPUPI4Y = __esm({
+  "../../packages/core/dist/chunk-DHPUPI4Y.js"() {
+    "use strict";
+    AUTH_TYPE = {
+      OAUTH: "oauth",
+      API_KEY: "api_key",
+      BASIC_AUTH: "basic_auth",
+      BEARER: "bearer",
+      NONE: "none"
+    };
+    ORG_CREDENTIAL_AUTH_TYPES = [
+      AUTH_TYPE.API_KEY,
+      AUTH_TYPE.BEARER,
+      AUTH_TYPE.BASIC_AUTH
+    ];
+    AUTH_TYPE_DISPLAY = {
+      [AUTH_TYPE.OAUTH]: "OAuth",
+      [AUTH_TYPE.API_KEY]: "API Key",
+      [AUTH_TYPE.BASIC_AUTH]: "Basic Auth",
+      [AUTH_TYPE.BEARER]: "Bearer Token",
+      [AUTH_TYPE.NONE]: "No Authentication"
+    };
+    LEGACY_AUTH_TYPE_MAP = {
+      "OAuth": AUTH_TYPE.OAUTH,
+      "API Key": AUTH_TYPE.API_KEY,
+      "Basic Auth": AUTH_TYPE.BASIC_AUTH,
+      "Bearer Token": AUTH_TYPE.BEARER,
+      "No authentication": AUTH_TYPE.NONE,
+      // Also handle the old DISPLAY_TO_CODE bug where 'basic' was used instead of 'basic_auth'
+      "basic": AUTH_TYPE.BASIC_AUTH
+    };
+    VALID_AUTH_TYPES = new Set(Object.values(AUTH_TYPE));
+    AGENT_ROLES = [
+      "pilot",
+      "copilot",
+      "pilot_specialist",
+      "copilot_specialist",
+      "pilot_advisor",
+      "copilot_advisor",
+      "monitor",
+      "conversation_evaluator",
+      "message_evaluator",
+      "summarizer",
+      "consultant",
+      "pilot_voice"
+    ];
+    PILOT_TRACK_ROLES = ["pilot", "pilot_specialist"];
+    COPILOT_TRACK_ROLES = ["copilot", "copilot_specialist"];
+    CUSTOMER_FACING_AGENT_ROLES = [...PILOT_TRACK_ROLES, "pilot_advisor"];
+    SAFE_USER_ID_REGEX = /^[A-Za-z0-9_-]{1,64}$/;
+    SUPPORTED_LOCALES = ["en", "pt", "es"];
+    SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
+  }
+});
+
 // ../../packages/core/dist/chunk-SXDX4GHS.js
 var orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody;
 var init_chunk_SXDX4GHS = __esm({
@@ -5257,181 +5289,6 @@ var init_chunk_IPXBFWUU = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-GK27ENTT.js
-var BASE_CREDENTIAL_MANAGED_BY, BASE_CREDENTIAL_NAME_MAX, baseCredentialNameSchema, createBaseCredentialLinkBody, baseCredentialLinkParams, baseCredentialLinkQuery;
-var init_chunk_GK27ENTT = __esm({
-  "../../packages/core/dist/chunk-GK27ENTT.js"() {
-    "use strict";
-    init_zod();
-    BASE_CREDENTIAL_MANAGED_BY = {
-      DIRECT: "direct",
-      ORG_LINK: "org-link"
-    };
-    BASE_CREDENTIAL_NAME_MAX = 100;
-    baseCredentialNameSchema = external_exports.string().min(1).max(BASE_CREDENTIAL_NAME_MAX).regex(
-      /^[A-Za-z0-9][A-Za-z0-9._:@+~=-]*$/,
-      "name must use letters, digits and '. _ : @ + ~ = -', starting with a letter or digit"
-    );
-    createBaseCredentialLinkBody = external_exports.object({
-      organization_id: external_exports.string().uuid(),
-      base_id: external_exports.string().min(1),
-      /** Defaults to a slug derived from the credential's display name. */
-      name: baseCredentialNameSchema.optional()
-    });
-    baseCredentialLinkParams = external_exports.object({
-      id: external_exports.string().uuid(),
-      base_credential_id: external_exports.string().min(1)
-    });
-    baseCredentialLinkQuery = external_exports.object({
-      organization_id: external_exports.string().uuid(),
-      base_id: external_exports.string().min(1)
-    });
-  }
-});
-
-// ../../packages/core/dist/chunk-IPDOHAZ5.js
-var reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody;
-var init_chunk_IPDOHAZ5 = __esm({
-  "../../packages/core/dist/chunk-IPDOHAZ5.js"() {
-    "use strict";
-    init_chunk_HZ6CADSY();
-    init_zod();
-    reportSourceSchema = external_exports.enum(["sentry", "cli", "review", "security_audit"]);
-    intakeReportSourceSchema = external_exports.enum(["cli", "review", "security_audit"]);
-    reportClassificationSchema = external_exports.enum(["bug", "flaky_test", "security", "enhancement"]);
-    reportStatusSchema = external_exports.enum([
-      "pending",
-      "grouped",
-      "escalated",
-      "shipped",
-      "contested",
-      "addressed",
-      "dismissed"
-    ]);
-    reportLocaleSchema = external_exports.enum(["en", "pt", "es"]);
-    reportMessageAuthorRoleSchema = external_exports.enum(["reporter", "triage", "fixer", "system"]);
-    reportMessageSchema = external_exports.object({
-      message_id: external_exports.string(),
-      author_role: reportMessageAuthorRoleSchema,
-      /** The status transition this note accompanied (e.g. 'shipped'); null for a free/system note. */
-      transition: external_exports.string().nullable(),
-      body: external_exports.string(),
-      created_at: timestampSchema,
-      /**
-       * Visibility: `false` = reporter-facing (the default for every narrative entry); `true` =
-       * triage-internal (e.g. a `hold` rationale) — surfaced to platform admins only and NEVER
-       * returned on the reporter read path. The reporter's `GET /api/reports/:id` filters these out.
-       */
-      internal: external_exports.boolean()
-    });
-    sentryRefStatusSchema = external_exports.enum(["valid", "not_found", "mismatch", "unverified"]);
-    createReportBody = external_exports.object({
-      title: external_exports.string().min(5).max(256),
-      description: external_exports.string().min(10).max(5e3),
-      steps_to_reproduce: external_exports.string().max(3e3).optional(),
-      error_message: external_exports.string().max(2e3).optional(),
-      // Taxonomy (server defaults: source=cli, classification=bug when absent).
-      source: intakeReportSourceSchema.optional(),
-      classification: reportClassificationSchema.optional(),
-      // Stable dedup key (e.g. "<file>::<test>" for flaky, "<file>:<line>" for
-      // security). When present, the fingerprint uses it instead of the body hash.
-      dedup_key: external_exports.string().min(1).max(256).optional(),
-      // Context fields (auto-captured by the CLI)
-      organization_id: external_exports.string().optional(),
-      hub_id: external_exports.string().uuid().optional(),
-      hub_name: external_exports.string().max(256).optional(),
-      conversation_id: external_exports.string().uuid().optional(),
-      agent_id: external_exports.string().uuid().optional(),
-      agent_name: external_exports.string().max(256).optional(),
-      client_version: external_exports.string().max(64).optional(),
-      additional_context: external_exports.string().max(2e3).optional()
-    });
-    editReportBody = external_exports.object({
-      title: external_exports.string().min(5).max(256).optional(),
-      description: external_exports.string().min(10).max(5e3).optional(),
-      steps_to_reproduce: external_exports.string().max(3e3).optional(),
-      error_message: external_exports.string().max(2e3).optional(),
-      additional_context: external_exports.string().max(2e3).optional()
-    }).strict().refine((b) => Object.keys(b).length > 0, {
-      message: "at least one field must be provided"
-    });
-    reporterReportSummarySchema = external_exports.object({
-      report_id: external_exports.string(),
-      title: external_exports.string(),
-      description: external_exports.string(),
-      classification: reportClassificationSchema,
-      status: reportStatusSchema,
-      created_at: timestampSchema,
-      triaged_at: timestampSchema.nullable(),
-      resolved_at: timestampSchema.nullable(),
-      /** How many times the reporter has contested (gates the hard cap). */
-      contest_count: external_exports.number(),
-      /** True once triage issued a non-contestable (final) dismissal. */
-      dismissal_final: external_exports.boolean()
-    });
-    reporterListResponseSchema = external_exports.object({
-      data: external_exports.array(reporterReportSummarySchema)
-    });
-    getReportResponseSchema = external_exports.object({
-      report: reporterReportSummarySchema,
-      messages: external_exports.array(reportMessageSchema)
-    });
-    reporterTransitionResponseSchema = external_exports.object({
-      report: reporterReportSummarySchema
-    });
-    contestReportBody = external_exports.object({
-      reason: external_exports.string().min(1).max(5e3)
-    });
-    reporterListQuery = external_exports.object({
-      status: reportStatusSchema.optional()
-    });
-    listReportsQuery = external_exports.object({
-      status: reportStatusSchema.optional(),
-      source: reportSourceSchema.optional(),
-      limit: external_exports.coerce.number().int().min(1).max(200).optional(),
-      offset: external_exports.coerce.number().int().min(0).optional(),
-      /** ISO 8601 lower bound on created_at. */
-      since: external_exports.string().datetime().optional(),
-      /**
-       * ISO 8601 lower bound on resolution time — "what did we resolve recently", which `since`
-       * (a created_at filter) cannot answer for a long-lived report resolved yesterday. Implies
-       * a terminal status (`addressed`/`dismissed`) and orders on that same axis.
