@wayai/cli 0.3.97 → 0.3.99

package/dist/index.js

@@ -15,21 +15,58 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/lib/redact.ts
-function redactSecrets(text) {
+// src/lib/mask-secrets.ts
+function valueEnd(text, from, isEnd) {
+  for (let i = from; i < text.length; i++) {
+    if (text[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (isEnd(text[i])) return i;
+  }
+  return text.length;
+}
+function maskCredentialValues(text, keyRe, isValueEnd) {
+  keyRe.lastIndex = 0;
+  let out = "";
+  let copied = 0;
+  let match;
+  while ((match = keyRe.exec(text)) !== null) {
+    const valueStart = match.index + match[0].length;
+    keyRe.lastIndex = valueStart;
+    if (!isCredentialKey(match[1])) continue;
+    const end = valueEnd(text, valueStart, isValueEnd);
+    const value = text.slice(valueStart, end);
+    if (value.length === 0 || FULLY_MASKED_VALUE_RE.test(value)) continue;
+    out += text.slice(copied, valueStart) + "[REDACTED]";
+    copied = end;
+    keyRe.lastIndex = end;
+  }
+  return out + text.slice(copied);
+}
+function maskSecretsInMessage(text) {
   let out = text;
-  for (const [pattern, replacement] of PATTERNS) {
-    out = out.replace(pattern, replacement);
-  }
-  return out;
-}
-var PATTERNS;
-var init_redact = __esm({
-  "src/lib/redact.ts"() {
+  for (const [pattern, replacement] of SHAPE_PATTERNS) out = out.replace(pattern, replacement);
+  out = maskCredentialValues(out, JSON_KEY_RE, isJsonValueEnd);
+  out = maskCredentialValues(out, QUERY_KEY_RE, isQueryValueEnd);
+  return out.replace(BASE64_RE, maskBase64);
+}
+var CREDENTIAL_KEY_RE, FULLY_MASKED_VALUE_RE, isCredentialKey, SHAPE_PATTERNS, JSON_KEY_RE, isJsonValueEnd, QUERY_KEY_RE, isQueryValueEnd, BASE64_RE, maskBase64;
+var init_mask_secrets = __esm({
+  "src/lib/mask-secrets.ts"() {
     "use strict";
-    PATTERNS = [
+    CREDENTIAL_KEY_RE = /token|secret|credential|password|passwd|api[_-]?key|authorization|private[_-]?key|session[_-]?id|cookie|jwt/i;
+    FULLY_MASKED_VALUE_RE = /^(?:Bearer\s+)?(?:way_|wst_)?\[REDACTED(?:_JWT|_BASE64)?\]$/;
+    isCredentialKey = (key) => CREDENTIAL_KEY_RE.test(key);
+    SHAPE_PATTERNS = [
       // JWTs (header.payload.signature) — WorkOS access/refresh tokens, OAuth JWTs.
       // Run first so a `Bearer <jwt>` collapses to the JWT placeholder.
+      //
+      // Deliberately NOT anchored with the lookbehind the base64 rule uses. It would
+      // make this linear (this rule is quadratic on a pathological `eyJeyJeyJ…` run),
+      // but it also NARROWS masking: `refresh-<jwt>` and `way_<jwt>` would stop
+      // matching and leak the token whole. Correctness of a redaction rule outranks
+      // its worst case on a body that has to be adversarial to hurt.
       [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[REDACTED_JWT]"],
       // way_ scoped API tokens (keyring/CI credentials). Leading \b avoids
       // over-redacting benign substrings (e.g. `gateway_config`); the charset is
@@ -40,6 +77,42 @@ var init_redact = __esm({
       // Authorization: Bearer <opaque token> (anything not already masked above).
       [/(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, "$1[REDACTED]"]
     ];
+    JSON_KEY_RE = /"([A-Za-z0-9_.-]+)"\s*:\s*"/g;
+    isJsonValueEnd = (char) => char === '"';
+    QUERY_KEY_RE = /(?:^|[?#&;,\s"'])([A-Za-z0-9_.-]+)=/g;
+    isQueryValueEnd = (char) => char === "&" || char === ";" || char === '"' || /\s/.test(char);
+    BASE64_RE = // Padded base64 bodies (wrapped DEKs, HMAC secrets, service-account material)
+    // appearing outside any credential-named key — the shape the rules above miss.
