@wayai/cli 0.3.75 → 0.3.77

package/dist/index.js

@@ -165,11 +165,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path24) {
+function addApiBreadcrumb(method, path25) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path24}`,
+    message: `${method} ${path25}`,
     level: "info"
   });
 }
@@ -231,9 +231,9 @@ var init_api_client = __esm({
     ApiError = class extends Error {
       status;
       body;
-      constructor(method, path24, status, body) {
+      constructor(method, path25, status, body) {
         const safeBody = redactSecrets(body);
-        super(`API request failed: ${method} ${path24} (${status}): ${safeBody}`);
+        super(`API request failed: ${method} ${path25} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
@@ -325,8 +325,8 @@ var init_api_client = __esm({
           ...organizationId && { organization_id: organizationId }
         });
       }
-      async lookup(path24, opts) {
-        const params = new URLSearchParams({ path: path24 });
+      async lookup(path25, opts) {
+        const params = new URLSearchParams({ path: path25 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -504,6 +504,18 @@ var init_api_client = __esm({
         const qs = new URLSearchParams({ organization_id: organizationId });
         return this.request("GET", `/api/setup/organization-credentials?${qs.toString()}`);
       }
+      async listConnections(hubId) {
+        const qs = new URLSearchParams({ hub_id: hubId });
+        return this.request("GET", `/api/setup/connections?${qs.toString()}`);
+      }
+      /** Set a credential on a PREVIEW connection (direct secret or org-credential link). */
+      async setPreviewConnectionCredential(connectionId, body) {
+        return this.request("PATCH", `/api/setup/connections/${connectionId}`, body);
+      }
+      /** Set a credential on a PRODUCTION connection (the sanctioned carve-out). */
+      async setProductionConnectionCredential(connectionId, body) {
+        return this.request("PATCH", `/api/setup/connections/${connectionId}/production-credential`, body);
+      }
       async updateOrgCredential(credentialId, organizationId, body) {
         const qs = new URLSearchParams({ organization_id: organizationId });
         return this.request("PUT", `/api/setup/organization-credentials/${credentialId}?${qs.toString()}`, body);
@@ -531,6 +543,30 @@ var init_api_client = __esm({
           preview_label: previewLabel ?? null
         });
       }
+      /**
+       * Preview → production diff — the source of truth for what `wayai publish`
+       * will do. `data.is_first_publish` distinguishes a first publish (no linked
+       * production hub yet, all entities listed as added) from a subsequent sync.
+       * Requires only `hub:read`, so it also drives the pre-confirm preview.
+       */
+      async getHubDiff(hubId) {
+        return this.request("GET", `/api/setup/hubs/${hubId}/diff`);
+      }
+      /**
+       * First publish: clone the preview hub into a NEW production hub. Errors if the
+       * preview is already linked to production (use `syncHub` instead). Returns the
+       * new production hub id (POST /api/setup/hubs/:id/publish — HTTP 201).
+       */
+      async publishHub(hubId) {
+        return this.request("POST", `/api/setup/hubs/${hubId}/publish`);
+      }
+      /**
+       * Sync a preview hub's changes into its linked production hub
+       * (POST /api/setup/hubs/:id/sync). No-op-safe when already in sync.
+       */
+      async syncHub(hubId) {
+        return this.request("POST", `/api/setup/hubs/${hubId}/sync`);
+      }
       /**
        * Set or clear a preview hub's label (PATCH /api/setup/hubs/:id). Pass null to
        * clear. The backend trims and normalizes empty → null (max 60 chars).
@@ -703,9 +739,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path24, body) {
-        addApiBreadcrumb(method, path24);
-        const url = `${this.apiUrl}${path24}`;
+      async request(method, path25, body) {
+        addApiBreadcrumb(method, path25);
+        const url = `${this.apiUrl}${path25}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body);
@@ -729,7 +765,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path24, response.status, errorBody);
+          throw new ApiError(method, path25, response.status, errorBody);
         }
       }
       /** Issue a single authenticated request with the client's current token. */
@@ -1164,8 +1200,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path24, errorMaps, issueData } = params;
-      const fullPath = [...path24, ...issueData.path || []];
+      const { data, path: path25, errorMaps, issueData } = params;
+      const fullPath = [...path25, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1476,11 +1512,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path24, key) {
+      constructor(parent, value, path25, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path24;
+        this._path = path25;
         this._key = key;
       }
       get path() {
@@ -4934,12 +4970,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path24, errors, opts = {}) {
+function validateSchema(schema, path25, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path24 || "<root>",
+      path: path25 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -4947,7 +4983,7 @@ function validateSchema(schema, path24, errors, opts = {}) {
   }
   if (!isRecord(schema)) {
     errors.push({
-      path: path24,
+      path: path25,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -4955,14 +4991,14 @@ function validateSchema(schema, path24, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path24 ? `${path24}.type` : "type",
+        path: path25 ? `${path25}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path24}.type`,
+      path: `${path25}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -4971,25 +5007,25 @@ function validateSchema(schema, path24, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       errors.push({
-        path: `${path24}.enum`,
+        path: `${path25}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path24}.enum`,
+        path: `${path25}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path24}.enum`,
+        path: `${path25}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path24}.enum[${i}]`,
+            path: `${path25}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -4999,7 +5035,7 @@ function validateSchema(schema, path24, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path24}.${key}`,
+        path: `${path25}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -5008,45 +5044,45 @@ function validateSchema(schema, path24, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord(schema.properties)) {
       errors.push({
-        path: `${path24}.properties`,
+        path: `${path25}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path24}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path25}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path24}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path25}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path24}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path25}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord(schema[key])) {
-      validateSchema(schema[key], `${path24}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path25}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path24}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path25}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path24}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path25}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path24}.${k}`;
+    const fieldPath = `${path25}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -5202,10 +5238,10 @@ function refineHubAsCodeLanes(config, ctx) {
