@wayai/cli 0.3.230 → 0.3.232

package/dist/index.js

@@ -4929,10 +4929,10 @@ var init_chunk_HZ6CADSY = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-DYI3BRJ3.js
+// ../../packages/core/dist/chunk-6VCHIFJT.js
 var resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery;
-var init_chunk_DYI3BRJ3 = __esm({
-  "../../packages/core/dist/chunk-DYI3BRJ3.js"() {
+var init_chunk_6VCHIFJT = __esm({
+  "../../packages/core/dist/chunk-6VCHIFJT.js"() {
     "use strict";
     init_chunk_HZ6CADSY();
     init_zod();
@@ -5060,8 +5060,7 @@ var init_chunk_DYI3BRJ3 = __esm({
       resource_id: uuidSchema,
       agent_id: uuidSchema,
       priority: external_exports.number().optional(),
-      use_native_integration: external_exports.boolean().optional(),
-      write_enabled: external_exports.boolean().optional()
+      use_native_integration: external_exports.boolean().optional()
     });
     updateAgentResourceBody = external_exports.object({
       hub_id: uuidSchema,
@@ -5069,8 +5068,7 @@ var init_chunk_DYI3BRJ3 = __esm({
       agent_id: uuidSchema,
       use_native_integration: external_exports.boolean().optional(),
       enabled: external_exports.boolean().optional(),
-      priority: external_exports.number().optional(),
-      write_enabled: external_exports.boolean().optional()
+      priority: external_exports.number().optional()
     });
     unlinkAgentResourceQuery = external_exports.object({
       hub_id: uuidSchema,
@@ -5623,7 +5621,7 @@ var init_chunk_5XEJSR22 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-KJXJKAYT.js
+// ../../packages/core/dist/chunk-QUKTIJKE.js
 function matchPath(pattern, path42) {
   const normalizedPath = path42.replace(/\/$/, "");
   if (pattern.endsWith("/*")) {
@@ -5651,8 +5649,8 @@ function getEndpointConfig(path42) {
   return { tier: "STANDARD" };
 }
 var ENDPOINT_CONFIGS, EXCLUDED_PATHS;
-var init_chunk_KJXJKAYT = __esm({
-  "../../packages/core/dist/chunk-KJXJKAYT.js"() {
+var init_chunk_QUKTIJKE = __esm({
+  "../../packages/core/dist/chunk-QUKTIJKE.js"() {
     "use strict";
     init_chunk_5XEJSR22();
     ENDPOINT_CONFIGS = {
@@ -5971,6 +5969,9 @@ var init_chunk_KJXJKAYT = __esm({
       // fans out over every production hub of every org, so it takes the same strict,
       // fail-closed budget as the team-orphan repair. Exact path, for the same reason.
       "/api/admin/hubs/repair-branching-orphans": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
+      // Knowledge-blob repair (#5142 step 5 C1) — deletes R2 objects across every hub of a scope, so it
+      // takes the same strict, fail-closed budget as the other hub repairs. Exact path, for the same reason.
+      "/api/admin/hubs/repair-knowledge-blobs": { tier: "STRICT", userLimit: 10, userWindow: 3600, failClosed: true },
       // CI/GitOps endpoints - standard with user limits. 500 because `wayai push` makes four requests
       // (pull, diff, push, pull) and a GitOps job may push every hub at once with one token; when
       // each path held its own 100, that ran to 100 hubs a minute.
@@ -6121,7 +6122,7 @@ var init_chunk_KJXJKAYT = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-4QBKRQMM.js
+// ../../packages/core/dist/chunk-4QU6WS7I.js
 function fileSnapshotChanged(run) {
   return run.written + run.removed > 0;
 }
@@ -6162,10 +6163,10 @@ async function sendWithRetry(opts, cursor) {
   }
 }
 var rekorFileSnapshotAnswerSchema, FILE_SNAPSHOT_MAX_PAGES, FILE_SNAPSHOT_CONFLICT_ATTEMPTS, FILE_SNAPSHOT_PAGE_SPACING_MS, FILE_SNAPSHOT_CONFLICT_STATUS;
-var init_chunk_4QBKRQMM = __esm({
-  "../../packages/core/dist/chunk-4QBKRQMM.js"() {
+var init_chunk_4QU6WS7I = __esm({
+  "../../packages/core/dist/chunk-4QU6WS7I.js"() {
     "use strict";
-    init_chunk_KJXJKAYT();
+    init_chunk_QUKTIJKE();
     init_chunk_5XEJSR22();
     init_zod();
     rekorFileSnapshotAnswerSchema = external_exports.object({
@@ -6231,15 +6232,18 @@ var init_chunk_BEOHBREG = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-4MRBBR5L.js
+// ../../packages/core/dist/chunk-OWAAYKPB.js
+function declaresReview(schema) {
+  return typeof schema === "object" && schema !== null && schema[REVIEW_DECLARATION_KEY] !== void 0;
+}
 function toolsetFileToolName(entry, op) {
   const names = entry.names;
   const stated = names?.[op];
   return stated !== void 0 && stated !== null ? String(stated) : `${op}_${entry.name ?? entry.file_type}`;
 }
-var TOOLSET_SLUG_SETTING, TOOLSET_SLUG_PATTERN, REKOR_STRUCTURAL_ID_PATTERN, baseEnvironmentSchema, TOOLSET_FILE_OPERATIONS, toolsetFileToolSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorToolsetToolsSchema, rekorBoundAttestation, rekorResolvedToolsetSchema, resolvedFileToolSchema, rekorToolsetFileSchema, rekorToolsetFileListSchema, rekorToolsetFileGetSchema, rekorToolsetFilePutSchema, TOOLSET_CUSTOMER_FACING_REFUSAL_MARK, TOOLSET_CUSTOMER_FACING_REFUSAL;
-var init_chunk_4MRBBR5L = __esm({
-  "../../packages/core/dist/chunk-4MRBBR5L.js"() {
+var TOOLSET_SLUG_SETTING, TOOLSET_SLUG_PATTERN, REKOR_STRUCTURAL_ID_PATTERN, baseEnvironmentSchema, TOOLSET_FILE_OPERATIONS, toolsetFileToolSchema, toolsetSurfaceSchema, toolsetConnectionBindingSchema, rekorToolsetToolsSchema, rekorBoundAttestation, rekorResolvedToolsetSchema, REVIEW_DECLARATION_KEY, resolvedRecordTypeSchema, reviewWritersSchema, sharedScopeSchema, resolvedFileToolSchema, rekorToolsetFileSchema, rekorToolsetFileListSchema, rekorToolsetFileGetSchema, rekorToolsetFilePutSchema, TOOLSET_CUSTOMER_FACING_REFUSAL_MARK, TOOLSET_CUSTOMER_FACING_REFUSAL;
+var init_chunk_OWAAYKPB = __esm({
+  "../../packages/core/dist/chunk-OWAAYKPB.js"() {
     "use strict";
     init_chunk_BEOHBREG();
     init_chunk_DHPUPI4Y();
@@ -6287,6 +6291,22 @@ var init_chunk_4MRBBR5L = __esm({
        * sync or token save records it.
        */
       file_writes: external_exports.boolean().optional(),
+      /**
+       * A record type the toolset's actions or composite steps reach (the resolve's `record_types`) names it
+       * among its writers (`x-review.writers`, #5083 RK4): the toolset writes the type's drafts and reads its
+       * every record, drafts included. Or such a type's declaration this side cannot read, or a resolve
+       * reaching records that carries no record types. A type only its relationship tools reach is not
+       * judged: the resolve does not carry that type's declaration. Absent
+       * on a surface recorded before it was, which the customer-facing rule reads as writing, for a toolset
+       * reaching records, until the connection's next tool sync or token save records it.
+       */
+      review_writes: external_exports.boolean().optional(),
+      /**
+       * Every record type the toolset reaches, at least one, is reviewed (`x-review`), holds no customer data
+       * (`shared`), and does not name it among its writers: each call reads only that type's approved
+       * records (#5083 decision 182, Q9). Absent on a surface recorded before it was, which reads as false.
+       */
+      approved_reads_only: external_exports.boolean().optional(),
       /**
        * The toolset's file tools. Absent when it has none, and on a surface recorded before they were.