-       */
-      resolved_since: external_exports.string().datetime().optional()
-    });
-    GITHUB_ISSUE_URL_REGEX = /^https:\/\/github\.com\/[^/]+\/[^/]+\/issues\/\d+(?:[/?#]|$)/;
-    githubIssueUrlSchema = external_exports.string().url().refine((u) => GITHUB_ISSUE_URL_REGEX.test(u), {
-      message: "must be an https://github.com/<owner>/<repo>/issues/<number> URL"
-    });
-    transitionReportBody = external_exports.discriminatedUnion("target", [
-      external_exports.object({
-        target: external_exports.literal("escalated"),
-        gh_issue_url: githubIssueUrlSchema,
-        ai_verdict: external_exports.string().max(2e3).optional()
-      }),
-      external_exports.object({
-        target: external_exports.literal("shipped"),
-        note: external_exports.string().min(1).max(2e3).optional()
-      }),
-      external_exports.object({
-        target: external_exports.literal("addressed")
-      }),
-      external_exports.object({
-        target: external_exports.literal("dismissed"),
-        dismissal_reason: external_exports.string().min(1).max(5e3),
-        ai_verdict: external_exports.string().max(2e3).optional(),
-        final: external_exports.boolean().optional()
-      })
-    ]);
-    groupReportsBody = external_exports.object({
-      member_ids: external_exports.array(external_exports.string().uuid()).min(1).max(100)
-    });
-    holdReportBody = external_exports.object({
-      reason: external_exports.string().min(1).max(5e3)
-    });
-  }
-});
-
 // ../../packages/core/dist/chunk-GPM7PE44.js
 var bootstrapQuery;
 var init_chunk_GPM7PE44 = __esm({
@@ -6374,15 +6231,18 @@ var init_chunk_BEOHBREG = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-4MRBBR5L.js
+// ../../packages/core/dist/chunk-OWAAYKPB.js
+function declaresReview(schema) {
+  return typeof schema === "object" && schema !== null && schema[REVIEW_DECLARATION_KEY] !== void 0;
+}
 function toolsetFileToolName(entry, op) {
   const names = entry.names;
   const stated = names?.[op];
   return stated !== void 0 && stated !== null ? String(stated) : `${op}_${entry.name ?? entry.file_type}`;
 }
-var TOOLSET_SLUG_SETTING, TOOLSET_SLUG_PATTERN, REKOR_STRUCTURAL_ID_PATTERN, baseEnvironmentSchema, TOOLSET_FILE_OPERATIONS, toolsetFileToolSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorToolsetToolsSchema, rekorBoundAttestation, rekorResolvedToolsetSchema, resolvedFileToolSchema, rekorToolsetFileSchema, rekorToolsetFileListSchema, rekorToolsetFileGetSchema, rekorToolsetFilePutSchema, TOOLSET_CUSTOMER_FACING_REFUSAL_MARK, TOOLSET_CUSTOMER_FACING_REFUSAL;
-var init_chunk_4MRBBR5L = __esm({
-  "../../packages/core/dist/chunk-4MRBBR5L.js"() {
+var TOOLSET_SLUG_SETTING, TOOLSET_SLUG_PATTERN, REKOR_STRUCTURAL_ID_PATTERN, baseEnvironmentSchema, TOOLSET_FILE_OPERATIONS, toolsetFileToolSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorToolsetToolsSchema, rekorBoundAttestation, rekorResolvedToolsetSchema, REVIEW_DECLARATION_KEY, resolvedRecordTypeSchema, reviewWritersSchema, sharedScopeSchema, resolvedFileToolSchema, rekorToolsetFileSchema, rekorToolsetFileListSchema, rekorToolsetFileGetSchema, rekorToolsetFilePutSchema, TOOLSET_CUSTOMER_FACING_REFUSAL_MARK, TOOLSET_CUSTOMER_FACING_REFUSAL;
+var init_chunk_OWAAYKPB = __esm({
+  "../../packages/core/dist/chunk-OWAAYKPB.js"() {
     "use strict";
     init_chunk_BEOHBREG();
     init_chunk_DHPUPI4Y();
@@ -6430,6 +6290,22 @@ var init_chunk_4MRBBR5L = __esm({
        * sync or token save records it.
        */
       file_writes: external_exports.boolean().optional(),
+      /**
+       * A record type the toolset's actions or composite steps reach (the resolve's `record_types`) names it
+       * among its writers (`x-review.writers`, #5083 RK4): the toolset writes the type's drafts and reads its
+       * every record, drafts included. Or such a type's declaration this side cannot read, or a resolve
+       * reaching records that carries no record types. A type only its relationship tools reach is not
+       * judged: the resolve does not carry that type's declaration. Absent
+       * on a surface recorded before it was, which the customer-facing rule reads as writing, for a toolset
+       * reaching records, until the connection's next tool sync or token save records it.
+       */
+      review_writes: external_exports.boolean().optional(),
+      /**
+       * Every record type the toolset reaches, at least one, is reviewed (`x-review`), holds no customer data
+       * (`shared`), and does not name it among its writers: each call reads only that type's approved
+       * records (#5083 decision 182, Q9). Absent on a surface recorded before it was, which reads as false.
+       */
+      approved_reads_only: external_exports.boolean().optional(),
       /**
        * The toolset's file tools. Absent when it has none, and on a surface recorded before they were.
        * A list this side cannot read is dropped rather than failing the binding, which every call and
@@ -6512,9 +6388,23 @@ var init_chunk_4MRBBR5L = __esm({
         batch: external_exports.object({ enabled: external_exports.boolean().optional() }).passthrough().nullable().optional(),
         sql_query: external_exports.boolean().optional(),
         /** The toolset serves one customer per call (#5083 RK2). Absent reads as not scoped. */
-        customer_scope: external_exports.boolean().optional()
+        customer_scope: external_exports.boolean().optional(),
+        /**
+         * Each record type the toolset's actions and composite steps reach, by id, as the data product
+         * stores it (`json_schema` included). A reviewed type's `x-review` names its writers (#5083 RK4).
+         */
+        record_types: external_exports.record(external_exports.unknown()).optional(),
+        /**
+         * What each record type the toolset can reach is to a customer scope (`{ role }`, or null), by id:
+         * those `record_types` holds, and those only its relationship tools and steps reach (#5083 RK2).
+         */
+        record_type_scopes: external_exports.record(external_exports.unknown()).optional()
       }).passthrough()
     });
+    REVIEW_DECLARATION_KEY = "x-review";
+    resolvedRecordTypeSchema = external_exports.object({ json_schema: external_exports.record(external_exports.unknown()) });
+    reviewWritersSchema = external_exports.object({ writers: external_exports.array(external_exports.string()).optional() });
+    sharedScopeSchema = external_exports.object({ role: external_exports.literal("shared") });
     resolvedFileToolSchema = external_exports.object({
       file_type: external_exports.string().min(1),
       path_prefix: external_exports.string().nullish(),
@@ -6537,61 +6427,149 @@ var init_chunk_4MRBBR5L = __esm({
     });
     rekorToolsetFilePutSchema = external_exports.object({ data: rekorToolsetFileSchema });
     TOOLSET_CUSTOMER_FACING_REFUSAL_MARK = "A customer-facing agent (a pilot, pilot specialist or pilot advisor) can use a toolset only when it exposes files alone: no record, composite or relationship tools, and neither sql_query nor batch";
-    TOOLSET_CUSTOMER_FACING_REFUSAL = `${TOOLSET_CUSTOMER_FACING_REFUSAL_MARK}, nor a file put or delete \u2014 unless the toolset is customer-scoped, which admits its record, composite and relationship tools, since each of their calls reaches only the conversation's customer and shared records`;
+    TOOLSET_CUSTOMER_FACING_REFUSAL = `${TOOLSET_CUSTOMER_FACING_REFUSAL_MARK}, nor a file put or delete, nor a write of a reviewed record type \u2014 unless the toolset is customer-scoped, which admits its record, composite and relationship tools, since each of their calls reaches only the conversation's customer and shared records, or they only read approved records of reviewed shared record types`;
   }
 });
 
-// ../../packages/core/dist/chunk-SY6PLCPK.js
-var jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse;
-var init_chunk_SY6PLCPK = __esm({
-  "../../packages/core/dist/chunk-SY6PLCPK.js"() {
+// ../../packages/core/dist/chunk-IPDOHAZ5.js
+var reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, reportMessageSchema, sentryRefStatusSchema, createReportBody, editReportBody, reporterReportSummarySchema, reporterListResponseSchema, getReportResponseSchema, reporterTransitionResponseSchema, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody;
+var init_chunk_IPDOHAZ5 = __esm({
+  "../../packages/core/dist/chunk-IPDOHAZ5.js"() {
     "use strict";
-    init_chunk_6TSQ5HXC();
+    init_chunk_HZ6CADSY();
     init_zod();
-    jsonSchemaSchema = external_exports.record(external_exports.unknown());
-    hubUserIdentity = external_exports.object({
-      user_id: external_exports.string().nullable(),
-      user_name: external_exports.string().nullable(),
-      user_email: external_exports.string().nullable(),
-      user_name_locked: external_exports.boolean(),
-      created_at: external_exports.string(),
-      updated_at: external_exports.string().nullable(),
-      hub_user_id: external_exports.string().optional(),
-      enabled: external_exports.boolean().optional(),
-      hub_team_id: external_exports.string().nullable().optional(),
-      source: external_exports.enum(["grant", "auto"]).optional()
+    reportSourceSchema = external_exports.enum(["sentry", "cli", "review", "security_audit"]);
+    intakeReportSourceSchema = external_exports.enum(["cli", "review", "security_audit"]);
+    reportClassificationSchema = external_exports.enum(["bug", "flaky_test", "security", "enhancement"]);
+    reportStatusSchema = external_exports.enum([
+      "pending",
+      "grouped",
+      "escalated",
+      "shipped",
+      "contested",
+      "addressed",
+      "dismissed"
+    ]);
+    reportLocaleSchema = external_exports.enum(["en", "pt", "es"]);
+    reportMessageAuthorRoleSchema = external_exports.enum(["reporter", "triage", "fixer", "system"]);
+    reportMessageSchema = external_exports.object({
+      message_id: external_exports.string(),
+      author_role: reportMessageAuthorRoleSchema,
+      /** The status transition this note accompanied (e.g. 'shipped'); null for a free/system note. */
+      transition: external_exports.string().nullable(),
+      body: external_exports.string(),
+      created_at: timestampSchema,
+      /**
+       * Visibility: `false` = reporter-facing (the default for every narrative entry); `true` =
+       * triage-internal (e.g. a `hold` rationale) — surfaced to platform admins only and NEVER
+       * returned on the reporter read path. The reporter's `GET /api/reports/:id` filters these out.
+       */
+      internal: external_exports.boolean()
     });
-    stateValueEntry = external_exports.object({
-      state_slug: external_exports.string(),
-      state_name: external_exports.string(),
-      state_description: external_exports.string().nullable().optional(),
-      scope: external_exports.enum(["user", "conversation"]),
-      json_schema: jsonSchemaSchema,
-      initial_value: external_exports.unknown(),
-      value: external_exports.unknown(),
-      is_reserved: external_exports.boolean()
+    sentryRefStatusSchema = external_exports.enum(["valid", "not_found", "mismatch", "unverified"]);
+    createReportBody = external_exports.object({
+      title: external_exports.string().min(5).max(256),
+      description: external_exports.string().min(10).max(5e3),
+      steps_to_reproduce: external_exports.string().max(3e3).optional(),
+      error_message: external_exports.string().max(2e3).optional(),
+      // Taxonomy (server defaults: source=cli, classification=bug when absent).
+      source: intakeReportSourceSchema.optional(),
+      classification: reportClassificationSchema.optional(),
+      // Stable dedup key (e.g. "<file>::<test>" for flaky, "<file>:<line>" for
+      // security). When present, the fingerprint uses it instead of the body hash.