     }
   }
 }
-function isSafeTemplatePath(path24) {
-  if (path24.length === 0 || path24.length > 300) return false;
-  if (path24.startsWith("/") || path24.includes("\\")) return false;
-  const segments = path24.split("/");
+function isSafeTemplatePath(path25) {
+  if (path25.length === 0 || path25.length > 300) return false;
+  if (path25.startsWith("/") || path25.includes("\\")) return false;
+  const segments = path25.split("/");
   return segments.every(
     (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
   );
@@ -5275,7 +5311,7 @@ function findStepBoundaries(transcript) {
   }
   return out;
 }
-var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, completionsBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
+var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, completionsBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
@@ -5866,15 +5902,27 @@ var init_dist = __esm({
       hub_id: uuidSchema,
       sync_credentials_to_production: external_exports.boolean().optional()
     }).passthrough();
+    PRODUCTION_DIRECT_FIELDS = ["username", "api_key", "access_token", "password", "refresh_token", "webhook_secret_token"];
     setProductionCredentialBody = external_exports.object({
       hub_id: uuidSchema,
+      organization_credential_id: external_exports.string().nullable().optional(),
+      organization_credential_token_id: external_exports.string().nullable().optional(),
       username: external_exports.string().optional(),
       api_key: external_exports.string().optional(),
       access_token: external_exports.string().optional(),
       password: external_exports.string().optional(),
       refresh_token: external_exports.string().optional(),
       webhook_secret_token: external_exports.string().optional()
-    }).strict();
+    }).strict().superRefine((data, ctx) => {
+      const hasOrgLink = !!data.organization_credential_id || !!data.organization_credential_token_id;
+      const hasDirect = PRODUCTION_DIRECT_FIELDS.some((f) => data[f] != null);
+      if (hasOrgLink && hasDirect) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Provide either an organization credential link or direct credential fields, not both" });
+      }
+      if (!hasOrgLink && !hasDirect) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "A credential is required: link an organization credential or provide a credential field" });
+      }
+    });
     registerWhatsappQuery = external_exports.object({ hub_id: uuidSchema });
     registerWhatsappBody = external_exports.object({
       pin: external_exports.string().optional()
@@ -7906,6 +7954,7 @@ __export(workspace_exports, {
   getChangedHubs: () => getChangedHubs,
   getHubFolderSlug: () => getHubFolderSlug,
   isPreviewHub: () => isPreviewHub,
+  localHubEnvironment: () => localHubEnvironment,
   resolveActiveHubId: () => resolveActiveHubId,
   resolveExplicitHubPath: () => resolveExplicitHubPath,
   resolveHubFolder: () => resolveHubFolder,
@@ -8197,6 +8246,13 @@ function resolveActiveHubId(args2) {
   }
   process.exit(1);
 }
+function localHubEnvironment(hubId) {
+  const workspace = detectWorkspace();
+  const gitRoot = findGitRoot();
+  const workspaceDir = workspace?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
+  if (!workspaceDir || !fs2.existsSync(workspaceDir)) return null;
+  return scanWorkspaceHubs(workspaceDir).find((h) => h.hubId === hubId)?.hubEnvironment ?? null;
+}
 function safeReaddir(dir) {
   try {
     return fs2.readdirSync(dir).filter((entry) => !entry.startsWith("."));
@@ -8504,9 +8560,9 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path24 = getVersionCachePath(filename);
-    if (!existsSync4(path24)) return null;
-    const parsed = JSON.parse(readFileSync5(path24, "utf-8"));
+    const path25 = getVersionCachePath(filename);
+    if (!existsSync4(path25)) return null;
+    const parsed = JSON.parse(readFileSync5(path25, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -8526,10 +8582,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path24 = getVersionCachePath(filename);
-  const dir = dirname3(path24);
+  const path25 = getVersionCachePath(filename);
+  const dir = dirname3(path25);
   if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(path24, JSON.stringify(cache));
+  writeFileSync2(path25, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -8568,14 +8624,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path24 = join7(projectRoot, rel);
-    if (!existsSync5(path24)) continue;
+    const path25 = join7(projectRoot, rel);
+    if (!existsSync5(path25)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path24, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path25, "utf-8"));
     } catch {
     }
-    found.push({ path: path24, version });
+    found.push({ path: path25, version });
   }
   return found;
 }
@@ -11545,12 +11601,12 @@ function typeMatches2(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema2(schema, path24, errors, opts = {}) {
+function validateSchema2(schema, path25, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH2) {
     errors.push({
-      path: path24 || "<root>",
+      path: path25 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH2} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -11558,7 +11614,7 @@ function validateSchema2(schema, path24, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path24,
+      path: path25,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -11566,14 +11622,14 @@ function validateSchema2(schema, path24, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path24 ? `${path24}.type` : "type",
+        path: path25 ? `${path25}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches2(schema.type, ALLOWED_TYPES2)) {
     errors.push({
-      path: `${path24}.type`,
+      path: `${path25}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES2].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -11582,25 +11638,25 @@ function validateSchema2(schema, path24, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS2.includes(e);
       errors.push({
-        path: `${path24}.enum`,
+        path: `${path25}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path24}.enum`,
+        path: `${path25}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path24}.enum`,
+        path: `${path25}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive2(e[i])) {
           errors.push({
-            path: `${path24}.enum[${i}]`,
+            path: `${path25}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -11610,7 +11666,7 @@ function validateSchema2(schema, path24, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path24}.${key}`,
+        path: `${path25}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -11619,45 +11675,45 @@ function validateSchema2(schema, path24, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path24}.properties`,
+        path: `${path25}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema2(propSchema, `${path24}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema2(propSchema, `${path25}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes2(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema2(sub, `${path24}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema2(sub, `${path25}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema2(schema.items, `${path24}.items`, errors, { depth: depth + 1 });
+      validateSchema2(schema.items, `${path25}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS2) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema2(schema[key], `${path24}.${key}`, errors, { depth: depth + 1 });