        * A list this side cannot read is dropped rather than failing the binding, which every call and
@@ -6369,9 +6389,23 @@ var init_chunk_4MRBBR5L = __esm({
         batch: external_exports.object({ enabled: external_exports.boolean().optional() }).passthrough().nullable().optional(),
         sql_query: external_exports.boolean().optional(),
         /** The toolset serves one customer per call (#5083 RK2). Absent reads as not scoped. */
-        customer_scope: external_exports.boolean().optional()
+        customer_scope: external_exports.boolean().optional(),
+        /**
+         * Each record type the toolset's actions and composite steps reach, by id, as the data product
+         * stores it (`json_schema` included). A reviewed type's `x-review` names its writers (#5083 RK4).
+         */
+        record_types: external_exports.record(external_exports.unknown()).optional(),
+        /**
+         * What each record type the toolset can reach is to a customer scope (`{ role }`, or null), by id:
+         * those `record_types` holds, and those only its relationship tools and steps reach (#5083 RK2).
+         */
+        record_type_scopes: external_exports.record(external_exports.unknown()).optional()
       }).passthrough()
     });
+    REVIEW_DECLARATION_KEY = "x-review";
+    resolvedRecordTypeSchema = external_exports.object({ json_schema: external_exports.record(external_exports.unknown()) });
+    reviewWritersSchema = external_exports.object({ writers: external_exports.array(external_exports.string()).optional() });
+    sharedScopeSchema = external_exports.object({ role: external_exports.literal("shared") });
     resolvedFileToolSchema = external_exports.object({
       file_type: external_exports.string().min(1),
       path_prefix: external_exports.string().nullish(),
@@ -6394,7 +6428,7 @@ var init_chunk_4MRBBR5L = __esm({
     });
     rekorToolsetFilePutSchema = external_exports.object({ data: rekorToolsetFileSchema });
     TOOLSET_CUSTOMER_FACING_REFUSAL_MARK = "A customer-facing agent (a pilot, pilot specialist or pilot advisor) can use a toolset only when it exposes files alone: no record, composite or relationship tools, and neither sql_query nor batch";
-    TOOLSET_CUSTOMER_FACING_REFUSAL = `${TOOLSET_CUSTOMER_FACING_REFUSAL_MARK}, nor a file put or delete \u2014 unless the toolset is customer-scoped, which admits its record, composite and relationship tools, since each of their calls reaches only the conversation's customer and shared records`;
+    TOOLSET_CUSTOMER_FACING_REFUSAL = `${TOOLSET_CUSTOMER_FACING_REFUSAL_MARK}, nor a file put or delete, nor a write of a reviewed record type \u2014 unless the toolset is customer-scoped, which admits its record, composite and relationship tools, since each of their calls reaches only the conversation's customer and shared records, or they only read approved records of reviewed shared record types`;
   }
 });
 
@@ -6823,7 +6857,7 @@ var init_chunk_A4JC7DXB = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-23UZ2IKU.js
+// ../../packages/core/dist/chunk-VMAX5YRT.js
 function spokenLineField(label, description2) {
   return { type: "text", label, maxLength: SPOKEN_LINE_MAX_CHARS, default: "", description: description2 };
 }
@@ -6833,8 +6867,8 @@ function byLowercaseName(a, b) {
   return x < y ? -1 : x > y ? 1 : 0;
 }
 var CALLER_LANGUAGE, TTS_VOICE_REPLY_ENABLED_FIELD, COPILOT_TRIGGER_FIELD, SANDBOX_AGENT_FIELDS, AUDIO_LANGUAGE_OPTIONS, whatsapp, instagram, resend, telegram, API_CHANNEL_DELIVERY_EVENTS, apiChannel, OPENAI_REASONING_MODELS, openai, anthropic, googleAiStudio, openRouter, xai, groqStt, openaiStt, elevenLabsStt, openaiTts, groqTts, elevenLabsTts, GEMINI_TTS_VOICES, googleTts, wayai, externalResources, restApiTool, mcpServer, REKOR_TOOLSET_SERVICE_NAME, rekorToolset, CLAUDE_HARNESS_MODELS, CLAUDE_HARNESS_MODEL_OPTIONS, HARNESS_MCP_SERVERS_FIELD, HARNESS_EGRESS_FIELDS, claudeManagedAgents, SPOKEN_LINE_MAX_CHARS, gptLive, CONNECTORS;
-var init_chunk_23UZ2IKU = __esm({
-  "../../packages/core/dist/chunk-23UZ2IKU.js"() {
+var init_chunk_VMAX5YRT = __esm({
+  "../../packages/core/dist/chunk-VMAX5YRT.js"() {
     "use strict";
     init_chunk_A4JC7DXB();
     CALLER_LANGUAGE = "caller";
@@ -7801,13 +7835,13 @@ var init_chunk_23UZ2IKU = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-23ESQLLF.js
+// ../../packages/core/dist/chunk-C4TPQN6Z.js
 var evalCallInstant, EVAL_CALL_MIN_SECONDS, EVAL_CALL_MAX_SECONDS, EVAL_CALL_SPOKEN_LINE_MAX_CHARS, hubScoped2, createEvalCallBody, createEvalCallResponse, evalCallConversationQuery, evalCallRecordQuery, evalCallSpeaker, evalCallUtterance, evalCallTurn, evalCallRecording, evalCallRecordResponse, evalCallFinishResponse;
-var init_chunk_23ESQLLF = __esm({
-  "../../packages/core/dist/chunk-23ESQLLF.js"() {
+var init_chunk_C4TPQN6Z = __esm({
+  "../../packages/core/dist/chunk-C4TPQN6Z.js"() {
     "use strict";
     init_chunk_E4DIIOOE();
-    init_chunk_23UZ2IKU();
+    init_chunk_VMAX5YRT();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
     init_zod();
@@ -8174,15 +8208,15 @@ var init_chunk_MH4O3YEX = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-UFYIBL66.js
+// ../../packages/core/dist/chunk-GWMNV3N4.js
 function catalogToolSideEffects(toolName) {
   const sideEffects = CATALOG_SIDE_EFFECTS.get(toolName);
   if (sideEffects === void 0) return "unknown";
   return sideEffects ? "side_effects" : "none";
 }
 var NATIVE_TOOL_SCHEMAS, WAYAI_CONNECTOR, SANDBOX_AGENT_ROLES, BASE_NATIVE_TOOLS, NATIVE_TOOLS, CATALOG_SIDE_EFFECTS;
-var init_chunk_UFYIBL66 = __esm({
-  "../../packages/core/dist/chunk-UFYIBL66.js"() {
+var init_chunk_GWMNV3N4 = __esm({
+  "../../packages/core/dist/chunk-GWMNV3N4.js"() {
     "use strict";
     init_chunk_DHPUPI4Y();
     NATIVE_TOOL_SCHEMAS = {
@@ -8660,83 +8694,6 @@ var init_chunk_UFYIBL66 = __esm({
         },
         "tool_instructions": 'Use to find out which files exist before reading one. Call it with no path first: that returns the mounts \u2014 "conversation" for what the user attached here, one "skills/<slug>" per skill and one "resources/<slug>" per knowledge resource linked to you. Then pass a mount or folder path back to list its contents. Every row carries a `path`; pass that path to read_file to open the file, or (outside "data/") to send_files to deliver it. Pass query, tags or metadata_filter to search a whole skill, resource or data/ file type at once instead of walking it folder by folder. Files from EARLIER conversations are not listed here \u2014 the transcript of each past conversation announces its own files by path (get_conversation).'
       },
-      "list_resource_folders": {
-        "tool_config": {
-          "name": "list_resource_folders",
-          "description": "(deprecated \u2014 use list_files) List all folders in resources that this agent has access to. Returns all folders with parent_folder_id for hierarchy reconstruction.",
-          "strict": false,
-          "parameters": {
-            "type": "object",
-            "properties": {
-              "resource_id": {
-                "type": "string",
-                "description": "Resource ID to query folders from. Must be one of the knowledge resources linked to this agent (the available ids are listed here at runtime). Required for access control and performance."
