@wayai/cli 0.3.53 → 0.3.55

package/dist/index.js

@@ -133,11 +133,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path19) {
+function addApiBreadcrumb(method, path22) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path19}`,
+    message: `${method} ${path22}`,
     level: "info"
   });
 }
@@ -189,13 +189,13 @@ var init_api_client = __esm({
     init_sentry();
     init_redact();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
-    delay = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
+    delay = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
     ApiError = class extends Error {
       status;
       body;
-      constructor(method, path19, status, body) {
+      constructor(method, path22, status, body) {
         const safeBody = redactSecrets(body);
-        super(`API request failed: ${method} ${path19} (${status}): ${safeBody}`);
+        super(`API request failed: ${method} ${path22} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
@@ -252,6 +252,25 @@ var init_api_client = __esm({
           commit_sha: commitSha
         });
       }
+      // --- Templates gallery ---
+      // Consumer (any authed user): list the joint template set + pull the wayai slice.
+      async templateList() {
+        return this.request("GET", "/api/ci/templates");
+      }
+      async templatePull(slug) {
+        return this.request("GET", `/api/ci/templates/${encodeURIComponent(slug)}`);
+      }
+      // Author (platform-admin): push a template into the store / pull it for inspection.
+      async adminTemplatePush(body) {
+        return this.request("POST", "/api/admin/templates/push", body);
+      }
+      async adminTemplatePull(slug) {
+        return this.request("GET", `/api/admin/templates/${encodeURIComponent(slug)}`);
+      }
+      // Download a private operator skill (platform-admin gated) for local install.
+      async adminSkillInstall(name) {
+        return this.request("GET", `/api/admin/skills/${encodeURIComponent(name)}`);
+      }
       /**
        * Re-discover an MCP connection's tool/resource catalog (refreshes stale
        * input schemas that `push` leaves untouched). `connection` is the display
@@ -264,8 +283,8 @@ var init_api_client = __esm({
           ...organizationId && { organization_id: organizationId }
         });
       }
-      async lookup(path19, opts) {
-        const params = new URLSearchParams({ path: path19 });
+      async lookup(path22, opts) {
+        const params = new URLSearchParams({ path: path22 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -615,9 +634,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path19, body) {
-        addApiBreadcrumb(method, path19);
-        const url = `${this.apiUrl}${path19}`;
+      async request(method, path22, body) {
+        addApiBreadcrumb(method, path22);
+        const url = `${this.apiUrl}${path22}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body);
@@ -641,7 +660,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path19, response.status, errorBody);
+          throw new ApiError(method, path22, response.status, errorBody);
         }
       }
       /** Issue a single authenticated request with the client's current token. */
@@ -1076,8 +1095,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path19, errorMaps, issueData } = params;
-      const fullPath = [...path19, ...issueData.path || []];
+      const { data, path: path22, errorMaps, issueData } = params;
+      const fullPath = [...path22, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1388,11 +1407,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path19, key) {
+      constructor(parent, value, path22, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path19;
+        this._path = path22;
         this._key = key;
       }
       get path() {
@@ -4783,6 +4802,38 @@ function normalizeAuthType(raw) {
 function visibleLength(s) {
   return s.replace(INVISIBLE_NAME_CHARS, "").length;
 }
+function validateLaneReferences(lanes, statuses) {
+  const issues = [];
+  if (!Array.isArray(statuses) || statuses.length === 0) return issues;
+  const declared = new Set((Array.isArray(lanes) ? lanes : []).map((l) => l.slug).filter(Boolean));
+  statuses.forEach((s, i) => {
+    const lane = s.lane_slug;
+    if (typeof lane !== "string" || lane.length === 0) return;
+    const label = s.slug ? `"${s.slug}"` : `[${i}]`;
+    if (s.isInitialStatus === true) {
+      issues.push({
+        path: [i, "lane_slug"],
+        message: `kanban status ${label}: the initial status cannot belong to a lane (it is the shared entry point)`
+      });
+      return;
+    }
+    if (!declared.has(lane)) {
+      issues.push({
+        path: [i, "lane_slug"],
+        message: `kanban status ${label}: lane_slug references unknown lane "${lane}"`
+      });
+    }
+  });
+  return issues;
+}
+function refineLaneReferences(val, ctx) {
+  const lanes = val.lanes;
+  const statuses = val.kanban_statuses;
+  if (lanes == null || statuses == null) return;
+  for (const issue of validateLaneReferences(lanes, statuses)) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["kanban_statuses", ...issue.path], message: issue.message });
+  }
+}
 function containsKanbanPlaceholders(value) {
   if (value == null) return false;
   const serialized = typeof value === "string" ? value : JSON.stringify(value);
@@ -4814,12 +4865,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path19, errors, opts = {}) {
+function validateSchema(schema, path22, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path19 || "<root>",
+      path: path22 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -4827,7 +4878,7 @@ function validateSchema(schema, path19, errors, opts = {}) {
   }
   if (!isRecord(schema)) {
     errors.push({
-      path: path19,
+      path: path22,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -4835,14 +4886,14 @@ function validateSchema(schema, path19, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path19 ? `${path19}.type` : "type",
+        path: path22 ? `${path22}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path19}.type`,
+      path: `${path22}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -4851,25 +4902,25 @@ function validateSchema(schema, path19, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       errors.push({
-        path: `${path19}.enum`,
+        path: `${path22}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path19}.enum`,
+        path: `${path22}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path19}.enum`,
+        path: `${path22}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path19}.enum[${i}]`,
+            path: `${path22}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -4879,7 +4930,7 @@ function validateSchema(schema, path19, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path19}.${key}`,
+        path: `${path22}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -4888,45 +4939,45 @@ function validateSchema(schema, path19, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord(schema.properties)) {
       errors.push({
-        path: `${path19}.properties`,
+        path: `${path22}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path19}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path22}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path19}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path22}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path19}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path22}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord(schema[key])) {