+      validateSchema2(schema[key], `${path25}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS2) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema2(sub, `${path24}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema2(sub, `${path25}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS2) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema2(sub, `${path24}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema2(sub, `${path25}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path24}.${k}`;
+    const fieldPath = `${path25}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS2) {
       if (v === token) {
@@ -11813,10 +11869,10 @@ function refineHubAsCodeLanes2(config, ctx) {
     }
   }
 }
-function isSafeTemplatePath2(path24) {
-  if (path24.length === 0 || path24.length > 300) return false;
-  if (path24.startsWith("/") || path24.includes("\\")) return false;
-  const segments = path24.split("/");
+function isSafeTemplatePath2(path25) {
+  if (path25.length === 0 || path25.length > 300) return false;
+  if (path25.startsWith("/") || path25.includes("\\")) return false;
+  const segments = path25.split("/");
   return segments.every(
     (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
   );
@@ -11844,14 +11900,14 @@ function isPlainObject(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 }
-function isSanitizableSliceFile(path24) {
-  if (!/\.ya?ml$/i.test(path24)) return false;
-  return path24 !== "resources" && !path24.startsWith("resources/");
+function isSanitizableSliceFile(path25) {
+  if (!/\.ya?ml$/i.test(path25)) return false;
+  return path25 !== "resources" && !path25.startsWith("resources/");
 }
 function distinctUsesBackends(uses) {
   return [...new Set((uses ?? []).map((u) => u.backend))];
 }
-var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, completionsBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
+var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, completionsBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -12358,15 +12414,27 @@ var init_contracts = __esm({
       hub_id: uuidSchema2,
       sync_credentials_to_production: external_exports.boolean().optional()
     }).passthrough();
+    PRODUCTION_DIRECT_FIELDS2 = ["username", "api_key", "access_token", "password", "refresh_token", "webhook_secret_token"];
     setProductionCredentialBody2 = external_exports.object({
       hub_id: uuidSchema2,
+      organization_credential_id: external_exports.string().nullable().optional(),
+      organization_credential_token_id: external_exports.string().nullable().optional(),
       username: external_exports.string().optional(),
       api_key: external_exports.string().optional(),
       access_token: external_exports.string().optional(),
       password: external_exports.string().optional(),
       refresh_token: external_exports.string().optional(),
       webhook_secret_token: external_exports.string().optional()
-    }).strict();
+    }).strict().superRefine((data, ctx) => {
+      const hasOrgLink = !!data.organization_credential_id || !!data.organization_credential_token_id;
+      const hasDirect = PRODUCTION_DIRECT_FIELDS2.some((f) => data[f] != null);
+      if (hasOrgLink && hasDirect) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Provide either an organization credential link or direct credential fields, not both" });
+      }
+      if (!hasOrgLink && !hasDirect) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "A credential is required: link an organization credential or provide a credential field" });
+      }
+    });
     registerWhatsappQuery2 = external_exports.object({ hub_id: uuidSchema2 });
     registerWhatsappBody2 = external_exports.object({
       pin: external_exports.string().optional()
@@ -14523,12 +14591,153 @@ var init_relabel = __esm({
   }
 });
 
+// src/commands/publish.ts
+var publish_exports = {};
+__export(publish_exports, {
+  parseArgs: () => parseArgs9,
+  publishCommand: () => publishCommand,
+  renderHubDiff: () => renderHubDiff,
+  runPublish: () => runPublish
+});
+import * as path17 from "path";
+function parseArgs9(args2) {
+  let autoConfirm = false;
+  let hubSelector;
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--yes" || arg === "-y") {
+      autoConfirm = true;
+    } else if (arg === "--hub" && args2[i + 1]) {
+      hubSelector = args2[++i];
+    }
+  }
+  return { autoConfirm, hubSelector };
+}
+function renderSection(title, entries) {
+  if (entries.length === 0) return;
+  console.log(`
+\x1B[1m${title}\x1B[0m`);
+  for (const e of entries) {
+    const { sym, color } = STATUS_STYLE[e.status];
+    const type = e.type ? ` (${e.type})` : "";
+    console.log(`\x1B[${color}m${sym} ${e.name}${type}\x1B[0m`);
+  }
+}
+function renderHubDiff(result) {
+  if (result.hub_changed) {
+    const { sym, color } = STATUS_STYLE[result.is_first_publish ? "added" : "updated"];
+    console.log("\n\x1B[1mHub\x1B[0m");
+    console.log(`\x1B[${color}m${sym} hub settings\x1B[0m`);
+  }
+  renderSection("Agents", result.agents);
+  renderSection("Connections", result.connections);
+  renderSection("Tools", result.tools);
+  renderSection("Channels", result.channels);
+  renderSection("States", result.states);
+  renderSection("Resources", result.resources);
+  console.log();
+}
+async function runPublish(client, opts) {
+  const { hubId, localConfig, organizationId, autoConfirm } = opts;
+  const confirmFn = opts.confirmFn ?? confirm;
+  if (localConfig) {
+    const pushDiff = await client.diff(hubId, localConfig, "push", organizationId);
+    if (pushDiff.has_changes) {
+      console.log("\n\x1B[33mYou have local changes not yet pushed to this preview.\x1B[0m");
+      console.log("Publishing promotes the PREVIEW (server) state \u2014 these local edits are NOT included.");
+      console.log("Run `wayai push` first if you want them in production.");
+      if (!autoConfirm) {
+        const ok = await confirmFn("Continue with the current preview state anyway?");
+        if (!ok) {
+          console.log("Cancelled.");
+          return "cancelled";
+        }
+      }
+    }
+  }
+  const { data: diff } = await client.getHubDiff(hubId);
+  if (!diff.has_changes && !diff.is_first_publish) {
+    console.log("Production is already up to date. Nothing to sync.");
+    return "up-to-date";
+  }
+  console.log(
+    diff.is_first_publish ? "\nPublish preview \u2192 new production hub:" : "\nSync preview \u2192 production:"
+  );
+  renderHubDiff(diff);
+  if (!autoConfirm) {
+    const ok = await confirmFn(
+      diff.is_first_publish ? "Publish to production?" : "Sync these changes to production?"
+    );
+    if (!ok) {
+      console.log("Cancelled.");
+      return "cancelled";
+    }
+  }
+  if (diff.is_first_publish) {
+    console.log("Publishing...");
+    const { data } = await client.publishHub(hubId);
+    console.log(`
+Published. Production hub: ${data.production_hub_id}`);
+    return "published";
+  }
+  console.log("Syncing...");
+  await client.syncHub(hubId);
+  console.log("\nSynced preview changes to production.");
+  return "synced";
+}
+async function publishCommand(args2) {
+  const { autoConfirm, hubSelector } = parseArgs9(args2);
+  const repoConfig = requireRepoConfig();
+  const { organization_id: organizationId } = repoConfig;
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  const workspaceDir = resolveWorkspaceDir();
+  const gitRoot = findGitRoot();
+  if (gitRoot) warnLayoutOnce(gitRoot);
+  const { hubId, hubFolder } = resolveHubTarget(workspaceDir, hubSelector);
+  let localConfig = null;
+  if (hubFolder) {
+    localConfig = parseHubFolder(hubFolder);
+    if (localConfig.hub_environment === "production") {
+      console.log(
+        "This is a read-only production mirror \u2014 production hubs cannot be published. Publish the linked preview hub instead."