-              },
-              "search_query": {
-                "type": "string",
-                "description": "Search folders by name"
-              },
-              "metadata_filter": {
-                "type": "object",
-                "description": 'Filter by metadata using MongoDB-style operators. Supported: $eq (equal), $ne (not equal), $gt/$gte/$lt/$lte (comparisons), $in/$nin (in/not in array), $contains (contains value), $and/$or/$not (logical). Supports nested paths like "location.city". Returns clear errors for type mismatches. Examples: {"status": "active"} for simple equality, {"priority": {"$gte": 5}} for comparison, {"location.city": "Miami"} for nested path, {"$and": [{"status": "active"}, {"priority": {"$gt": 3}}]} for complex logic, {"$not": {"status": "archived"}} for negation. Schema from resource.folder_metadata_schema.'
-              }
-            },
-            "required": [
-              "resource_id"
-            ],
-            "additionalProperties": false
-          }
-        },
-        "tool_instructions": "Deprecated: prefer list_files, which walks the same folders by path and needs no resource_id. Still works \u2014 lists all folders in a resource, filtered by search_query or metadata, returning folder info with parent_folder_id, file counts, and subfolder counts."
-      },
-      "list_resource_files": {
-        "tool_config": {
-          "name": "list_resource_files",
-          "description": "(deprecated \u2014 use list_files) List files in resources that this agent has access to. Each file is returned with its path \u2014 the address read_file accepts \u2014 plus metadata.",
-          "strict": false,
-          "parameters": {
-            "type": "object",
-            "properties": {
-              "resource_id": {
-                "type": "string",
-                "description": "Resource ID to query files from. Must be one of the knowledge resources linked to this agent (the available ids are listed here at runtime). Required for access control and performance."
-              },
-              "folder_id": {
-                "type": "string",
-                "description": "Filter by folder ID. Omit to return ALL files. Use 00000000-0000-0000-0000-000000000000 for root-level files only."
-              },
-              "search_query": {
-                "type": "string",
-                "description": "Search files by title or file name"
-              },
-              "tags": {
-                "type": "array",
-                "items": {
-                  "type": "string"
-                },
-                "description": "Filter by tags (matches files with any of the specified tags)"
-              },
-              "metadata_filter": {
-                "type": "object",
-                "description": 'Filter by metadata using MongoDB-style operators. Supported: $eq (equal), $ne (not equal), $gt/$gte/$lt/$lte (comparisons), $in/$nin (in/not in array), $contains (contains value), $and/$or/$not (logical). Supports nested paths like "location.city". Returns clear errors for type mismatches. Examples: {"status": "active"} for simple equality, {"priority": {"$gte": 5}} for comparison, {"location.city": "Miami"} for nested path, {"$and": [{"status": "active"}, {"priority": {"$gt": 3}}]} for complex logic, {"$not": {"status": "archived"}} for negation. Schema from resource.file_metadata_schema.'
-              },
-              "limit": {
-                "type": "integer",
-                "description": "Maximum number of files to return (default: 50, max: 100)"
-              },
-              "offset": {
-                "type": "integer",
-                "description": "Number of files to skip for pagination (default: 0)"
-              }
-            },
-            "required": [
-              "resource_id"
-            ],
-            "additionalProperties": false
-          }
-        },
-        "tool_instructions": "Deprecated: prefer list_files, which lists the same files by path, needs no resource_id, and also sees this conversation's attachments. Still works \u2014 each row carries a `path`; pass that path to read_file to retrieve the file's content for AI analysis. `file_id` is also returned and still accepted."
-      },
       "get_tool_schema": {
         "tool_config": {
           "name": "get_tool_schema",
@@ -9084,21 +9041,6 @@ var init_chunk_UFYIBL66 = __esm({
       { tool_native_id: "nt-013", tool_name: "read_skill", tool_display_name: "Read Skill", tool_description: "Read the full specification of a skill", connector_id: WAYAI_CONNECTOR, operation: "read_skill", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", hosted: false },
       { tool_native_id: "nt-014", tool_name: "read_skill_file", tool_display_name: "Read Skill File", tool_description: "Read a specific file within a skill", connector_id: WAYAI_CONNECTOR, operation: "read_skill_file", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", hosted: false },
       { tool_native_id: "nt-015", tool_name: "read_file", tool_display_name: "Read File", tool_description: "Read the contents of a resource file", connector_id: WAYAI_CONNECTOR, operation: "read_file", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", hosted: false },
-      // Superseded by `list_files` (nt-027), which browses the same resource files
-      // by PATH plus this conversation's attachments.
-      //
-      // `ui_assignable: false` — DEPRECATED, not withdrawn. Hiding the Add grid entry
-      // stops a NEW agent from being wired to a tool that addresses files by an id a
-      // publish re-mints and that cannot see a conversation attachment at all (the id
-      // itself is discoverable — `RESOURCE_TOOL_INJECTIONS` still writes the linked
-      // ids into their `resource_id` description every turn), while every hub that
-      // already assigns one keeps
-      // working: the handler still dispatches, CI name resolution still resolves the
-      // name, and `wayai pull` / `push` still round-trips the YAML. There is no
-      // auto-provisioning anywhere in the platform, so an existing agent is never
-      // migrated for free — an author swaps the tool deliberately.
-      { tool_native_id: "nt-016", tool_name: "list_resource_files", tool_display_name: "List Resource Files", tool_description: "(deprecated \u2014 use list_files) List files in a resource folder", connector_id: WAYAI_CONNECTOR, operation: "list_resource_files", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", hosted: false, ui_assignable: false },
-      { tool_native_id: "nt-017", tool_name: "list_resource_folders", tool_display_name: "List Resource Folders", tool_description: "(deprecated \u2014 use list_files) List all resource folders", connector_id: WAYAI_CONNECTOR, operation: "list_resource_folders", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", hosted: false, ui_assignable: false },
       { tool_native_id: "nt-018", tool_name: "get_conversations_summary", tool_display_name: "Get Conversations Summary", tool_description: "Get a summary of recent conversations", connector_id: WAYAI_CONNECTOR, operation: "get_conversations_summary", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", hosted: true },
       { tool_native_id: "nt-019", tool_name: "get_conversation", tool_display_name: "Get Conversation", tool_description: "Retrieve full conversation history", connector_id: WAYAI_CONNECTOR, operation: "get_conversation", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", hosted: true },
       { tool_native_id: "nt-020", tool_name: "get_tool_schema", tool_display_name: "Get Tool Schema", tool_description: "Retrieve the JSON schema for a tool", connector_id: WAYAI_CONNECTOR, operation: "get_tool_schema", tool_method: "internal", tool_group: "Native Tools", is_delegation: false, is_auto_set: false, execution_config: null, side_effects: false, replay: "rerun", hosted: false },
@@ -9129,8 +9071,9 @@ var init_chunk_UFYIBL66 = __esm({
       // live button that only ever errors is worse than no button. Assign via `wayai push`
       // until the picker ships.
       { tool_native_id: "nt-026", tool_name: "start_consult_thread", tool_display_name: "Start Consult Thread", tool_description: "Ask a configured consultant (or partner hub) a question in a visible consult thread", connector_id: WAYAI_CONNECTOR, operation: "start_consult_thread", tool_method: "internal", tool_group: "Native Tools", is_delegation: true, is_auto_set: false, execution_config: null, side_effects: true, replay: "keyed", hosted: false, ui_assignable: false },
-      // One drill-down listing for every file namespace, replacing `list_resource_files`
-      // (nt-016) and `list_resource_folders` (nt-017). Fully visible: it needs no
+      // One drill-down listing for every file namespace, which replaced `list_resource_files`
+      // (nt-016) and `list_resource_folders` (nt-017), both retired with knowledge (HubDO v105,
+      // #5142 step 5 C1; ids never reused). Fully visible: it needs no
       // configuration the Add dialog cannot collect — the mounts an agent may browse
       // come from its existing resource links and its own conversation, and the only
       // model-supplied input is a path.
