@wayai/cli 0.3.71 → 0.3.73

package/dist/index.js

@@ -7859,6 +7859,7 @@ var workspace_exports = {};
 __export(workspace_exports, {
   autoRenameHubFolder: () => autoRenameHubFolder,
   detectWorkspace: () => detectWorkspace,
+  filterPreviewHubs: () => filterPreviewHubs,
   findEnclosingHubFolder: () => findEnclosingHubFolder,
   findGitRoot: () => findGitRoot,
   findHubByFolderName: () => findHubByFolderName,
@@ -7866,10 +7867,12 @@ __export(workspace_exports, {
   findRepoRootSync: () => findRepoRootSync,
   getChangedHubs: () => getChangedHubs,
   getHubFolderSlug: () => getHubFolderSlug,
+  isPreviewHub: () => isPreviewHub,
   resolveActiveHubId: () => resolveActiveHubId,
   resolveExplicitHubPath: () => resolveExplicitHubPath,
   resolveHubFolder: () => resolveHubFolder,
   resolveHubFolderBySelector: () => resolveHubFolderBySelector,
+  resolveWorkspaceDir: () => resolveWorkspaceDir,
   scanNewHubs: () => scanNewHubs,
   scanWorkspaceHubs: () => scanWorkspaceHubs
 });
@@ -7905,6 +7908,16 @@ function detectWorkspace() {
   }
   return { gitRoot, workspaceDir: hubsDir };
 }
+function resolveWorkspaceDir() {
+  const workspace = detectWorkspace();
+  if (workspace) return workspace.workspaceDir;
+  const gitRoot = findGitRoot();
+  if (!gitRoot) {
+    console.error("Not inside a git repository.");
+    process.exit(1);
+  }
+  return resolveLayout(gitRoot).hubsDir;
+}
 function readHubYaml(yamlPath) {
   if (!fs2.existsSync(yamlPath)) return null;
   try {
@@ -7928,6 +7941,12 @@ function scanWorkspaceHubs(workspaceDir) {
   }
   return hubs;
 }
+function isPreviewHub(hub) {
+  return hub.hubEnvironment === "preview";
+}
+function filterPreviewHubs(hubs) {
+  return hubs.filter(isPreviewHub);
+}
 function readNewHubYaml(yamlPath) {
   if (!fs2.existsSync(yamlPath)) return null;
   try {
@@ -8020,7 +8039,7 @@ function getChangedHubs(workspaceDir) {
       hubs.push({ hubFolder, hubId: meta.hubId, hubEnvironment: meta.hubEnvironment });
     }
   }
-  return hubs;
+  return filterPreviewHubs(hubs);
 }
 function resolveExplicitHubPath(hubPath) {
   const parts = hubPath.split("/");
@@ -8128,13 +8147,14 @@ function resolveActiveHubId(args2) {
   }
   const enclosing = findEnclosingHubFolder(workspaceDir);
   if (enclosing) return enclosing.hubId;
-  if (allHubs.length === 1) return allHubs[0].hubId;
-  if (allHubs.length === 0) {
+  const previewHubs = filterPreviewHubs(allHubs);
+  if (previewHubs.length === 1) return previewHubs[0].hubId;
+  if (previewHubs.length === 0) {
     console.error(`No hub folders found in ${wsLabel}/. Run \`wayai pull --hub <uuid>\` to fetch a hub for the first time, or pass --hub <uuid>.`);
     process.exit(1);
   }
   console.error(`Multiple hubs in ${wsLabel}/. Pass --hub <uuid|folder-name> or run from inside a hub folder:`);
-  for (const h of allHubs) {
+  for (const h of previewHubs) {
     console.error(`  ${path2.basename(h.hubFolder)} (${h.hubId})`);
   }
   process.exit(1);
@@ -9712,6 +9732,44 @@ var init_whoami = __esm({
   }
 });
 