+      );
+      return;
+    }
+  }
+  assertHubMatchesBinding(hubId, hubFolder ? path17.basename(hubFolder) : void 0);
+  await runPublish(client, { hubId, localConfig, organizationId, autoConfirm });
+}
+var STATUS_STYLE;
+var init_publish = __esm({
+  "src/commands/publish.ts"() {
+    "use strict";
+    init_auth();
+    init_api_client();
+    init_parser();
+    init_pull();
+    init_utils();
+    init_workspace();
+    init_layout();
+    init_repo_config();
+    init_hub_binding();
+    STATUS_STYLE = {
+      added: { sym: "+", color: 32 },
+      // green
+      removed: { sym: "-", color: 31 },
+      // red
+      updated: { sym: "~", color: 33 }
+      // yellow
+    };
+  }
+});
+
 // src/commands/use.ts
 var use_exports = {};
 __export(use_exports, {
   useCommand: () => useCommand
 });
-import * as path17 from "path";
+import * as path18 from "path";
 async function useCommand(args2) {
   const target = args2[0];
   if (!target || target.startsWith("-")) {
@@ -14551,7 +14760,7 @@ async function useCommand(args2) {
     if (!match) {
       console.error(`No hub matching "${target}" found in ${wsLabel}/. Pass a UUID or a folder name from:`);
       for (const h of scanWorkspaceHubs(workspaceDir)) {
-        console.error(`  ${path17.basename(h.hubFolder)} (${h.hubId})`);
+        console.error(`  ${path18.basename(h.hubFolder)} (${h.hubId})`);
       }
       process.exit(1);
     }
@@ -14591,10 +14800,10 @@ __export(migrate_exports, {
 });
 import { execFileSync as execFileSync3 } from "child_process";
 import * as fs14 from "fs";
-import * as path18 from "path";
+import * as path19 from "path";
 function isTracked(gitRoot, p) {
   try {
-    execFileSync3("git", ["ls-files", "--error-unmatch", "--", path18.relative(gitRoot, p)], {
+    execFileSync3("git", ["ls-files", "--error-unmatch", "--", path19.relative(gitRoot, p)], {
       cwd: gitRoot,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -14604,10 +14813,10 @@ function isTracked(gitRoot, p) {
   }
 }
 function moveDir(gitRoot, from, to) {
-  fs14.mkdirSync(path18.dirname(to), { recursive: true });
+  fs14.mkdirSync(path19.dirname(to), { recursive: true });
   if (isTracked(gitRoot, from)) {
     try {
-      execFileSync3("git", ["mv", path18.relative(gitRoot, from), path18.relative(gitRoot, to)], {
+      execFileSync3("git", ["mv", path19.relative(gitRoot, from), path19.relative(gitRoot, to)], {
         cwd: gitRoot,
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -14624,12 +14833,12 @@ async function migrateCommand(_args) {
     console.error("Not inside a git repository.");
     process.exit(1);
   }
-  const rel = (p) => path18.relative(gitRoot, p);
-  const newWs = path18.join(gitRoot, WAYAI_LAYOUT.wsDir);
-  const legacyWs = path18.join(gitRoot, WAYAI_LAYOUT.legacy.wsDir);
-  const legacyOrg = path18.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
-  const newHubs = path18.join(newWs, WAYAI_LAYOUT.hubsSubdir);
-  const newOrg = path18.join(newWs, WAYAI_LAYOUT.orgSubdir);
+  const rel = (p) => path19.relative(gitRoot, p);
+  const newWs = path19.join(gitRoot, WAYAI_LAYOUT.wsDir);
+  const legacyWs = path19.join(gitRoot, WAYAI_LAYOUT.legacy.wsDir);
+  const legacyOrg = path19.join(gitRoot, WAYAI_LAYOUT.legacy.orgAtRoot);
+  const newHubs = path19.join(newWs, WAYAI_LAYOUT.hubsSubdir);
+  const newOrg = path19.join(newWs, WAYAI_LAYOUT.orgSubdir);
   const hasLegacyWs = isDirectory(legacyWs);
   const hasLegacyOrg = isDirectory(legacyOrg);
   if (!hasLegacyWs && !hasLegacyOrg) {
@@ -15263,10 +15472,10 @@ var init_delete_history = __esm({
 // src/commands/sync-skills.ts
 var sync_skills_exports = {};
 __export(sync_skills_exports, {
-  parseArgs: () => parseArgs9,
+  parseArgs: () => parseArgs10,
   syncSkillsCommand: () => syncSkillsCommand
 });
-function parseArgs9(args2) {
+function parseArgs10(args2) {
   let connectionId;
   const idx = args2.indexOf("--connection-id");
   if (idx !== -1 && args2[idx + 1]) {
@@ -15289,7 +15498,7 @@ function printSyncResults(response) {
 }
 async function syncSkillsCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const { connectionId } = parseArgs9(args2);
+  const { connectionId } = parseArgs10(args2);
   requireRepoConfig();
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -15314,10 +15523,10 @@ var init_sync_skills = __esm({
 // src/commands/sync-mcp.ts
 var sync_mcp_exports = {};
 __export(sync_mcp_exports, {
-  parseArgs: () => parseArgs10,
+  parseArgs: () => parseArgs11,
   syncMcpCommand: () => syncMcpCommand
 });
-function parseArgs10(args2) {
+function parseArgs11(args2) {
   let connection;
   for (let i = 0; i < args2.length; i++) {
     const arg = args2[i];
@@ -15329,7 +15538,7 @@ function parseArgs10(args2) {
 }
 async function syncMcpCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const { connection } = parseArgs10(args2);
+  const { connection } = parseArgs11(args2);
   if (!connection) {
     console.error("Usage: wayai sync-mcp --connection <name> [--hub <uuid|folder-name>]");
     console.error("");
@@ -15938,14 +16147,14 @@ __export(eval_capture_exports, {
   evalCaptureCommand: () => evalCaptureCommand
 });
 import * as fs15 from "fs";
-import * as path19 from "path";
+import * as path20 from "path";
 import * as yaml7 from "js-yaml";
 function isValidSetName(name) {
   if (name.length === 0 || name === "." || name === "..") return false;
   if (name.startsWith(".")) return false;
   return !/[\/\\\0]/.test(name);
 }
-function parseArgs11(args2) {
+function parseArgs12(args2) {
   if (args2.length === 0 || args2[0].startsWith("-")) {
     console.error("Usage: wayai eval capture <conversation_id> [--set <name>] [--name <eval_name>] [--instructions <text>]");
     process.exit(1);
@@ -15991,7 +16200,7 @@ function parseArgs11(args2) {
 }
 async function evalCaptureCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const parsed = parseArgs11(args2);
+  const parsed = parseArgs12(args2);
   const { config, accessToken } = await requireAuth();
   requireRepoConfig();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -16004,15 +16213,15 @@ async function evalCaptureCommand(args2) {
   const setFolderName = targetSetName;
   const scenarioName = parsed.evalName ?? `Capture ${parsed.conversationId.slice(0, 8)}`;
   const slug = slugify(scenarioName);
-  const evalsDir = path19.join(hubFolder, "evals");
