@wayai/cli 0.3.96 → 0.3.98

package/dist/index.js

@@ -15,21 +15,58 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/lib/redact.ts
-function redactSecrets(text) {
+// src/lib/mask-secrets.ts
+function valueEnd(text, from, isEnd) {
+  for (let i = from; i < text.length; i++) {
+    if (text[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (isEnd(text[i])) return i;
+  }
+  return text.length;
+}
+function maskCredentialValues(text, keyRe, isValueEnd) {
+  keyRe.lastIndex = 0;
+  let out = "";
+  let copied = 0;
+  let match;
+  while ((match = keyRe.exec(text)) !== null) {
+    const valueStart = match.index + match[0].length;
+    keyRe.lastIndex = valueStart;
+    if (!isCredentialKey(match[1])) continue;
+    const end = valueEnd(text, valueStart, isValueEnd);
+    const value = text.slice(valueStart, end);
+    if (value.length === 0 || FULLY_MASKED_VALUE_RE.test(value)) continue;
+    out += text.slice(copied, valueStart) + "[REDACTED]";
+    copied = end;
+    keyRe.lastIndex = end;
+  }
+  return out + text.slice(copied);
+}
+function maskSecretsInMessage(text) {
   let out = text;
-  for (const [pattern, replacement] of PATTERNS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-var PATTERNS;
-var init_redact = __esm({
-  "src/lib/redact.ts"() {
+  for (const [pattern, replacement] of SHAPE_PATTERNS) out = out.replace(pattern, replacement);
+  out = maskCredentialValues(out, JSON_KEY_RE, isJsonValueEnd);
+  out = maskCredentialValues(out, QUERY_KEY_RE, isQueryValueEnd);
+  return out.replace(BASE64_RE, maskBase64);
+}
+var CREDENTIAL_KEY_RE, FULLY_MASKED_VALUE_RE, isCredentialKey, SHAPE_PATTERNS, JSON_KEY_RE, isJsonValueEnd, QUERY_KEY_RE, isQueryValueEnd, BASE64_RE, maskBase64;
+var init_mask_secrets = __esm({
+  "src/lib/mask-secrets.ts"() {
     "use strict";
-    PATTERNS = [
+    CREDENTIAL_KEY_RE = /token|secret|credential|password|passwd|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt/i;
+    FULLY_MASKED_VALUE_RE = /^(?:Bearer\s+)?(?:way_|wst_)?\[REDACTED(?:_JWT|_BASE64)?\]$/;
+    isCredentialKey = (key) => CREDENTIAL_KEY_RE.test(key);
+    SHAPE_PATTERNS = [
       // JWTs (header.payload.signature) — WorkOS access/refresh tokens, OAuth JWTs.
       // Run first so a `Bearer <jwt>` collapses to the JWT placeholder.
+      //
+      // Deliberately NOT anchored with the lookbehind the base64 rule uses. It would
+      // make this linear (this rule is quadratic on a pathological `eyJeyJeyJ…` run),
+      // but it also NARROWS masking: `refresh-<jwt>` and `way_<jwt>` would stop
+      // matching and leak the token whole. Correctness of a redaction rule outranks
+      // its worst case on a body that has to be adversarial to hurt.
       [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[REDACTED_JWT]"],
       // way_ scoped API tokens (keyring/CI credentials). Leading \b avoids
       // over-redacting benign substrings (e.g. `gateway_config`); the charset is
@@ -40,6 +77,42 @@ var init_redact = __esm({
       // Authorization: Bearer <opaque token> (anything not already masked above).
       [/(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, "$1[REDACTED]"]
     ];
+    JSON_KEY_RE = /"([A-Za-z0-9_.-]+)"\s*:\s*"/g;
+    isJsonValueEnd = (char) => char === '"';
+    QUERY_KEY_RE = /(?:^|[?#&;,\s"'])([A-Za-z0-9_.-]+)=/g;
+    isQueryValueEnd = (char) => char === "&" || char === ";" || char === '"' || /\s/.test(char);
+    BASE64_RE = // Padded base64 bodies (wrapped DEKs, HMAC secrets, service-account material)
+    // appearing outside any credential-named key — the shape the rules above miss.
+    //
+    // Base64 has no distinguishing charset: a bare `[A-Za-z0-9+/]{20,}` run also
+    // matches slash-separated paths (`hubs/production/agents/support`), 64-char DO
+    // hex ids, and ordinary long words — all debugging context, not secrets. Three
+    // constraints buy the precision instead:
+    //   1. Terminal `=` padding, which prose and paths don't carry.
+    //   2. Nothing base64-ish after the padding, so `?param=value` (where `=` is a
+    //      separator, not padding) is excluded.
+    //   3. Not sitting immediately after `?` or `&`, where a run followed by `=` is
+    //      a query parameter NAME. Constraints 2 and 3 are separate cases: `=value`
+    //      vs. an empty value (`?someLongParamName=&next=1`), which 2 lets through.
+    //   4. The quad-length check below, for a run reached by neither 2 nor 3
+    //      (`bad xxxxxxxxxxxxxxxxxxxxxx= here`).
+    // Runs last so `Bearer <base64>` still collapses to the Bearer placeholder.
+    //
+    // The trade: unpadded base64 (any input whose byte length is a multiple of 3)
+    // is NOT matched here — no marker distinguishes it from prose. It stays covered
+    // by the credential-key rules above, which is where such a value realistically
+    // reaches this module.
+    //
+    // The leading lookbehind (NOT \b) is what keeps this linear. `/` and `+` are
+    // non-word characters, so \b also fires *inside* a base64 run: on a body like
+    // `aaaa/aaaa/aaaa/…` every slash would start a fresh greedy scan of the rest of
+    // the string, which is quadratic (~5.5s on a 100KB body, vs ~1.3ms now). "No
+    // base64 char precedes this" is both the correct notion of a run's start and
+    // O(1) starts per run — and, unlike the JWT rule above, it narrows nothing:
+    // base64 embedded mid-run isn't decodable base64 anyway.