+// ../../packages/core/dist/constants.js
+var AUTH_TYPE2, ORG_CREDENTIAL_AUTH_TYPES2, AUTH_TYPE_DISPLAY2, LEGACY_AUTH_TYPE_MAP2, VALID_AUTH_TYPES2, SKILL_INSTALL_COMMAND;
+var init_constants = __esm({
+  "../../packages/core/dist/constants.js"() {
+    "use strict";
+    AUTH_TYPE2 = {
+      OAUTH: "oauth",
+      API_KEY: "api_key",
+      BASIC_AUTH: "basic_auth",
+      BEARER: "bearer",
+      NONE: "none"
+    };
+    ORG_CREDENTIAL_AUTH_TYPES2 = [
+      AUTH_TYPE2.API_KEY,
+      AUTH_TYPE2.BEARER,
+      AUTH_TYPE2.BASIC_AUTH
+    ];
+    AUTH_TYPE_DISPLAY2 = {
+      [AUTH_TYPE2.OAUTH]: "OAuth",
+      [AUTH_TYPE2.API_KEY]: "API Key",
+      [AUTH_TYPE2.BASIC_AUTH]: "Basic Auth",
+      [AUTH_TYPE2.BEARER]: "Bearer Token",
+      [AUTH_TYPE2.NONE]: "No Authentication"
+    };
+    LEGACY_AUTH_TYPE_MAP2 = {
+      "OAuth": AUTH_TYPE2.OAUTH,
+      "API Key": AUTH_TYPE2.API_KEY,
+      "Basic Auth": AUTH_TYPE2.BASIC_AUTH,
+      "Bearer Token": AUTH_TYPE2.BEARER,
+      "No authentication": AUTH_TYPE2.NONE,
+      // Also handle the old DISPLAY_TO_CODE bug where 'basic' was used instead of 'basic_auth'
+      "basic": AUTH_TYPE2.BASIC_AUTH
+    };
+    VALID_AUTH_TYPES2 = new Set(Object.values(AUTH_TYPE2));
+    SKILL_INSTALL_COMMAND = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
+  }
+});
+
 // src/commands/init.ts
 var init_exports = {};
 __export(init_exports, {
@@ -9850,7 +9908,8 @@ var init_init = __esm({
     init_workspace();
     init_layout();
     init_utils();
-    SKILL_INSTALL_CMD = "mkdir -p .claude && npx skills add wayai-pro/wayai-skill -y";
+    init_constants();
+    SKILL_INSTALL_CMD = SKILL_INSTALL_COMMAND;
   }
 });
 
@@ -10670,7 +10729,9 @@ var pull_exports = {};
 __export(pull_exports, {
   connectionsEqual: () => connectionsEqual,
   downloadBinaryResourceFiles: () => downloadBinaryResourceFiles,
-  pullCommand: () => pullCommand
+  pullCommand: () => pullCommand,
+  resolveHubTarget: () => resolveHubTarget,
+  writeProductionMirror: () => writeProductionMirror
 });
 import * as fs11 from "fs";
 import * as path13 from "path";
@@ -10701,13 +10762,14 @@ function resolveHubTarget(workspaceDir, selector) {
   }
   const enclosing = findEnclosingHubFolder(workspaceDir);
   if (enclosing) return { hubId: enclosing.hubId, hubFolder: enclosing.hubFolder };
-  if (allHubs.length === 1) return { hubId: allHubs[0].hubId, hubFolder: allHubs[0].hubFolder };
-  if (allHubs.length === 0) {
+  const previewHubs = filterPreviewHubs(allHubs);
+  if (previewHubs.length === 1) return { hubId: previewHubs[0].hubId, hubFolder: previewHubs[0].hubFolder };
+  if (previewHubs.length === 0) {
     console.error(`No hub folders found in ${wsLabel}/. Pass --hub <uuid> to fetch a hub for the first time.`);
     process.exit(1);
   }
   console.error(`Multiple hubs found in ${wsLabel}/. Pass --hub <uuid|folder-name> to choose, or run from inside a hub folder:`);
-  for (const h of allHubs) {
+  for (const h of previewHubs) {
     console.error(`  ${path13.basename(h.hubFolder)} (${h.hubId})`);
   }