-      validateSchema(schema[key], `${path19}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path22}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path19}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path22}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path19}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path22}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path19}.${k}`;
+    const fieldPath = `${path22}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -5059,6 +5110,37 @@ function refineHubAsCodeKanbanStatuses(config, ctx) {
     }
   }
 }
+function refineHubAsCodeLanes(config, ctx) {
+  const hub = config.hub;
+  if (hub == null) return;
+  if ("lanes" in hub && hub.lanes != null) {
+    if (!Array.isArray(hub.lanes)) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["hub", "lanes"], message: "lanes must be an array" });
+      return;
+    }
+    const result = lanesArraySchema.safeParse(hub.lanes);
+    if (!result.success) {
+      for (const issue of result.error.issues) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["hub", "lanes", ...issue.path], message: issue.message });
+      }
+      return;
+    }
+  }
+  const statuses = hub.kanban_statuses;
+  if (Array.isArray(statuses)) {
+    for (const issue of validateLaneReferences(hub.lanes, statuses)) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["hub", "kanban_statuses", ...issue.path], message: issue.message });
+    }
+  }
+}
+function isSafeTemplatePath(path22) {
+  if (path22.length === 0 || path22.length > 300) return false;
+  if (path22.startsWith("/") || path22.includes("\\")) return false;
+  const segments = path22.split("/");
+  return segments.every(
+    (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
+  );
+}
 function identifyTokenType(token) {
   if (token.startsWith("way_")) return "way_token";
   if (token.startsWith("eyJ")) return "jwt";
@@ -5124,7 +5206,7 @@ function findStepBoundaries(transcript) {
   }
   return out;
 }
-var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, uuidSchema, paginationSchema, timestampSchema, idParamSchema, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, completionsBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
+var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, uuidSchema, paginationSchema, timestampSchema, idParamSchema, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, completionsBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateWayaiBlockSchema, templateRekorBlockSchema, templateYamlWayaiBlock, templateYamlRekorBlock, templateYamlSchema, templatePushMetadataSchema, templateHeroSchema, templatePushBody, templateSlugParam, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
@@ -5172,6 +5254,8 @@ var init_dist = __esm({
     init_zod();
     init_zod();
     init_zod();
+    init_zod();
+    init_zod();
     APP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("wayai.AppError");
     AppError = class extends Error {
       constructor(message, code, statusCode = 500, details) {
@@ -5417,6 +5501,7 @@ var init_dist = __esm({
     INVISIBLE_NAME_CHARS = /[\s\p{Default_Ignorable_Code_Point}]/gu;
     MAX_KANBAN_STATUSES = 50;
     MAX_FOLLOWUPS_PER_STATUS = 20;
+    MAX_LANES = 20;
     MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES = 16384;
     RESERVED_TEMPLATE_DUMP_NAME = "additional_data";
     kanbanStatusSlugSchema = slugSchema;
@@ -5473,7 +5558,14 @@ var init_dist = __esm({
       /** Slugs this status may transition to. `undefined` = unrestricted (any
        *  next status). Empty array `[]` is rejected — author must use
        *  `isTerminalStatus: true` to express "no outbound transitions". */
-      allowed_next_statuses: external_exports.array(external_exports.string()).min(1, "allowed_next_statuses cannot be empty \u2014 use isTerminalStatus: true for no outbound transitions").optional()
+      allowed_next_statuses: external_exports.array(external_exports.string()).min(1, "allowed_next_statuses cannot be empty \u2014 use isTerminalStatus: true for no outbound transitions").optional(),
+      /** Optional presentational grouping — the slug of a hub `lanes[]` entry this
+       *  status belongs to. `undefined` = ungrouped. Purely a board-filter/organization
+       *  concept; it does NOT constrain transitions (those live in `allowed_next_statuses`)
+       *  and is not exposed to agents. The cross-reference invariant (must point at a
+       *  declared lane; the initial status must not have one) is enforced at the hub
+       *  level via `validateLaneReferences` — this schema only sees the status array. */
+      lane_slug: kanbanStatusSlugSchema.optional()
     }).passthrough().superRefine((status, ctx) => {
       const label = status.name ? `"${status.name}"` : status.slug ? `"${status.slug}"` : "<unnamed>";
       for (const [a, b] of EXCLUSIVE_FLAG_PAIRS) {
@@ -5564,6 +5656,28 @@ var init_dist = __esm({
         });
       });
     });
+    laneSchema = external_exports.object({
+      slug: kanbanStatusSlugSchema,
+      name: external_exports.string().min(1, "name is required").max(100, "name must be 100 characters or fewer").refine((v) => visibleLength(v) > 0, "name must not be blank"),
+      color: external_exports.string().optional(),
+      order: external_exports.number().int().nonnegative().optional()
+    }).passthrough();
+    lanesArraySchema = external_exports.array(laneSchema).max(MAX_LANES, `lanes must have at most ${MAX_LANES} entries`).superRefine((lanes, ctx) => {
+      const seen = /* @__PURE__ */ new Map();
+      lanes.forEach((l, i) => {
+        if (!l.slug) return;
+        const arr = seen.get(l.slug) ?? [];
+        arr.push(i);
+        seen.set(l.slug, arr);
+      });
+      for (const [slug, indices] of seen) {
+        if (indices.length > 1) {
+          for (const i of indices) {
+            ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [i, "slug"], message: `lanes: duplicate slug "${slug}"` });
+          }
+        }
+      }
+    });
     hubIdParam = external_exports.object({ id: uuidSchema });
     hubAdminIdParam = external_exports.object({ id: uuidSchema, adminId: uuidSchema });
     hubUserIdParam = external_exports.object({ id: uuidSchema, hubUserId: uuidSchema });
@@ -5576,14 +5690,16 @@ var init_dist = __esm({
       hub_name: external_exports.string().min(1, "hub_name is required"),
       hub_description: external_exports.string().optional(),
       kanban_statuses: kanbanStatusesArraySchema.nullable().optional(),
+      lanes: lanesArraySchema.nullable().optional(),
       // Write-once at creation; updateHubBody does not accept this.
       primary_region: primaryRegionSchema.optional()
-    }).passthrough();
+    }).passthrough().superRefine(refineLaneReferences);
     updateHubBody = external_exports.object({
       support_model: external_exports.enum(["conversation", "account"]).optional(),
       unassigned_policy: external_exports.enum(["default_team", "auto_assign_random", "auto_assign_round_robin", "pull_queue"]).optional(),
       default_hub_team_id: uuidSchema.nullable().optional(),
       kanban_statuses: kanbanStatusesArraySchema.nullable().optional(),
+      lanes: lanesArraySchema.nullable().optional(),
       // summarization_threshold_tokens relocated to the summarizer AGENT (PR4) — validated/
       // persisted via the agent path (.passthrough() agent body → HubDO column), not here.