+    // {22,} + 1-2 pad chars => a 24-char floor, i.e. a 16-byte secret.
+    /(?<![A-Za-z0-9+/])(?<![?&])[A-Za-z0-9+/]{22,}={1,2}(?![A-Za-z0-9+/=])/g;
+    maskBase64 = (match) => match.length % 4 === 0 ? "[REDACTED_BASE64]" : match;
   }
 });
 
@@ -119,17 +192,17 @@ function initSentry(command2, version) {
               }
             }
           }
-          if (value.value) value.value = redactSecrets(value.value);
+          if (value.value) value.value = maskSecretsInMessage(value.value);
         }
       }
       if (event.breadcrumbs) {
         for (const crumb of event.breadcrumbs) {
-          if (crumb.message) crumb.message = redactSecrets(crumb.message);
+          if (crumb.message) crumb.message = maskSecretsInMessage(crumb.message);
         }
       }
       if (event.extra) {
         for (const [key, val] of Object.entries(event.extra)) {
-          if (typeof val === "string") event.extra[key] = redactSecrets(val);
+          if (typeof val === "string") event.extra[key] = maskSecretsInMessage(val);
         }
       }
       return event;
@@ -199,7 +272,7 @@ var HARDCODED_DSN, initialized;
 var init_sentry = __esm({
   "src/lib/sentry.ts"() {
     "use strict";
-    init_redact();
+    init_mask_secrets();
     init_network_error();
     HARDCODED_DSN = "https://ffe500121277babcabf32e5868f00f9e@o4510669417807872.ingest.us.sentry.io/4510960145465344";
     initialized = false;
@@ -225,14 +298,14 @@ var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     "use strict";
     init_sentry();
-    init_redact();
+    init_mask_secrets();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
     delay = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
     ApiError = class extends Error {
       status;
       body;
       constructor(method, path27, status, body) {
-        const safeBody = redactSecrets(body);
+        const safeBody = maskSecretsInMessage(body);
         super(`API request failed: ${method} ${path27} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
@@ -323,6 +396,11 @@ var init_api_client = __esm({
       async adminHarnessMassDestroy(body) {
         return this.request("POST", "/api/admin/harness/mass-destroy", body);
       }
+      // Purge dangling hub_team_id references left by a pre-cascade team deletion.
+      // Used by `wayai admin hubs repair-team-orphans` (platform-admin gated).
+      async adminRepairTeamOrphans(body) {
+        return this.request("POST", "/api/admin/hubs/repair-team-orphans", body);
+      }
       // Read the platform config (platform-admin gated). Used by `wayai admin harness status`.
       async adminGetConfig() {
         return this.request("GET", "/api/admin/config");
@@ -4995,6 +5073,18 @@ function normalizeAuthType(raw) {
   if (VALID_AUTH_TYPES.has(raw)) return raw;
   return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
 }
+function jsonLengthOrNull(value) {
+  try {
+    const json = JSON.stringify(value);
+    return typeof json === "string" ? json.length : null;
+  } catch {
+    return null;
+  }
+}
+function withinJsonLength(value, max) {
+  const length = jsonLengthOrNull(value);
+  return length !== null && length <= max;
+}
 function visibleLength(s) {
   return s.replace(INVISIBLE_NAME_CHARS, "").length;
 }
@@ -5238,6 +5328,45 @@ function refineToolConfig(value, ctx) {
     }
   }
 }
+function describeRole(role) {
+  if (typeof role === "string") {
+    return JSON.stringify(role.length > ROLE_ECHO_MAX ? `${role.slice(0, ROLE_ECHO_MAX)}\u2026` : role);
+  }
+  if (role === null) return "null";
+  if (Array.isArray(role)) return "an array";
+  if (typeof role === "object") return "an object";
+  return `a ${typeof role}`;
+}
+function asEvalInputRecord(input) {
+  const value = typeof input === "string" ? (() => {
+    try {
+      return JSON.parse(input);
+    } catch {
+      return null;
+    }
+  })() : input;
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function evalInputRoleError(input) {
+  const record = asEvalInputRecord(input);
+  if (record === null) return null;
+  const role = record.role;
+  if (role === void 0 || role === null) return null;
+  if (typeof role === "string" && EVAL_INPUT_ROLES.includes(role)) {
+    return null;
+  }
+  return `role must be ${EVAL_INPUT_ROLE_LIST} (received ${describeRole(role)}) \u2014 an eval trigger is what the responder answers, and an assistant or tool role gives it nothing to answer`;
+}
+function refineEvalMessageTextRole(value, ctx) {
+  const error = evalInputRoleError(value.eval.message_text);
+  if (error) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["eval", "message_text", "role"],
+      message: error
+    });
+  }
+}
 function refineHubAsCodeCustomTools(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -5329,6 +5458,22 @@ function refineHubAsCodeLanes(config, ctx) {
     }
   }
 }
+function refineHubAsCodeEvals(config, ctx) {
+  const evals = config.evals;
+  if (!Array.isArray(evals)) return;
+  for (let e = 0; e < evals.length; e++) {
+    const entry = evals[e];
+    const error = evalInputRoleError(entry?.input);
+    if (error) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["evals", e, "input", "role"],
+        // Named, not just indexed — the YAML author has files, not an array.