   process.exit(1);
@@ -10718,27 +10780,18 @@ async function pullCommand(args2) {
   const { organization_id: organizationId } = repoConfig;
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
-  let workspaceDir;
-  const workspace = detectWorkspace();
+  const workspaceDir = resolveWorkspaceDir();
   const gitRoot = findGitRoot();
-  if (workspace) {
-    workspaceDir = workspace.workspaceDir;
-  } else {
-    if (!gitRoot) {
-      console.error("Not inside a git repository.");
-      process.exit(1);
-    }
-    workspaceDir = resolveLayout(gitRoot).hubsDir;
-  }
   if (gitRoot) warnLayoutOnce(gitRoot);
   const { hubId, hubFolder: existingFolder } = resolveHubTarget(workspaceDir, hubSelector);
-  assertHubMatchesBinding(hubId);
   console.log("Fetching hub configuration...");
   const payload = await client.pull(hubId, organizationId);
   if (payload.hub_environment === "production") {
-    console.log("Skipping production hub \u2014 production hubs are not tracked in the repository. Edit the linked preview hub instead.");
+    const folder = await writeProductionMirror(workspaceDir, payload);
+    console.log(`Production hub mirrored (read-only) \u2192 ${folder}`);
     return;
   }
+  assertHubMatchesBinding(hubId);
   let hubFolder = existingFolder;
   let wroteFiles = false;
   if (!hubFolder) {
@@ -10805,6 +10858,38 @@ async function pullCommand(args2) {
     if (cancelled) return;
   }
   if (wroteFiles) autoBindIfUnbound(hubId);
+  if (payload.production_hub_id) {
+    await mirrorLinkedProduction(client, workspaceDir, payload.production_hub_id, organizationId);
+  }
+}
+async function writeProductionMirror(workspaceDir, prodPayload) {
+  const folder = resolveHubFolder(workspaceDir, prodPayload.hub_id, prodPayload.hub.name, "production", null, null);
+  fs11.mkdirSync(path13.dirname(folder), { recursive: true });
+  writeHubFolder(folder, prodPayload);
+  await downloadBinaryResourceFiles(folder, prodPayload);
+  const finalFolder = autoRenameHubFolder(folder, prodPayload.hub.name, "production", prodPayload.hub_id, null, null);
+  prependMirrorMarker(finalFolder, prodPayload.hub_id);
+  return finalFolder;
+}
+async function mirrorLinkedProduction(client, workspaceDir, productionHubId, organizationId) {
+  try {
+    const prodPayload = await client.pull(productionHubId, organizationId);
+    const folder = await writeProductionMirror(workspaceDir, prodPayload);
+    console.log(`Mirrored production hub \u2192 ${folder} (read-only)`);
+  } catch (err) {
+    console.warn(`Warning: could not mirror production hub (${err instanceof Error ? err.message : String(err)}). Preview pull is unaffected.`);
+  }
+}
+function prependMirrorMarker(hubFolder, productionHubId) {
+  const hubYaml = path13.join(hubFolder, "hub.yaml");
+  try {
+    const content = fs11.readFileSync(hubYaml, "utf-8");
+    if (content.startsWith(MIRROR_MARKER_PREFIX)) return;
+    const marker = `${MIRROR_MARKER_PREFIX} ${productionHubId}. Edits are ignored; push is blocked. Edit the linked preview hub instead.