       auto_close_inactive_days: external_exports.number().int().min(1).max(180).optional(),
@@ -5592,7 +5708,7 @@ var init_dist = __esm({
       language: external_exports.enum(["en", "pt", "es"]).optional(),
       access_request_message: external_exports.string().max(1e3).nullable().optional(),
       access_approval_role: external_exports.enum(["admin", "team"]).optional()
-    }).passthrough();
+    }).passthrough().superRefine(refineLaneReferences);
     addHubAdminBody = external_exports.object({
       user_email: external_exports.string().email("valid email is required")
     });
@@ -6768,6 +6884,7 @@ var init_dist = __esm({
     }).passthrough().superRefine((config, ctx) => {
       refineHubAsCodeCustomTools(config, ctx);
       refineHubAsCodeKanbanStatuses(config, ctx);
+      refineHubAsCodeLanes(config, ctx);
     });
     ciPullHubIdParam = external_exports.object({
       hub_id: ciUuidSchema
@@ -7439,6 +7556,66 @@ var init_dist = __esm({
       offset: external_exports.coerce.number().int().min(0).optional()
     });
     noticeIdParamSchema = external_exports.object({ id: external_exports.string().min(1) });
+    TEMPLATE_SLUG_REGEX = /^[a-z0-9][a-z0-9-]{0,62}$/;
+    templateSlugSchema = external_exports.string().regex(TEMPLATE_SLUG_REGEX, "slug must be lowercase alphanumeric with hyphens (max 63)");
+    templateStatusSchema = external_exports.enum(["published", "draft", "internal"]);
+    templateFileMapSchema = external_exports.record(external_exports.string()).refine((m) => Object.keys(m).every(isSafeTemplatePath), {
+      message: 'file map contains an unsafe path (no absolute paths, "..", or backslashes)'
+    });
+    templateWayaiBlockSchema = external_exports.object({
+      metaTitle: external_exports.string().min(1).max(200),
+      metaDescription: external_exports.string().max(1e3).default(""),
+      installCommand: external_exports.string().min(1).max(300)
+    });
+    templateRekorBlockSchema = templateWayaiBlockSchema.extend({
+      mcpEndpoint: external_exports.string().url().optional(),
+      url: external_exports.string().url().optional()
+    });
+    templateYamlWayaiBlock = templateWayaiBlockSchema.extend({
+      source: external_exports.string().min(1)
+    });
+    templateYamlRekorBlock = templateRekorBlockSchema.extend({
+      source: external_exports.string().min(1)
+    });
+    templateYamlSchema = external_exports.object({
+      slug: templateSlugSchema,
+      category: external_exports.string().min(1).max(60),
+      status: templateStatusSchema.default("draft"),
+      order: external_exports.number().int().min(0).max(1e5).optional(),
+      hero: external_exports.string().optional(),
+      // relative path to a hero image inside the template folder
+      wayai: templateYamlWayaiBlock.optional(),
+      rekor: templateYamlRekorBlock.optional()
+    }).refine((c) => Boolean(c.wayai) || Boolean(c.rekor), {
+      message: "template.yaml must define at least one of `wayai:` or `rekor:`"
+    });
+    templatePushMetadataSchema = external_exports.object({
+      category: external_exports.string().min(1).max(60),
+      status: templateStatusSchema,
+      order: external_exports.number().int().min(0).max(1e5).default(0),
+      wayai: templateWayaiBlockSchema.optional(),
+      rekor: templateRekorBlockSchema.optional()
+    });
+    templateHeroSchema = external_exports.object({
+      filename: external_exports.string().min(1).max(200).regex(/\.(png|jpe?g|webp|gif)$/i, "hero must be a raster image (png/jpg/webp/gif)"),
+      // ~8MB of base64 ≈ a ~6MB image — a generous cap that bounds the inline payload
+      // (the endpoint is platform-admin-only, but an unbounded blob is still avoidable).
+      dataBase64: external_exports.string().min(1).max(8e6)
+    });
+    templatePushBody = external_exports.object({
+      slug: templateSlugSchema,
+      metadata: templatePushMetadataSchema,
+      // wayai slice file-map (path -> body); ABSENT for a Rekor-only template.
+      wayaiFiles: templateFileMapSchema.optional(),
+      // raw README markdown; the backend renders + sanitizes (single authority).
+      readmeMarkdown: external_exports.string().default(""),
+      hero: templateHeroSchema.optional()
+    });
+    templateSlugParam = external_exports.object({ slug: templateSlugSchema });
+    ADMIN_SKILL_NAME_REGEX = /^[a-z0-9][a-z0-9-]{0,63}$/;
+    adminSkillNameParam = external_exports.object({
+      name: external_exports.string().regex(ADMIN_SKILL_NAME_REGEX, "invalid skill name")
+    });
     WAYAI_WORKSPACE_LAYOUT = {
       /** Product-namespaced root dir at the git root. */
       wsDir: "wayai-ws",
@@ -7490,6 +7667,9 @@ function resolveLayout(gitRoot, layout = WAYAI_LAYOUT) {
     legacyAlsoPresent: false
   };
 }
+function resolveTemplatesDir(gitRoot) {
+  return path.join(gitRoot, TEMPLATES_AUTHORING_SUBDIR);
+}
 function hubsDirLabel(gitRoot) {
   if (!gitRoot) return path.join(WAYAI_LAYOUT.wsDir, WAYAI_LAYOUT.hubsSubdir);
   return path.relative(gitRoot, resolveLayout(gitRoot).hubsDir);
@@ -7515,7 +7695,7 @@ function warnLayoutOnce(gitRoot) {
     );
   }
 }
-var WAYAI_LAYOUT, _layoutWarned;
+var WAYAI_LAYOUT, TEMPLATES_AUTHORING_SUBDIR, _layoutWarned;
 var init_layout = __esm({
   "src/lib/layout.ts"() {
     "use strict";
@@ -7524,6 +7704,7 @@ var init_layout = __esm({
       ...WAYAI_WORKSPACE_LAYOUT,
       legacy: { wsDir: "workspace", orgAtRoot: "org" }
     };
+    TEMPLATES_AUTHORING_SUBDIR = "templates";
     _layoutWarned = false;
   }
 });
@@ -7814,24 +7995,24 @@ import * as path4 from "path";
 import * as readline from "readline";
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve4(answer.trim());
+      resolve5(answer.trim());
     });
   });
 }
 function confirm(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
-      resolve4(answer.trim().toLowerCase() === "y");
+      resolve5(answer.trim().toLowerCase() === "y");
     });
   });
 }
 function promptSecret(question) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const originalWrite = rl._writeToOutput;
     let firstWrite = true;
@@ -7847,18 +8028,18 @@ function promptSecret(question) {
       rl._writeToOutput = originalWrite;
       process.stdout.write("\n");
       rl.close();
-      resolve4(answer);
+      resolve5(answer);
     });
   });
 }
 function readStdin() {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
-    process.stdin.on("end", () => resolve4(data.trim()));
+    process.stdin.on("end", () => resolve5(data.trim()));
     process.stdin.on("error", reject);
   });
 }
@@ -8019,9 +8200,9 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path19 = getVersionCachePath(filename);
-    if (!existsSync4(path19)) return null;
-    const parsed = JSON.parse(readFileSync5(path19, "utf-8"));
+    const path22 = getVersionCachePath(filename);
+    if (!existsSync4(path22)) return null;
+    const parsed = JSON.parse(readFileSync5(path22, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -8041,10 +8222,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path19 = getVersionCachePath(filename);
-  const dir = dirname3(path19);