+        message: `eval "${entry?.name ?? "<unnamed>"}": ${error}`
+      });
+    }
+  }
+}
 function isSafeTemplatePath(path27) {
   if (path27.length === 0 || path27.length > 300) return false;
   if (path27.startsWith("/") || path27.includes("\\")) return false;
@@ -5402,7 +5547,7 @@ function findStepBoundaries(transcript) {
   }
   return out;
 }
-var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminHubIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminSetOrgHarnessBody, adminSetHubHarnessBody, adminHarnessMassDestroyBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
+var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, clientOptionalString, clientOptionalBoolean, appMessageSenderType, appMessageReceiverType, appMessageAttachment, MAX_ATTACHMENTS_PER_MESSAGE, appMessageBody, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminHubIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminSetOrgHarnessBody, adminSetHubHarnessBody, adminScopedTargetBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
@@ -5453,6 +5598,7 @@ var init_dist = __esm({
     init_zod();
     init_zod();
     init_zod();
+    init_zod();
     APP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("wayai.AppError");
     AppError = class extends Error {
       constructor(message, code, statusCode = 500, details) {
@@ -5750,7 +5896,7 @@ var init_dist = __esm({
       eventName: external_exports.string().optional(),
       additional_instructions: external_exports.string().optional(),
       additional_context_schema: external_exports.record(external_exports.unknown()).refine(
-        (s) => JSON.stringify(s).length <= MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES,
+        (s) => withinJsonLength(s, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES),
         `additional_context_schema must be at most ${MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES} bytes when JSON-serialized`
       ).optional(),
       followups: external_exports.array(followupSchema).max(MAX_FOLLOWUPS_PER_STATUS, `followups must have at most ${MAX_FOLLOWUPS_PER_STATUS} entries`).optional(),
@@ -5885,6 +6031,7 @@ var init_dist = __esm({
     hubTeamUserDeleteParam = external_exports.object({ id: uuidSchema, teamUserId: uuidSchema });
     hubSchemaQuery = external_exports.object({ hub_id: uuidSchema });
     PREVIEW_LABEL_MAX_LENGTH = 60;
+    MAX_ENDED_INDEX_RETENTION_DAYS = 730;
     previewLabelField = external_exports.string().max(PREVIEW_LABEL_MAX_LENGTH).optional().nullable().transform((v) => {
       if (v == null) return null;
       const trimmed = v.trim();
@@ -5912,8 +6059,14 @@ var init_dist = __esm({
       // persisted via the agent path (.passthrough() agent body → HubDO column), not here.
       auto_close_inactive_days: external_exports.number().int().min(1).max(180).optional(),
       // Per-hub ConversationDO retention window (days) — keeps an ended conversation's DO
-      // alive for post-hoc annotation. Default 7, max 30 (= ENDED_INDEX_RETENTION_DAYS).
+      // alive for post-hoc annotation. Default 7, max 30 — the floor of the retention
+      // chain (≤ ended_index_retention_days ≤ effective storage retention).
       conversation_retention_days: external_exports.number().int().min(1).max(30).optional(),
+      // Per-hub ended-conversation index retention window (days) — how long the warm
+      // "Ended" tab + chat-hub continuous history serve a closed conversation before
+      // the cleanup cron reaps its index row. Absent → DEFAULT_ENDED_INDEX_RETENTION_DAYS
+      // (365). Re-clamped to the effective storage retention at reap time.
+      ended_index_retention_days: external_exports.number().int().min(1).max(MAX_ENDED_INDEX_RETENTION_DAYS).optional(),
       // Channel contact access control. Enum-validated explicitly (not via passthrough)
       // so `language`/`access_approval_role` can't reach the DB with an invalid value.
       language: external_exports.enum(["en", "pt", "es"]).optional(),
@@ -5969,6 +6122,9 @@ var init_dist = __esm({
     replicatePreviewBody = external_exports.object({
       preview_label: previewLabelField
     });
+    updateChannelTestIdentitiesBody = external_exports.object({
+      test_identities: external_exports.array(external_exports.string().max(320)).max(1e3)
+    });
     claimCodeChannelParam = external_exports.object({
       id: uuidSchema,
       channelId: uuidSchema
@@ -6619,12 +6775,15 @@ var init_dist = __esm({
     hubIdQuery = external_exports.object({
       hub_id: external_exports.string().uuid()
     });
+    EVAL_INPUT_ROLES = ["user", "system"];
+    EVAL_INPUT_ROLE_LIST = EVAL_INPUT_ROLES.map((r) => `"${r}"`).join(" or ");
+    ROLE_ECHO_MAX = 40;
     createEvalBody = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    });
+    }).superRefine(refineEvalMessageTextRole);
     updateEvalBody = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    });
+    }).superRefine(refineEvalMessageTextRole);
     getEvalsQuery = external_exports.object({
       hub_id: external_exports.string().uuid(),
       agent_id: external_exports.string().uuid().optional(),
@@ -6796,18 +6955,21 @@ var init_dist = __esm({
       hub_user_id: external_exports.string().optional(),
       search_filter: external_exports.string().optional(),
       hub_id: external_exports.string().uuid().optional(),
+      // NON-authorizing single-hub narrow. Unlike `hub_id` (which runs the
+      // grant-gated `loadHub('hub:read')` and so throws for grant-less end users /
+      // team members), `scope_hub_id` INTERSECTS the caller's already-resolved hub
+      // roster server-side. Intersecting the caller's own roster IS the
+      // authorization — a hub the caller isn't in narrows to empty and leaks
+      // nothing. Continuous history sends it to take the single-hub ended-index
+      // path (one HubDO read, accurate uncapped total) instead of the all-hub
+      // fan-out it would otherwise discard client-side (gh #3319).
+      scope_hub_id: external_exports.string().uuid().optional(),
       conversation_id: external_exports.string().uuid().optional(),
       // 'ended' = recently-closed, served warm from the HubDO index (≤ retention
       // window). 'archived' = the full closed-conversation history from ClickHouse.
       status: external_exports.enum(["active", "agent", "team", "ended", "archived"]).optional(),
       page: external_exports.string().regex(/^\d+$/).optional(),
-      page_size: external_exports.string().regex(/^\d+$/).optional(),
-      // Cursor for the continuous-history scroll (chat hubs): with status='archived',
-      // return only conversations that ended strictly before this instant. The caller
-      // passes the oldest warm-index `ended_at` so the CH superset excludes the
-      // already-loaded warm slice. UTC ISO-8601 (Timestamps standard) — datetime()
-      // hardens it before it reaches the parameterized CH predicate.