+`;
+    fs11.writeFileSync(hubYaml, marker + content, "utf-8");
+  } catch {
+  }
 }
 async function downloadBinaryResourceFiles(hubFolder, payload) {
   const resources = payload.resources || [];
@@ -10831,6 +10916,7 @@ function connectionsEqual(a, b) {
   }
   return true;
 }
+var MIRROR_MARKER_PREFIX;
 var init_pull = __esm({
   "src/commands/pull.ts"() {
     "use strict";
@@ -10845,6 +10931,7 @@ var init_pull = __esm({
     init_layout();
     init_repo_config();
     init_hub_binding();
+    MIRROR_MARKER_PREFIX = "# Read-only mirror of production hub";
   }
 });
 
@@ -11110,16 +11197,6 @@ async function pushSingleHub(client, hubId, hubFolder, autoConfirm, organization
   autoBindIfUnbound(hubId);
   return true;
 }
-function resolveWorkspaceDir() {
-  const workspace = detectWorkspace();
-  if (workspace) return workspace.workspaceDir;
-  const gitRoot = findGitRoot();
-  if (!gitRoot) {
-    console.error("Not inside a git repository.");
-    process.exit(1);
-  }
-  return resolveLayout(gitRoot).hubsDir;
-}
 function selectExistingHub(workspaceDir, allHubs, selector, wsLabel) {
   if (selector) {
     const match = allHubs.find(
@@ -11133,7 +11210,8 @@ function selectExistingHub(workspaceDir, allHubs, selector, wsLabel) {
   }
   const enclosing = findEnclosingHubFolder(workspaceDir);
   if (enclosing) return enclosing;
-  if (allHubs.length === 1) return allHubs[0];
+  const previewHubs = filterPreviewHubs(allHubs);
+  if (previewHubs.length === 1) return previewHubs[0];
   return null;
 }
 function selectNewHub(newHubs, selector) {
@@ -11166,6 +11244,10 @@ async function pushCommand(args2) {
   const newHubs = scanNewHubs(workspaceDir);
   const existing = selectExistingHub(workspaceDir, existingHubs, hubSelector, wsLabel);
   if (existing) {
+    if (existing.hubEnvironment === "production") {
+      console.log("This is a read-only production mirror \u2014 production hubs cannot be pushed. Edit the linked preview hub instead.");
+      return;
+    }
     assertHubMatchesBinding(existing.hubId, path14.basename(existing.hubFolder));
     await pushSingleHub(client, existing.hubId, existing.hubFolder, autoConfirm, organizationId);
     return;
@@ -11247,6 +11329,85 @@ var init_push = __esm({
   }
 });
 
+// src/commands/diff.ts
+var diff_exports = {};
+__export(diff_exports, {
+  diffCommand: () => diffCommand,
+  parseArgs: () => parseArgs6
+});
+function parseArgs6(args2) {
+  let production = false;
+  let hubSelector;
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--production") {
+      production = true;
+    } else if (arg === "--hub" && args2[i + 1]) {
+      hubSelector = args2[++i];
+    }
+  }
+  return { production, hubSelector };
+}
+async function diffCommand(args2) {
+  const { production, hubSelector } = parseArgs6(args2);
+  const repoConfig = requireRepoConfig();
+  const { organization_id: organizationId } = repoConfig;
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  const workspaceDir = resolveWorkspaceDir();
+  const gitRoot = findGitRoot();
+  if (gitRoot) warnLayoutOnce(gitRoot);
+  const { hubId: previewHubId, hubFolder } = resolveHubTarget(workspaceDir, hubSelector);
+  if (!hubFolder) {
+    console.error("Hub is not materialized locally \u2014 nothing to diff. Run `wayai pull` first.");
+    process.exit(1);
+  }
+  console.log("Parsing local configuration...");
+  const localConfig = parseHubFolder(hubFolder);
+  let targetHubId = previewHubId;
+  let label = "preview";
+  if (production) {
+    if (localConfig.hub_environment === "production") {