@@ -9213,7 +9156,16 @@ var init_chunk_IBL7FANV = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-Z22T2ASG.js
+// ../../packages/core/dist/chunk-C2UEA2KW.js
+var FLAG_CONDITION_OPERATORS;
+var init_chunk_C2UEA2KW = __esm({
+  "../../packages/core/dist/chunk-C2UEA2KW.js"() {
+    "use strict";
+    FLAG_CONDITION_OPERATORS = ["=", "!=", ">=", "<=", ">", "<"];
+  }
+});
+
+// ../../packages/core/dist/chunk-D4AWK26E.js
 function parseExpr(expr) {
   const fnMatch = expr.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\s*\((.*?)\)\s*(?:\.(.*))?$/);
   if (!fnMatch) return null;
@@ -9240,87 +9192,36 @@ function stripQuotes(s) {
   }
   return s;
 }
-function parseCatalogArgs(args2) {
-  let kind = null;
-  let tree = false;
-  for (const token of args2) {
-    if (token === "tree") tree = true;
-    else if ((token === "kb" || token === "skill") && kind === null) kind = token;
-  }
-  return { kind, tree };
-}
-function widenKinds(kinds) {
-  if (kinds.has("all") || kinds.size > 1) return "all";
-  return [...kinds][0] ?? null;
-}
 function* parseCalls(template) {
   for (const match of template.matchAll(PLACEHOLDER_RE)) {
     const parsed = parseExpr(match[1].trim());
     if (parsed) yield parsed;
   }
 }
-function scanTemplateResources(template) {
-  if (!template || !template.includes("{{")) return EMPTY_SCAN;
-  const scan = { ...EMPTY_SCAN };
-  const names = /* @__PURE__ */ new Set();
-  const paths = /* @__PURE__ */ new Set();
-  const treeKinds = /* @__PURE__ */ new Set();
-  const legacyKinds = /* @__PURE__ */ new Set();
+function countResourcePlaceholders(template) {
+  const calls = {
+    catalog: { kb: 0, skill: 0, all: 0 },
+    file_content_paths: [],
+    resource_content_names: []
+  };
+  if (!template || !template.includes("{{")) return calls;
   for (const { fn, args: args2 } of parseCalls(template)) {
-    switch (fn) {
-      case CATALOG_FN:
-      case LEGACY_CATALOG_FN: {
-        scan.needs_catalog = true;
-        scan.has_catalog_call = true;
-        const { kind, tree } = parseCatalogArgs(args2);
-        if (fn === LEGACY_CATALOG_FN) legacyKinds.add(kind ?? "all");
-        if (tree) treeKinds.add(kind ?? "all");
-        break;
-      }
-      case "agent_skills":
-        scan.needs_catalog = true;
-        break;
-      case "resource_content":
-        if (args2[0]) names.add(args2[0]);
-        break;
-      case "file_content":
-        if (args2[0]) paths.add(args2[0]);
-        break;
-      default:
-        break;
-    }
+    if (fn === CATALOG_FN || fn === RETIRED_CATALOG_FN) {
+      const kind = args2.find((token) => token === "kb" || token === "skill");
+      calls.catalog[kind ?? "all"] += 1;
+    } else if (fn === "file_content" && args2[0]) calls.file_content_paths.push(args2[0]);
+    else if (fn === "resource_content" && args2[0]) calls.resource_content_names.push(args2[0]);
   }
-  scan.tree_kinds = widenKinds(treeKinds);
-  scan.legacy_kinds = widenKinds(legacyKinds);
-  scan.resource_content_names = [...names];
-  scan.file_content_paths = [...paths];
-  return scan;
+  return calls;
 }
-var PREVIOUS_CONVERSATIONS_MAX, PLACEHOLDER_RE, CATALOG_FN, LEGACY_CATALOG_FN, EMPTY_SCAN;
-var init_chunk_Z22T2ASG = __esm({
-  "../../packages/core/dist/chunk-Z22T2ASG.js"() {
+var PREVIOUS_CONVERSATIONS_MAX, PLACEHOLDER_RE, CATALOG_FN, RETIRED_CATALOG_FN;
+var init_chunk_D4AWK26E = __esm({
+  "../../packages/core/dist/chunk-D4AWK26E.js"() {
     "use strict";
     PREVIOUS_CONVERSATIONS_MAX = 20;
     PLACEHOLDER_RE = /\{\{\s*([^{}]+?)\s*\}\}/g;
     CATALOG_FN = "files";
-    LEGACY_CATALOG_FN = "resources";
-    EMPTY_SCAN = {
-      needs_catalog: false,
-      has_catalog_call: false,
-      legacy_kinds: null,
-      tree_kinds: null,
-      resource_content_names: [],
-      file_content_paths: []
-    };
-  }
-});
-
-// ../../packages/core/dist/chunk-C2UEA2KW.js
-var FLAG_CONDITION_OPERATORS;
-var init_chunk_C2UEA2KW = __esm({
-  "../../packages/core/dist/chunk-C2UEA2KW.js"() {
-    "use strict";
-    FLAG_CONDITION_OPERATORS = ["=", "!=", ">=", "<=", ">", "<"];
+    RETIRED_CATALOG_FN = "resources";
   }
 });
 
@@ -9502,7 +9403,7 @@ var init_chunk_T7KQKDET = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-2LZYS6YX.js
+// ../../packages/core/dist/chunk-BV6U4HXF.js
 function resolveMonitorTrigger(monitorConfig) {
   if (!monitorConfig || typeof monitorConfig !== "object") return "idle";
   const raw = monitorConfig.trigger;
@@ -9808,14 +9709,14 @@ function refineMonitorRulesStructuredOutput(body, ctx) {
   if (refusal2) ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["response_format"], message: refusal2 });
 }
 var NATIVE_TOOL_NAMES, previousConversationsCountField, summarizationThresholdField, flagConditionSchema, MONITOR_TRIGGERS, monitorTriggerSchema, AUTOMATION_GATE_TRIGGERS, NON_FIRING_TRIGGERS, MONITOR_FIRING_TRIGGERS, MONITOR_DELAY_SECONDS_MIN, MONITOR_IDLE_DELAY_REQUIRED_MESSAGE, MONITOR_HISTORY_MESSAGES_MAX, monitorHistoryMessagesSchema, monitorIncludeToolResultsSchema, MONITOR_INPUT_SHAPING_KEYS, MONITOR_INPUT_SHAPING_SCHEMAS, MONITOR_INPUT_SHAPING_IDLE_MESSAGE, monitorArgumentSourceSchema, MONITOR_NOTE_TEMPLATE_MAX, MONITOR_STEER_NOTE_MAX, MONITOR_GATE_AGENT_NAME_MAX, monitorActionSchema, monitorRuleSchema, MONITOR_RULE_KEYS, MONITOR_RULE_SCHEMAS, MONITOR_RULE_TRIGGERS, MONITOR_RULE_TRIGGER_MESSAGE, CALL_UTTERANCE_SPEAKERS, callUtteranceSpeakerSchema, MONITOR_CALL_KEYS, MONITOR_CALL_SCHEMAS, MONITOR_CALL_KEY_MESSAGE, CALL_STEERING_MIN_CONFIDENCE, CALL_UTTERANCE_RULE_NOT_CONFIDENT_MESSAGE, CALL_UTTERANCE_FALLBACK_MESSAGE, CALL_UTTERANCE_FLAG_CONDITIONS_MESSAGE, CALL_STEER_NOTE_BLANK_MESSAGE, MONITOR_USER_MESSAGE_ACTION_KINDS, MONITOR_ASSISTANT_REPLY_ACTION_KINDS, MONITOR_CALL_UTTERANCE_ACTION_KINDS, MONITOR_AUTOMATION_FIRE_ACTION_KINDS, MONITOR_AUTOMATION_ITEM_ACTION_KINDS, INSERT_NOTE_TOOL_NAME, RUN_MONITOR_TOOL_NAME, MONITOR_RULE_ALLOWED_NATIVE_TOOLS, MONITOR_RULE_REENTRY_TOOLS, MONITOR_RULE_REENTRY_TRACKS, AUTOMATION_FIRE_FLAG_CONDITIONS_MESSAGE, AUTOMATION_FIRE_INPUT_SHAPING_MESSAGE, AUTOMATION_ITEM_FLAG_CONDITIONS_MESSAGE, AUTOMATION_ITEM_INPUT_SHAPING_MESSAGE, AUTOMATION_GATE_KEY_MESSAGES, monitorConfigField, flagConditionsField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody;
-var init_chunk_2LZYS6YX = __esm({
-  "../../packages/core/dist/chunk-2LZYS6YX.js"() {
+var init_chunk_BV6U4HXF = __esm({
+  "../../packages/core/dist/chunk-BV6U4HXF.js"() {
     "use strict";
-    init_chunk_UFYIBL66();
+    init_chunk_GWMNV3N4();
     init_chunk_IBL7FANV();
-    init_chunk_Z22T2ASG();
     init_chunk_HZ6CADSY();
     init_chunk_C2UEA2KW();
+    init_chunk_D4AWK26E();
     init_chunk_DHPUPI4Y();
     init_chunk_T7KQKDET();
     init_chunk_L5F7ZOUJ();
@@ -10034,12 +9935,12 @@ var init_chunk_2LZYS6YX = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-XR36MYEY.js