+      dedup_key: external_exports.string().min(1).max(256).optional(),
+      // Context fields (auto-captured by the CLI)
+      organization_id: external_exports.string().optional(),
+      hub_id: external_exports.string().uuid().optional(),
+      hub_name: external_exports.string().max(256).optional(),
+      conversation_id: external_exports.string().uuid().optional(),
+      agent_id: external_exports.string().uuid().optional(),
+      agent_name: external_exports.string().max(256).optional(),
+      client_version: external_exports.string().max(64).optional(),
+      additional_context: external_exports.string().max(2e3).optional()
     });
-    getHubUserContextResponse = external_exports.object({
-      user: hubUserIdentity,
-      user_states: external_exports.array(stateValueEntry),
-      conversation_states: external_exports.array(stateValueEntry)
+    editReportBody = external_exports.object({
+      title: external_exports.string().min(5).max(256).optional(),
+      description: external_exports.string().min(10).max(5e3).optional(),
+      steps_to_reproduce: external_exports.string().max(3e3).optional(),
+      error_message: external_exports.string().max(2e3).optional(),
+      additional_context: external_exports.string().max(2e3).optional()
+    }).strict().refine((b) => Object.keys(b).length > 0, {
+      message: "at least one field must be provided"
     });
-    updateHubUserBody = external_exports.object({
-      // Non-empty, non-null. `.nullable()` here would bypass `.min(1)` and let an
-      // admin arm the lock on a null name — see hub-do.ts updateHubUser null-guard.
-      user_name: external_exports.string().min(1).max(120)
+    reporterReportSummarySchema = external_exports.object({
+      report_id: external_exports.string(),
+      title: external_exports.string(),
+      description: external_exports.string(),
+      classification: reportClassificationSchema,
+      status: reportStatusSchema,
+      created_at: timestampSchema,
+      triaged_at: timestampSchema.nullable(),
+      resolved_at: timestampSchema.nullable(),
+      /** How many times the reporter has contested (gates the hard cap). */
+      contest_count: external_exports.number(),
+      /** True once triage issued a non-contestable (final) dismissal. */
+      dismissal_final: external_exports.boolean()
     });
-    updateHubUserResponse = external_exports.object({
-      user: hubUserIdentity
+    reporterListResponseSchema = external_exports.object({
+      data: external_exports.array(reporterReportSummarySchema)
     });
-    unlockHubUserNameResponse = external_exports.object({
-      user: hubUserIdentity
+    getReportResponseSchema = external_exports.object({
+      report: reporterReportSummarySchema,
+      messages: external_exports.array(reportMessageSchema)
     });
-    stateResetParams = external_exports.object({
-      stateSlug: slugSchema
+    reporterTransitionResponseSchema = external_exports.object({
+      report: reporterReportSummarySchema
     });
-    stateResetResponse = external_exports.object({
-      ok: external_exports.literal(true)
+    contestReportBody = external_exports.object({
+      reason: external_exports.string().min(1).max(5e3)
+    });
+    reporterListQuery = external_exports.object({
+      status: reportStatusSchema.optional()
+    });
+    listReportsQuery = external_exports.object({
+      status: reportStatusSchema.optional(),
+      source: reportSourceSchema.optional(),
+      limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+      offset: external_exports.coerce.number().int().min(0).optional(),
+      /** ISO 8601 lower bound on created_at. */
+      since: external_exports.string().datetime().optional(),
+      /**
+       * ISO 8601 lower bound on resolution time — "what did we resolve recently", which `since`
+       * (a created_at filter) cannot answer for a long-lived report resolved yesterday. Implies
+       * a terminal status (`addressed`/`dismissed`) and orders on that same axis.
+       */
+      resolved_since: external_exports.string().datetime().optional()
+    });
+    GITHUB_ISSUE_URL_REGEX = /^https:\/\/github\.com\/[^/]+\/[^/]+\/issues\/\d+(?:[/?#]|$)/;
+    githubIssueUrlSchema = external_exports.string().url().refine((u) => GITHUB_ISSUE_URL_REGEX.test(u), {
+      message: "must be an https://github.com/<owner>/<repo>/issues/<number> URL"
+    });
+    transitionReportBody = external_exports.discriminatedUnion("target", [
+      external_exports.object({
+        target: external_exports.literal("escalated"),
+        gh_issue_url: githubIssueUrlSchema,
+        ai_verdict: external_exports.string().max(2e3).optional()
+      }),
+      external_exports.object({
+        target: external_exports.literal("shipped"),
+        note: external_exports.string().min(1).max(2e3).optional()
+      }),
+      external_exports.object({
+        target: external_exports.literal("addressed")
+      }),
+      external_exports.object({
+        target: external_exports.literal("dismissed"),
+        dismissal_reason: external_exports.string().min(1).max(5e3),
+        ai_verdict: external_exports.string().max(2e3).optional(),
+        final: external_exports.boolean().optional()
+      })
+    ]);
+    groupReportsBody = external_exports.object({
+      member_ids: external_exports.array(external_exports.string().uuid()).min(1).max(100)
+    });
+    holdReportBody = external_exports.object({
+      reason: external_exports.string().min(1).max(5e3)
     });
   }
 });
@@ -6714,101 +6692,6 @@ var init_chunk_FPSDNS2E = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-LKBSHANA.js
-var DESKTOP_SHELL_VERSION_RE, DESKTOP_PLATFORMS, DESKTOP_FLAVORS, desktopShellInfoSchema, DESKTOP_PRESENCE_STATES, desktopPresenceSchema, desktopUpdateSchema, DESKTOP_SIGN_IN_URL_MAX_LENGTH, DESKTOP_APP_PATH_MAX_LENGTH, desktopAppPathSchema, DESKTOP_NOTIFICATION_KINDS, DESKTOP_NOTIFICATION_TITLE_MAX_LENGTH, DESKTOP_NOTIFICATION_BODY_MAX_LENGTH, notificationTitleSchema, notificationBodySchema, desktopNotificationSchema, DESKTOP_BADGE_MAX_COUNT, DESKTOP_BADGE_LABEL_MAX_LENGTH, desktopBadgeSchema, desktopNavigateSchema, desktopSettingsSchema, desktopSettingsChangeSchema, desktopBridgeArgsSchemas;
-var init_chunk_LKBSHANA = __esm({
-  "../../packages/core/dist/chunk-LKBSHANA.js"() {
-    "use strict";
-    init_zod();
-    DESKTOP_SHELL_VERSION_RE = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})(-[0-9A-Za-z.-]{1,32})?$/;
-    DESKTOP_PLATFORMS = ["darwin", "win32"];
-    DESKTOP_FLAVORS = ["production", "development"];
-    desktopShellInfoSchema = external_exports.object({
-      /** The shell's own release version, independent of the web deploy. */
-      shellVersion: external_exports.string().regex(DESKTOP_SHELL_VERSION_RE),
-      /** The Electron runtime the shell was built with. */
-      electronVersion: external_exports.string().regex(/^\d{1,4}\.\d{1,4}\.\d{1,4}(-[0-9A-Za-z.-]{1,32})?$/),
-      platform: external_exports.enum(DESKTOP_PLATFORMS),
-      /** CPU architecture as Node reports it (`arm64`, `x64`). */
-      arch: external_exports.string().regex(/^[a-z0-9_]{1,16}$/),
-      flavor: external_exports.enum(DESKTOP_FLAVORS),
-      /**
-       * Present, and true, when the shell runs from the Microsoft Store's package: the Store updates it,
-       * and Windows alone opens it at login (the package's startup task, which the person turns on in
-       * Windows' settings). An optional field, so no new `bridgeVersion`: an older page ignores it, and
-       * its absence is every other shell.
-       */
-      store: external_exports.literal(true).optional()
-    });
-    DESKTOP_PRESENCE_STATES = ["present", "away"];
-    desktopPresenceSchema = external_exports.object({
-      presence: external_exports.enum(DESKTOP_PRESENCE_STATES),
-      mainWindow: external_exports.object({
-        shown: external_exports.boolean(),
-        focused: external_exports.boolean()
-      })
-    });
-    desktopUpdateSchema = external_exports.object({
-      ready: external_exports.object({
-        version: external_exports.string().regex(DESKTOP_SHELL_VERSION_RE),
-        offerRestart: external_exports.boolean()
-      }).nullable()
-    });
-    DESKTOP_SIGN_IN_URL_MAX_LENGTH = 4096;
-    DESKTOP_APP_PATH_MAX_LENGTH = 512;
-    desktopAppPathSchema = external_exports.string().max(DESKTOP_APP_PATH_MAX_LENGTH).regex(/^\/(?![/\\])[^\s\\]*$/);
-    DESKTOP_NOTIFICATION_KINDS = ["handoff", "message", "summary"];
-    DESKTOP_NOTIFICATION_TITLE_MAX_LENGTH = 200;
-    DESKTOP_NOTIFICATION_BODY_MAX_LENGTH = 500;
-    notificationTitleSchema = external_exports.string().min(1).max(DESKTOP_NOTIFICATION_TITLE_MAX_LENGTH);
-    notificationBodySchema = external_exports.string().max(DESKTOP_NOTIFICATION_BODY_MAX_LENGTH);
-    desktopNotificationSchema = external_exports.object({
-      kind: external_exports.enum(DESKTOP_NOTIFICATION_KINDS),
-      title: notificationTitleSchema,
-      body: notificationBodySchema,
-      path: desktopAppPathSchema,
-      withoutPreview: external_exports.object({ title: notificationTitleSchema, body: notificationBodySchema }).optional()
-    });
-    DESKTOP_BADGE_MAX_COUNT = 1e6;
-    DESKTOP_BADGE_LABEL_MAX_LENGTH = 200;
-    desktopBadgeSchema = external_exports.object({
-      count: external_exports.number().int().min(0).max(DESKTOP_BADGE_MAX_COUNT),
-      label: external_exports.string().max(DESKTOP_BADGE_LABEL_MAX_LENGTH)
-    });
-    desktopNavigateSchema = external_exports.object({
-      path: desktopAppPathSchema
-    });
-    desktopSettingsSchema = external_exports.object({
-      /** The app opens when the person logs in to the computer: the operating system's own login item. */
-      openAtLogin: external_exports.boolean(),
-      /** Closing the window keeps the app running in the tray (true), or quits it (false). */
-      closeToTray: external_exports.boolean(),
-      /** The shell shows notifications (true), or none (false). The badge is not a notification. */
-      notifications: external_exports.boolean(),
-      /**
-       * A customer message's notification shows the customer's name and words, where the platform
-       * allows them at all (`desktopShowsCustomerWords`: macOS); elsewhere the shell never shows them.