-      before_ended_at: external_exports.string().datetime().optional()
+      page_size: external_exports.string().regex(/^\d+$/).optional()
     });
     getMessagesQuery = external_exports.object({
       hub_id: external_exports.string().uuid(),
@@ -6823,8 +6985,7 @@ var init_dist = __esm({
       // Keyset cursor for the newest-first scroll (`page` absent): return only
       // messages strictly older than (before_created_at, before_message_id) — the
       // oldest currently-loaded VISIBLE message. UTC ISO-8601 (Timestamps standard);
-      // `datetime()` hardens it before the parameterized DO predicate. Mirrors the
-      // `before_ended_at` cursor precedent above.
+      // `datetime()` hardens it before the parameterized DO predicate.
       before_created_at: external_exports.string().datetime().optional(),
       before_message_id: external_exports.string().uuid().optional(),
       /**
@@ -6843,6 +7004,50 @@ var init_dist = __esm({
         });
       }
     });
+    clientOptionalString = external_exports.string().nullish().transform((v) => v ?? void 0);
+    clientOptionalBoolean = external_exports.boolean().nullish().transform((v) => v ?? void 0);
+    appMessageSenderType = external_exports.enum(["user", "team"]);
+    appMessageReceiverType = external_exports.enum(["user", "team", "agent", "assistant"]).transform((v) => v === "assistant" ? "agent" : v);
+    appMessageAttachment = external_exports.object({
+      file_name: external_exports.string(),
+      file_binary: external_exports.string(),
+      file_size: external_exports.number().nullish().transform((v) => v ?? void 0),
+      file_extension: clientOptionalString
+    });
+    MAX_ATTACHMENTS_PER_MESSAGE = 20;
+    appMessageBody = external_exports.object({
+      // Message content — three historical aliases. All optional: an attachment-only
+      // or voice-only message carries no text.
+      content: clientOptionalString,
+      message_text: clientOptionalString,
+      message_body: clientOptionalString,
+      // Conversation context. Ids are plain strings rather than `.uuid()` on purpose:
+      // they are AUTHORIZED downstream, which is the stronger guarantee — a well-formed
+      // uuid belonging to another tenant must fail just as hard as junk. `hub_id` is
+      // gated by `assertHubEndUserAccess` (gh #3286) and `conversation_id` by HubDO's
+      // conversation_index owner check (gh #2781, #3281). The route's own falsy guards
+      // ('hub_id is required') still reject an empty one.
+      hub_id: clientOptionalString,
+      channel_id: clientOptionalString,
+      conversation_id: clientOptionalString,
+      hub_type: external_exports.enum(["chat", "task"]).nullish().transform((v) => v ?? void 0),
+      // Routing.
+      sender_type: appMessageSenderType.nullish().transform((v) => v ?? void 0),
+      receiver_type: appMessageReceiverType.nullish().transform((v) => v ?? void 0),
+      // Only meaningful on a team send, where `validateAppTeamSendContext` proves the
+      // caller may send to this receiver. The end-user branch ignores it — see the
+      // receiver derivation in the route.
+      user_receiver_id: clientOptionalString,
+      is_first_message: clientOptionalBoolean,
+      end_conversation: clientOptionalBoolean,
+      // Pre-generated by the client so the optimistic bubble and the stored row share
+      // a key (transcription live-updates land on the same row instead of duplicating).
+      message_id: clientOptionalString,
+      attachments: external_exports.array(appMessageAttachment).max(MAX_ATTACHMENTS_PER_MESSAGE).nullish().transform((v) => v ?? void 0),
+      // Base64-encoded audio for STT. Size-capped in the route (the cap is a byte
+      // budget tied to the /channels/* bodyLimit, not a shape rule).
+      audio_file: clientOptionalString
+    });
     updateUserBody = external_exports.object({
       user_language: external_exports.string().optional(),
       ui_dark_mode: external_exports.boolean().optional(),
@@ -6965,7 +7170,7 @@ var init_dist = __esm({
       hub_type: external_exports.enum(["chat", "task"]).default("chat"),
       user_id: external_exports.string().optional()
     });
-    additionalContextPayloadSchema = external_exports.record(external_exports.unknown()).refine((r) => JSON.stringify(r).length <= 16384, {
+    additionalContextPayloadSchema = external_exports.record(external_exports.unknown()).refine((r) => withinJsonLength(r, 16384), {
       message: "additional_context payload must be at most 16384 bytes when JSON-serialized"
     });
     kanbanUpdateBody = external_exports.object({
@@ -7225,6 +7430,7 @@ var init_dist = __esm({
       refineHubAsCodeCustomTools(config, ctx);
       refineHubAsCodeKanbanStatuses(config, ctx);
       refineHubAsCodeLanes(config, ctx);
+      refineHubAsCodeEvals(config, ctx);
     });
     ciPullHubIdParam = external_exports.object({
       hub_id: ciUuidSchema
@@ -7352,7 +7558,7 @@ var init_dist = __esm({
     adminSetHubHarnessBody = external_exports.object({
       harness_enabled: external_exports.number().int().min(0).max(1)
     }).strict();
-    adminHarnessMassDestroyBody = external_exports.object({
+    adminScopedTargetBody = external_exports.object({
       scope: external_exports.enum(["all", "org", "hub"]),
       org_id: external_exports.string().uuid().optional(),
       hub_id: external_exports.string().optional(),
@@ -9311,7 +9517,7 @@ async function exchangeCodeForTokens(authkitDomain, clientId, code, codeVerifier
   });
   if (!response.ok) {
     const body = await response.text();
-    throw new Error(`Token exchange failed (${response.status}): ${redactSecrets(body)}`);
+    throw new Error(`Token exchange failed (${response.status}): ${maskSecretsInMessage(body)}`);
   }
   return response.json();
 }
@@ -9337,7 +9543,7 @@ async function refreshAccessToken(authkitDomain, clientId, refreshToken) {
       }
       if (isInvalidGrant) throw new Error("SESSION_EXPIRED");
     }
-    throw new Error(`Token refresh failed (${status}): ${redactSecrets(body)}`);