+      console.log("This is a read-only production mirror \u2014 run `wayai diff --production` from the preview workspace instead.");
+      return;
+    }
+    const { hubs } = await client.listHubs(organizationId);
+    const entry = hubs.find((h) => h.hub_id === previewHubId);
+    const productionHubId = entry?.production_hub_id ?? null;
+    if (!productionHubId) {
+      console.log("This preview has no linked production hub yet (never published) \u2014 nothing to diff against production.");
+      return;
+    }
+    targetHubId = productionHubId;
+    label = "production";
+  }
+  console.log(`Computing diff against ${label}...`);
+  const result = await client.diff(targetHubId, localConfig, "push", organizationId);
+  printWarnings(result.warnings);
+  if (!result.has_changes) {
+    console.log(`
+No differences \u2014 local files match ${label}.`);
+    return;
+  }
+  console.log(`
+Local files vs ${label.toUpperCase()}:`);
+  printDiff(result.summary);
+}
+var init_diff = __esm({
+  "src/commands/diff.ts"() {
+    "use strict";
+    init_auth();
+    init_api_client();
+    init_parser();
+    init_diff_display();
+    init_push();
+    init_pull();
+    init_repo_config();
+    init_layout();
+    init_workspace();
+  }
+});
+
 // src/commands/use.ts
 var use_exports = {};
 __export(use_exports, {
@@ -11987,10 +12148,10 @@ var init_delete_history = __esm({
 // src/commands/sync-skills.ts
 var sync_skills_exports = {};
 __export(sync_skills_exports, {
-  parseArgs: () => parseArgs6,
+  parseArgs: () => parseArgs7,
   syncSkillsCommand: () => syncSkillsCommand
 });
-function parseArgs6(args2) {
+function parseArgs7(args2) {
   let connectionId;
   const idx = args2.indexOf("--connection-id");
   if (idx !== -1 && args2[idx + 1]) {
@@ -12013,7 +12174,7 @@ function printSyncResults(response) {
 }
 async function syncSkillsCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const { connectionId } = parseArgs6(args2);
+  const { connectionId } = parseArgs7(args2);
   requireRepoConfig();
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -12038,10 +12199,10 @@ var init_sync_skills = __esm({
 // src/commands/sync-mcp.ts
 var sync_mcp_exports = {};
 __export(sync_mcp_exports, {
-  parseArgs: () => parseArgs7,
+  parseArgs: () => parseArgs8,
   syncMcpCommand: () => syncMcpCommand
 });
-function parseArgs7(args2) {
+function parseArgs8(args2) {
   let connection;
   for (let i = 0; i < args2.length; i++) {
     const arg = args2[i];
@@ -12053,7 +12214,7 @@ function parseArgs7(args2) {
 }
 async function syncMcpCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const { connection } = parseArgs7(args2);
+  const { connection } = parseArgs8(args2);
   if (!connection) {
     console.error("Usage: wayai sync-mcp --connection <name> [--hub <uuid|folder-name>]");
     console.error("");
@@ -12669,7 +12830,7 @@ function isValidSetName(name) {
   if (name.startsWith(".")) return false;
   return !/[\/\\\0]/.test(name);
 }
-function parseArgs8(args2) {
+function parseArgs9(args2) {
   if (args2.length === 0 || args2[0].startsWith("-")) {
     console.error("Usage: wayai eval capture <conversation_id> [--set <name>] [--name <eval_name>] [--instructions <text>]");
     process.exit(1);
@@ -12715,7 +12876,7 @@ function parseArgs8(args2) {
 }
 async function evalCaptureCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const parsed = parseArgs8(args2);
+  const parsed = parseArgs9(args2);
   const { config, accessToken } = await requireAuth();
   requireRepoConfig();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -12792,7 +12953,7 @@ var journey_capture_exports = {};
 __export(journey_capture_exports, {
   journeyCaptureCommand: () => journeyCaptureCommand