+    //
+    // Base64 has no distinguishing charset: a bare `[A-Za-z0-9+/]{20,}` run also
+    // matches slash-separated paths (`hubs/production/agents/support`), 64-char DO
+    // hex ids, and ordinary long words — all debugging context, not secrets. Three
+    // constraints buy the precision instead:
+    //   1. Terminal `=` padding, which prose and paths don't carry.
+    //   2. Nothing base64-ish after the padding, so `?param=value` (where `=` is a
+    //      separator, not padding) is excluded.
+    //   3. Not sitting immediately after `?` or `&`, where a run followed by `=` is
+    //      a query parameter NAME. Constraints 2 and 3 are separate cases: `=value`
+    //      vs. an empty value (`?someLongParamName=&next=1`), which 2 lets through.
+    //   4. The quad-length check below, for a run reached by neither 2 nor 3
+    //      (`bad xxxxxxxxxxxxxxxxxxxxxx= here`).
+    // Runs last so `Bearer <base64>` still collapses to the Bearer placeholder.
+    //
+    // The trade: unpadded base64 (any input whose byte length is a multiple of 3)
+    // is NOT matched here — no marker distinguishes it from prose. It stays covered
+    // by the credential-key rules above, which is where such a value realistically
+    // reaches this module.
+    //
+    // The leading lookbehind (NOT \b) is what keeps this linear. `/` and `+` are
+    // non-word characters, so \b also fires *inside* a base64 run: on a body like
+    // `aaaa/aaaa/aaaa/…` every slash would start a fresh greedy scan of the rest of
+    // the string, which is quadratic (~5.5s on a 100KB body, vs ~1.3ms now). "No
+    // base64 char precedes this" is both the correct notion of a run's start and
+    // O(1) starts per run — and, unlike the JWT rule above, it narrows nothing:
+    // base64 embedded mid-run isn't decodable base64 anyway.
+    // {22,} + 1-2 pad chars => a 24-char floor, i.e. a 16-byte secret.
+    /(?<![A-Za-z0-9+/])(?<![?&])[A-Za-z0-9+/]{22,}={1,2}(?![A-Za-z0-9+/=])/g;
+    maskBase64 = (match) => match.length % 4 === 0 ? "[REDACTED_BASE64]" : match;
   }
 });
 
@@ -119,17 +192,17 @@ function initSentry(command2, version) {
               }
             }
           }
-          if (value.value) value.value = redactSecrets(value.value);
+          if (value.value) value.value = maskSecretsInMessage(value.value);
         }
       }
       if (event.breadcrumbs) {
         for (const crumb of event.breadcrumbs) {
-          if (crumb.message) crumb.message = redactSecrets(crumb.message);
+          if (crumb.message) crumb.message = maskSecretsInMessage(crumb.message);
         }
       }
       if (event.extra) {
         for (const [key, val] of Object.entries(event.extra)) {
-          if (typeof val === "string") event.extra[key] = redactSecrets(val);
+          if (typeof val === "string") event.extra[key] = maskSecretsInMessage(val);
         }
       }
       return event;
@@ -165,11 +238,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path27) {
+function addApiBreadcrumb(method, path28) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path27}`,
+    message: `${method} ${path28}`,
     level: "info"
   });
 }
@@ -199,7 +272,7 @@ var HARDCODED_DSN, initialized;
 var init_sentry = __esm({
   "src/lib/sentry.ts"() {
     "use strict";
-    init_redact();
+    init_mask_secrets();
     init_network_error();
     HARDCODED_DSN = "https://ffe500121277babcabf32e5868f00f9e@o4510669417807872.ingest.us.sentry.io/4510960145465344";
     initialized = false;
@@ -225,15 +298,15 @@ var init_api_client = __esm({
   "src/lib/api-client.ts"() {
     "use strict";
     init_sentry();
-    init_redact();
+    init_mask_secrets();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
     delay = (ms) => new Promise((resolve4) => setTimeout(resolve4, ms));
     ApiError = class extends Error {
       status;
       body;
-      constructor(method, path27, status, body) {
-        const safeBody = redactSecrets(body);
-        super(`API request failed: ${method} ${path27} (${status}): ${safeBody}`);
+      constructor(method, path28, status, body) {
+        const safeBody = maskSecretsInMessage(body);
+        super(`API request failed: ${method} ${path28} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
@@ -381,8 +454,8 @@ var init_api_client = __esm({
           ...organizationId && { organization_id: organizationId }
         });
       }
-      async lookup(path27, opts) {
-        const params = new URLSearchParams({ path: path27 });
+      async lookup(path28, opts) {
+        const params = new URLSearchParams({ path: path28 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -429,8 +502,11 @@ var init_api_client = __esm({
       async sendMessage(hubId, message, opts) {
         return this.request("POST", "/api/conversations/send-message", {
           hub_id: hubId,
-          message,
-          ...opts?.conversationId && { conversation_id: opts.conversationId }
+          // Omitted entirely when absent: the contract allows an attachment-only send,
+          // but `message: undefined` would still fail its `.min(1)` if serialized.