+    throw new Error(`Token refresh failed (${status}): ${maskSecretsInMessage(body)}`);
   }
   return response.json();
 }
@@ -9469,7 +9675,7 @@ var init_auth = __esm({
     init_config();
     init_token_store();
     init_sentry();
-    init_redact();
+    init_mask_secrets();
     OAUTH_CALLBACK_PORT = 3829;
     AUTHKIT_DOMAIN = "https://sprightly-comic-51.authkit.app";
     AUTHKIT_CLIENT_ID = "client_01KMZHB50KENM5SV90ZA80VXK4";
@@ -12016,6 +12222,18 @@ var init_diff = __esm({
 });
 
 // ../../packages/core/dist/contracts/index.js
+function jsonLengthOrNull2(value) {
+  try {
+    const json = JSON.stringify(value);
+    return typeof json === "string" ? json.length : null;
+  } catch {
+    return null;
+  }
+}
+function withinJsonLength2(value, max) {
+  const length = jsonLengthOrNull2(value);
+  return length !== null && length <= max;
+}
 function normalizeAuthType2(raw) {
   if (VALID_AUTH_TYPES3.has(raw)) return raw;
   return LEGACY_AUTH_TYPE_MAP3[raw] ?? raw;
@@ -12263,6 +12481,45 @@ function refineToolConfig2(value, ctx) {
     }
   }
 }
+function describeRole2(role) {
+  if (typeof role === "string") {
+    return JSON.stringify(role.length > ROLE_ECHO_MAX2 ? `${role.slice(0, ROLE_ECHO_MAX2)}\u2026` : role);
+  }
+  if (role === null) return "null";
+  if (Array.isArray(role)) return "an array";
+  if (typeof role === "object") return "an object";
+  return `a ${typeof role}`;
+}
+function asEvalInputRecord2(input) {
+  const value = typeof input === "string" ? (() => {
+    try {
+      return JSON.parse(input);
+    } catch {
+      return null;
+    }
+  })() : input;
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function evalInputRoleError2(input) {
+  const record = asEvalInputRecord2(input);
+  if (record === null) return null;
+  const role = record.role;
+  if (role === void 0 || role === null) return null;
+  if (typeof role === "string" && EVAL_INPUT_ROLES2.includes(role)) {
+    return null;
+  }
+  return `role must be ${EVAL_INPUT_ROLE_LIST2} (received ${describeRole2(role)}) \u2014 an eval trigger is what the responder answers, and an assistant or tool role gives it nothing to answer`;
+}
+function refineEvalMessageTextRole2(value, ctx) {
+  const error = evalInputRoleError2(value.eval.message_text);
+  if (error) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["eval", "message_text", "role"],
+      message: error
+    });
+  }
+}
 function refineHubAsCodeCustomTools2(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -12354,6 +12611,22 @@ function refineHubAsCodeLanes2(config, ctx) {
     }
   }
 }
+function refineHubAsCodeEvals2(config, ctx) {
+  const evals = config.evals;
+  if (!Array.isArray(evals)) return;
+  for (let e = 0; e < evals.length; e++) {
+    const entry = evals[e];
+    const error = evalInputRoleError2(entry?.input);
+    if (error) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["evals", e, "input", "role"],
+        // Named, not just indexed — the YAML author has files, not an array.
+        message: `eval "${entry?.name ?? "<unnamed>"}": ${error}`
+      });
+    }
+  }
+}
 function isSafeTemplatePath2(path27) {
   if (path27.length === 0 || path27.length > 300) return false;
   if (path27.startsWith("/") || path27.includes("\\")) return false;
@@ -12392,7 +12665,7 @@ function isSanitizableSliceFile(path27) {
 function distinctUsesBackends(uses) {
   return [...new Set((uses ?? []).map((u) => u.backend))];
 }
-var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminHubIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminSetOrgHarnessBody2, adminSetHubHarnessBody2, adminHarnessMassDestroyBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
+var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, clientOptionalString2, clientOptionalBoolean2, appMessageSenderType2, appMessageReceiverType2, appMessageAttachment2, MAX_ATTACHMENTS_PER_MESSAGE2, appMessageBody2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminHubIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminSetOrgHarnessBody2, adminSetHubHarnessBody2, adminScopedTargetBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -12443,6 +12716,7 @@ var init_contracts = __esm({
     init_zod();
     init_zod();
     init_zod();
+    init_zod();
     uuidSchema2 = external_exports.string().uuid();
     paginationSchema3 = external_exports.object({
       limit: external_exports.coerce.number().int().min(1).max(100).default(50),
@@ -12655,7 +12929,7 @@ var init_contracts = __esm({
       eventName: external_exports.string().optional(),
       additional_instructions: external_exports.string().optional(),
       additional_context_schema: external_exports.record(external_exports.unknown()).refine(
-        (s) => JSON.stringify(s).length <= MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2,
+        (s) => withinJsonLength2(s, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2),
         `additional_context_schema must be at most ${MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2} bytes when JSON-serialized`
       ).optional(),
       followups: external_exports.array(followupSchema2).max(MAX_FOLLOWUPS_PER_STATUS2, `followups must have at most ${MAX_FOLLOWUPS_PER_STATUS2} entries`).optional(),
@@ -12790,6 +13064,7 @@ var init_contracts = __esm({
     hubTeamUserDeleteParam2 = external_exports.object({ id: uuidSchema2, teamUserId: uuidSchema2 });
     hubSchemaQuery2 = external_exports.object({ hub_id: uuidSchema2 });
     PREVIEW_LABEL_MAX_LENGTH2 = 60;
+    MAX_ENDED_INDEX_RETENTION_DAYS2 = 730;
     previewLabelField2 = external_exports.string().max(PREVIEW_LABEL_MAX_LENGTH2).optional().nullable().transform((v) => {
       if (v == null) return null;
       const trimmed = v.trim();
@@ -12817,8 +13092,14 @@ var init_contracts = __esm({
       // persisted via the agent path (.passthrough() agent body → HubDO column), not here.
       auto_close_inactive_days: external_exports.number().int().min(1).max(180).optional(),
       // Per-hub ConversationDO retention window (days) — keeps an ended conversation's DO
-      // alive for post-hoc annotation. Default 7, max 30 (= ENDED_INDEX_RETENTION_DAYS).