 });
-function parseArgs9(args2) {
+function parseArgs10(args2) {
   if (args2.length === 0 || args2[0].startsWith("-")) {
     console.error("Usage: wayai eval journey capture <conversation_id> [--name <journey_name>] [--instructions <text>]");
     process.exit(1);
@@ -12827,7 +12988,7 @@ function parseArgs9(args2) {
 }
 async function journeyCaptureCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const parsed = parseArgs9(args2);
+  const parsed = parseArgs10(args2);
   const { config, accessToken } = await requireAuth();
   requireRepoConfig();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -13035,8 +13196,8 @@ var init_eval = __esm({
 
 // ../../packages/core/dist/contracts/index.js
 function normalizeAuthType2(raw) {
-  if (VALID_AUTH_TYPES2.has(raw)) return raw;
-  return LEGACY_AUTH_TYPE_MAP2[raw] ?? raw;
+  if (VALID_AUTH_TYPES3.has(raw)) return raw;
+  return LEGACY_AUTH_TYPE_MAP3[raw] ?? raw;
 }
 function visibleLength2(s) {
   return s.replace(INVISIBLE_NAME_CHARS2, "").length;
@@ -13410,7 +13571,7 @@ function isSanitizableSliceFile(path22) {
 function distinctUsesBackends(uses) {
   return [...new Set((uses ?? []).map((u) => u.backend))];
 }
-var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE2, ORG_CREDENTIAL_AUTH_TYPES2, AUTH_TYPE_DISPLAY2, LEGACY_AUTH_TYPE_MAP2, VALID_AUTH_TYPES2, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, completionsBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
+var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, completionsBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -13510,35 +13671,35 @@ var init_contracts = __esm({
     addOrgAdminBody2 = external_exports.object({
       user_email: external_exports.string().email("valid email is required")
     });
-    AUTH_TYPE2 = {
+    AUTH_TYPE3 = {
       OAUTH: "oauth",
       API_KEY: "api_key",
       BASIC_AUTH: "basic_auth",
       BEARER: "bearer",
       NONE: "none"
     };
-    ORG_CREDENTIAL_AUTH_TYPES2 = [
-      AUTH_TYPE2.API_KEY,
-      AUTH_TYPE2.BEARER,
-      AUTH_TYPE2.BASIC_AUTH
+    ORG_CREDENTIAL_AUTH_TYPES3 = [
+      AUTH_TYPE3.API_KEY,
+      AUTH_TYPE3.BEARER,
+      AUTH_TYPE3.BASIC_AUTH
     ];
-    AUTH_TYPE_DISPLAY2 = {
-      [AUTH_TYPE2.OAUTH]: "OAuth",
-      [AUTH_TYPE2.API_KEY]: "API Key",
-      [AUTH_TYPE2.BASIC_AUTH]: "Basic Auth",
-      [AUTH_TYPE2.BEARER]: "Bearer Token",
-      [AUTH_TYPE2.NONE]: "No Authentication"
+    AUTH_TYPE_DISPLAY3 = {
+      [AUTH_TYPE3.OAUTH]: "OAuth",
+      [AUTH_TYPE3.API_KEY]: "API Key",
+      [AUTH_TYPE3.BASIC_AUTH]: "Basic Auth",
+      [AUTH_TYPE3.BEARER]: "Bearer Token",
+      [AUTH_TYPE3.NONE]: "No Authentication"
     };
-    LEGACY_AUTH_TYPE_MAP2 = {
-      "OAuth": AUTH_TYPE2.OAUTH,
-      "API Key": AUTH_TYPE2.API_KEY,
-      "Basic Auth": AUTH_TYPE2.BASIC_AUTH,
-      "Bearer Token": AUTH_TYPE2.BEARER,
-      "No authentication": AUTH_TYPE2.NONE,
+    LEGACY_AUTH_TYPE_MAP3 = {
+      "OAuth": AUTH_TYPE3.OAUTH,
+      "API Key": AUTH_TYPE3.API_KEY,
+      "Basic Auth": AUTH_TYPE3.BASIC_AUTH,
+      "Bearer Token": AUTH_TYPE3.BEARER,
+      "No authentication": AUTH_TYPE3.NONE,
       // Also handle the old DISPLAY_TO_CODE bug where 'basic' was used instead of 'basic_auth'
-      "basic": AUTH_TYPE2.BASIC_AUTH
+      "basic": AUTH_TYPE3.BASIC_AUTH
     };
-    VALID_AUTH_TYPES2 = new Set(Object.values(AUTH_TYPE2));
+    VALID_AUTH_TYPES3 = new Set(Object.values(AUTH_TYPE3));
     AGENT_ROLES2 = [
       "pilot",
       "copilot",
@@ -16411,8 +16572,8 @@ var init_analytics = __esm({
 
 // src/lib/credential-utils.ts