-  const targetDir = path19.join(evalsDir, setFolderName);
-  const targetPath = path19.join(targetDir, `${slug}.yaml`);
-  if (!targetPath.startsWith(evalsDir + path19.sep)) {
-    console.error(`Resolved path "${path19.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
+  const evalsDir = path20.join(hubFolder, "evals");
+  const targetDir = path20.join(evalsDir, setFolderName);
+  const targetPath = path20.join(targetDir, `${slug}.yaml`);
+  if (!targetPath.startsWith(evalsDir + path20.sep)) {
+    console.error(`Resolved path "${path20.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
     process.exit(1);
   }
   if (fs15.existsSync(targetPath)) {
-    console.error(`File already exists: ${path19.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
+    console.error(`File already exists: ${path20.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
     process.exit(1);
   }
   console.log("Resolving scenario set...");
@@ -16046,7 +16255,7 @@ async function evalCaptureCommand(args2) {
   const yamlObj = buildEvalYamlObject(evalEntry, slug);
   fs15.mkdirSync(targetDir, { recursive: true });
   fs15.writeFileSync(targetPath, yaml7.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
-  const relPath = path19.relative(process.cwd(), targetPath);
+  const relPath = path20.relative(process.cwd(), targetPath);
   console.log(`
 Wrote ${relPath}`);
   console.log("Run `wayai pull` to refresh the agent display name, then commit. The scenario is already on the platform.");
@@ -16068,7 +16277,7 @@ var journey_capture_exports = {};
 __export(journey_capture_exports, {
   journeyCaptureCommand: () => journeyCaptureCommand
 });
-function parseArgs12(args2) {
+function parseArgs13(args2) {
   if (args2.length === 0 || args2[0].startsWith("-")) {
     console.error("Usage: wayai eval journey capture <conversation_id> [--name <journey_name>] [--instructions <text>]");
     process.exit(1);
@@ -16103,7 +16312,7 @@ function parseArgs12(args2) {
 }
 async function journeyCaptureCommand(args2) {
   const hubId = resolveActiveHubId(args2);
-  const parsed = parseArgs12(args2);
+  const parsed = parseArgs13(args2);
   const { config, accessToken } = await requireAuth();
   requireRepoConfig();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
@@ -16900,9 +17109,9 @@ var init_credential_utils = __esm({
 var create_credential_exports = {};
 __export(create_credential_exports, {
   createCredentialCommand: () => createCredentialCommand,
-  parseArgs: () => parseArgs13
+  parseArgs: () => parseArgs14
 });
-function parseArgs13(args2) {
+function parseArgs14(args2) {
   let name;
   let type;
   let orgId;
@@ -16930,7 +17139,7 @@ function parseArgs13(args2) {
   return { name, type, orgId, description, tags: splitTagRefs(tags), environment, stdin };
 }
 async function createCredentialCommand(args2) {
-  const parsed = parseArgs13(args2);
+  const parsed = parseArgs14(args2);
   if (!parsed.name) {
     console.error("Missing required flag: --name <credential-name>");
     console.error('Usage: wayai create-credential --name "openai-key" --type "Bearer Token"');
@@ -17037,10 +17246,10 @@ var init_create_credential = __esm({
 // src/commands/update-credential.ts
 var update_credential_exports = {};
 __export(update_credential_exports, {
-  parseArgs: () => parseArgs14,
+  parseArgs: () => parseArgs15,
   updateCredentialCommand: () => updateCredentialCommand
 });
-function parseArgs14(args2) {
+function parseArgs15(args2) {
   let name;
   let rename;
   let orgId;
@@ -17073,7 +17282,7 @@ function parseArgs14(args2) {
   return { name, rename, orgId, description, tags: splitTagRefs(tags), hasTagFlag, environment, stdin, secretPrompt };
 }
 async function updateCredentialCommand(args2) {
-  const parsed = parseArgs14(args2);
+  const parsed = parseArgs15(args2);
   if (!parsed.name) {
     console.error("Missing required flag: --name <credential-name>");
     console.error('Usage: wayai update-credential --name "my-key" --stdin');
@@ -17175,24 +17384,121 @@ var init_update_credential = __esm({
   }
 });
 
+// src/commands/set-connection-credential.ts
+var set_connection_credential_exports = {};
+__export(set_connection_credential_exports, {
+  parseArgs: () => parseArgs16,
+  setConnectionCredentialCommand: () => setConnectionCredentialCommand
+});
+function parseArgs16(args2) {
+  let connection;
+  let orgCredential;
+  let field;
+  let stdin = false;
+  for (let i = 0; i < args2.length; i++) {
+    if (args2[i] === "--connection" && args2[i + 1]) connection = args2[++i];
+    else if (args2[i] === "--org-credential" && args2[i + 1]) orgCredential = args2[++i];
+    else if (args2[i] === "--field" && args2[i + 1]) field = args2[++i];
+    else if (args2[i] === "--stdin") stdin = true;
+  }
+  return { connection, orgCredential, field, stdin };
+}
+function usage(msg) {
+  if (msg) console.error(`${msg}
+`);
+  console.error("Usage: wayai set-connection-credential --hub <id|name> --connection <name|id> ( --org-credential <name> | --field <field> --stdin )");
+  console.error(`  --org-credential <name>   link an organization credential by display name`);
+  console.error(`  --field <field> --stdin   set a raw secret from stdin (field: ${VALID_FIELDS.join(", ")})`);
+  process.exit(1);
+}
+async function setConnectionCredentialCommand(args2) {
+  const hubId = resolveActiveHubId(args2);
+  const parsed = parseArgs16(args2);
+  if (!parsed.connection) usage("Missing required flag: --connection <name|id>");
+  const orgMode = !!parsed.orgCredential;
+  const directMode = !!parsed.field;
+  if (orgMode === directMode) {
+    usage("Provide exactly one of --org-credential or --field.");
+  }
+  if (directMode && !VALID_FIELDS.includes(parsed.field)) {
+    usage(`Invalid --field "${parsed.field}". Valid fields: ${VALID_FIELDS.join(", ")}`);
+  }
+  if (directMode && !parsed.stdin) {
+    usage("--field requires --stdin (the secret is read from stdin, never an argument).");
+  }
+  const { organization_id: organizationId } = requireRepoConfig();
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let environment = localHubEnvironment(hubId);
+  if (!environment) {
+    const { hubs } = await client.listHubs(organizationId);
+    if (hubs.some((h) => h.hub_id === hubId)) environment = "preview";
+    else if (hubs.some((h) => h.production_hub_id === hubId)) environment = "production";
+  }
+  if (!environment) {