+      // alive for post-hoc annotation. Default 7, max 30 — the floor of the retention
+      // chain (≤ ended_index_retention_days ≤ effective storage retention).
       conversation_retention_days: external_exports.number().int().min(1).max(30).optional(),
+      // Per-hub ended-conversation index retention window (days) — how long the warm
+      // "Ended" tab + chat-hub continuous history serve a closed conversation before
+      // the cleanup cron reaps its index row. Absent → DEFAULT_ENDED_INDEX_RETENTION_DAYS
+      // (365). Re-clamped to the effective storage retention at reap time.
+      ended_index_retention_days: external_exports.number().int().min(1).max(MAX_ENDED_INDEX_RETENTION_DAYS2).optional(),
       // Channel contact access control. Enum-validated explicitly (not via passthrough)
       // so `language`/`access_approval_role` can't reach the DB with an invalid value.
       language: external_exports.enum(["en", "pt", "es"]).optional(),
@@ -12874,6 +13155,9 @@ var init_contracts = __esm({
     replicatePreviewBody2 = external_exports.object({
       preview_label: previewLabelField2
     });
+    updateChannelTestIdentitiesBody2 = external_exports.object({
+      test_identities: external_exports.array(external_exports.string().max(320)).max(1e3)
+    });
     claimCodeChannelParam2 = external_exports.object({
       id: uuidSchema2,
       channelId: uuidSchema2
@@ -13524,12 +13808,15 @@ var init_contracts = __esm({
     hubIdQuery2 = external_exports.object({
       hub_id: external_exports.string().uuid()
     });
+    EVAL_INPUT_ROLES2 = ["user", "system"];
+    EVAL_INPUT_ROLE_LIST2 = EVAL_INPUT_ROLES2.map((r) => `"${r}"`).join(" or ");
+    ROLE_ECHO_MAX2 = 40;
     createEvalBody2 = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    });
+    }).superRefine(refineEvalMessageTextRole2);
     updateEvalBody2 = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    });
+    }).superRefine(refineEvalMessageTextRole2);
     getEvalsQuery2 = external_exports.object({
       hub_id: external_exports.string().uuid(),
       agent_id: external_exports.string().uuid().optional(),
@@ -13701,18 +13988,21 @@ var init_contracts = __esm({
       hub_user_id: external_exports.string().optional(),
       search_filter: external_exports.string().optional(),
       hub_id: external_exports.string().uuid().optional(),
+      // NON-authorizing single-hub narrow. Unlike `hub_id` (which runs the
+      // grant-gated `loadHub('hub:read')` and so throws for grant-less end users /
+      // team members), `scope_hub_id` INTERSECTS the caller's already-resolved hub
+      // roster server-side. Intersecting the caller's own roster IS the
+      // authorization — a hub the caller isn't in narrows to empty and leaks
+      // nothing. Continuous history sends it to take the single-hub ended-index
+      // path (one HubDO read, accurate uncapped total) instead of the all-hub
+      // fan-out it would otherwise discard client-side (gh #3319).
+      scope_hub_id: external_exports.string().uuid().optional(),
       conversation_id: external_exports.string().uuid().optional(),
       // 'ended' = recently-closed, served warm from the HubDO index (≤ retention
       // window). 'archived' = the full closed-conversation history from ClickHouse.
       status: external_exports.enum(["active", "agent", "team", "ended", "archived"]).optional(),
       page: external_exports.string().regex(/^\d+$/).optional(),
-      page_size: external_exports.string().regex(/^\d+$/).optional(),
-      // Cursor for the continuous-history scroll (chat hubs): with status='archived',
-      // return only conversations that ended strictly before this instant. The caller
-      // passes the oldest warm-index `ended_at` so the CH superset excludes the
-      // already-loaded warm slice. UTC ISO-8601 (Timestamps standard) — datetime()
-      // hardens it before it reaches the parameterized CH predicate.
-      before_ended_at: external_exports.string().datetime().optional()
+      page_size: external_exports.string().regex(/^\d+$/).optional()
     });
     getMessagesQuery2 = external_exports.object({
       hub_id: external_exports.string().uuid(),
@@ -13728,8 +14018,7 @@ var init_contracts = __esm({
       // Keyset cursor for the newest-first scroll (`page` absent): return only
       // messages strictly older than (before_created_at, before_message_id) — the
       // oldest currently-loaded VISIBLE message. UTC ISO-8601 (Timestamps standard);
-      // `datetime()` hardens it before the parameterized DO predicate. Mirrors the
-      // `before_ended_at` cursor precedent above.
+      // `datetime()` hardens it before the parameterized DO predicate.
       before_created_at: external_exports.string().datetime().optional(),
       before_message_id: external_exports.string().uuid().optional(),
       /**
@@ -13748,6 +14037,50 @@ var init_contracts = __esm({
         });
       }
     });
+    clientOptionalString2 = external_exports.string().nullish().transform((v) => v ?? void 0);
+    clientOptionalBoolean2 = external_exports.boolean().nullish().transform((v) => v ?? void 0);
+    appMessageSenderType2 = external_exports.enum(["user", "team"]);
+    appMessageReceiverType2 = external_exports.enum(["user", "team", "agent", "assistant"]).transform((v) => v === "assistant" ? "agent" : v);
+    appMessageAttachment2 = external_exports.object({
+      file_name: external_exports.string(),
+      file_binary: external_exports.string(),
+      file_size: external_exports.number().nullish().transform((v) => v ?? void 0),
+      file_extension: clientOptionalString2
+    });
+    MAX_ATTACHMENTS_PER_MESSAGE2 = 20;
+    appMessageBody2 = external_exports.object({
+      // Message content — three historical aliases. All optional: an attachment-only
+      // or voice-only message carries no text.