-       */
-      messagePreview: external_exports.boolean()
-    });
-    desktopSettingsChangeSchema = desktopSettingsSchema.partial().strict().refine((change) => Object.values(change).every((value) => typeof value === "boolean"), {
-      message: "each setting changed is true or false"
-    });
-    desktopBridgeArgsSchemas = {
-      getShellInfo: external_exports.tuple([]),
-      getPresence: external_exports.tuple([]),
-      openSignIn: external_exports.tuple([external_exports.string().max(DESKTOP_SIGN_IN_URL_MAX_LENGTH)]),
-      getUpdate: external_exports.tuple([]),
-      restartToUpdate: external_exports.tuple([]),
-      notify: external_exports.tuple([desktopNotificationSchema]),
-      setBadge: external_exports.tuple([desktopBadgeSchema]),
-      clearAll: external_exports.tuple([]),
-      getSettings: external_exports.tuple([]),
-      setSettings: external_exports.tuple([desktopSettingsChangeSchema])
-    };
-  }
-});
-
 // ../../packages/core/dist/chunk-MIWZOSPI.js
 function toIso(epochMs) {
   return new Date(epochMs).toISOString();
@@ -6973,7 +6856,7 @@ var init_chunk_A4JC7DXB = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-23UZ2IKU.js
+// ../../packages/core/dist/chunk-VMAX5YRT.js
 function spokenLineField(label, description2) {
   return { type: "text", label, maxLength: SPOKEN_LINE_MAX_CHARS, default: "", description: description2 };
 }
@@ -6983,8 +6866,8 @@ function byLowercaseName(a, b) {
   return x < y ? -1 : x > y ? 1 : 0;
 }
 var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, SANDBOX_AGENT_FIELDS, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, REKOR_TOOLSET_SERVICE_NAME, rekorToolset, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeManagedAgents, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
-var init_chunk_23UZ2IKU = __esm({
-  "../../packages/core/dist/chunk-23UZ2IKU.js"() {
+var init_chunk_VMAX5YRT = __esm({
+  "../../packages/core/dist/chunk-VMAX5YRT.js"() {
     "use strict";
     init_chunk_A4JC7DXB();
     CALLER_LANGUAGE = "caller";
@@ -7951,13 +7834,13 @@ var init_chunk_23UZ2IKU = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-23ESQLLF.js
+// ../../packages/core/dist/chunk-C4TPQN6Z.js
 var evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse;
-var init_chunk_23ESQLLF = __esm({
-  "../../packages/core/dist/chunk-23ESQLLF.js"() {
+var init_chunk_C4TPQN6Z = __esm({
+  "../../packages/core/dist/chunk-C4TPQN6Z.js"() {
     "use strict";
     init_chunk_E4DIIOOE();
-    init_chunk_23UZ2IKU();
+    init_chunk_VMAX5YRT();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
     init_zod();
@@ -8212,58 +8095,58 @@ var init_chunk_EA23LSDS = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-V4FRPRH5.js
-var CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS;
-var init_chunk_V4FRPRH5 = __esm({
-  "../../packages/core/dist/chunk-V4FRPRH5.js"() {
+// ../../packages/core/dist/chunk-SY6PLCPK.js
+var jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse;
+var init_chunk_SY6PLCPK = __esm({
+  "../../packages/core/dist/chunk-SY6PLCPK.js"() {
     "use strict";
+    init_chunk_6TSQ5HXC();
     init_zod();
-    CONSULT_THREAD_STATUSES = ["open", "awaiting", "resolved", "cancelled_at_close"];
-    consultThreadStatus = external_exports.enum(CONSULT_THREAD_STATUSES);
-    CONSULT_THREAD_TITLE_MAX = 120;
-    consultThreadTitle = external_exports.string().trim().min(1).max(CONSULT_THREAD_TITLE_MAX);
-    consultThreadSummary = external_exports.object({
-      consult_thread_id: external_exports.string(),
-      conversation_id: external_exports.string(),
-      initiator_type: external_exports.enum(["team", "agent"]),
-      initiator_id: external_exports.string(),
-      engaged_agent_id: external_exports.string().nullable(),
-      engaged_agent_name: external_exports.string().nullable(),
-      title: external_exports.string().nullable(),
-      status: consultThreadStatus,
-      created_at: external_exports.string()
+    jsonSchemaSchema = external_exports.record(external_exports.unknown());
+    hubUserIdentity = external_exports.object({
+      user_id: external_exports.string().nullable(),
+      user_name: external_exports.string().nullable(),
+      user_email: external_exports.string().nullable(),
+      user_name_locked: external_exports.boolean(),
+      created_at: external_exports.string(),
+      updated_at: external_exports.string().nullable(),
+      hub_user_id: external_exports.string().optional(),
+      enabled: external_exports.boolean().optional(),
+      hub_team_id: external_exports.string().nullable().optional(),
+      source: external_exports.enum(["grant", "auto"]).optional()
     });
-    listConsultThreadsQuery = external_exports.object({
-      hub_id: external_exports.string().uuid()
+    stateValueEntry = external_exports.object({
+      state_slug: external_exports.string(),
+      state_name: external_exports.string(),
+      state_description: external_exports.string().nullable().optional(),
+      scope: external_exports.enum(["user", "conversation"]),
+      json_schema: jsonSchemaSchema,
+      initial_value: external_exports.unknown(),
+      value: external_exports.unknown(),
+      is_reserved: external_exports.boolean()
     });
-    listConsultThreadsResponse = external_exports.object({
-      threads: external_exports.array(consultThreadSummary)
+    getHubUserContextResponse = external_exports.object({
+      user: hubUserIdentity,
+      user_states: external_exports.array(stateValueEntry),
+      conversation_states: external_exports.array(stateValueEntry)
     });
-    createConsultThreadBody = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      title: consultThreadTitle.optional(),
-      // Optionally engage a consultant on creation. Validated server-side against the
-      // hub's `consultant`-role agents; a non-consultant / unknown id is rejected.
-      engaged_agent_id: external_exports.string().uuid().optional()
+    updateHubUserBody = external_exports.object({
+      // Non-empty, non-null. `.nullable()` here would bypass `.min(1)` and let an
+      // admin arm the lock on a null name — see hub-do.ts updateHubUser null-guard.
+      user_name: external_exports.string().min(1).max(120)
     });
-    createConsultThreadResponse = external_exports.object({
-      thread: consultThreadSummary
+    updateHubUserResponse = external_exports.object({
+      user: hubUserIdentity
     });
-    consultThreadIdParam = external_exports.object({
-      id: external_exports.string().uuid(),
-      threadId: external_exports.string().uuid()
+    unlockHubUserNameResponse = external_exports.object({
+      user: hubUserIdentity
     });
-    updateConsultThreadBody = external_exports.object({
-      hub_id: external_exports.string().uuid(),
-      title: consultThreadTitle.optional(),
-      engaged_agent_id: external_exports.string().uuid().optional()
-    }).refine((v) => v.title !== void 0 || v.engaged_agent_id !== void 0, {
-      message: "Provide a title and/or an engaged_agent_id to update"
+    stateResetParams = external_exports.object({
+      stateSlug: slugSchema
     });
-    updateConsultThreadResponse = external_exports.object({
-      thread: consultThreadSummary
+    stateResetResponse = external_exports.object({
+      ok: external_exports.literal(true)
     });
-    CONSULT_AWAIT_TIMEOUT_MS = 15 * 6e4;
   }
 });
 
@@ -9363,7 +9246,7 @@ var init_chunk_IBL7FANV = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-Y3S4XX4K.js
+// ../../packages/core/dist/chunk-Z22T2ASG.js
 function parseExpr(expr) {
   const fnMatch = expr.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\s*\((.*?)\)\s*(?:\.(.*))?$/);
   if (!fnMatch) return null;
@@ -9447,8 +9330,8 @@ function scanTemplateResources(template) {
   return scan;
 }
 var PREVIOUS_CONVERSATIONS_MAX, PLACEHOLDER_RE, CATALOG_FN, LEGACY_CATALOG_FN, EMPTY_SCAN;
-var init_chunk_Y3S4XX4K = __esm({
-  "../../packages/core/dist/chunk-Y3S4XX4K.js"() {
+var init_chunk_Z22T2ASG = __esm({
+  "../../packages/core/dist/chunk-Z22T2ASG.js"() {
     "use strict";
     PREVIOUS_CONVERSATIONS_MAX = 20;
     PLACEHOLDER_RE = /\{\{\s*([^{}]+?)\s*\}\}/g;
@@ -9652,7 +9535,7 @@ var init_chunk_T7KQKDET = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-DIBRGYL6.js
+// ../../packages/core/dist/chunk-2LZYS6YX.js
 function resolveMonitorTrigger(monitorConfig) {
   if (!monitorConfig || typeof monitorConfig !== "object") return "idle";
   const raw = monitorConfig.trigger;
@@ -9958,12 +9841,12 @@ function refineMonitorRulesStructuredOutput(body, ctx) {
   if (refusal2) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["response_format"], message: refusal2 });
 }
 var NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, AUTOMATION_GATE_TRIGGERS, NON_FIRING_TRIGGERS, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, MONITOR_GATE_AGENT_NAME_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, MONITOR_AUTOMATION_FIRE_ACTION_KINDS, MONITOR_AUTOMATION_ITEM_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE, AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE, AUTOMATION_GATE_KEY_MESSAGES, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody;
-var init_chunk_DIBRGYL6 = __esm({
-  "../../packages/core/dist/chunk-DIBRGYL6.js"() {
+var init_chunk_2LZYS6YX = __esm({
+  "../../packages/core/dist/chunk-2LZYS6YX.js"() {
     "use strict";
     init_chunk_UFYIBL66();
     init_chunk_IBL7FANV();
-    init_chunk_Y3S4XX4K();
+    init_chunk_Z22T2ASG();
     init_chunk_HZ6CADSY();
     init_chunk_C2UEA2KW();
     init_chunk_DHPUPI4Y();
@@ -10184,12 +10067,12 @@ var init_chunk_DIBRGYL6 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-6GBBTCME.js
+// ../../packages/core/dist/chunk-XR36MYEY.js
 var conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody;
-var init_chunk_6GBBTCME = __esm({
-  "../../packages/core/dist/chunk-6GBBTCME.js"() {
+var init_chunk_XR36MYEY = __esm({
+  "../../packages/core/dist/chunk-XR36MYEY.js"() {
     "use strict";
-    init_chunk_DIBRGYL6();
+    init_chunk_2LZYS6YX();
     init_chunk_HZ6CADSY();
     init_chunk_DHPUPI4Y();
     init_zod();
@@ -10486,115 +10369,98 @@ var init_chunk_KSTYTQ7I = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-7CYHPF35.js
-var appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse;
-var init_chunk_7CYHPF35 = __esm({
-  "../../packages/core/dist/chunk-7CYHPF35.js"() {
+// ../../packages/core/dist/chunk-LKBSHANA.js
+var DESKTOP_SHELL_VERSION_RE, DESKTOP_PLATFORMS, DESKTOP_FLAVORS, desktopShellInfoSchema, DESKTOP_PRESENCE_STATES, desktopPresenceSchema, desktopUpdateSchema, DESKTOP_SIGN_IN_URL_MAX_LENGTH, DESKTOP_APP_PATH_MAX_LENGTH, desktopAppPathSchema, DESKTOP_NOTIFICATION_KINDS, DESKTOP_NOTIFICATION_TITLE_MAX_LENGTH, DESKTOP_NOTIFICATION_BODY_MAX_LENGTH, notificationTitleSchema, notificationBodySchema, desktopNotificationSchema, DESKTOP_BADGE_MAX_COUNT, DESKTOP_BADGE_LABEL_MAX_LENGTH, desktopBadgeSchema, desktopNavigateSchema, desktopSettingsSchema, desktopSettingsChangeSchema, desktopBridgeArgsSchemas;
+var init_chunk_LKBSHANA = __esm({
+  "../../packages/core/dist/chunk-LKBSHANA.js"() {
     "use strict";
-    init_chunk_HZ6CADSY();
     init_zod();
-    appMessageSenderType = external_exports.enum(["user", "team"]);
-    appMessageReceiverType = external_exports.enum(["user", "team", "agent", "assistant"]).transform((v) => v === "assistant" ? "agent" : v);
-    apiChannelMessage = external_exports.object({
-      text: clientOptionalString,
-      attachments: external_exports.array(messageAttachment).max(MAX_ATTACHMENTS_PER_MESSAGE).nullish().transform((v) => v ?? void 0)
-    }).refine((m) => m.text && m.text.length > 0 || m.attachments && m.attachments.length > 0, {
-      message: "message must have text or at least one attachment"
+    DESKTOP_SHELL_VERSION_RE = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})(-[0-9A-Za-z.-]{1,32})?$/;
+    DESKTOP_PLATFORMS = ["darwin", "win32"];
+    DESKTOP_FLAVORS = ["production", "development"];
+    desktopShellInfoSchema = external_exports.object({
+      /** The shell's own release version, independent of the web deploy. */
+      shellVersion: external_exports.string().regex(DESKTOP_SHELL_VERSION_RE),
+      /** The Electron runtime the shell was built with. */
+      electronVersion: external_exports.string().regex(/^\d{1,4}\.\d{1,4}\.\d{1,4}(-[0-9A-Za-z.-]{1,32})?$/),
+      platform: external_exports.enum(DESKTOP_PLATFORMS),
+      /** CPU architecture as Node reports it (`arm64`, `x64`). */
+      arch: external_exports.string().regex(/^[a-z0-9_]{1,16}$/),
+      flavor: external_exports.enum(DESKTOP_FLAVORS),
+      /**
+       * Present, and true, when the shell runs from the Microsoft Store's package: the Store updates it,
+       * and Windows alone opens it at login (the package's startup task, which the person turns on in
+       * Windows' settings). An optional field, so no new `bridgeVersion`: an older page ignores it, and
+       * its absence is every other shell.