+    usage(`Could not resolve hub "${hubId}". Pull it first (\`wayai pull --hub ${hubId}\`) or check the id.`);
+  }
+  const isProduction = environment === "production";
+  const { connections } = await client.listConnections(hubId);
+  const conn = connections.find(
+    (c) => c.connection_id === parsed.connection || c.connection_display_name === parsed.connection
+  );
+  if (!conn || !conn.connection_id) usage(`Connection "${parsed.connection}" not found on hub ${hubId}.`);
+  const connectionId = conn.connection_id;
+  const body = { hub_id: hubId };
+  if (orgMode) {
+    const { data: creds } = await client.listOrgCredentials(organizationId);
+    const cred = creds.find((c) => c.credential_display_name === parsed.orgCredential);
+    if (!cred) usage(`Organization credential "${parsed.orgCredential}" not found.`);
+    body.organization_credential_id = cred.organization_credential_id;
+  } else {
+    if (process.stdin.isTTY) {
+      usage('--field requires the secret on stdin. Example: echo "$SECRET" | wayai set-connection-credential ... --field api_key --stdin');
+    }
+    const secret = (await readStdin())?.trim();
+    if (!secret) usage("No secret received from stdin.");
+    body[parsed.field] = secret;
+  }
+  const target = isProduction ? "production" : "preview";
+  console.log(`Setting ${orgMode ? `org credential "${parsed.orgCredential}"` : `${parsed.field}`} on ${target} connection "${conn.connection_display_name}"...`);
+  if (isProduction) {
+    await client.setProductionConnectionCredential(connectionId, body);
+  } else {
+    await client.setPreviewConnectionCredential(connectionId, body);
+  }
+  console.log("Credential set.");
+}
+var VALID_FIELDS;
+var init_set_connection_credential = __esm({
+  "src/commands/set-connection-credential.ts"() {
+    "use strict";
+    init_auth();
+    init_api_client();
+    init_repo_config();
+    init_workspace();
+    init_utils();
+    VALID_FIELDS = ["api_key", "access_token", "password", "refresh_token", "webhook_secret_token", "username"];
+  }
+});
+
 // src/lib/org-workspace.ts
 import * as fs16 from "fs";
-import * as path20 from "path";
+import * as path21 from "path";
 import * as yaml8 from "js-yaml";
 function getOrgDir(gitRoot) {
   return resolveLayout(gitRoot).orgDir;
 }
 function orgManifestExists(orgDir) {
-  return fs16.existsSync(path20.join(orgDir, ORG_MANIFEST_NAME));
+  return fs16.existsSync(path21.join(orgDir, ORG_MANIFEST_NAME));
 }
 function parseOrgResources(orgDir) {
-  const manifestPath = path20.join(orgDir, ORG_MANIFEST_NAME);
+  const manifestPath = path21.join(orgDir, ORG_MANIFEST_NAME);
   let manifest = {};
   if (fs16.existsSync(manifestPath)) {
     manifest = yaml8.load(fs16.readFileSync(manifestPath, "utf-8")) ?? {};
   }
   const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
-  const resourcesDir = path20.join(orgDir, "resources");
+  const resourcesDir = path21.join(orgDir, "resources");
   const resources = rawResources.map((res) => {
     const resource = { name: res.name };
     if (res.id) resource.id = res.id;
@@ -17204,7 +17510,7 @@ function parseOrgResources(orgDir) {
     if (res.environment) resource.environment = res.environment;
     if (Array.isArray(res.tags)) resource.tags = res.tags;
     if (Array.isArray(res.folders)) resource.folders = res.folders;
-    const resDir = path20.join(resourcesDir, slugify(resource.name));
+    const resDir = path21.join(resourcesDir, slugify(resource.name));
     if (fs16.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) resource.files = files;
@@ -17221,21 +17527,21 @@ function writeOrgResources(orgDir, payload) {
     return rest;
   });
   fs16.writeFileSync(
-    path20.join(orgDir, ORG_MANIFEST_NAME),
+    path21.join(orgDir, ORG_MANIFEST_NAME),
     yaml8.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
     "utf-8"
   );
-  const resourcesDir = path20.join(orgDir, "resources");
+  const resourcesDir = path21.join(orgDir, "resources");
   const currentSlugs = /* @__PURE__ */ new Set();
   for (const resource of resources) {
     const resSlug = slugify(resource.name);
     currentSlugs.add(resSlug);
-    writeResourceFileTree(path20.join(resourcesDir, resSlug), resource.files || []);
+    writeResourceFileTree(path21.join(resourcesDir, resSlug), resource.files || []);
   }
   if (fs16.existsSync(resourcesDir)) {
     for (const entry of fs16.readdirSync(resourcesDir, { withFileTypes: true })) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
-        fs16.rmSync(path20.join(resourcesDir, entry.name), { recursive: true, force: true });
+        fs16.rmSync(path21.join(resourcesDir, entry.name), { recursive: true, force: true });
       }
     }
   }
@@ -17244,7 +17550,7 @@ async function downloadOrgBinaryFiles(orgDir, payload) {
   let count = 0;
   for (const resource of payload.resources ?? []) {
     if (!resource.files) continue;
-    const resDir = path20.join(orgDir, "resources", slugify(resource.name));
+    const resDir = path21.join(orgDir, "resources", slugify(resource.name));
     count += await downloadBinaryFiles(resDir, resource.files);
   }
   if (count > 0) console.log(`Downloaded ${count} binary resource file(s).`);
@@ -17432,9 +17738,9 @@ var init_org = __esm({
 var list_exports = {};
 __export(list_exports, {
   listCommand: () => listCommand,
-  parseArgs: () => parseArgs15
+  parseArgs: () => parseArgs17
 });
-function parseArgs15(args2) {
+function parseArgs17(args2) {
   let orgId;
   let json = false;
   for (let i = 0; i < args2.length; i++) {
@@ -17447,7 +17753,7 @@ function parseArgs15(args2) {
   return { orgId, json };
 }
 async function listCommand(args2) {
-  const { orgId, json } = parseArgs15(args2);
+  const { orgId, json } = parseArgs17(args2);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   const { organizations } = await client.organizations();
@@ -17501,13 +17807,13 @@ var init_list = __esm({
 
 // src/lib/template-files.ts
 import * as fs17 from "fs";
-import * as path21 from "path";
+import * as path22 from "path";
 function readDirToFileMap(rootDir) {
   const out = {};
   function walk(dir, prefix) {
     const entries = fs17.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const abs = path21.join(dir, entry.name);
+      const abs = path22.join(dir, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) walk(abs, rel);