+// ../../packages/core/dist/chunk-MUG3LWPZ.js
 var conversationIdParam, conversationHubQuery, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, deleteUserConversationsResponse, sendMessageBody, listConversationsQuery, flagSourceSchema, getConversationsResponse, getConversationDetailParams, getConversationDetailQuery, getConversationDetailResponse, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody;
-var init_chunk_XR36MYEY = __esm({
-  "../../packages/core/dist/chunk-XR36MYEY.js"() {
+var init_chunk_MUG3LWPZ = __esm({
+  "../../packages/core/dist/chunk-MUG3LWPZ.js"() {
     "use strict";
-    init_chunk_2LZYS6YX();
+    init_chunk_BV6U4HXF();
     init_chunk_HZ6CADSY();
     init_chunk_DHPUPI4Y();
     init_zod();
@@ -10495,7 +10396,7 @@ var init_chunk_BPCNB5RT = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-MCSEEMGN.js
+// ../../packages/core/dist/chunk-HWB3MFZT.js
 function idempotencyHeaderRefusal(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(value)) {
     return "idempotency_header must be a header name: letters, digits and dashes, at most 64";
@@ -10506,10 +10407,10 @@ function idempotencyHeaderRefusal(value) {
   return null;
 }
 var CATALOG_REPLAY, REPLAY_OVERRIDES, RESERVED_HEADERS;
-var init_chunk_MCSEEMGN = __esm({
-  "../../packages/core/dist/chunk-MCSEEMGN.js"() {
+var init_chunk_HWB3MFZT = __esm({
+  "../../packages/core/dist/chunk-HWB3MFZT.js"() {
     "use strict";
-    init_chunk_UFYIBL66();
+    init_chunk_GWMNV3N4();
     CATALOG_REPLAY = new Map(
       NATIVE_TOOLS.map((tool) => [tool.tool_name, tool.replay])
     );
@@ -10742,7 +10643,7 @@ var init_chunk_WEXVYJ5H = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-4S4FBSBE.js
+// ../../packages/core/dist/chunk-VHQED53I.js
 function refineToolConfig(value, ctx) {
   const raw = value.tool_config;
   if (raw == null) return;
@@ -10778,10 +10679,10 @@ function refineToolConfig(value, ctx) {
   }
 }
 var toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, CONTEXT_BOUNDARIES, contextBoundarySchema, addNativeToolBody, addMcpToolBody, toolReplaySettingsFields, toolReplaySettingsSchema, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody;
-var init_chunk_4S4FBSBE = __esm({
-  "../../packages/core/dist/chunk-4S4FBSBE.js"() {
+var init_chunk_VHQED53I = __esm({
+  "../../packages/core/dist/chunk-VHQED53I.js"() {
     "use strict";
-    init_chunk_MCSEEMGN();
+    init_chunk_HWB3MFZT();
     init_chunk_WEXVYJ5H();
     init_chunk_HZ6CADSY();
     init_zod();
@@ -10803,11 +10704,9 @@ var init_chunk_4S4FBSBE = __esm({
       /** Only meaningful for a `hub` delegation (`delegate_to_hub`); ignored otherwise.
        *  Defaults to `summary` when omitted. Admin-set — the link and boundary require
        *  hub-admin (`hub:write`), never derived from any end user's grants. */
-      delegation_context_boundary: contextBoundarySchema.optional(),
-      resource_config: external_exports.object({
-        access_mode: external_exports.enum(["all", "selected", "none"]),
-        enabled_resources: external_exports.array(external_exports.string()).optional()
-      }).optional()
+      delegation_context_boundary: contextBoundarySchema.optional()
+      // `resource_config` was retired with knowledge (wayai-pro/wayai#5142 step 5 C1): written and never
+      // read. A body that still sends it is accepted, the key stripped; the column goes at step 5's E.
     });
     addMcpToolBody = external_exports.object({
       agent_id: uuidSchema,
@@ -10852,7 +10751,7 @@ var init_chunk_4LXDRTO4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-6Y7XMRWF.js
+// ../../packages/core/dist/chunk-2FQVW3O7.js
 function isIanaTimezone(timezone) {
   try {
     new Intl.DateTimeFormat("en-US", { timeZone: timezone }).format(0);
@@ -10862,12 +10761,12 @@ function isIanaTimezone(timezone) {
   }
 }
 var evalDateContextSchema;
-var init_chunk_6Y7XMRWF = __esm({
-  "../../packages/core/dist/chunk-6Y7XMRWF.js"() {
+var init_chunk_2FQVW3O7 = __esm({
+  "../../packages/core/dist/chunk-2FQVW3O7.js"() {
     "use strict";
-    init_chunk_Z22T2ASG();
     init_chunk_HZ6CADSY();
     init_chunk_MIWZOSPI();
+    init_chunk_D4AWK26E();
     init_chunk_DHPUPI4Y();
     init_zod();
     evalDateContextSchema = external_exports.object({
@@ -10892,7 +10791,7 @@ var init_chunk_2ISUBJG7 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-RCTKQTJH.js
+// ../../packages/core/dist/chunk-TY6K2EWO.js
 function describeRole(role) {
   if (typeof role === "string") {
     return JSON.stringify(role.length > ROLE_ECHO_MAX ? `${role.slice(0, ROLE_ECHO_MAX)}\u2026` : role);
@@ -11066,11 +10965,11 @@ function terminalRunCount(counts) {
   return counts.successful_runs + counts.failed_runs;
 }
 var evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, EVAL_FIXTURE_NAME_MAX_LENGTH, evalFixtureOverrideSchema, runSessionQuery, runJourneyQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, EVAL_INITIAL_STATE_SCOPES, MAX_INITIAL_STATE_ENTRIES, evalInitialStateEntry, evalCustomerContactIdSchema, evalBody, EVAL_LIST_MAX_LIMIT, evalListLimit, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, EVAL_MAX_SELECTED_SCENARIOS, evalScenarioSelectionEntrySchema, evalScenarioSelectionSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, evalAttachmentRef, turnMayCarryAttachments, ATTACHMENTS_USER_ONLY_MESSAGE, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, evalSessionConfigResponseSchema, evalSessionResponseSchema, evalSessionListConfigSchema, evalSessionListItemSchema, seedReleaseStatusSchema, EVAL_SESSION_NOT_QUIESCENT;
-var init_chunk_RCTKQTJH = __esm({
-  "../../packages/core/dist/chunk-RCTKQTJH.js"() {
+var init_chunk_TY6K2EWO = __esm({
+  "../../packages/core/dist/chunk-TY6K2EWO.js"() {
     "use strict";
     init_chunk_4LXDRTO4();
-    init_chunk_6Y7XMRWF();
+    init_chunk_2FQVW3O7();
     init_chunk_HZ6CADSY();
     init_chunk_2ISUBJG7();
     init_zod();
@@ -12153,7 +12052,7 @@ var init_chunk_6NI5RAM4 = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-FJ5K57CB.js
+// ../../packages/core/dist/chunk-EYZBTMVU.js
 function refineHubAsCodeCustomTools(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -12689,12 +12588,12 @@ function refineHubAsCodeMonitorRulesOutput(config, ctx) {
   });
 }
 var MAX_10MB_BASE64_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_ENCODED_BYTES, MAX_EVAL_ATTACHMENT_CARRIERS, MAX_EVAL_ATTACHMENT_AGGREGATE_ENCODED_BYTES, MAX_RESOURCE_ENCODED_BYTES, MAX_HUB_AS_CODE_RESOURCES, MAX_HUB_AS_CODE_RESOURCE_FILES, MAX_RESOURCE_AGGREGATE_ENCODED_BYTES, MAX_CI_CONFIG_BODY_BYTES, MAX_CALL_OPENING_CARRIERS, MAX_CALL_OPENING_AGGREGATE_ENCODED_BYTES, hubAsCodeStateSchema, hubAsCodeResourceFileSchema, hubAsCodeResourceSchema, uuidPattern, ciUuidSchema, boundedHubAsCodeResourcesSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, CI_APPLY_ENTITY_KINDS, CI_APPLY_OPERATIONS, ciApplyErrorBaseSchema, ciApplyErrorSchema, ciSyncCountSchema, ciSyncChangesSchema, ciSyncWarningSchema, ciSyncResponseSchema;