+       */
+      store: external_exports.literal(true).optional()
     });
-    apiChannelMessageBody = external_exports.object({
-      // Correlation id (task hubs): new → new conversation, repeat → continue. min 1 so an
-      // empty string can't masquerade as a ref. Mutually exclusive with conversation_id.
-      external_ref: external_exports.string().min(1).max(256).optional(),
-      // Continue a specific WayAI conversation (authorized against the hub/channel + owner).
-      // UUID-validated here (unlike the app channel, whose client we control): allocation
-      // only treats a UUID-shaped id as a provided conversation, so a malformed id would
-      // otherwise skip the owner guard and silently MINT a new conversation instead of
-      // rejecting. A format 400 is shape-only — not an existence oracle (a valid-but-unknown
-      // UUID still collapses to the opaque authorization error downstream).
-      conversation_id: external_exports.string().uuid().optional(),
-      // On-behalf-of end-user identity. Absent → per-connection service principal (task-hub
-      // only; chat hub rejects with 422 in the route).
-      user: external_exports.object({
-        id: external_exports.string().min(1),
-        email: clientOptionalString,
-        name: clientOptionalString
-      }).optional(),
-      message: apiChannelMessage,
-      // Idempotency key: maps to channel_message_sid, deduped within one conversation
-      // (ConversationDO.storeMessage). A retried POST resolves to the same conversation (a chat
-      // hub's user, the external_ref, the conversation_id, or on a task hub with neither, this key
-      // scoped by the sender), so it echoes the original message_id and skips billing / turn
-      // dispatch. A failed store answers a retryable 503 only when this key is set; without it a
-      // retry could store the message twice, so it answers 400.
-      client_message_id: external_exports.string().min(1).max(256).optional()
-    }).refine((b) => !(b.external_ref && b.conversation_id), {
-      message: "provide external_ref or conversation_id, not both",
-      path: ["external_ref"]
+    DESKTOP_PRESENCE_STATES = ["present", "away"];
+    desktopPresenceSchema = external_exports.object({
+      presence: external_exports.enum(DESKTOP_PRESENCE_STATES),
+      mainWindow: external_exports.object({
+        shown: external_exports.boolean(),
+        focused: external_exports.boolean()
+      })
     });
-    appMessageBody = external_exports.object({
-      // Message content — three historical aliases. All optional: an attachment-only
-      // or voice-only message carries no text.
-      content: clientOptionalString,
-      message_text: clientOptionalString,
-      message_body: clientOptionalString,
-      // Conversation context. Ids are plain strings rather than `.uuid()` on purpose:
-      // they are AUTHORIZED downstream, which is the stronger guarantee — a well-formed
-      // uuid belonging to another tenant must fail just as hard as junk. `hub_id` is
-      // gated by `assertHubEndUserAccess` (gh #3286) and `conversation_id` by HubDO's
-      // conversation_index owner check (gh #2781, #3281). The route's own falsy guards
-      // ('hub_id is required') still reject an empty one.
-      hub_id: clientOptionalString,
-      channel_id: clientOptionalString,
-      conversation_id: clientOptionalString,
-      hub_type: external_exports.enum(["chat", "task"]).nullish().transform((v) => v ?? void 0),
-      // Stable idempotency key for one explicit task-hub launcher. HubDO scopes it
-      // to the authenticated user and resolves retries/tabs to one conversation.
-      task_start_id: external_exports.string().uuid().nullish().transform((v) => v ?? void 0),
-      // Routing.
-      sender_type: appMessageSenderType.nullish().transform((v) => v ?? void 0),
-      receiver_type: appMessageReceiverType.nullish().transform((v) => v ?? void 0),
-      // Only meaningful on a team send, where `validateAppTeamSendContext` proves the
-      // caller may send to this receiver. Absent on a team send to a conversation with no
-      // person, which names its `conversation_id` instead. The end-user branch ignores it —
-      // see the receiver derivation in the route.
-      user_receiver_id: clientOptionalString,
-      // ── Internal consult (consultant-agents PR 2 — H1.0) ──────────────────────
-      // A team member handling a customer conversation can tag a `consultant`-role
-      // agent for a PRIVATE, team-only exchange that never reaches the customer. A
-      // consult send is a team send with `receiver_type: 'agent'` targeting the
-      // consultant; `user_receiver_id` identifies the customer whose conversation this is
-      // (and is authorized by `validateAppTeamSendContext`, exactly as a team→user send is),
-      // and is absent, as on a team→user send, when the conversation has no person. The consultant is resolved from `agent_receiver_id`
-      // when supplied, else from an `@mention` parsed out of the message text against
-      // the hub's consultant agents. `consult_thread_id` continues an existing thread;
-      // absent, the route creates/reuses the single implicit thread. These fields are
-      // inert on every non-consult send (end-user send, team→user send).
-      agent_receiver_id: clientOptionalString,
-      consult_thread_id: clientOptionalString,
-      is_first_message: clientOptionalBoolean,
-      end_conversation: clientOptionalBoolean,
-      // Pre-generated by the client so the optimistic bubble and the stored row share
-      // a key (transcription live-updates land on the same row instead of duplicating).
-      message_id: clientOptionalString,
-      attachments: external_exports.array(messageAttachment).max(MAX_ATTACHMENTS_PER_MESSAGE).nullish().transform((v) => v ?? void 0),
-      // Base64-encoded audio for STT. Size-capped in the route (the cap is a byte
-      // budget tied to the /channels/* bodyLimit, not a shape rule).
-      audio_file: clientOptionalString
+    desktopUpdateSchema = external_exports.object({
+      ready: external_exports.object({
+        version: external_exports.string().regex(DESKTOP_SHELL_VERSION_RE),
+        offerRestart: external_exports.boolean()
+      }).nullable()
     });
-    appMessageResponse = external_exports.object({
-      success: external_exports.boolean(),
-      message: external_exports.string(),
-      result: external_exports.object({
-        conversation_id: external_exports.string().optional(),
-        message_id: external_exports.string().optional(),
-        status: external_exports.string().optional(),
-        files: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
-        // True when this request reused a task-start/message id already accepted by
-        // the server. Clients must replace their optimistic payload with a fresh
-        // authoritative read because another tab may have won with different text.
-        deduped: external_exports.boolean().optional()
-      }).optional()
+    DESKTOP_SIGN_IN_URL_MAX_LENGTH = 4096;
+    DESKTOP_APP_PATH_MAX_LENGTH = 512;
+    desktopAppPathSchema = external_exports.string().max(DESKTOP_APP_PATH_MAX_LENGTH).regex(/^\/(?![/\\])[^\s\\]*$/);
+    DESKTOP_NOTIFICATION_KINDS = ["handoff", "message", "summary"];
+    DESKTOP_NOTIFICATION_TITLE_MAX_LENGTH = 200;
+    DESKTOP_NOTIFICATION_BODY_MAX_LENGTH = 500;
+    notificationTitleSchema = external_exports.string().min(1).max(DESKTOP_NOTIFICATION_TITLE_MAX_LENGTH);
+    notificationBodySchema = external_exports.string().max(DESKTOP_NOTIFICATION_BODY_MAX_LENGTH);
+    desktopNotificationSchema = external_exports.object({
+      kind: external_exports.enum(DESKTOP_NOTIFICATION_KINDS),
+      title: notificationTitleSchema,
+      body: notificationBodySchema,
+      path: desktopAppPathSchema,
+      withoutPreview: external_exports.object({ title: notificationTitleSchema, body: notificationBodySchema }).optional()
+    });
+    DESKTOP_BADGE_MAX_COUNT = 1e6;
+    DESKTOP_BADGE_LABEL_MAX_LENGTH = 200;
+    desktopBadgeSchema = external_exports.object({
+      count: external_exports.number().int().min(0).max(DESKTOP_BADGE_MAX_COUNT),
+      label: external_exports.string().max(DESKTOP_BADGE_LABEL_MAX_LENGTH)
+    });
+    desktopNavigateSchema = external_exports.object({
+      path: desktopAppPathSchema
+    });
+    desktopSettingsSchema = external_exports.object({
+      /** The app opens when the person logs in to the computer: the operating system's own login item. */
+      openAtLogin: external_exports.boolean(),
+      /** Closing the window keeps the app running in the tray (true), or quits it (false). */
+      closeToTray: external_exports.boolean(),
+      /** The shell shows notifications (true), or none (false). The badge is not a notification. */
+      notifications: external_exports.boolean(),
+      /**
+       * A customer message's notification shows the customer's name and words, where the platform
+       * allows them at all (`desktopShowsCustomerWords`: macOS); elsewhere the shell never shows them.