       else if (entry.isFile()) out[rel] = fs17.readFileSync(abs, "utf-8");
@@ -17522,7 +17828,7 @@ function detectCollisions(targetDir, files) {
     if (!isSafeTemplatePath2(rel)) {
       throw new Error(`Refusing to inspect unsafe template path: ${rel}`);
     }
-    if (fs17.existsSync(path21.join(targetDir, rel))) collisions.push(rel);
+    if (fs17.existsSync(path22.join(targetDir, rel))) collisions.push(rel);
   }
   return collisions.sort((a, b) => a.localeCompare(b));
 }
@@ -17532,8 +17838,8 @@ function writeFileMap(targetDir, files) {
     if (!isSafeTemplatePath2(rel)) {
       throw new Error(`Refusing to write unsafe template path: ${rel}`);
     }
-    const abs = path21.join(targetDir, rel);
-    fs17.mkdirSync(path21.dirname(abs), { recursive: true });
+    const abs = path22.join(targetDir, rel);
+    fs17.mkdirSync(path22.dirname(abs), { recursive: true });
     fs17.writeFileSync(abs, body, "utf-8");
     written.push(rel);
   }
@@ -17544,7 +17850,7 @@ function listDirRelFiles(dir) {
   function walk(d, prefix) {
     for (const entry of fs17.readdirSync(d, { withFileTypes: true })) {
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-      if (entry.isDirectory()) walk(path21.join(d, entry.name), rel);
+      if (entry.isDirectory()) walk(path22.join(d, entry.name), rel);
       else if (entry.isFile()) out.push(rel);
     }
   }
@@ -17571,7 +17877,7 @@ var templates_exports = {};
 __export(templates_exports, {
   templateCommand: () => templateCommand
 });
-import * as path22 from "path";
+import * as path23 from "path";
 async function templateCommand(args2) {
   const [sub, ...rest] = args2;
   switch (sub) {
@@ -17687,8 +17993,8 @@ async function runTemplatePull(rest) {
     console.log(`Template "${slug}" has no WayAI slice${hint}`);
     return;
   }
-  const targetDir = path22.join(resolveLayout(gitRoot).hubsDir, slug);
-  const relTarget = path22.relative(gitRoot, targetDir);
+  const targetDir = path23.join(resolveLayout(gitRoot).hubsDir, slug);
+  const relTarget = path23.relative(gitRoot, targetDir);
   const collisions = detectCollisions(targetDir, detail.files);
   if (dryRun) {
     const planned = Object.keys(detail.files).sort((a, b) => a.localeCompare(b));
@@ -17863,7 +18169,7 @@ __export(admin_exports, {
   adminCommand: () => adminCommand
 });
 import * as fs18 from "fs";
-import * as path23 from "path";
+import * as path24 from "path";
 import * as yaml10 from "js-yaml";
 async function adminCommand(args2) {
   const [group, ...afterGroup] = args2;
@@ -18242,10 +18548,10 @@ function loadTemplateManifest(slug) {
     console.error("Not in a git repository. Run from the tutorials/ authoring repo.");
     process.exit(1);
   }
-  const templateDir = path23.join(resolveTemplatesDir(gitRoot), slug);
-  const manifestPath = path23.join(templateDir, "template.yaml");
+  const templateDir = path24.join(resolveTemplatesDir(gitRoot), slug);
+  const manifestPath = path24.join(templateDir, "template.yaml");
   if (!fs18.existsSync(manifestPath)) {
-    console.error(`template.yaml not found at ${path23.relative(gitRoot, manifestPath)}`);
+    console.error(`template.yaml not found at ${path24.relative(gitRoot, manifestPath)}`);
     process.exit(1);
   }
   let manifest;
@@ -18280,19 +18586,19 @@ async function runTemplatePush(positional) {
     const wayaiEntry = manifest.wayai.locales[locale];
     let wayaiFiles;
     if (wayaiEntry) {
-      const sliceDir = path23.resolve(templateDir, wayaiEntry.source);
+      const sliceDir = path24.resolve(templateDir, wayaiEntry.source);
       if (!fs18.existsSync(sliceDir)) {
         console.error(`wayai source not found for ${locale}: ${wayaiEntry.source} (resolved ${sliceDir})`);
         process.exit(1);
       }
       if (!isInsideTemplateDir(sliceDir, templateDir)) {
         console.warn(
-          `Note: ${locale} source points at a live hub (${wayaiEntry.source}); it can go stale on a hub recreate. Run \`wayai admin template freeze ${slug} --locale ${locale} --from ${path23.basename(sliceDir)}\` to commit a stable frozen slice.`
+          `Note: ${locale} source points at a live hub (${wayaiEntry.source}); it can go stale on a hub recreate. Run \`wayai admin template freeze ${slug} --locale ${locale} --from ${path24.basename(sliceDir)}\` to commit a stable frozen slice.`
         );
       }
       wayaiFiles = readDirToFileMap(sliceDir);
     }
-    const readmePath = path23.join(templateDir, `README.${locale}.md`);
+    const readmePath = path24.join(templateDir, `README.${locale}.md`);
     const readmeMarkdown = fs18.existsSync(readmePath) ? fs18.readFileSync(readmePath, "utf-8") : "";
     locales[locale] = {
       readmeMarkdown,
@@ -18304,9 +18610,9 @@ async function runTemplatePush(positional) {
   }
   let hero;
   if (manifest.hero) {
-    const heroPath = path23.resolve(templateDir, manifest.hero);
+    const heroPath = path24.resolve(templateDir, manifest.hero);
     if (fs18.existsSync(heroPath)) {
-      hero = { filename: path23.basename(heroPath), dataBase64: fs18.readFileSync(heroPath).toString("base64") };
+      hero = { filename: path24.basename(heroPath), dataBase64: fs18.readFileSync(heroPath).toString("base64") };
     } else {
       console.error(`Warning: hero not found at ${manifest.hero}; skipping.`);
     }
@@ -18332,7 +18638,7 @@ async function runTemplatePush(positional) {
   }
 }
 function isInsideTemplateDir(dest, templateDir) {
-  return dest === templateDir || dest.startsWith(templateDir + path23.sep);
+  return dest === templateDir || dest.startsWith(templateDir + path24.sep);
 }
 async function runTemplateFreeze(positional, flagArgs) {
   const slug = positional[0];
@@ -18393,7 +18699,7 @@ async function runTemplateFreeze(positional, flagArgs) {
     process.exit(1);
   }
   const entry = manifest.wayai.locales[targetLocale];
-  const dest = path23.resolve(templateDir, entry.source);
+  const dest = path24.resolve(templateDir, entry.source);
   if (!isInsideTemplateDir(dest, templateDir) || dest === templateDir) {
     console.error(
       `source for "${targetLocale}" must be a committed path inside ${slug}/ (e.g. "./${targetLocale}/slice"), but resolved to:
@@ -18412,7 +18718,7 @@ Set it to a subdir of the template folder and re-run freeze.`
     const hubs = scanWorkspaceHubs(hubsDir);
     if (hubs.length) {
       console.error("Available hubs:");