+  const path22 = getVersionCachePath(filename);
+  const dir = dirname3(path22);
   if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(path19, JSON.stringify(cache));
+  writeFileSync2(path22, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -8079,14 +8260,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot) {
   const found = [];
   for (const rel of SKILL_INSTALL_PATHS) {
-    const path19 = join7(projectRoot, rel);
-    if (!existsSync5(path19)) continue;
+    const path22 = join7(projectRoot, rel);
+    if (!existsSync5(path22)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path19, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path22, "utf-8"));
     } catch {
     }
-    found.push({ path: path19, version });
+    found.push({ path: path22, version });
   }
   return found;
 }
@@ -8516,7 +8697,7 @@ async function validateToken(apiUrl, token) {
   }
 }
 function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
       if (url.pathname === "/callback") {
@@ -8542,7 +8723,7 @@ function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login successful!</h2><p>You can close this tab and return to your terminal.</p></body></html>");
           server.close();
-          resolve4({ code, port });
+          resolve5({ code, port });
         } else {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login failed</h2><p>No authorization code received</p></body></html>");
@@ -8707,10 +8888,10 @@ import * as readline2 from "readline";
 function prompt2(question, defaultValue) {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(display, (answer) => {
       rl.close();
-      resolve4(answer.trim() || defaultValue || "");
+      resolve5(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -8828,8 +9009,8 @@ async function tryOpenBrowser(url) {
       cmd = "xdg-open";
       args2 = [url];
     }
-    return new Promise((resolve4) => {
-      execFile(cmd, args2, (err) => resolve4(!err));
+    return new Promise((resolve5) => {
+      execFile(cmd, args2, (err) => resolve5(!err));
     });
   } catch {
     return false;
@@ -11948,7 +12129,7 @@ Timeout after ${timeoutSeconds}s. Session is still running.`);
   console.log(`Check results: wayai eval-results --session ${sessionId}`);
 }
 function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 function extractApiMessage(err) {
   if (err instanceof ApiError) {
@@ -12531,6 +12712,38 @@ function normalizeAuthType2(raw) {
 function visibleLength2(s) {
   return s.replace(INVISIBLE_NAME_CHARS2, "").length;
 }
+function validateLaneReferences2(lanes, statuses) {
+  const issues = [];
+  if (!Array.isArray(statuses) || statuses.length === 0) return issues;
+  const declared = new Set((Array.isArray(lanes) ? lanes : []).map((l) => l.slug).filter(Boolean));
+  statuses.forEach((s, i) => {
+    const lane = s.lane_slug;
+    if (typeof lane !== "string" || lane.length === 0) return;
+    const label = s.slug ? `"${s.slug}"` : `[${i}]`;
+    if (s.isInitialStatus === true) {
+      issues.push({
+        path: [i, "lane_slug"],
+        message: `kanban status ${label}: the initial status cannot belong to a lane (it is the shared entry point)`
+      });
+      return;
+    }
+    if (!declared.has(lane)) {
+      issues.push({
+        path: [i, "lane_slug"],
+        message: `kanban status ${label}: lane_slug references unknown lane "${lane}"`
+      });
+    }
+  });
+  return issues;
+}
+function refineLaneReferences2(val, ctx) {
+  const lanes = val.lanes;
+  const statuses = val.kanban_statuses;
+  if (lanes == null || statuses == null) return;
+  for (const issue of validateLaneReferences2(lanes, statuses)) {
+    ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["kanban_statuses", ...issue.path], message: issue.message });
+  }
+}
 function containsKanbanPlaceholders2(value) {
   if (value == null) return false;
   const serialized = typeof value === "string" ? value : JSON.stringify(value);
@@ -12562,12 +12775,12 @@ function typeMatches2(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema2(schema, path19, errors, opts = {}) {
+function validateSchema2(schema, path22, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH2) {
     errors.push({
-      path: path19 || "<root>",
+      path: path22 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH2} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -12575,7 +12788,7 @@ function validateSchema2(schema, path19, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path19,
+      path: path22,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -12583,14 +12796,14 @@ function validateSchema2(schema, path19, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path19 ? `${path19}.type` : "type",
+        path: path22 ? `${path22}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches2(schema.type, ALLOWED_TYPES2)) {
     errors.push({
-      path: `${path19}.type`,
+      path: `${path22}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES2].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -12599,25 +12812,25 @@ function validateSchema2(schema, path19, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS2.includes(e);
       errors.push({
-        path: `${path19}.enum`,
+        path: `${path22}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path19}.enum`,
+        path: `${path22}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path19}.enum`,
+        path: `${path22}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive2(e[i])) {
           errors.push({
-            path: `${path19}.enum[${i}]`,
+            path: `${path22}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -12627,7 +12840,7 @@ function validateSchema2(schema, path19, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path19}.${key}`,
+        path: `${path22}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -12636,45 +12849,45 @@ function validateSchema2(schema, path19, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path19}.properties`,
+        path: `${path22}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema2(propSchema, `${path19}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema2(propSchema, `${path22}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes2(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema2(sub, `${path19}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema2(sub, `${path22}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema2(schema.items, `${path19}.items`, errors, { depth: depth + 1 });
+      validateSchema2(schema.items, `${path22}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS2) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema2(schema[key], `${path19}.${key}`, errors, { depth: depth + 1 });
+      validateSchema2(schema[key], `${path22}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS2) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema2(sub, `${path19}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema2(sub, `${path22}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS2) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema2(sub, `${path19}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema2(sub, `${path22}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path19}.${k}`;