 function normalizeCliAuthType(type) {
-  const normalized = LEGACY_AUTH_TYPE_MAP3[type] ?? type;
-  return VALID_AUTH_TYPES3.includes(normalized) ? normalized : null;
+  const normalized = LEGACY_AUTH_TYPE_MAP4[type] ?? type;
+  return VALID_AUTH_TYPES4.includes(normalized) ? normalized : null;
 }
 function normalizeCliEnvironment(env) {
   return VALID_ENVIRONMENTS.includes(env) ? env : null;
@@ -16463,12 +16624,12 @@ function resolveTagIds(tagRefs, orgTags) {
 function splitTagRefs(rawValues) {
   return rawValues.flatMap((v) => v.split(",")).map((v) => v.trim()).filter((v) => v.length > 0);
 }
-var VALID_AUTH_TYPES3, LEGACY_AUTH_TYPE_MAP3, VALID_ENVIRONMENTS;
+var VALID_AUTH_TYPES4, LEGACY_AUTH_TYPE_MAP4, VALID_ENVIRONMENTS;
 var init_credential_utils = __esm({
   "src/lib/credential-utils.ts"() {
     "use strict";
-    VALID_AUTH_TYPES3 = ["api_key", "bearer", "basic_auth"];
-    LEGACY_AUTH_TYPE_MAP3 = {
+    VALID_AUTH_TYPES4 = ["api_key", "bearer", "basic_auth"];
+    LEGACY_AUTH_TYPE_MAP4 = {
       "API Key": "api_key",
       "Bearer Token": "bearer",
       "Basic Auth": "basic_auth"
@@ -16481,9 +16642,9 @@ var init_credential_utils = __esm({
 var create_credential_exports = {};
 __export(create_credential_exports, {
   createCredentialCommand: () => createCredentialCommand,
-  parseArgs: () => parseArgs10
+  parseArgs: () => parseArgs11
 });
-function parseArgs10(args2) {
+function parseArgs11(args2) {
   let name;
   let type;
   let orgId;
@@ -16511,7 +16672,7 @@ function parseArgs10(args2) {
   return { name, type, orgId, description, tags: splitTagRefs(tags), environment, stdin };
 }
 async function createCredentialCommand(args2) {
-  const parsed = parseArgs10(args2);
+  const parsed = parseArgs11(args2);
   if (!parsed.name) {
     console.error("Missing required flag: --name <credential-name>");
     console.error('Usage: wayai create-credential --name "openai-key" --type "Bearer Token"');
@@ -16519,13 +16680,13 @@ async function createCredentialCommand(args2) {
   }
   if (!parsed.type) {
     console.error("Missing required flag: --type <auth-type>");
-    console.error(`Supported types: ${VALID_AUTH_TYPES3.join(", ")}`);
+    console.error(`Supported types: ${VALID_AUTH_TYPES4.join(", ")}`);
     process.exit(1);
   }
   const authType = normalizeCliAuthType(parsed.type);
   if (!authType) {
     console.error(`Invalid authentication type: "${parsed.type}"`);
-    console.error(`Supported types: ${VALID_AUTH_TYPES3.join(", ")}`);
+    console.error(`Supported types: ${VALID_AUTH_TYPES4.join(", ")}`);
     process.exit(1);
   }
   if (parsed.environment && !normalizeCliEnvironment(parsed.environment)) {
@@ -16618,10 +16779,10 @@ var init_create_credential = __esm({
 // src/commands/update-credential.ts
 var update_credential_exports = {};
 __export(update_credential_exports, {
-  parseArgs: () => parseArgs11,
+  parseArgs: () => parseArgs12,
   updateCredentialCommand: () => updateCredentialCommand
 });
-function parseArgs11(args2) {
+function parseArgs12(args2) {
   let name;
   let rename;
   let orgId;
@@ -16654,7 +16815,7 @@ function parseArgs11(args2) {
   return { name, rename, orgId, description, tags: splitTagRefs(tags), hasTagFlag, environment, stdin, secretPrompt };
 }
 async function updateCredentialCommand(args2) {
-  const parsed = parseArgs11(args2);
+  const parsed = parseArgs12(args2);
   if (!parsed.name) {
     console.error("Missing required flag: --name <credential-name>");
     console.error('Usage: wayai update-credential --name "my-key" --stdin');
@@ -17013,9 +17174,9 @@ var init_org = __esm({
 var list_exports = {};