-      for (const h of hubs) console.error(`  ${path23.basename(h.hubFolder)} (${h.hubId})`);
+      for (const h of hubs) console.error(`  ${path24.basename(h.hubFolder)} (${h.hubId})`);
     }
     console.error(`
 Pass --from <folder|uuid>${selector ? "." : " or run `wayai use <hub>` first."}`);
@@ -18420,12 +18726,12 @@ Pass --from <folder|uuid>${selector ? "." : " or run `wayai use <hub>` first."}`
   }
   const liveFiles = readDirToFileMap(hubFolder);
   if (Object.keys(liveFiles).length === 0) {
-    console.error(`Source hub folder has no files to freeze: ${path23.relative(gitRoot, hubFolder)}`);
+    console.error(`Source hub folder has no files to freeze: ${path24.relative(gitRoot, hubFolder)}`);
     process.exit(1);
   }
   const sanitized = sanitizeWayaiSliceFiles(liveFiles);
-  const relDest = path23.relative(gitRoot, dest);
-  const relSrc = path23.relative(gitRoot, hubFolder);
+  const relDest = path24.relative(gitRoot, dest);
+  const relSrc = path24.relative(gitRoot, hubFolder);
   if (dryRun) {
     const existing = new Set(listDirRelFiles(dest));
     const nextKeys = new Set(Object.keys(sanitized));
@@ -18485,7 +18791,7 @@ async function runTemplatePull2(positional, flagArgs) {
     console.log(JSON.stringify(detail, null, 2));
     return;
   }
-  const target = outDir ? path23.resolve(outDir) : path23.join(process.cwd(), "template-store-pull", slug);
+  const target = outDir ? path24.resolve(outDir) : path24.join(process.cwd(), "template-store-pull", slug);
   const written = writeFileMap(target, detail.files);
   console.log(`Pulled "${slug}" from the store \u2192 ${target} (${written.length} file${written.length === 1 ? "" : "s"}).`);
   const uses = detail.uses ?? [];
@@ -18508,13 +18814,13 @@ async function runSkillInstall(positional) {
     throw err;
   }
   const root = findGitRoot() ?? process.cwd();
-  const present = HARNESS_SKILL_DIRS.filter((dir) => fs18.existsSync(path23.join(root, dir)));
+  const present = HARNESS_SKILL_DIRS.filter((dir) => fs18.existsSync(path24.join(root, dir)));
   const targets = present.length > 0 ? present : HARNESS_SKILL_DIRS;
   const fileCount = Object.keys(res.files).length;
   const relDirs = targets.map((harness) => {
-    const targetDir = path23.join(root, harness, "skills", name);
+    const targetDir = path24.join(root, harness, "skills", name);
     writeFileMap(targetDir, res.files);
-    return `${path23.relative(root, targetDir)}/`;
+    return `${path24.relative(root, targetDir)}/`;
   });
   console.log(`Installed skill "${name}" (${fileCount} file${fileCount === 1 ? "" : "s"}) \u2192 ${relDirs.join(", ")}`);
   console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
@@ -19408,6 +19714,9 @@ function friendlyHint(err) {
     return "Couldn't reach WayAI \u2014 check your network connection and try again.";
   }
   if (!(err instanceof ApiError)) return null;
+  if (err.body.includes("FREE_PLAN_RESTRICTION")) {
+    return "Publishing to production requires a paid plan. Upgrade your organization to publish or sync.";
+  }
   const { status } = err;
   if (status === 401) return "Your session may have expired. Run `wayai login` to re-authenticate.";
   if (status === 402) return "Quota exceeded for your plan. Review usage or upgrade your plan.";
@@ -19644,6 +19953,14 @@ async function main() {
       await relabelCommand2(args);
       break;
     }
+    // `sync` is a bare alias of `publish` (distinct from `sync-skills` / `sync-mcp`,
+    // which are exact-string cases). Both promote preview → production.
+    case "publish":
+    case "sync": {
+      const { publishCommand: publishCommand2 } = await Promise.resolve().then(() => (init_publish(), publish_exports));
+      await publishCommand2(args);
+      break;
+    }
     case "use": {
       const { useCommand: useCommand2 } = await Promise.resolve().then(() => (init_use(), use_exports));
       await useCommand2(args);
@@ -19721,6 +20038,11 @@ async function main() {
       await updateCredentialCommand2(args);
       break;
     }
+    case "set-connection-credential": {
+      const { setConnectionCredentialCommand: setConnectionCredentialCommand2 } = await Promise.resolve().then(() => (init_set_connection_credential(), set_connection_credential_exports));
+      await setConnectionCredentialCommand2(args);
+      break;
+    }
     case "org": {
       const { orgCommand: orgCommand2 } = await Promise.resolve().then(() => (init_org(), org_exports));
       await orgCommand2(args);
@@ -19783,11 +20105,14 @@ Commands:
   init               Set up .wayai.yaml (pick organization)
   create-credential  Create an organization credential (API key, token, etc.)
   update-credential  Update / rotate an organization credential (by name)
+  set-connection-credential  Set a connection's credential directly (org link or --field/--stdin), preview or production
   pull               Fetch hub config and write local files (also mirrors the linked production hub read-only)
   push               Parse local files, show diff, sync to preview (creates hub if new)
   diff               Dry-run diff of local files vs the platform (--production diffs vs the linked production hub)
   replicate          Clone a hub into a new sibling preview (--label to name it)
   relabel            Set a preview hub's label (--clear to remove it)
+  publish            Promote the preview to production (first publish clones it; subsequent runs sync changes)
+  sync               Alias of \`publish\` (not to be confused with sync-skills / sync-mcp)
   org create         Create a new organization (you become its owner)
   org <pull|push|diff>  Sync org-scoped resources as code (wayai-ws/org/)
   use <hub>          Bind this worktree to a specific hub (UUID or folder name)
@@ -19813,7 +20138,7 @@ Commands:
 
 Flags:
   --yes, -y              Skip confirmation prompts (useful for CI and scripting)
-  --hub <uuid|name>      Target hub when the workspace has more than one (push, pull, diff, replicate, relabel)
+  --hub <uuid|name>      Target hub when the workspace has more than one (push, pull, diff, replicate, relabel, publish)
   --production           Diff local preview files against the linked production hub (diff)
   --label <name>         Preview label \u2014 for the new sibling (replicate) or a brand-new hub (push on create)
   --clear                Remove the preview label (relabel)