+          ...message && { message },
+          ...opts?.conversationId && { conversation_id: opts.conversationId },
+          ...opts?.attachments?.length && { attachments: opts.attachments }
         });
       }
       async deleteHistory(hubId, opts) {
@@ -779,9 +855,9 @@ var init_api_client = __esm({
        * sandbox for this conversation, or the blob was purged).
        */
       async downloadArchiveSandboxFs(hubId, conversationId) {
-        const path27 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
-        addApiBreadcrumb("GET", path27);
-        const url = `${this.apiUrl}${path27}`;
+        const path28 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
+        addApiBreadcrumb("GET", path28);
+        const url = `${this.apiUrl}${path28}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -795,7 +871,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path27, response.status, await response.text());
+          throw new ApiError("GET", path28, response.status, await response.text());
         }
         return new Uint8Array(await response.arrayBuffer());
       }
@@ -835,9 +911,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path27, body) {
-        addApiBreadcrumb(method, path27);
-        const url = `${this.apiUrl}${path27}`;
+      async request(method, path28, body) {
+        addApiBreadcrumb(method, path28);
+        const url = `${this.apiUrl}${path28}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body);
@@ -861,7 +937,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path27, response.status, errorBody);
+          throw new ApiError(method, path28, response.status, errorBody);
         }
       }
       /** Issue a single authenticated request with the client's current token. */
@@ -1296,8 +1372,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path27, errorMaps, issueData } = params;
-      const fullPath = [...path27, ...issueData.path || []];
+      const { data, path: path28, errorMaps, issueData } = params;
+      const fullPath = [...path28, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1608,11 +1684,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path27, key) {
+      constructor(parent, value, path28, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path27;
+        this._path = path28;
         this._key = key;
       }
       get path() {
@@ -4996,10 +5072,40 @@ var init_zod = __esm({
 });
 
 // ../../packages/core/dist/index.js
+function isPublicIdentifier(value) {
+  return UUID_RE.test(value) || HEX_RE.test(value) || WORKOS_ID_RE.test(value);
+}
+function redactTokenShapes(input) {
+  return input.replace(TOKEN_RE, REDACTED).replace(PROVIDER_TOKEN_RE, `$1${REDACTED}`).replace(JSON_CREDENTIAL_RE, `$1"${REDACTED}"`).replace(QUERY_CREDENTIAL_RE, `$1${REDACTED}`);
+}
+function redactSecrets(value) {
+  if (isPublicIdentifier(value)) {
+    return value;
+  }
+  if (OPAQUE_SECRET_RE.test(value)) {
+    return REDACTED;
+  }
+  if (BASE64_SECRET_RE.test(value) && BASE64_MARKER_RE.test(value)) {
+    return REDACTED;
+  }
+  return redactTokenShapes(value);
+}
 function normalizeAuthType(raw) {
   if (VALID_AUTH_TYPES.has(raw)) return raw;
   return LEGACY_AUTH_TYPE_MAP[raw] ?? raw;
 }
+function jsonLengthOrNull(value) {
+  try {
+    const json = JSON.stringify(value);
+    return typeof json === "string" ? json.length : null;
+  } catch {
+    return null;
+  }
+}
+function withinJsonLength(value, max) {
+  const length = jsonLengthOrNull(value);
+  return length !== null && length <= max;
+}
 function visibleLength(s) {
   return s.replace(INVISIBLE_NAME_CHARS, "").length;
 }
@@ -5066,12 +5172,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path27, errors, opts = {}) {
+function validateSchema(schema, path28, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path27 || "<root>",
+      path: path28 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -5079,7 +5185,7 @@ function validateSchema(schema, path27, errors, opts = {}) {
   }
   if (!isRecord(schema)) {
     errors.push({
-      path: path27,
+      path: path28,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -5087,14 +5193,14 @@ function validateSchema(schema, path27, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path27 ? `${path27}.type` : "type",