+       */
+      messagePreview: external_exports.boolean()
     });
+    desktopSettingsChangeSchema = desktopSettingsSchema.partial().strict().refine((change) => Object.values(change).every((value) => typeof value === "boolean"), {
+      message: "each setting changed is true or false"
+    });
+    desktopBridgeArgsSchemas = {
+      getShellInfo: external_exports.tuple([]),
+      getPresence: external_exports.tuple([]),
+      openSignIn: external_exports.tuple([external_exports.string().max(DESKTOP_SIGN_IN_URL_MAX_LENGTH)]),
+      getUpdate: external_exports.tuple([]),
+      restartToUpdate: external_exports.tuple([]),
+      notify: external_exports.tuple([desktopNotificationSchema]),
+      setBadge: external_exports.tuple([desktopBadgeSchema]),
+      clearAll: external_exports.tuple([]),
+      getSettings: external_exports.tuple([]),
+      setSettings: external_exports.tuple([desktopSettingsChangeSchema])
+    };
   }
 });
 
@@ -11019,7 +10885,7 @@ var init_chunk_4LXDRTO4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-C5MU3WEM.js
+// ../../packages/core/dist/chunk-6Y7XMRWF.js
 function isIanaTimezone(timezone) {
   try {
     new Intl.DateTimeFormat("en-US", { timeZone: timezone }).format(0);
@@ -11029,10 +10895,10 @@ function isIanaTimezone(timezone) {
   }
 }
 var evalDateContextSchema;
-var init_chunk_C5MU3WEM = __esm({
-  "../../packages/core/dist/chunk-C5MU3WEM.js"() {
+var init_chunk_6Y7XMRWF = __esm({
+  "../../packages/core/dist/chunk-6Y7XMRWF.js"() {
     "use strict";
-    init_chunk_Y3S4XX4K();
+    init_chunk_Z22T2ASG();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
     init_chunk_DHPUPI4Y();
@@ -11059,7 +10925,7 @@ var init_chunk_2ISUBJG7 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-6UKJ6EMZ.js
+// ../../packages/core/dist/chunk-RCTKQTJH.js
 function describeRole(role) {
   if (typeof role === "string") {
     return JSON.stringify(role.length > ROLE_ECHO_MAX ? `${role.slice(0, ROLE_ECHO_MAX)}\u2026` : role);
@@ -11233,11 +11099,11 @@ function terminalRunCount(counts) {
   return counts.successful_runs + counts.failed_runs;
 }
 var evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, runJourneyQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, evalCustomerContactIdSchema, evalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT;
-var init_chunk_6UKJ6EMZ = __esm({
-  "../../packages/core/dist/chunk-6UKJ6EMZ.js"() {
+var init_chunk_RCTKQTJH = __esm({
+  "../../packages/core/dist/chunk-RCTKQTJH.js"() {
     "use strict";
     init_chunk_4LXDRTO4();
-    init_chunk_C5MU3WEM();
+    init_chunk_6Y7XMRWF();
     init_chunk_HZ6CADSY();
     init_chunk_2ISUBJG7();
     init_zod();
@@ -12320,7 +12186,7 @@ var init_chunk_6NI5RAM4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-SCZ3GSJE.js
+// ../../packages/core/dist/chunk-FJ5K57CB.js
 function refineHubAsCodeCustomTools(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -12856,12 +12722,12 @@ function refineHubAsCodeMonitorRulesOutput(config, ctx) {
   });
 }
 var MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
-var init_chunk_SCZ3GSJE = __esm({
-  "../../packages/core/dist/chunk-SCZ3GSJE.js"() {
+var init_chunk_FJ5K57CB = __esm({
+  "../../packages/core/dist/chunk-FJ5K57CB.js"() {
     "use strict";
     init_chunk_4S4FBSBE();
-    init_chunk_6UKJ6EMZ();
-    init_chunk_DIBRGYL6();
+    init_chunk_RCTKQTJH();
+    init_chunk_2LZYS6YX();
     init_chunk_LBDH7LCG();
     init_chunk_4LXDRTO4();
     init_chunk_T4Q5COKJ();
@@ -13703,29 +13569,58 @@ var init_chunk_YULHXJ5M = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-UEJOG2Q7.js
-var archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams;
-var init_chunk_UEJOG2Q7 = __esm({
-  "../../packages/core/dist/chunk-UEJOG2Q7.js"() {
+// ../../packages/core/dist/chunk-V4FRPRH5.js
+var CONSULT_THREAD_STATUSES, consultThreadStatus, CONSULT_THREAD_TITLE_MAX, consultThreadTitle, consultThreadSummary, listConsultThreadsQuery, listConsultThreadsResponse, createConsultThreadBody, createConsultThreadResponse, consultThreadIdParam, updateConsultThreadBody, updateConsultThreadResponse, CONSULT_AWAIT_TIMEOUT_MS;
+var init_chunk_V4FRPRH5 = __esm({
+  "../../packages/core/dist/chunk-V4FRPRH5.js"() {
     "use strict";
     init_zod();
-    archiveHubIdParam = external_exports.object({
-      hubId: external_exports.string().uuid()
+    CONSULT_THREAD_STATUSES = ["open", "awaiting", "resolved", "cancelled_at_close"];
+    consultThreadStatus = external_exports.enum(CONSULT_THREAD_STATUSES);
+    CONSULT_THREAD_TITLE_MAX = 120;
+    consultThreadTitle = external_exports.string().trim().min(1).max(CONSULT_THREAD_TITLE_MAX);
+    consultThreadSummary = external_exports.object({
+      consult_thread_id: external_exports.string(),
+      conversation_id: external_exports.string(),
+      initiator_type: external_exports.enum(["team", "agent"]),
+      initiator_id: external_exports.string(),
+      engaged_agent_id: external_exports.string().nullable(),
+      engaged_agent_name: external_exports.string().nullable(),
+      title: external_exports.string().nullable(),
+      status: consultThreadStatus,
+      created_at: external_exports.string()
     });
-    archiveConversationParams = external_exports.object({
-      hubId: external_exports.string().uuid(),
-      conversationId: external_exports.string().uuid()
+    listConsultThreadsQuery = external_exports.object({
+      hub_id: external_exports.string().uuid()
     });
-    archiveListQuery = external_exports.object({
-      user_id: external_exports.string().optional(),
-      start: external_exports.string().optional(),
-      end: external_exports.string().optional(),
-      page: external_exports.string().regex(/^\d+$/).optional(),
-      page_size: external_exports.string().regex(/^\d+$/).optional()
+    listConsultThreadsResponse = external_exports.object({
+      threads: external_exports.array(consultThreadSummary)
     });
-    archiveMessageObservabilityParams = archiveConversationParams.extend({
-      messageId: external_exports.string().uuid()
+    createConsultThreadBody = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      title: consultThreadTitle.optional(),
+      // Optionally engage a consultant on creation. Validated server-side against the
+      // hub's `consultant`-role agents; a non-consultant / unknown id is rejected.
+      engaged_agent_id: external_exports.string().uuid().optional()
+    });
+    createConsultThreadResponse = external_exports.object({
+      thread: consultThreadSummary
+    });
+    consultThreadIdParam = external_exports.object({
+      id: external_exports.string().uuid(),
+      threadId: external_exports.string().uuid()
     });
+    updateConsultThreadBody = external_exports.object({
+      hub_id: external_exports.string().uuid(),
+      title: consultThreadTitle.optional(),
+      engaged_agent_id: external_exports.string().uuid().optional()
+    }).refine((v) => v.title !== void 0 || v.engaged_agent_id !== void 0, {
+      message: "Provide a title and/or an engaged_agent_id to update"
+    });
+    updateConsultThreadResponse = external_exports.object({
+      thread: consultThreadSummary
+    });
+    CONSULT_AWAIT_TIMEOUT_MS = 15 * 6e4;
   }
 });
 
@@ -13842,13 +13737,13 @@ var init_chunk_LQY2OCQL = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-EHPGISOL.js
+// ../../packages/core/dist/chunk-EA6XOOL2.js
 var AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam;
-var init_chunk_EHPGISOL = __esm({
-  "../../packages/core/dist/chunk-EHPGISOL.js"() {
+var init_chunk_EA6XOOL2 = __esm({
+  "../../packages/core/dist/chunk-EA6XOOL2.js"() {
     "use strict";
     init_chunk_LQY2OCQL();
-    init_chunk_DIBRGYL6();
+    init_chunk_2LZYS6YX();
     init_chunk_3HSB6J4J();
     init_chunk_5XEJSR22();
     init_chunk_DHPUPI4Y();
@@ -14099,6 +13994,118 @@ var init_chunk_ZJJ5ODOD = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-7CYHPF35.js
+var appMessageSenderType, appMessageReceiverType, apiChannelMessage, apiChannelMessageBody, appMessageBody, appMessageResponse;
+var init_chunk_7CYHPF35 = __esm({
+  "../../packages/core/dist/chunk-7CYHPF35.js"() {
+    "use strict";
+    init_chunk_HZ6CADSY();
+    init_zod();
+    appMessageSenderType = external_exports.enum(["user", "team"]);
+    appMessageReceiverType = external_exports.enum(["user", "team", "agent", "assistant"]).transform((v) => v === "assistant" ? "agent" : v);
+    apiChannelMessage = external_exports.object({
+      text: clientOptionalString,
+      attachments: external_exports.array(messageAttachment).max(MAX_ATTACHMENTS_PER_MESSAGE).nullish().transform((v) => v ?? void 0)
+    }).refine((m) => m.text && m.text.length > 0 || m.attachments && m.attachments.length > 0, {
+      message: "message must have text or at least one attachment"
+    });
+    apiChannelMessageBody = external_exports.object({
+      // Correlation id (task hubs): new → new conversation, repeat → continue. min 1 so an
+      // empty string can't masquerade as a ref. Mutually exclusive with conversation_id.
+      external_ref: external_exports.string().min(1).max(256).optional(),
+      // Continue a specific WayAI conversation (authorized against the hub/channel + owner).