-var init_chunk_FJ5K57CB = __esm({
-  "../../packages/core/dist/chunk-FJ5K57CB.js"() {
+var init_chunk_EYZBTMVU = __esm({
+  "../../packages/core/dist/chunk-EYZBTMVU.js"() {
     "use strict";
-    init_chunk_4S4FBSBE();
-    init_chunk_RCTKQTJH();
-    init_chunk_2LZYS6YX();
+    init_chunk_VHQED53I();
+    init_chunk_TY6K2EWO();
+    init_chunk_BV6U4HXF();
     init_chunk_LBDH7LCG();
     init_chunk_4LXDRTO4();
     init_chunk_T4Q5COKJ();
@@ -13704,13 +13603,13 @@ var init_chunk_LQY2OCQL = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-EA6XOOL2.js
+// ../../packages/core/dist/chunk-H6TTCXPL.js
 var AUTOMATION_TRIGGER_TYPES, AUTOMATION_EVENT_TYPES, AUTOMATION_TARGET_TYPES, AUTOMATION_ACTION_TYPES, AUTOMATION_CHANNEL_TYPES, AUTOMATION_PURPOSES, AUTOMATION_NAME_MAX, AUTOMATION_DESCRIPTION_MAX, AUTOMATION_INSTRUCTIONS_MAX, AUTOMATION_TEXT_MAX, AUTOMATION_CRON_MAX, AUTOMATION_WEBHOOK_AUTHS, AUTOMATION_WEBHOOK_HEADERS, AUTOMATION_WEBHOOK_BODY_MAX_BYTES, AUTOMATION_WEBHOOK_HEADER_NAME_MAX, WEBHOOK_RESERVED_HEADERS, automationTriggerSchema, automationTargetSchema, automationActionSchema, automationGateSchema, automationName, automationDescription, automationIdParam, automationHubQuery, automationWebhookParams, AUTOMATION_RUNS_PAGE_MAX, listAutomationRunsQuery, createAutomationBody, updateAutomationBody, AUTOMATION_ALERT_CATEGORIES, AUTOMATION_BLOCKED_ALERT_CATEGORY, automationEventSubscriberParam;
-var init_chunk_EA6XOOL2 = __esm({
-  "../../packages/core/dist/chunk-EA6XOOL2.js"() {
+var init_chunk_H6TTCXPL = __esm({
+  "../../packages/core/dist/chunk-H6TTCXPL.js"() {
     "use strict";
     init_chunk_LQY2OCQL();
-    init_chunk_2LZYS6YX();
+    init_chunk_BV6U4HXF();
     init_chunk_3HSB6J4J();
     init_chunk_5XEJSR22();
     init_chunk_DHPUPI4Y();
@@ -14236,7 +14135,7 @@ var init_chunk_OMPT4ZHR = __esm({
   }
 });
 
-// ../../packages/core/dist/chunk-3ACHWKFV.js
+// ../../packages/core/dist/chunk-RUFVP7Q3.js
 function refineScopedTarget(data, ctx) {
   if (data.scope === "org") {
     if (!data.org_id) {
@@ -14261,9 +14160,9 @@ function refineScopedTarget(data, ctx) {
     }
   }
 }
-var adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, turnDeadlineSeconds, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, dataExplorerDebugCountsDoType, dataExplorerDebugCountsParam, debugHubConvParam, debugMessageIdQuery;
-var init_chunk_3ACHWKFV = __esm({
-  "../../packages/core/dist/chunk-3ACHWKFV.js"() {
+var adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, PRICING_PLAN_ID_RE, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, MAX_VOICE_CALL_MINUTE_OPS, voiceCallMinuteOps, AUTOMATION_GATE_EVALUATIONS_PER_OPERATION_BOUND, automationGateEvaluationsPerOperation, AUTOMATION_RUN_RETENTION_DAYS_MAX, automationRunRetentionDays, turnDeadlineSeconds, updatePlatformConfigBody, updateFreeOrgLimitBody, adminScopedTargetShape, adminScopedTargetBody, adminRepairKnowledgeBlobsBody, BRANCHING_ORPHAN_ENTITY_TYPES, BRANCHING_ORPHAN_MAX_TARGETS, adminRepairBranchingOrphansBody, adminRepairLegacyOrgGrantsBody, adminRepairCompedPlansBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysBody, dataExplorerKvKeyBody, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteBody, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, dataExplorerDebugCountsDoType, dataExplorerDebugCountsParam, debugHubConvParam, debugMessageIdQuery;
+var init_chunk_RUFVP7Q3 = __esm({
+  "../../packages/core/dist/chunk-RUFVP7Q3.js"() {
     "use strict";
     init_chunk_FECLIZTY();
     init_chunk_BFG4ZWR4();
@@ -14430,6 +14329,7 @@ var init_chunk_3ACHWKFV = __esm({
       dry_run: external_exports.boolean().optional().default(false)
     });
     adminScopedTargetBody = adminScopedTargetShape.strict().superRefine(refineScopedTarget);
+    adminRepairKnowledgeBlobsBody = adminScopedTargetShape.extend({ dry_run: external_exports.boolean().optional().default(true) }).strict().superRefine(refineScopedTarget);
     BRANCHING_ORPHAN_ENTITY_TYPES = [
       "agent",
       "agent_parameter",
@@ -14964,7 +14864,7 @@ var init_contracts = __esm({
     init_chunk_SXDX4GHS();
     init_chunk_HENF6YTF();
     init_chunk_VXEAR36B();
-    init_chunk_DYI3BRJ3();
+    init_chunk_6VCHIFJT();
     init_chunk_Q7KIQHAZ();
     init_chunk_WBFLPPDI();
     init_chunk_IPXBFWUU();
@@ -14975,15 +14875,15 @@ var init_contracts = __esm({
     init_chunk_ZXK6N2HN();
     init_chunk_Y7CFCYX4();
     init_chunk_5DGHIY7L();
-    init_chunk_4QBKRQMM();
-    init_chunk_4MRBBR5L();
+    init_chunk_4QU6WS7I();
+    init_chunk_OWAAYKPB();
     init_chunk_BEOHBREG();
     init_chunk_IPDOHAZ5();
     init_chunk_YUZFHVB2();
     init_chunk_I3O2RACG();
     init_chunk_34LE6P7E();
     init_chunk_FPSDNS2E();
-    init_chunk_23ESQLLF();
+    init_chunk_C4TPQN6Z();
     init_chunk_C4HEZ7ZI();
     init_chunk_IR2NOSI3();
     init_chunk_EA23LSDS();
@@ -14991,13 +14891,13 @@ var init_contracts = __esm({
     init_chunk_LWMLR2WI();
     init_chunk_ACGAI25T();
     init_chunk_MH4O3YEX();
-    init_chunk_XR36MYEY();
+    init_chunk_MUG3LWPZ();
     init_chunk_KSTYTQ7I();
     init_chunk_LKBSHANA();
     init_chunk_BPCNB5RT();
-    init_chunk_FJ5K57CB();
-    init_chunk_4S4FBSBE();
-    init_chunk_RCTKQTJH();
+    init_chunk_EYZBTMVU();
+    init_chunk_VHQED53I();
+    init_chunk_TY6K2EWO();
     init_chunk_JDJ4EUOL();
     init_chunk_3KYTITOR();
     init_chunk_XCDUP42J();
@@ -15006,9 +14906,9 @@ var init_contracts = __esm({
     init_chunk_YULHXJ5M();
     init_chunk_V4FRPRH5();
     init_chunk_ZHJEQBXJ();
-    init_chunk_EA6XOOL2();
+    init_chunk_H6TTCXPL();
     init_chunk_LQY2OCQL();
-    init_chunk_2LZYS6YX();
+    init_chunk_BV6U4HXF();
     init_chunk_3HSB6J4J();
     init_chunk_IG6QBZMA();
     init_chunk_ZJJ5ODOD();
@@ -15017,11 +14917,11 @@ var init_contracts = __esm({
     init_chunk_4LXDRTO4();
     init_chunk_E4DIIOOE();
     init_chunk_7CYHPF35();
-    init_chunk_23UZ2IKU();
-    init_chunk_MCSEEMGN();
-    init_chunk_UFYIBL66();
+    init_chunk_VMAX5YRT();
+    init_chunk_HWB3MFZT();
+    init_chunk_GWMNV3N4();
     init_chunk_NVKU5PPQ();
-    init_chunk_3ACHWKFV();
+    init_chunk_RUFVP7Q3();
     init_chunk_FECLIZTY();
     init_chunk_BFG4ZWR4();
     init_chunk_6QXCHNFQ();
@@ -15032,13 +14932,12 @@ var init_contracts = __esm({
     init_chunk_OMPT4ZHR();
     init_chunk_2PZIF56U();
     init_chunk_UEJOG2Q7();
-    init_chunk_KJXJKAYT();
+    init_chunk_QUKTIJKE();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
-    init_chunk_6Y7XMRWF();
+    init_chunk_2FQVW3O7();
     init_chunk_5XEJSR22();
     init_chunk_IBL7FANV();
-    init_chunk_Z22T2ASG();
     init_chunk_VORPHGDT();
     init_chunk_A4JC7DXB();