+    const fieldPath = `${path22}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS2) {
       if (v === token) {
@@ -12807,7 +13020,38 @@ function refineHubAsCodeKanbanStatuses2(config, ctx) {
     }
   }
 }
-var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE2, ORG_CREDENTIAL_AUTH_TYPES2, AUTH_TYPE_DISPLAY2, LEGACY_AUTH_TYPE_MAP2, VALID_AUTH_TYPES2, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, completionsBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2;
+function refineHubAsCodeLanes2(config, ctx) {
+  const hub = config.hub;
+  if (hub == null) return;
+  if ("lanes" in hub && hub.lanes != null) {
+    if (!Array.isArray(hub.lanes)) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["hub", "lanes"], message: "lanes must be an array" });
+      return;
+    }
+    const result = lanesArraySchema2.safeParse(hub.lanes);
+    if (!result.success) {
+      for (const issue of result.error.issues) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["hub", "lanes", ...issue.path], message: issue.message });
+      }
+      return;
+    }
+  }
+  const statuses = hub.kanban_statuses;
+  if (Array.isArray(statuses)) {
+    for (const issue of validateLaneReferences2(hub.lanes, statuses)) {
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["hub", "kanban_statuses", ...issue.path], message: issue.message });
+    }
+  }
+}
+function isSafeTemplatePath2(path22) {
+  if (path22.length === 0 || path22.length > 300) return false;
+  if (path22.startsWith("/") || path22.includes("\\")) return false;
+  const segments = path22.split("/");
+  return segments.every(
+    (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
+  );
+}
+var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE2, ORG_CREDENTIAL_AUTH_TYPES2, AUTH_TYPE_DISPLAY2, LEGACY_AUTH_TYPE_MAP2, VALID_AUTH_TYPES2, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, completionsBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, templateWayaiBlockSchema2, templateRekorBlockSchema2, templateYamlWayaiBlock2, templateYamlRekorBlock2, templateYamlSchema2, templatePushMetadataSchema2, templateHeroSchema2, templatePushBody2, templateSlugParam2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -12855,6 +13099,8 @@ var init_contracts = __esm({
     init_zod();
     init_zod();
     init_zod();
+    init_zod();
+    init_zod();
     uuidSchema2 = external_exports.string().uuid();
     paginationSchema3 = external_exports.object({
       limit: external_exports.coerce.number().int().min(1).max(100).default(50),
@@ -13016,6 +13262,7 @@ var init_contracts = __esm({
     INVISIBLE_NAME_CHARS2 = /[\s\p{Default_Ignorable_Code_Point}]/gu;
     MAX_KANBAN_STATUSES2 = 50;
     MAX_FOLLOWUPS_PER_STATUS2 = 20;
+    MAX_LANES2 = 20;
     MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2 = 16384;
     RESERVED_TEMPLATE_DUMP_NAME2 = "additional_data";
     kanbanStatusSlugSchema2 = slugSchema2;
@@ -13072,7 +13319,14 @@ var init_contracts = __esm({
       /** Slugs this status may transition to. `undefined` = unrestricted (any
        *  next status). Empty array `[]` is rejected — author must use
        *  `isTerminalStatus: true` to express "no outbound transitions". */
-      allowed_next_statuses: external_exports.array(external_exports.string()).min(1, "allowed_next_statuses cannot be empty \u2014 use isTerminalStatus: true for no outbound transitions").optional()
+      allowed_next_statuses: external_exports.array(external_exports.string()).min(1, "allowed_next_statuses cannot be empty \u2014 use isTerminalStatus: true for no outbound transitions").optional(),
+      /** Optional presentational grouping — the slug of a hub `lanes[]` entry this
+       *  status belongs to. `undefined` = ungrouped. Purely a board-filter/organization
+       *  concept; it does NOT constrain transitions (those live in `allowed_next_statuses`)
+       *  and is not exposed to agents. The cross-reference invariant (must point at a
+       *  declared lane; the initial status must not have one) is enforced at the hub
+       *  level via `validateLaneReferences` — this schema only sees the status array. */
+      lane_slug: kanbanStatusSlugSchema2.optional()
     }).passthrough().superRefine((status, ctx) => {
       const label = status.name ? `"${status.name}"` : status.slug ? `"${status.slug}"` : "<unnamed>";
       for (const [a, b] of EXCLUSIVE_FLAG_PAIRS2) {
@@ -13163,6 +13417,28 @@ var init_contracts = __esm({
         });
       });
     });
+    laneSchema2 = external_exports.object({
+      slug: kanbanStatusSlugSchema2,
+      name: external_exports.string().min(1, "name is required").max(100, "name must be 100 characters or fewer").refine((v) => visibleLength2(v) > 0, "name must not be blank"),
+      color: external_exports.string().optional(),
+      order: external_exports.number().int().nonnegative().optional()
+    }).passthrough();
+    lanesArraySchema2 = external_exports.array(laneSchema2).max(MAX_LANES2, `lanes must have at most ${MAX_LANES2} entries`).superRefine((lanes, ctx) => {
+      const seen = /* @__PURE__ */ new Map();
+      lanes.forEach((l, i) => {
+        if (!l.slug) return;
+        const arr = seen.get(l.slug) ?? [];
+        arr.push(i);
+        seen.set(l.slug, arr);
+      });
+      for (const [slug, indices] of seen) {
+        if (indices.length > 1) {
+          for (const i of indices) {
+            ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: [i, "slug"], message: `lanes: duplicate slug "${slug}"` });
+          }
+        }
+      }
+    });
     hubIdParam2 = external_exports.object({ id: uuidSchema2 });
     hubAdminIdParam2 = external_exports.object({ id: uuidSchema2, adminId: uuidSchema2 });
     hubUserIdParam2 = external_exports.object({ id: uuidSchema2, hubUserId: uuidSchema2 });
@@ -13175,14 +13451,16 @@ var init_contracts = __esm({
       hub_name: external_exports.string().min(1, "hub_name is required"),
       hub_description: external_exports.string().optional(),
       kanban_statuses: kanbanStatusesArraySchema2.nullable().optional(),
+      lanes: lanesArraySchema2.nullable().optional(),
       // Write-once at creation; updateHubBody does not accept this.
       primary_region: primaryRegionSchema2.optional()
-    }).passthrough();
+    }).passthrough().superRefine(refineLaneReferences2);
     updateHubBody2 = external_exports.object({
       support_model: external_exports.enum(["conversation", "account"]).optional(),
       unassigned_policy: external_exports.enum(["default_team", "auto_assign_random", "auto_assign_round_robin", "pull_queue"]).optional(),
       default_hub_team_id: uuidSchema2.nullable().optional(),
       kanban_statuses: kanbanStatusesArraySchema2.nullable().optional(),
+      lanes: lanesArraySchema2.nullable().optional(),
       // summarization_threshold_tokens relocated to the summarizer AGENT (PR4) — validated/
       // persisted via the agent path (.passthrough() agent body → HubDO column), not here.