+      // UUID-validated here (unlike the app channel, whose client we control): allocation
+      // only treats a UUID-shaped id as a provided conversation, so a malformed id would
+      // otherwise skip the owner guard and silently MINT a new conversation instead of
+      // rejecting. A format 400 is shape-only — not an existence oracle (a valid-but-unknown
+      // UUID still collapses to the opaque authorization error downstream).
+      conversation_id: external_exports.string().uuid().optional(),
+      // On-behalf-of end-user identity. Absent → per-connection service principal (task-hub
+      // only; chat hub rejects with 422 in the route).
+      user: external_exports.object({
+        id: external_exports.string().min(1),
+        email: clientOptionalString,
+        name: clientOptionalString
+      }).optional(),
+      message: apiChannelMessage,
+      // Idempotency key: maps to channel_message_sid, deduped within one conversation
+      // (ConversationDO.storeMessage). A retried POST resolves to the same conversation (a chat
+      // hub's user, the external_ref, the conversation_id, or on a task hub with neither, this key
+      // scoped by the sender), so it echoes the original message_id and skips billing / turn
+      // dispatch. A failed store answers a retryable 503 only when this key is set; without it a
+      // retry could store the message twice, so it answers 400.
+      client_message_id: external_exports.string().min(1).max(256).optional()
+    }).refine((b) => !(b.external_ref && b.conversation_id), {
+      message: "provide external_ref or conversation_id, not both",
+      path: ["external_ref"]
+    });
+    appMessageBody = external_exports.object({
+      // Message content — three historical aliases. All optional: an attachment-only
+      // or voice-only message carries no text.
+      content: clientOptionalString,
+      message_text: clientOptionalString,
+      message_body: clientOptionalString,
+      // Conversation context. Ids are plain strings rather than `.uuid()` on purpose:
+      // they are AUTHORIZED downstream, which is the stronger guarantee — a well-formed
+      // uuid belonging to another tenant must fail just as hard as junk. `hub_id` is
+      // gated by `assertHubEndUserAccess` (gh #3286) and `conversation_id` by HubDO's
+      // conversation_index owner check (gh #2781, #3281). The route's own falsy guards
+      // ('hub_id is required') still reject an empty one.
+      hub_id: clientOptionalString,
+      channel_id: clientOptionalString,
+      conversation_id: clientOptionalString,
+      hub_type: external_exports.enum(["chat", "task"]).nullish().transform((v) => v ?? void 0),
+      // Stable idempotency key for one explicit task-hub launcher. HubDO scopes it
+      // to the authenticated user and resolves retries/tabs to one conversation.
+      task_start_id: external_exports.string().uuid().nullish().transform((v) => v ?? void 0),
+      // Routing.
+      sender_type: appMessageSenderType.nullish().transform((v) => v ?? void 0),
+      receiver_type: appMessageReceiverType.nullish().transform((v) => v ?? void 0),
+      // Only meaningful on a team send, where `validateAppTeamSendContext` proves the
+      // caller may send to this receiver. Absent on a team send to a conversation with no
+      // person, which names its `conversation_id` instead. The end-user branch ignores it —
+      // see the receiver derivation in the route.
+      user_receiver_id: clientOptionalString,
+      // ── Internal consult (consultant-agents PR 2 — H1.0) ──────────────────────
+      // A team member handling a customer conversation can tag a `consultant`-role
+      // agent for a PRIVATE, team-only exchange that never reaches the customer. A
+      // consult send is a team send with `receiver_type: 'agent'` targeting the
+      // consultant; `user_receiver_id` identifies the customer whose conversation this is
+      // (and is authorized by `validateAppTeamSendContext`, exactly as a team→user send is),
+      // and is absent, as on a team→user send, when the conversation has no person. The consultant is resolved from `agent_receiver_id`
+      // when supplied, else from an `@mention` parsed out of the message text against
+      // the hub's consultant agents. `consult_thread_id` continues an existing thread;
+      // absent, the route creates/reuses the single implicit thread. These fields are
+      // inert on every non-consult send (end-user send, team→user send).
+      agent_receiver_id: clientOptionalString,
+      consult_thread_id: clientOptionalString,
+      is_first_message: clientOptionalBoolean,
+      end_conversation: clientOptionalBoolean,
+      // Pre-generated by the client so the optimistic bubble and the stored row share
+      // a key (transcription live-updates land on the same row instead of duplicating).
+      message_id: clientOptionalString,
+      attachments: external_exports.array(messageAttachment).max(MAX_ATTACHMENTS_PER_MESSAGE).nullish().transform((v) => v ?? void 0),
+      // Base64-encoded audio for STT. Size-capped in the route (the cap is a byte
+      // budget tied to the /channels/* bodyLimit, not a shape rule).
+      audio_file: clientOptionalString
+    });
+    appMessageResponse = external_exports.object({
+      success: external_exports.boolean(),
+      message: external_exports.string(),
+      result: external_exports.object({
+        conversation_id: external_exports.string().optional(),
+        message_id: external_exports.string().optional(),
+        status: external_exports.string().optional(),
+        files: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
+        // True when this request reused a task-start/message id already accepted by
+        // the server. Clients must replace their optimistic payload with a fresh
+        // authoritative read because another tab may have won with different text.
+        deduped: external_exports.boolean().optional()
+      }).optional()
+    });
+  }
+});
+
 // ../../packages/core/dist/chunk-NVKU5PPQ.js
 var ADMIN_SKILL_NAME_REGEX, adminSkillNameParam;
 var init_chunk_NVKU5PPQ = __esm({
@@ -14148,10 +14155,10 @@ var init_chunk_BFG4ZWR4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-WO37XYVD.js
+// ../../packages/core/dist/chunk-6QXCHNFQ.js
 var dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT;
-var init_chunk_WO37XYVD = __esm({
-  "../../packages/core/dist/chunk-WO37XYVD.js"() {
+var init_chunk_6QXCHNFQ = __esm({
+  "../../packages/core/dist/chunk-6QXCHNFQ.js"() {
     "use strict";
     init_zod();
     dataExplorerDebugDoType = external_exports.enum(["hub", "org", "conversation", "user", "platform", "thread", "community", "contact_book", "batch"]);
@@ -14262,7 +14269,7 @@ var init_chunk_OMPT4ZHR = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-2FCLSQSQ.js
+// ../../packages/core/dist/chunk-3ACHWKFV.js
 function refineScopedTarget(data, ctx) {
   if (data.scope === "org") {
     if (!data.org_id) {
@@ -14287,13 +14294,13 @@ function refineScopedTarget(data, ctx) {
     }
   }
 }
-var adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, turnDeadlineSeconds, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery;
-var init_chunk_2FCLSQSQ = __esm({
-  "../../packages/core/dist/chunk-2FCLSQSQ.js"() {
+var adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, turnDeadlineSeconds, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, dataExplorerDebugCountsDoType, dataExplorerDebugCountsParam, debugHubConvParam, debugMessageIdQuery;
+var init_chunk_3ACHWKFV = __esm({
+  "../../packages/core/dist/chunk-3ACHWKFV.js"() {
     "use strict";
     init_chunk_FECLIZTY();
     init_chunk_BFG4ZWR4();
-    init_chunk_WO37XYVD();
+    init_chunk_6QXCHNFQ();
     init_chunk_T4Q5COKJ();
     init_chunk_OMPT4ZHR();
     init_chunk_HZ6CADSY();
@@ -14620,6 +14627,11 @@ var init_chunk_2FCLSQSQ = __esm({
       message_id: debugUuid.optional(),
       limit: external_exports.coerce.number().int().min(1).max(DEBUG_READ_MAX_LIMIT).default(DEBUG_READ_DEFAULT_LIMIT)
     });
+    dataExplorerDebugCountsDoType = dataExplorerDebugDoType.extract(["hub", "org"]);
+    dataExplorerDebugCountsParam = external_exports.object({
+      type: dataExplorerDebugCountsDoType,
+      id: debugUuid
+    });
     debugHubConvParam = external_exports.object({
       hubId: debugUuid,
       conversationId: debugUuid
@@ -14741,6 +14753,32 @@ var init_chunk_2PZIF56U = __esm({
   }
 });
 
+// ../../packages/core/dist/chunk-UEJOG2Q7.js
+var archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams;
+var init_chunk_UEJOG2Q7 = __esm({
+  "../../packages/core/dist/chunk-UEJOG2Q7.js"() {
+    "use strict";
+    init_zod();
+    archiveHubIdParam = external_exports.object({
+      hubId: external_exports.string().uuid()
+    });
+    archiveConversationParams = external_exports.object({
+      hubId: external_exports.string().uuid(),
+      conversationId: external_exports.string().uuid()
+    });
+    archiveListQuery = external_exports.object({
+      user_id: external_exports.string().optional(),
+      start: external_exports.string().optional(),
+      end: external_exports.string().optional(),
+      page: external_exports.string().regex(/^\d+$/).optional(),
+      page_size: external_exports.string().regex(/^\d+$/).optional()
+    });
+    archiveMessageObservabilityParams = archiveConversationParams.extend({
+      messageId: external_exports.string().uuid()
+    });
+  }
+});
+
 // ../../packages/core/dist/chunk-SOJMWM63.js
 var init_chunk_SOJMWM63 = __esm({
   "../../packages/core/dist/chunk-SOJMWM63.js"() {
@@ -14955,6 +14993,7 @@ var init_chunk_TS4EYU3W = __esm({
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
+    init_chunk_GK27ENTT();
     init_chunk_SXDX4GHS();
     init_chunk_HENF6YTF();
     init_chunk_VXEAR36B();
@@ -14962,8 +15001,6 @@ var init_contracts = __esm({
     init_chunk_Q7KIQHAZ();
     init_chunk_WBFLPPDI();
     init_chunk_IPXBFWUU();
-    init_chunk_GK27ENTT();
-    init_chunk_IPDOHAZ5();
     init_chunk_GPM7PE44();
     init_chunk_DGKMMFIR();
     init_chunk_ZC6YGHNX();
@@ -14972,40 +15009,39 @@ var init_contracts = __esm({
     init_chunk_Y7CFCYX4();
     init_chunk_5DGHIY7L();