+      content: clientOptionalString2,
+      message_text: clientOptionalString2,
+      message_body: clientOptionalString2,
+      // Conversation context. Ids are plain strings rather than `.uuid()` on purpose:
+      // they are AUTHORIZED downstream, which is the stronger guarantee — a well-formed
+      // uuid belonging to another tenant must fail just as hard as junk. `hub_id` is
+      // gated by `assertHubEndUserAccess` (gh #3286) and `conversation_id` by HubDO's
+      // conversation_index owner check (gh #2781, #3281). The route's own falsy guards
+      // ('hub_id is required') still reject an empty one.
+      hub_id: clientOptionalString2,
+      channel_id: clientOptionalString2,
+      conversation_id: clientOptionalString2,
+      hub_type: external_exports.enum(["chat", "task"]).nullish().transform((v) => v ?? void 0),
+      // Routing.
+      sender_type: appMessageSenderType2.nullish().transform((v) => v ?? void 0),
+      receiver_type: appMessageReceiverType2.nullish().transform((v) => v ?? void 0),
+      // Only meaningful on a team send, where `validateAppTeamSendContext` proves the
+      // caller may send to this receiver. The end-user branch ignores it — see the
+      // receiver derivation in the route.
+      user_receiver_id: clientOptionalString2,
+      is_first_message: clientOptionalBoolean2,
+      end_conversation: clientOptionalBoolean2,
+      // Pre-generated by the client so the optimistic bubble and the stored row share
+      // a key (transcription live-updates land on the same row instead of duplicating).
+      message_id: clientOptionalString2,
+      attachments: external_exports.array(appMessageAttachment2).max(MAX_ATTACHMENTS_PER_MESSAGE2).nullish().transform((v) => v ?? void 0),
+      // Base64-encoded audio for STT. Size-capped in the route (the cap is a byte
+      // budget tied to the /channels/* bodyLimit, not a shape rule).
+      audio_file: clientOptionalString2
+    });
     updateUserBody2 = external_exports.object({
       user_language: external_exports.string().optional(),
       ui_dark_mode: external_exports.boolean().optional(),
@@ -13870,7 +14203,7 @@ var init_contracts = __esm({
       hub_type: external_exports.enum(["chat", "task"]).default("chat"),
       user_id: external_exports.string().optional()
     });
-    additionalContextPayloadSchema2 = external_exports.record(external_exports.unknown()).refine((r) => JSON.stringify(r).length <= 16384, {
+    additionalContextPayloadSchema2 = external_exports.record(external_exports.unknown()).refine((r) => withinJsonLength2(r, 16384), {
       message: "additional_context payload must be at most 16384 bytes when JSON-serialized"
     });
     kanbanUpdateBody2 = external_exports.object({
@@ -14130,6 +14463,7 @@ var init_contracts = __esm({
       refineHubAsCodeCustomTools2(config, ctx);
       refineHubAsCodeKanbanStatuses2(config, ctx);
       refineHubAsCodeLanes2(config, ctx);
+      refineHubAsCodeEvals2(config, ctx);
     });
     ciPullHubIdParam2 = external_exports.object({
       hub_id: ciUuidSchema2
@@ -14257,7 +14591,7 @@ var init_contracts = __esm({
     adminSetHubHarnessBody2 = external_exports.object({
       harness_enabled: external_exports.number().int().min(0).max(1)
     }).strict();
-    adminHarnessMassDestroyBody2 = external_exports.object({
+    adminScopedTargetBody2 = external_exports.object({
       scope: external_exports.enum(["all", "org", "hub"]),
       org_id: external_exports.string().uuid().optional(),
       hub_id: external_exports.string().optional(),
@@ -19161,6 +19495,20 @@ async function adminCommand(args2) {
         process.exit(1);
     }
   }
+  if (group === "hubs") {
+    if (!sub) {
+      printHelp2();
+      process.exit(1);
+    }
+    switch (sub) {
+      case "repair-team-orphans":
+        await runRepairTeamOrphans(flagArgs);
+        return;
+      default:
+        printHelp2();
+        process.exit(1);
+    }
+  }
   if (group === "harness") {
     if (!sub) {
       printHelp2();
@@ -19820,8 +20168,7 @@ async function runSandboxExec(positional, flagArgs) {
     process.exit(data.exit_code);
   }
 }
-async function runHarnessMassDestroy(flagArgs) {
-  const USAGE = "wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
+function parseScopedTargetFlags(flagArgs, usage2) {
   let all = false;
   let orgId;
   let hubId;
@@ -19854,24 +20201,69 @@ async function runHarnessMassDestroy(flagArgs) {
         process.exit(1);
     }
   }
-  const selectorCount = (all ? 1 : 0) + (orgId ? 1 : 0) + (hubId ? 1 : 0);
-  if (selectorCount !== 1) {
+  if ((all ? 1 : 0) + (orgId ? 1 : 0) + (hubId ? 1 : 0) !== 1) {
     console.error("Provide exactly ONE of --all, --org <org_id>, or --hub <hub_id>.");
-    console.error(USAGE);
+    console.error(usage2);
     process.exit(1);
   }
-  let body;
-  let targetLabel;
   if (all) {
-    body = { scope: "all", dry_run: dryRun };
-    targetLabel = "ALL hubs (platform-wide)";
-  } else if (orgId) {
-    body = { scope: "org", org_id: orgId, dry_run: dryRun };
-    targetLabel = `org ${orgId}`;
-  } else {
-    body = { scope: "hub", hub_id: hubId, dry_run: dryRun };
-    targetLabel = `hub ${hubId}`;
+    return { body: { scope: "all", dry_run: dryRun }, targetLabel: "ALL hubs (platform-wide)", dryRun, yes, jsonOutput };
+  }
+  if (orgId) {
+    return { body: { scope: "org", org_id: orgId, dry_run: dryRun }, targetLabel: `org ${orgId}`, dryRun, yes, jsonOutput };
   }
+  return { body: { scope: "hub", hub_id: hubId, dry_run: dryRun }, targetLabel: `hub ${hubId}`, dryRun, yes, jsonOutput };
+}
+async function runRepairTeamOrphans(flagArgs) {
+  const USAGE = "wayai admin hubs repair-team-orphans --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
+  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE);