       auto_close_inactive_days: external_exports.number().int().min(1).max(180).optional(),
@@ -13191,7 +13469,7 @@ var init_contracts = __esm({
       language: external_exports.enum(["en", "pt", "es"]).optional(),
       access_request_message: external_exports.string().max(1e3).nullable().optional(),
       access_approval_role: external_exports.enum(["admin", "team"]).optional()
-    }).passthrough();
+    }).passthrough().superRefine(refineLaneReferences2);
     addHubAdminBody2 = external_exports.object({
       user_email: external_exports.string().email("valid email is required")
     });
@@ -14367,6 +14645,7 @@ var init_contracts = __esm({
     }).passthrough().superRefine((config, ctx) => {
       refineHubAsCodeCustomTools2(config, ctx);
       refineHubAsCodeKanbanStatuses2(config, ctx);
+      refineHubAsCodeLanes2(config, ctx);
     });
     ciPullHubIdParam2 = external_exports.object({
       hub_id: ciUuidSchema2
@@ -15038,6 +15317,66 @@ var init_contracts = __esm({
       offset: external_exports.coerce.number().int().min(0).optional()
     });
     noticeIdParamSchema2 = external_exports.object({ id: external_exports.string().min(1) });
+    TEMPLATE_SLUG_REGEX2 = /^[a-z0-9][a-z0-9-]{0,62}$/;
+    templateSlugSchema2 = external_exports.string().regex(TEMPLATE_SLUG_REGEX2, "slug must be lowercase alphanumeric with hyphens (max 63)");
+    templateStatusSchema2 = external_exports.enum(["published", "draft", "internal"]);
+    templateFileMapSchema2 = external_exports.record(external_exports.string()).refine((m) => Object.keys(m).every(isSafeTemplatePath2), {
+      message: 'file map contains an unsafe path (no absolute paths, "..", or backslashes)'
+    });
+    templateWayaiBlockSchema2 = external_exports.object({
+      metaTitle: external_exports.string().min(1).max(200),
+      metaDescription: external_exports.string().max(1e3).default(""),
+      installCommand: external_exports.string().min(1).max(300)
+    });
+    templateRekorBlockSchema2 = templateWayaiBlockSchema2.extend({
+      mcpEndpoint: external_exports.string().url().optional(),
+      url: external_exports.string().url().optional()
+    });
+    templateYamlWayaiBlock2 = templateWayaiBlockSchema2.extend({
+      source: external_exports.string().min(1)
+    });
+    templateYamlRekorBlock2 = templateRekorBlockSchema2.extend({
+      source: external_exports.string().min(1)
+    });
+    templateYamlSchema2 = external_exports.object({
+      slug: templateSlugSchema2,
+      category: external_exports.string().min(1).max(60),
+      status: templateStatusSchema2.default("draft"),
+      order: external_exports.number().int().min(0).max(1e5).optional(),
+      hero: external_exports.string().optional(),
+      // relative path to a hero image inside the template folder
+      wayai: templateYamlWayaiBlock2.optional(),
+      rekor: templateYamlRekorBlock2.optional()
+    }).refine((c) => Boolean(c.wayai) || Boolean(c.rekor), {
+      message: "template.yaml must define at least one of `wayai:` or `rekor:`"
+    });
+    templatePushMetadataSchema2 = external_exports.object({
+      category: external_exports.string().min(1).max(60),
+      status: templateStatusSchema2,
+      order: external_exports.number().int().min(0).max(1e5).default(0),
+      wayai: templateWayaiBlockSchema2.optional(),
+      rekor: templateRekorBlockSchema2.optional()
+    });
+    templateHeroSchema2 = external_exports.object({
+      filename: external_exports.string().min(1).max(200).regex(/\.(png|jpe?g|webp|gif)$/i, "hero must be a raster image (png/jpg/webp/gif)"),
+      // ~8MB of base64 ≈ a ~6MB image — a generous cap that bounds the inline payload
+      // (the endpoint is platform-admin-only, but an unbounded blob is still avoidable).
+      dataBase64: external_exports.string().min(1).max(8e6)
+    });
+    templatePushBody2 = external_exports.object({
+      slug: templateSlugSchema2,
+      metadata: templatePushMetadataSchema2,
+      // wayai slice file-map (path -> body); ABSENT for a Rekor-only template.
+      wayaiFiles: templateFileMapSchema2.optional(),
+      // raw README markdown; the backend renders + sanitizes (single authority).
+      readmeMarkdown: external_exports.string().default(""),
+      hero: templateHeroSchema2.optional()
+    });
+    templateSlugParam2 = external_exports.object({ slug: templateSlugSchema2 });
+    ADMIN_SKILL_NAME_REGEX2 = /^[a-z0-9][a-z0-9-]{0,63}$/;
+    adminSkillNameParam2 = external_exports.object({
+      name: external_exports.string().regex(ADMIN_SKILL_NAME_REGEX2, "invalid skill name")
+    });
   }
 });
 
@@ -16231,6 +16570,172 @@ var init_list = __esm({
   }
 });
 
+// src/lib/template-files.ts
+import * as fs16 from "fs";
+import * as path19 from "path";
+function readDirToFileMap(rootDir) {
+  const out = {};
+  function walk(dir, prefix) {
+    const entries = fs16.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const abs = path19.join(dir, entry.name);
+      const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) walk(abs, rel);
+      else if (entry.isFile()) out[rel] = fs16.readFileSync(abs, "utf-8");
+    }
+  }
+  if (fs16.existsSync(rootDir)) walk(rootDir, "");
+  return out;
+}
+function writeFileMap(targetDir, files) {
+  const written = [];
+  for (const [rel, body] of Object.entries(files)) {
+    if (!isSafeTemplatePath2(rel)) {
+      throw new Error(`Refusing to write unsafe template path: ${rel}`);
+    }
+    const abs = path19.join(targetDir, rel);
+    fs16.mkdirSync(path19.dirname(abs), { recursive: true });
+    fs16.writeFileSync(abs, body, "utf-8");
+    written.push(rel);
+  }
+  return written;
+}
+var init_template_files = __esm({
+  "src/lib/template-files.ts"() {
+    "use strict";
+    init_contracts();
+  }
+});
+
+// src/commands/templates.ts
+var templates_exports = {};
+__export(templates_exports, {
+  templateCommand: () => templateCommand
+});
+import * as path20 from "path";
+async function templateCommand(args2) {
+  const [sub, ...rest] = args2;
+  switch (sub) {
+    case "list":
+      await runTemplateList();
+      return;
+    case "pull":
+      await runTemplatePull(rest);
+      return;
+    case void 0:
+    case "help":
+    case "--help":
+    case "-h":
+      printTemplateHelp();
+      return;
+    default:
+      console.error(`Unknown template subcommand: ${sub}`);
+      printTemplateHelp();
+      process.exit(1);
+  }
+}
+function includesLabel(includes) {
+  const parts = [];
+  if (includes.wayai) parts.push("wayai agent");
+  if (includes.rekor) parts.push("rekor data layer");
+  return parts.length ? parts.join(" + ") : "(none)";
+}
+async function runTemplateList() {
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let response;
+  try {
+    response = await client.templateList();
+  } catch (err) {
+    exitOnTemplateApiError(err);
+    throw err;
+  }
+  const { templates } = response;
+  if (templates.length === 0) {