 __export(list_exports, {
   listCommand: () => listCommand,
-  parseArgs: () => parseArgs12
+  parseArgs: () => parseArgs13
 });
-function parseArgs12(args2) {
+function parseArgs13(args2) {
   let orgId;
   let json = false;
   for (let i = 0; i < args2.length; i++) {
@@ -17028,7 +17189,7 @@ function parseArgs12(args2) {
   return { orgId, json };
 }
 async function listCommand(args2) {
-  const { orgId, json } = parseArgs12(args2);
+  const { orgId, json } = parseArgs13(args2);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   const { organizations } = await client.organizations();
@@ -18590,12 +18751,12 @@ var init_admin = __esm({
 });
 
 // src/commands/report-create.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 import { dirname as dirname8, join as join24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getCliVersion() {
   try {
-    const pkg2 = JSON.parse(readFileSync16(join24(__dirname, "..", "..", "package.json"), "utf-8"));
+    const pkg2 = JSON.parse(readFileSync17(join24(__dirname, "..", "..", "package.json"), "utf-8"));
     return `cli@${pkg2.version}`;
   } catch {
     return "cli@unknown";
@@ -18977,7 +19138,7 @@ var init_update = __esm({
 
 // src/index.ts
 init_sentry();
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { dirname as dirname9, join as join25 } from "path";
 
@@ -19156,7 +19317,7 @@ Run \`wayai admin skill install\` to update.`);
 
 // src/index.ts
 var __dirname2 = dirname9(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync17(join25(__dirname2, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync18(join25(__dirname2, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command);
@@ -19210,6 +19371,11 @@ async function main() {
       await pushCommand2(args);
       break;
     }
+    case "diff": {
+      const { diffCommand: diffCommand2 } = await Promise.resolve().then(() => (init_diff(), diff_exports));
+      await diffCommand2(args);
+      break;
+    }
     case "use": {
       const { useCommand: useCommand2 } = await Promise.resolve().then(() => (init_use(), use_exports));
       await useCommand2(args);
@@ -19349,8 +19515,9 @@ Commands:
   init               Set up .wayai.yaml (pick organization)
   create-credential  Create an organization credential (API key, token, etc.)
   update-credential  Update / rotate an organization credential (by name)
-  pull               Fetch hub config and write local files
+  pull               Fetch hub config and write local files (also mirrors the linked production hub read-only)
   push               Parse local files, show diff, sync to preview (creates hub if new)
+  diff               Dry-run diff of local files vs the platform (--production diffs vs the linked production hub)
   org create         Create a new organization (you become its owner)
   org <pull|push|diff>  Sync org-scoped resources as code (wayai-ws/org/)
   use <hub>          Bind this worktree to a specific hub (UUID or folder name)
@@ -19376,7 +19543,8 @@ Commands:
 
 Flags:
   --yes, -y              Skip confirmation prompts (useful for CI and scripting)
-  --hub <uuid|name>      Target hub when the workspace has more than one (push, pull)
+  --hub <uuid|name>      Target hub when the workspace has more than one (push, pull, diff)
+  --production           Diff local preview files against the linked production hub (diff)
   --name <name>          Credential name (create-credential; target for update-credential)
   --type <auth-type>     Auth type: "api_key", "bearer", "basic_auth" (create-credential)
   --rename <name>        New name for the credential (update-credential)