+  if (!dryRun && !yes && !jsonOutput) {
+    console.log(`About to PURGE dangling team references in: ${targetLabel}.`);
+    console.log("Memberships pointing at a deleted team are removed (HubDO + UserDO mirror); conversations pinned to one are unassigned.");
+    console.log("Run with --dry-run first to see what would change.");
+    const ok = await confirm("Proceed?");
+    if (!ok) {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const { config, accessToken } = await requireAuth();
+  const client = new ApiClient({ apiUrl: config.api_url, accessToken });
+  let response;
+  try {
+    response = await client.adminRepairTeamOrphans(body);
+  } catch (err) {
+    exitOnApiError(err);
+    throw err;
+  }
+  const data = response.data;
+  if (jsonOutput) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  const mode = data.dry_run ? "DRY RUN \u2014 nothing written" : "repaired";
+  console.log(
+    `repair-team-orphans (${data.scope}) \u2014 ${mode}: hubs_scanned=${data.hubs_scanned} hubs_repaired=${data.hubs_repaired} team_users_removed=${data.team_users_removed}`
+  );
+  if (data.hubs_errored > 0 || data.orgs_errored > 0) {
+    console.log(
+      `WARNING: ${data.orgs_errored} org(s) and ${data.hubs_errored} hub(s) errored and were SKIPPED \u2014 re-run to cover them.`
+    );
+  }
+  if (data.details.length === 0) {
+    console.log("(no dangling team references in scope)");
+    return;
+  }
+  console.log("");
+  console.log("hub_id | dangling_team_ids | team_users_removed");
+  console.log("-------+-------------------+-------------------");
+  for (const d of data.details) {
+    console.log(`${d.hub_id} | ${d.dangling_team_ids.join(",")} | ${d.team_users_removed}`);
+  }
+}
+async function runHarnessMassDestroy(flagArgs) {
+  const USAGE = "wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
+  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE);
   if (!dryRun && !yes && !jsonOutput) {
     console.log(`About to REAP every live harness sandbox / token / slot in: ${targetLabel}.`);
     console.log("This destroys running sandboxes and revokes their tokens. Run with --dry-run first to see the blast radius.");
@@ -19899,9 +20291,9 @@ async function runHarnessMassDestroy(flagArgs) {
   console.log(
     `harness mass-destroy (${data.scope}) \u2014 ${mode}: hubs_scanned=${data.hubs_scanned} sessions_found=${data.sessions_found} sessions_reaped=${data.sessions_reaped} sandboxes_destroyed=${data.sandboxes_destroyed}`
   );
-  if (data.hubs_errored > 0 || data.sessions_errored > 0) {
+  if (data.orgs_errored > 0 || data.hubs_errored > 0 || data.sessions_errored > 0) {
     console.log(
-      `WARNING: ${data.hubs_errored} hub(s) and ${data.sessions_errored} session(s) errored and were SKIPPED \u2014 re-run to cover them.`
+      `WARNING: ${data.orgs_errored} org(s), ${data.hubs_errored} hub(s) and ${data.sessions_errored} session(s) errored and were SKIPPED \u2014 re-run to cover them.`
     );
   }
   if (data.details.length === 0) {
@@ -20438,6 +20830,9 @@ Usage:
   wayai admin sandbox exec [--cmd "<c>" | <c>] --hub <id> --connection <id> [--egress open|allowlist|isolated] [--allow <host> ...] [--timeout <ms>] [--json]
                                                    Run one shell command in a fresh E2B sandbox (create \u2192 run \u2192 destroy) to test the sandbox driver + egress gate
 
+  wayai admin hubs repair-team-orphans --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]
+                                                   Purge hub_team_id references left dangling by a pre-cascade team deletion (silently empties a support agent's queue). Idempotent \u2014 run --dry-run first
+
   wayai admin harness disable [--org <org_id> | --hub <hub_id>]
                                                    Flip harness_enabled OFF. No scope = platform (break-glass: per-turn kill switch aborts each harness turn on its next invocation); --org/--hub target that layer of the three-layer rollout gate
   wayai admin harness enable [--org <org_id> | --hub <hub_id>]
@@ -20468,6 +20863,13 @@ Sources:
                  "Gemini degraded" / "Analytics delayed" notices. \`create\` authors one
                  (severity defaults to info, scope to global); \`list\` reads them
                  (--status active|resolved); \`resolve\` ends an active notice.
+  hubs           Hub data repair. \`repair-team-orphans\` purges hub_team_id references left
+                 dangling by a team deletion that predates the deleteHubTeam cascade (a
+                 \`wayai push\` / hub-sync that replaced a hub's teams orphaned its
+                 memberships). A dangling membership resolves to an EMPTY support scope, so
+                 its owner's Support list silently goes blank; a conversation pinned to a
+                 deleted team goes invisible to everyone. Idempotent \u2014 a healthy hub writes
+                 nothing, so re-running and --all are both safe.
   sandbox        Run arbitrary code in a fresh E2B sandbox (harness-agents isolation surface).
                  \`exec\` provisions a sandbox from a named Sandbox connection, runs one
                  command, and destroys it. Egress omitted \u21D2 deny-all (fail-closed); opt up
@@ -21022,7 +21424,7 @@ function friendlyHint(err) {
 }
 
 // src/index.ts
-init_redact();
+init_mask_secrets();
 init_utils();
 
 // src/lib/version-refresh.ts
@@ -21516,7 +21918,7 @@ async function runForeground() {
       captureException2(err);
     }
     await closeSentry();
-    console.error(redactSecrets(err instanceof Error ? err.message : String(err)));
+    console.error(maskSecretsInMessage(err instanceof Error ? err.message : String(err)));
     const hint = friendlyHint(err);
     if (hint) console.error(hint);
     process.exit(1);