+    console.log("(no templates published yet)");
+    return;
+  }
+  const slugWidth = Math.max(4, ...templates.map((t) => t.slug.length));
+  const catWidth = Math.max(8, ...templates.map((t) => t.category.length));
+  console.log(`${"SLUG".padEnd(slugWidth)}  ${"CATEGORY".padEnd(catWidth)}  INCLUDES`);
+  for (const t of templates) {
+    console.log(`${t.slug.padEnd(slugWidth)}  ${t.category.padEnd(catWidth)}  ${includesLabel(t.includes)}`);
+  }
+}
+async function runTemplatePull(rest) {
+  const slug = rest[0];
+  if (!slug) {
+    console.error("wayai template pull <slug>");
+    process.exit(1);
+  }
+  if (!TEMPLATE_SLUG_REGEX2.test(slug)) {
+    console.error(`Invalid template slug: ${slug}`);
+    process.exit(1);
+  }
+  const gitRoot = findGitRoot();
+  if (!gitRoot) {
+    console.error("Not in a git repository. Run `wayai template pull` inside your project repo.");
+    process.exit(1);
+  }
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let detail;
+  try {
+    detail = await client.templatePull(slug);
+  } catch (err) {
+    exitOnTemplateApiError(err);
+    throw err;
+  }
+  if (!detail.includes.wayai) {
+    console.log(`Template "${slug}" has no WayAI slice \u2014 run \`rekor template pull ${slug}\` for its data layer.`);
+    return;
+  }
+  const targetDir = path20.join(resolveLayout(gitRoot).hubsDir, slug);
+  const written = writeFileMap(targetDir, detail.files);
+  console.log(`Pulled template "${slug}" \u2192 ${path20.relative(gitRoot, targetDir)}/ (${written.length} file${written.length === 1 ? "" : "s"}).`);
+  console.log(`Next: \`wayai push\` to deploy it into your own hub.`);
+  if (detail.includes.rekor) {
+    console.log(`
+This template includes a Rekor data layer \u2014 run \`rekor template pull ${slug}\` to add it.`);
+  }
+}
+function printTemplateHelp() {
+  console.log(`wayai template \u2014 install ready-made hub templates
+
+Usage:
+  wayai template list            List available templates
+  wayai template pull <slug>     Write a template's WayAI slice into wayai-ws/hubs/<slug>/
+
+After pulling, run \`wayai push\` to deploy the template into your own hub.`);
+}
+function exitOnTemplateApiError(err) {
+  if (err instanceof ApiError) {
+    if (err.status === 401) {
+      console.error("Authentication failed. Run `wayai login` again.");
+    } else if (err.status === 404) {
+      console.error("Template not found. Run `wayai template list` to see available templates.");
+    } else if (err.status === 429) {
+      console.error("Rate limited. Please retry in a moment.");
+    } else {
+      console.error(err.message);
+    }
+    process.exit(1);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+}
+var init_templates = __esm({
+  "src/commands/templates.ts"() {
+    "use strict";
+    init_auth();
+    init_api_client();
+    init_workspace();
+    init_layout();
+    init_template_files();
+    init_contracts();
+  }
+});
+
 // src/lib/report-edit-args.ts
 function parseReportEditArgs(args2) {
   const patch = {};
@@ -16276,6 +16781,9 @@ var admin_exports = {};
 __export(admin_exports, {
   adminCommand: () => adminCommand
 });
+import * as fs17 from "fs";
+import * as path21 from "path";
+import * as yaml9 from "js-yaml";
 async function adminCommand(args2) {
   const [group, ...afterGroup] = args2;
   if (!group) {
@@ -16389,6 +16897,37 @@ async function adminCommand(args2) {
         process.exit(1);
     }
   }
+  if (group === "template") {
+    if (!sub) {
+      printHelp2();
+      process.exit(1);
+    }
+    switch (sub) {
+      case "push":
+        await runTemplatePush(positional);
+        return;
+      case "pull":
+        await runTemplatePull2(positional, flagArgs);
+        return;
+      default:
+        printHelp2();
+        process.exit(1);
+    }
+  }
+  if (group === "skill") {
+    if (!sub) {
+      printHelp2();
+      process.exit(1);
+    }
+    switch (sub) {
+      case "install":
+        await runSkillInstall(positional);
+        return;
+      default:
+        printHelp2();
+        process.exit(1);
+    }
+  }
   printHelp2();
   process.exit(1);
 }
@@ -16613,6 +17152,160 @@ function parseFlags2(flagArgs, allowed) {
   }
   return out;
 }
+async function runTemplatePush(positional) {
+  const slug = positional[0];
+  if (!slug) {
+    console.error("wayai admin template push <slug>");
+    process.exit(1);
+  }
+  if (!TEMPLATE_SLUG_REGEX2.test(slug)) {
+    console.error(`Invalid template slug: ${slug}`);
+    process.exit(1);
+  }
+  const gitRoot = findGitRoot();
+  if (!gitRoot) {
+    console.error("Not in a git repository. Run from the tutorials/ authoring repo.");
+    process.exit(1);
+  }
+  const templateDir = path21.join(resolveTemplatesDir(gitRoot), slug);
+  const manifestPath = path21.join(templateDir, "template.yaml");
+  if (!fs17.existsSync(manifestPath)) {
+    console.error(`template.yaml not found at ${path21.relative(gitRoot, manifestPath)}`);
+    process.exit(1);
+  }
+  let manifest;
+  try {
+    manifest = templateYamlSchema2.parse(yaml9.load(fs17.readFileSync(manifestPath, "utf-8")));
+  } catch (err) {
+    console.error(`Invalid template.yaml: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+  if (manifest.slug !== slug) {
+    console.error(`template.yaml slug "${manifest.slug}" does not match folder "${slug}".`);
+    process.exit(1);
+  }
+  let wayaiFiles;
+  if (manifest.wayai) {
+    const sliceDir = path21.resolve(templateDir, manifest.wayai.source);
+    if (!fs17.existsSync(sliceDir)) {
+      console.error(`wayai source not found: ${manifest.wayai.source} (resolved ${sliceDir})`);
+      process.exit(1);
+    }
+    wayaiFiles = readDirToFileMap(sliceDir);
+  }
+  const readmePath = path21.join(templateDir, "README.md");
+  const readmeMarkdown = fs17.existsSync(readmePath) ? fs17.readFileSync(readmePath, "utf-8") : "";
+  let hero;
+  if (manifest.hero) {
+    const heroPath = path21.resolve(templateDir, manifest.hero);
+    if (fs17.existsSync(heroPath)) {
+      hero = { filename: path21.basename(heroPath), dataBase64: fs17.readFileSync(heroPath).toString("base64") };
+    } else {
+      console.error(`Warning: hero not found at ${manifest.hero}; skipping.`);
+    }
+  }
+  const metadata = {
+    category: manifest.category,
+    status: manifest.status,
+    order: manifest.order ?? 0,
+    ...manifest.wayai && {
+      wayai: {
+        metaTitle: manifest.wayai.metaTitle,
+        metaDescription: manifest.wayai.metaDescription,
+        installCommand: manifest.wayai.installCommand
+      }
+    },
+    ...manifest.rekor && {
+      rekor: {
+        metaTitle: manifest.rekor.metaTitle,
+        metaDescription: manifest.rekor.metaDescription,
+        installCommand: manifest.rekor.installCommand,
+        ...manifest.rekor.mcpEndpoint && { mcpEndpoint: manifest.rekor.mcpEndpoint }
+      }
+    }
+  };
+  const body = { slug, metadata, wayaiFiles, readmeMarkdown, hero };