+        path: path28 ? `${path28}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path27}.type`,
+      path: `${path28}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -5103,25 +5209,25 @@ function validateSchema(schema, path27, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       errors.push({
-        path: `${path27}.enum`,
+        path: `${path28}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path27}.enum`,
+        path: `${path28}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path27}.enum`,
+        path: `${path28}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path27}.enum[${i}]`,
+            path: `${path28}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -5131,7 +5237,7 @@ function validateSchema(schema, path27, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path27}.${key}`,
+        path: `${path28}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -5140,45 +5246,45 @@ function validateSchema(schema, path27, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord(schema.properties)) {
       errors.push({
-        path: `${path27}.properties`,
+        path: `${path28}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path27}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path28}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path27}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path28}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path27}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path28}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord(schema[key])) {
-      validateSchema(schema[key], `${path27}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path28}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path27}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path28}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path27}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path28}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path27}.${k}`;
+    const fieldPath = `${path28}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -5243,6 +5349,45 @@ function refineToolConfig(value, ctx) {
     }
   }
 }
+function describeRole(role) {
+  if (typeof role === "string") {
+    return JSON.stringify(role.length > ROLE_ECHO_MAX ? `${role.slice(0, ROLE_ECHO_MAX)}\u2026` : role);
+  }
+  if (role === null) return "null";
+  if (Array.isArray(role)) return "an array";
+  if (typeof role === "object") return "an object";
+  return `a ${typeof role}`;
+}
+function asEvalInputRecord(input) {
+  const value = typeof input === "string" ? (() => {
+    try {
+      return JSON.parse(input);
+    } catch {
+      return null;
+    }
+  })() : input;
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function evalInputRoleError(input) {
+  const record = asEvalInputRecord(input);
+  if (record === null) return null;
+  const role = record.role;
+  if (role === void 0 || role === null) return null;
+  if (typeof role === "string" && EVAL_INPUT_ROLES.includes(role)) {
+    return null;
+  }
+  return `role must be ${EVAL_INPUT_ROLE_LIST} (received ${describeRole(role)}) \u2014 an eval trigger is what the responder answers, and an assistant or tool role gives it nothing to answer`;
+}
+function refineEvalMessageTextRole(value, ctx) {
+  const error = evalInputRoleError(value.eval.message_text);
+  if (error) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["eval", "message_text", "role"],
+      message: error
+    });
+  }
+}
 function refineHubAsCodeCustomTools(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -5334,10 +5479,26 @@ function refineHubAsCodeLanes(config, ctx) {
     }
   }
 }
-function isSafeTemplatePath(path27) {
-  if (path27.length === 0 || path27.length > 300) return false;
-  if (path27.startsWith("/") || path27.includes("\\")) return false;
-  const segments = path27.split("/");
+function refineHubAsCodeEvals(config, ctx) {
+  const evals = config.evals;
+  if (!Array.isArray(evals)) return;
+  for (let e = 0; e < evals.length; e++) {
+    const entry = evals[e];
+    const error = evalInputRoleError(entry?.input);
+    if (error) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["evals", e, "input", "role"],
+        // Named, not just indexed — the YAML author has files, not an array.