     init_chunk_HZ6CADSY();
@@ -15046,6 +14945,7 @@ var init_contracts = __esm({
     init_chunk_2ISUBJG7();
     init_chunk_C2UEA2KW();
     init_chunk_6NI5RAM4();
+    init_chunk_D4AWK26E();
     init_chunk_CJ3L46X6();
     init_chunk_6TSQ5HXC();
     init_chunk_DHPUPI4Y();
@@ -15191,6 +15091,11 @@ var init_api_client = __esm({
       async adminRepairTeamOrphans(body) {
         return this.request("POST", "/api/admin/hubs/repair-team-orphans", body);
       }
+      // Report, or delete, the R2 objects retired hub knowledge left behind (#5142 step 5 C1).
+      // Used by `wayai admin hubs repair-knowledge-blobs` (platform-admin gated).
+      async adminRepairKnowledgeBlobs(body) {
+        return this.request("POST", "/api/admin/hubs/repair-knowledge-blobs", body);
+      }
       // Report twin candidates, or delete named production rows no preview maps (#4577).
       // Used by `wayai admin hubs repair-branching-orphans` (platform-admin gated).
       async adminRepairBranchingOrphans(body) {
@@ -16365,13 +16270,12 @@ var UUID_RE2, WAYAI_WORKSPACE_LAYOUT;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
-    init_chunk_KJXJKAYT();
+    init_chunk_QUKTIJKE();
     init_chunk_SOJMWM63();
     init_chunk_WEXVYJ5H();
-    init_chunk_6Y7XMRWF();
+    init_chunk_2FQVW3O7();
     init_chunk_5XEJSR22();
     init_chunk_IBL7FANV();
-    init_chunk_Z22T2ASG();
     init_chunk_P3AWZG3N();
     init_chunk_VORPHGDT();
     init_chunk_A4JC7DXB();
@@ -16383,6 +16287,7 @@ var init_dist = __esm({
     init_chunk_RPGBR5IN();
     init_chunk_C2UEA2KW();
     init_chunk_6NI5RAM4();
+    init_chunk_D4AWK26E();
     init_chunk_CJ3L46X6();
     init_chunk_6TSQ5HXC();
     init_chunk_DHPUPI4Y();
@@ -17789,6 +17694,7 @@ var init_utils = __esm({
       ["admin skill install", { positionals: 1 }],
       ["admin hubs repair-team-orphans", { positionals: 0, values: ["--org", "--hub"], dryRun: true }],
       ["admin hubs repair-branching-orphans", { positionals: 0, values: ["--org", "--hub", "--id"], dryRun: true }],
+      ["admin hubs repair-knowledge-blobs", { positionals: 0, values: ["--org", "--hub"], dryRun: true }],
       ["admin orgs repair-legacy-grants", { positionals: 0, values: ["--org"], dryRun: true }],
       ["admin harness mass-destroy", { positionals: 0, values: ["--org", "--hub"], dryRun: true }],
       ["admin harness disable", { positionals: 0 }],
@@ -33561,7 +33467,7 @@ token (\`wayai login --token\`, or WAYAI_TOKEN) is refused.
 var init_rekor_toolset = __esm({
   "../../packages/core/dist/contracts/rekor-toolset.js"() {
     "use strict";
-    init_chunk_4MRBBR5L();
+    init_chunk_OWAAYKPB();
     init_chunk_BEOHBREG();
     init_chunk_DHPUPI4Y();
   }
@@ -33793,6 +33699,7 @@ var init_resource_paths = __esm({
   "../../packages/core/dist/resource-paths.js"() {
     "use strict";
     init_chunk_6NI5RAM4();
+    init_chunk_D4AWK26E();
     init_chunk_CJ3L46X6();
     init_chunk_6TSQ5HXC();
     RESOURCE_NAMESPACE = "resources";
@@ -35432,9 +35339,9 @@ var COUNTER_KEYS, STT_PRICING, CONTAINER_PRICING, connectorById, nativeToolById;
 var init_catalog = __esm({
   "../../packages/core/dist/catalog/index.js"() {
     "use strict";
-    init_chunk_23UZ2IKU();
-    init_chunk_MCSEEMGN();
-    init_chunk_UFYIBL66();
+    init_chunk_VMAX5YRT();
+    init_chunk_HWB3MFZT();
+    init_chunk_GWMNV3N4();
     init_chunk_A4JC7DXB();
     init_chunk_MIWZOSPI();
     init_chunk_DHPUPI4Y();
@@ -35484,14 +35391,13 @@ function rewriteCitations(text, fileTypeBySlug) {
 }
 function knowledgePlaceholders(template, losing) {
   if (losing.length === 0 || !template.includes("{{")) return [];
-  const scan = scanTemplateResources(template);
-  const kinds = scanTemplateResources(template.replace(/\{\{(\s*)files(\s*\()/g, "{{$1resources$2")).legacy_kinds;
+  const calls = countResourcePlaceholders(template);
   const uses = [];
-  if (kinds === "all" || kinds === "kb") uses.push("a {{files()}} catalog that lists knowledge");
+  if (calls.catalog.all > 0 || calls.catalog.kb > 0) uses.push("a {{files()}} catalog that lists knowledge");
   const names = new Set(losing.map((r) => r.name));
-  for (const name of scan.resource_content_names) if (names.has(name)) uses.push(`{{resource_content(${name})}}`);
+  for (const name of new Set(calls.resource_content_names)) if (names.has(name)) uses.push(`{{resource_content(${name})}}`);
   const slugs = new Set(losing.map((r) => r.slug));
-  for (const path42 of scan.file_content_paths) {
+  for (const path42 of new Set(calls.file_content_paths)) {
     const [namespace, slug] = cleanRelativePath(path42).split("/");
     if (namespace?.toLowerCase() === RESOURCE_NAMESPACE && slug && slugs.has(slug.toLowerCase())) {
       uses.push(`{{file_content(${path42})}}`);
@@ -36285,6 +36191,9 @@ async function adminCommand(args2) {
       case "repair-branching-orphans":
         await runRepairBranchingOrphans(flagArgs);
         return;
+      case "repair-knowledge-blobs":
+        await runRepairKnowledgeBlobs(flagArgs);
+        return;
       default:
         printHelp2();
         process.exit(1);
@@ -36794,6 +36703,64 @@ async function runRepairTeamOrphans(flagArgs) {
     console.log(`${d.hub_id} | ${d.dangling_team_ids.join(",")} | ${d.team_users_removed}`);
   }
 }
+async function runRepairKnowledgeBlobs(flagArgs) {
+  const USAGE5 = "wayai admin hubs repair-knowledge-blobs --all | --org <org_id> | --hub <hub_id> [--apply] [--yes] [--json]";
+  const apply = flagArgs.includes("--apply");
+  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(
+    flagArgs.filter((arg) => arg !== "--apply"),
+    USAGE5
+  );
+  if (apply && dryRun) {
+    console.error("--apply and --dry-run contradict each other: a run is a dry run unless --apply is given.");
+    console.error(USAGE5);
+    process.exit(1);
+  }
+  const input = { ...body, dry_run: !apply };
+  if (apply && !yes && !jsonOutput) {
+    console.log(`About to DELETE the R2 objects no file row holds in: ${targetLabel}.`);
+    console.log("Run without --apply first to see what would go.");
+    const ok = await confirm("Proceed?");
+    if (!ok) {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let response;
+  try {
+    response = await client.adminRepairKnowledgeBlobs(input);
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  const data = response.data;
+  if (jsonOutput) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  const mode = data.dry_run ? "DRY RUN \u2014 nothing deleted" : "deleted";
+  console.log(
+    `repair-knowledge-blobs (${data.scope}) \u2014 ${mode}: hubs_scanned=${data.hubs_scanned} keys_listed=${data.keys_listed} keys_unreferenced=${data.keys_unreferenced} keys_deleted=${data.keys_deleted}`
+  );
+  if (data.hubs_errored > 0 || data.orgs_errored > 0) {
+    console.log(