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let result;
+  try {
+    result = await client.adminTemplatePush(body);
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  console.log(`Template "${result.slug}": ${result.action} (${result.filesWritten} written, ${result.filesDeleted} deleted).`);
+  if (manifest.status !== "published") {
+    console.log(`(status=${manifest.status} \u2192 unpublished from the store)`);
+  }
+}
+async function runTemplatePull2(positional, flagArgs) {
+  const slug = positional[0];
+  if (!slug) {
+    console.error("wayai admin template pull <slug> [--out DIR] [--json]");
+    process.exit(1);
+  }
+  if (!TEMPLATE_SLUG_REGEX2.test(slug)) {
+    console.error(`Invalid template slug: ${slug}`);
+    process.exit(1);
+  }
+  let outDir;
+  let jsonOutput = false;
+  for (let i = 0; i < flagArgs.length; i++) {
+    if (flagArgs[i] === "--json") {
+      jsonOutput = true;
+      continue;
+    }
+    if (flagArgs[i] === "--out") {
+      outDir = flagArgs[++i];
+      if (!outDir) {
+        console.error("--out requires a value");
+        process.exit(1);
+      }
+      continue;
+    }
+    console.error(`Unknown flag: ${flagArgs[i]}`);
+    process.exit(1);
+  }
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let detail;
+  try {
+    detail = await client.adminTemplatePull(slug);
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  if (jsonOutput) {
+    console.log(JSON.stringify(detail, null, 2));
+    return;
+  }
+  const target = outDir ? path21.resolve(outDir) : path21.join(process.cwd(), "template-store-pull", slug);
+  const written = writeFileMap(target, detail.files);
+  console.log(`Pulled "${slug}" from the store \u2192 ${target} (${written.length} file${written.length === 1 ? "" : "s"}).`);
+  console.log(`includes: wayai=${detail.includes.wayai} rekor=${detail.includes.rekor}`);
+}
+async function runSkillInstall(positional) {
+  const name = positional[0] ?? "wayai-admin";
+  if (!ADMIN_SKILL_NAME_REGEX2.test(name)) {
+    console.error(`Invalid skill name: ${name}`);
+    process.exit(1);
+  }
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let res;
+  try {
+    res = await client.adminSkillInstall(name);
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  const root = findGitRoot() ?? process.cwd();
+  const targetDir = path21.join(root, ".claude", "skills", name);
+  const written = writeFileMap(targetDir, res.files);
+  console.log(`Installed skill "${name}" \u2192 ${path21.relative(root, targetDir)}/ (${written.length} file${written.length === 1 ? "" : "s"}).`);
+  console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
+}
 function exitOnApiError(err) {
   if (err instanceof ApiError) {
     if (err.status === 401) {
@@ -17024,6 +17717,11 @@ Usage:
   wayai admin notice list [--status active|resolved] [--limit N] [--offset N] [--json]
   wayai admin notice resolve <notice_id>
 
+  wayai admin template push <slug>                 Publish a template from tutorials/templates/<slug>/ into the store
+  wayai admin template pull <slug> [--out DIR] [--json]   Pull a published template from the store for inspection
+
+  wayai admin skill install [name]                 Install a private operator skill (default: wayai-admin) into .claude/skills/
+
 Sources:
   do             Live DO SQLite (existing conversation, hub config, etc.).
   analytics      ClickHouse projections (conversation, message, billing_event, schedule_event).
@@ -17081,6 +17779,9 @@ var init_admin = __esm({
     init_api_client();
     init_observability();
     init_report_edit_args();
+    init_workspace();
+    init_layout();
+    init_template_files();
     init_contracts();
     VALID_TYPES = dataExplorerDebugDoType2.options;
     VALID_ANALYTICS_TABLES = dataExplorerDebugAnalyticsTable2.options;
@@ -17089,12 +17790,12 @@ var init_admin = __esm({
 });
 
 // src/commands/report-create.ts
-import { readFileSync as readFileSync14 } from "fs";
-import { dirname as dirname7, join as join20 } from "path";
+import { readFileSync as readFileSync16 } from "fs";
+import { dirname as dirname8, join as join23 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getCliVersion() {
   try {
-    const pkg2 = JSON.parse(readFileSync14(join20(__dirname, "..", "..", "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync16(join23(__dirname, "..", "..", "package.json"), "utf-8"));
     return `cli@${pkg2.version}`;
   } catch {
     return "cli@unknown";
@@ -17201,7 +17902,7 @@ var init_report_create = __esm({
     init_auth();
     init_repo_config();
     init_api_client();
-    __dirname = dirname7(fileURLToPath2(import.meta.url));
+    __dirname = dirname8(fileURLToPath2(import.meta.url));
   }
 });
 
@@ -17476,9 +18177,9 @@ var init_update = __esm({
 
 // src/index.ts
 init_sentry();
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname8, join as join21 } from "path";
+import { dirname as dirname9, join as join24 } from "path";
 
 // src/lib/errors.ts
 init_api_client();
@@ -17503,7 +18204,7 @@ init_skill_version();
 import { exec } from "child_process";
 var REFRESH_TIMEOUT_MS = 1e4;
 function refreshCliCache() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     exec("npm view @wayai/cli version", { timeout: REFRESH_TIMEOUT_MS }, (err, stdout) => {
       if (!err) {
         const latest = stdout.trim();
@@ -17514,7 +18215,7 @@ function refreshCliCache() {
           }
         }
       }
-      resolve4();
+      resolve5();
     });
   });
 }
@@ -17606,8 +18307,8 @@ Run \`npx skills add wayai-pro/wayai-skill -y\` to update.`);
 }
 
 // src/index.ts
-var __dirname2 = dirname8(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync15(join21(__dirname2, "..", "package.json"), "utf-8"));
+var __dirname2 = dirname9(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync17(join24(__dirname2, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command);
@@ -17739,6 +18440,11 @@ async function main() {
       await listCommand2(args);
       break;
     }
+    case "template": {
+      const { templateCommand: templateCommand2 } = await Promise.resolve().then(() => (init_templates(), templates_exports));
+      await templateCommand2(args);
+      break;
+    }
     case "admin": {
       const { adminCommand: adminCommand2 } = await Promise.resolve().then(() => (init_admin(), admin_exports));
       await adminCommand2(args);
@@ -17805,6 +18511,8 @@ Commands:
   sync-skills        Sync skills to Anthropic/OpenAI provider connections
   sync-mcp           Re-discover an MCP connection's tools (refresh stale schemas)
   list               List organizations and hubs
+  template list      List ready-made hub templates
+  template pull      Write a template's WayAI slice into wayai-ws/hubs/<slug>/
   report create      Report a platform bug (submits to the triage queue)
   report edit        Amend your own pending report (title/description/error/steps/context)
   update             Update CLI to the latest version