     init_chunk_4QBKRQMM();
-    init_chunk_4MRBBR5L();
+    init_chunk_OWAAYKPB();
     init_chunk_BEOHBREG();
-    init_chunk_SY6PLCPK();
+    init_chunk_IPDOHAZ5();
     init_chunk_YUZFHVB2();
     init_chunk_I3O2RACG();
     init_chunk_34LE6P7E();
     init_chunk_FPSDNS2E();
-    init_chunk_LKBSHANA();
-    init_chunk_23ESQLLF();
+    init_chunk_C4TPQN6Z();
     init_chunk_C4HEZ7ZI();
     init_chunk_IR2NOSI3();
     init_chunk_EA23LSDS();
-    init_chunk_V4FRPRH5();
+    init_chunk_SY6PLCPK();
     init_chunk_LWMLR2WI();
     init_chunk_ACGAI25T();
     init_chunk_MH4O3YEX();
-    init_chunk_6GBBTCME();
+    init_chunk_XR36MYEY();
     init_chunk_KSTYTQ7I();
-    init_chunk_7CYHPF35();
+    init_chunk_LKBSHANA();
     init_chunk_BPCNB5RT();
-    init_chunk_SCZ3GSJE();
+    init_chunk_FJ5K57CB();
     init_chunk_4S4FBSBE();
-    init_chunk_6UKJ6EMZ();
+    init_chunk_RCTKQTJH();
     init_chunk_JDJ4EUOL();
     init_chunk_3KYTITOR();
     init_chunk_XCDUP42J();
     init_chunk_6J742GLA();
     init_chunk_ZVXO3XL6();
     init_chunk_YULHXJ5M();
-    init_chunk_UEJOG2Q7();
+    init_chunk_V4FRPRH5();
     init_chunk_ZHJEQBXJ();
-    init_chunk_EHPGISOL();
+    init_chunk_EA6XOOL2();
     init_chunk_LQY2OCQL();
-    init_chunk_DIBRGYL6();
+    init_chunk_2LZYS6YX();
     init_chunk_3HSB6J4J();
     init_chunk_IG6QBZMA();
     init_chunk_ZJJ5ODOD();
@@ -15013,29 +15049,31 @@ var init_contracts = __esm({
     init_chunk_LBDH7LCG();
     init_chunk_4LXDRTO4();
     init_chunk_E4DIIOOE();
-    init_chunk_23UZ2IKU();
+    init_chunk_7CYHPF35();
+    init_chunk_VMAX5YRT();
     init_chunk_MCSEEMGN();
     init_chunk_UFYIBL66();
     init_chunk_NVKU5PPQ();
-    init_chunk_2FCLSQSQ();
+    init_chunk_3ACHWKFV();
     init_chunk_FECLIZTY();
     init_chunk_BFG4ZWR4();
-    init_chunk_WO37XYVD();
+    init_chunk_6QXCHNFQ();
     init_chunk_T4Q5COKJ();
     init_chunk_3VHMUK4W();
     init_chunk_AMG6HKUQ();
     init_chunk_ACN6GXU6();
     init_chunk_OMPT4ZHR();
     init_chunk_2PZIF56U();
+    init_chunk_UEJOG2Q7();
     init_chunk_KJXJKAYT();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
-    init_chunk_C5MU3WEM();
+    init_chunk_6Y7XMRWF();
     init_chunk_5XEJSR22();
     init_chunk_IBL7FANV();
-    init_chunk_Y3S4XX4K();
-    init_chunk_A4JC7DXB();
+    init_chunk_Z22T2ASG();
     init_chunk_VORPHGDT();
+    init_chunk_A4JC7DXB();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
     init_chunk_2ISUBJG7();
@@ -15935,6 +15973,10 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/do/${doType}/${encodeURIComponent(doId)}/tables/${encodeURIComponent(table)}/rows${qs}`
         );
       }
+      /** A hub's or an organization's knowledge as numbers: the admin census's counts (no text). */
+      async debugCounts(doType, doId) {
+        return this.request("GET", `/api/admin/data-explorer/debug/do/${doType}/${encodeURIComponent(doId)}/counts`);
+      }
       async debugListAnalyticsTables() {
         return this.request("GET", "/api/admin/data-explorer/debug/analytics/tables");
       }
@@ -16359,13 +16401,13 @@ var init_dist = __esm({
     init_chunk_KJXJKAYT();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
-    init_chunk_C5MU3WEM();
+    init_chunk_6Y7XMRWF();
     init_chunk_5XEJSR22();
     init_chunk_IBL7FANV();
-    init_chunk_Y3S4XX4K();
-    init_chunk_A4JC7DXB();
+    init_chunk_Z22T2ASG();
     init_chunk_P3AWZG3N();
     init_chunk_VORPHGDT();
+    init_chunk_A4JC7DXB();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
     init_chunk_ERFR7IRY();
@@ -17754,6 +17796,7 @@ var init_utils = __esm({
       ["admin observability", { positionals: 2, values: ["--message-id"] }],
       ["admin do tables", { positionals: 2 }],
       ["admin do read", { positionals: 3, values: ["--limit", "--id"] }],
+      ["admin do counts", { positionals: 2 }],
       ["admin analytics tables", { positionals: 0 }],
       ["admin analytics read", { positionals: 1, values: ["--limit", "--conversation-id", "--hub-id", "--message-id"] }],
       ["admin report list", { positionals: 0, values: ["--status", "--source", "--limit", "--offset", "--since", "--resolved-since"] }],
@@ -33551,7 +33594,7 @@ token (\`wayai login --token\`, or WAYAI_TOKEN) is refused.
 var init_rekor_toolset = __esm({
   "../../packages/core/dist/contracts/rekor-toolset.js"() {
     "use strict";
-    init_chunk_4MRBBR5L();
+    init_chunk_OWAAYKPB();
     init_chunk_BEOHBREG();
     init_chunk_DHPUPI4Y();
   }
@@ -35422,7 +35465,7 @@ var COUNTER_KEYS, STT_PRICING, CONTAINER_PRICING, connectorById, nativeToolById;
 var init_catalog = __esm({
   "../../packages/core/dist/catalog/index.js"() {
     "use strict";
-    init_chunk_23UZ2IKU();
+    init_chunk_VMAX5YRT();
     init_chunk_MCSEEMGN();
     init_chunk_UFYIBL66();
     init_chunk_A4JC7DXB();
@@ -36131,6 +36174,9 @@ async function adminCommand(args2) {
       case "read":
         await runDoRead(positional, flagArgs);
         return;
+      case "counts":
+        await runDoCounts(positional, flagArgs);
+        return;
       default:
         printHelp2();
         process.exit(1);
@@ -36461,6 +36507,32 @@ async function runDoRead(positional, flagArgs) {
   }
   printDebugRowsResult(response.data, jsonOutput);
 }
+async function runDoCounts(positional, flagArgs) {
+  const type = dataExplorerDebugCountsDoType.safeParse(positional[0]);
+  if (positional.length < 2 || !type.success) {
+    console.error(`wayai admin do counts <${dataExplorerDebugCountsDoType.options.join("|")}> <id> [--json]`);
+    process.exit(1);
+  }
+  const { jsonOutput } = parseFlags2(flagArgs, ["--json"]);
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let response;
+  try {
+    response = await client.debugCounts(type.data, positional[1]);
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  if (jsonOutput) {
+    console.log(JSON.stringify(response.data, null, 2));
+    return;
+  }
+  for (const line of flattenCounts(response.data)) console.log(line);
+}
+function flattenCounts(value, prefix = "") {
+  if (value === null || typeof value !== "object") return [`${prefix}: ${value === null ? "\u2014" : String(value)}`];
+  return Object.entries(value).flatMap(([key, child]) => flattenCounts(child, prefix ? `${prefix}.${key}` : key));
+}
 async function runAnalyticsTables() {
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -37824,6 +37896,9 @@ wayai admin \u2014 platform-admin diagnostic commands
 Usage:
   wayai admin do tables <type> <id>
   wayai admin do read <type> <id> <table> [--limit N] [--id X] [--json]
+  wayai admin do counts <hub|org> <id> [--json]    Knowledge as numbers, no text: a hub's knowledge rows, links, toolset connections,
+                                                   knowledge placeholders per stored text and (production) publish state; an org's
+                                                   resources and moved-knowledge registry
 
   wayai admin analytics tables
   wayai admin analytics read <table> [--conversation-id X] [--hub-id Y] [--message-id Z] [--limit N] [--json]
@@ -38965,8 +39040,10 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
       if (n === 0) {
         console.error("No rows left to undo \u2014 closing the import session.");
       } else {
+        const reviewed = await recordTypeIsReviewed(client, base, plan.record_type);
+        const count = `${reviewed ? "up to " : ""}${n} record${n === 1 ? "" : "s"}`;
         const ok = await confirm(
-          `Delete ${n} record${n === 1 ? "" : "s"} created by this import into "${sanitizeTerminalText(String(plan.record_type))}", plus every relationship pointing at them?`
+          `Delete ${count} created by this import into "${sanitizeTerminalText(String(plan.record_type))}"${reviewed ? " (those approved now stay unless you are signed in to WayAI as a person)" : ""}, plus every relationship pointing at them?`
         );
         if (!ok) {
           console.error("Aborted.");
@@ -38976,6 +39053,7 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
     }
     let records = 0;
     let relationships = 0;
+    let kept = 0;
     let calls = 0;
     let incomplete = false;
     for (let sweep = 0; ; sweep++) {
@@ -38987,7 +39065,10 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
       records += res.swept.records;
       relationships += res.swept.relationships;
       calls++;
-      if (res.complete) break;
+      if (res.complete) {
+        kept = res.kept?.records ?? 0;
+        break;
+      }
       const sweptNothing = res.swept.records === 0 && res.swept.relationships === 0;
       if (sweptNothing || sweep + 1 >= MAX_ROLLBACK_SWEEPS) {
         incomplete = true;
@@ -39005,10 +39086,16 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
         "Note: a request was re-sent after its outcome was unknown, so the counts below are a lower bound \u2014 a page that committed before its response was lost is not included."
       );
     }
+    if (kept > 0) {
+      console.error(
+        `Kept ${kept} record${kept === 1 ? "" : "s"} of this import that ${kept === 1 ? "is" : "are"} approved: only a person signed in to WayAI removes an approved record. A rollback of this import by one removes them.`
+      );
+    }
     printOutput(
       {
         import_id: importId,
         swept: { records, relationships },
+        ...kept > 0 ? { kept: { records: kept } } : {},
         requests: calls,
         // The server's own completion claim, carried so a script can tell an
         // undo that FINISHED from one that stopped early and needs re-running.
@@ -39021,10 +39108,23 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
   });
   return importCmd;
 }
+async function recordTypeIsReviewed(client, base, recordType2) {
+  if (recordType2 === null) return false;
+  try {
+    const type = await client.request(
+      "GET",
+      `/v1/${base}/record-types/${pathSegment(recordType2, "record_type")}`
+    );
+    return declaresReview(type?.json_schema);
+  } catch {
+    return true;
+  }
+}
 var MAX_CHUNK_ROWS, MAX_ATTEMPTS, MAX_ROLLBACK_SWEEPS, BASE_BACKOFF_MS, RETRYABLE_CODES, sleep2;
 var init_import = __esm({
   "src/data/commands/import.ts"() {
     "use strict";
+    init_rekor_toolset();
     init_client();
     init_output();
     init_helpers();