+      `WARNING: ${data.orgs_errored} org(s) errored and were skipped, and ${data.hubs_errored} hub(s) stopped part-way (their finished pages are counted below) \u2014 re-run to finish them.`
+    );
+  }
+  if (data.details.length === 0) {
+    console.log("(no unreferenced keys in scope)");
+    return;
+  }
+  console.log("");
+  console.log("hub_id | listed | unreferenced | too_recent | deleted");
+  console.log("-------+--------+--------------+------------+--------");
+  for (const d of data.details) {
+    const stopped = d.errored ? " (stopped part-way: re-run to finish)" : "";
+    console.log(`${d.hub_id} | ${d.keys_listed} | ${d.keys_unreferenced} | ${d.keys_too_recent} | ${d.keys_deleted}${stopped}`);
+    for (const key of d.keys) console.log(`    ${key}`);
+  }
+}
 async function runRepairBranchingOrphans(flagArgs) {
   const USAGE5 = "wayai admin hubs repair-branching-orphans --all | --org <org_id> | --hub <hub_id> [--id <type>:<id> ...] [--dry-run] [--yes] [--json]";
   const targets = [];
@@ -37908,6 +37875,9 @@ Usage:
   wayai admin hubs repair-branching-orphans --all | --org <org_id> | --hub <hub_id> [--id <type>:<id> ...] [--dry-run] [--yes] [--json]
                                                    Without --id: report unmapped production rows that duplicate a mapped one (#4577). With --id: delete exactly those rows of one production hub, each only if no live preview maps it and nothing references it
 
+  wayai admin hubs repair-knowledge-blobs --all | --org <org_id> | --hub <hub_id> [--apply] [--yes] [--json]
+                                                   Report, or with --apply delete, the R2 objects under each hub no file row holds (retired knowledge's, #5142), older than a day; never eval attachments or call openings. A dry run by default. Run it once the deploy that retired knowledge is fully live: a hub on older code stops on its first page, as errored
+
   wayai admin orgs repair-legacy-grants --all | --org <org_id> [--dry-run] [--yes] [--json]
                                                    Repair org-admin roster rows keyed by email with a NULL user_email (pre-#3922 platform-admin adds): grant the real access they never conferred, or drop the phantom seat. Idempotent \u2014 run --dry-run first
 
@@ -37990,6 +37960,9 @@ Sources:
                  diff sees them. It never picks rows itself \u2014 a deleted preview leaves live
                  rows unmapped too \u2014 so without --id it only reports candidates, and with
                  --id it deletes the named rows that pass its checks.
+                 \`repair-knowledge-blobs\` sweeps the R2 objects retired hub knowledge left
+                 behind once its rows were deleted: keys no file row holds, older than a
+                 day. It reports by default and deletes only with --apply.
   orgs           Org roster repair. \`repair-legacy-grants\` fixes member_grant rows the
                  platform-admin org-admin add wrote before #3922: the email landed in the
                  user_id column with user_email NULL. Auth reads UserDO, never member_grant,
@@ -38052,6 +38025,8 @@ Examples:
   wayai admin observability <hub-id> <conv-id> --message-id <msg-id> --json
   wayai admin hubs repair-branching-orphans --hub <prod-hub-id>
   wayai admin hubs repair-branching-orphans --hub <prod-hub-id> --id connection:<id> --dry-run
+  wayai admin hubs repair-knowledge-blobs --all
+  wayai admin hubs repair-knowledge-blobs --hub <hub-id> --apply
   wayai admin orgs repair-legacy-grants --all --dry-run
   wayai admin orgs repair-legacy-grants --org <org-id> --yes
   wayai admin harness disable
@@ -39007,8 +38982,10 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
       if (n === 0) {
         console.error("No rows left to undo \u2014 closing the import session.");
       } else {
+        const reviewed = await recordTypeIsReviewed(client, base, plan.record_type);
+        const count = `${reviewed ? "up to " : ""}${n} record${n === 1 ? "" : "s"}`;
         const ok = await confirm(
-          `Delete ${n} record${n === 1 ? "" : "s"} created by this import into "${sanitizeTerminalText(String(plan.record_type))}", plus every relationship pointing at them?`
+          `Delete ${count} created by this import into "${sanitizeTerminalText(String(plan.record_type))}"${reviewed ? " (those approved now stay unless you are signed in to WayAI as a person)" : ""}, plus every relationship pointing at them?`
         );
         if (!ok) {
           console.error("Aborted.");
@@ -39018,6 +38995,7 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
     }
     let records = 0;
     let relationships = 0;
+    let kept = 0;
     let calls = 0;
     let incomplete = false;
     for (let sweep = 0; ; sweep++) {
@@ -39029,7 +39007,10 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
       records += res.swept.records;
       relationships += res.swept.relationships;
       calls++;
-      if (res.complete) break;
+      if (res.complete) {
+        kept = res.kept?.records ?? 0;
+        break;
+      }
       const sweptNothing = res.swept.records === 0 && res.swept.relationships === 0;
       if (sweptNothing || sweep + 1 >= MAX_ROLLBACK_SWEEPS) {
         incomplete = true;
@@ -39047,10 +39028,16 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
         "Note: a request was re-sent after its outcome was unknown, so the counts below are a lower bound \u2014 a page that committed before its response was lost is not included."
       );
     }
+    if (kept > 0) {
+      console.error(
+        `Kept ${kept} record${kept === 1 ? "" : "s"} of this import that ${kept === 1 ? "is" : "are"} approved: only a person signed in to WayAI removes an approved record. A rollback of this import by one removes them.`
+      );
+    }
     printOutput(
       {
         import_id: importId,
         swept: { records, relationships },
+        ...kept > 0 ? { kept: { records: kept } } : {},
         requests: calls,
         // The server's own completion claim, carried so a script can tell an
         // undo that FINISHED from one that stopped early and needs re-running.
@@ -39063,10 +39050,23 @@ Stopped at chunk ${nextIndex}. To resume, re-run the SAME command with:
   });
   return importCmd;
 }
+async function recordTypeIsReviewed(client, base, recordType2) {
+  if (recordType2 === null) return false;
+  try {
+    const type = await client.request(
+      "GET",
+      `/v1/${base}/record-types/${pathSegment(recordType2, "record_type")}`
+    );
+    return declaresReview(type?.json_schema);
+  } catch {
+    return true;
+  }
+}
 var MAX_CHUNK_ROWS, MAX_ATTEMPTS, MAX_ROLLBACK_SWEEPS, BASE_BACKOFF_MS, RETRYABLE_CODES, sleep2;
 var init_import = __esm({
   "src/data/commands/import.ts"() {
     "use strict";
+    init_rekor_toolset();
     init_client();
     init_output();
     init_helpers();