+        message: `eval "${entry?.name ?? "<unnamed>"}": ${error}`
+      });
+    }
+  }
+}
+function isSafeTemplatePath(path28) {
+  if (path28.length === 0 || path28.length > 300) return false;
+  if (path28.startsWith("/") || path28.includes("\\")) return false;
+  const segments = path28.split("/");
   return segments.every(
     (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
   );
@@ -5407,7 +5568,7 @@ function findStepBoundaries(transcript) {
   }
   return out;
 }
-var APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, clientOptionalString, clientOptionalBoolean, appMessageSenderType, appMessageReceiverType, appMessageAttachment, MAX_ATTACHMENTS_PER_MESSAGE, appMessageBody, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminHubIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminSetOrgHarnessBody, adminSetHubHarnessBody, adminScopedTargetBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
+var UUID_RE, HEX_RE, WORKOS_ID_RE, OPAQUE_SECRET_RE, BASE64_SECRET_RE, BASE64_MARKER_RE, TOKEN_RE, SENSITIVE_FIELDS, SENSITIVE_KEY_ALTERNATION, SENSITIVE_KEY_PATTERN, JSON_CREDENTIAL_RE, QUERY_CREDENTIAL_RE, REDACTED, PROVIDER_TOKEN_RE, APP_ERROR_BRAND, AppError, LLM_RATE_LIMIT_BRAND, LlmRateLimitError, LLM_PROVIDER_HTTP_BRAND, LlmProviderHttpError, LLM_PROVIDER_TIMEOUT_BRAND, LlmProviderTimeoutError, ExternalServiceError, CHANNEL_PROVIDER_HTTP_BRAND, ChannelProviderHttpError, MEDIA_PROVIDER_HTTP_BRAND, MediaProviderHttpError, AUTH_TYPE, ORG_CREDENTIAL_AUTH_TYPES, AUTH_TYPE_DISPLAY, LEGACY_AUTH_TYPE_MAP, VALID_AUTH_TYPES, AGENT_ROLES, SAFE_USER_ID_REGEX, SUPPORTED_LOCALES, uuidSchema, paginationSchema, timestampSchema, idParamSchema, clientOptionalString, clientOptionalBoolean, clientOptionalNumber, messageAttachment, MAX_MESSAGE_BODY_BYTES, MAX_ATTACHMENTS_PER_MESSAGE, primaryRegionSchema, placementSourceSchema, orgIdParam, orgAdminIdParam, createOrganizationBody, updateOrganizationBody, addOrgAdminBody, SUMMARIZATION_THRESHOLD_MIN, SUMMARIZATION_THRESHOLD_MAX, summarizationThresholdField, monitorConfigField, agentIdParam, listAgentsQuery, agentConnectionsQuery, createAgentBody, updateAgentBody, AGENT_PARAMETER_TYPES, AGENT_PARAMETER_NAME_REGEX, agentParameterCreateSchema, MAX_AGENT_PARAMETERS_PER_REQUEST, createAgentParametersBody, SLUG_REGEX, slugSchema, INVISIBLE_NAME_CHARS, MAX_KANBAN_STATUSES, MAX_FOLLOWUPS_PER_STATUS, MAX_LANES, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES, RESERVED_TEMPLATE_DUMP_NAME, kanbanStatusSlugSchema, followupSchema, EXCLUSIVE_FLAG_PAIRS, kanbanStatusSchema, kanbanStatusesArraySchema, laneSchema, lanesArraySchema, hubIdParam, hubAdminIdParam, hubUserIdParam, hubIdentityIdParam, hubTeamIdParam, hubTeamUserDeleteParam, hubSchemaQuery, PREVIEW_LABEL_MAX_LENGTH, MAX_ENDED_INDEX_RETENTION_DAYS, previewLabelField, createHubBody, updateHubBody, addHubAdminBody, addHubIdentityAuthorizationBody, contactDecisionBody, approveContactBody, listContactAccessQuery, createHubTeamBody, updateHubTeamBody, addHubTeamUserBody, reassignHubUserBody, replicatePreviewBody, updateChannelTestIdentitiesBody, claimCodeChannelParam, claimCodeDeleteParam, connectionIdParam, connectorIdParam, listConnectionsQuery, deleteConnectionQuery, addConnectionBody, editConnectionBody, PRODUCTION_DIRECT_FIELDS, setProductionCredentialBody, registerWhatsappQuery, registerWhatsappBody, retryProvisioningQuery, resendDomainStatusQuery, PLACEHOLDER_TOKENS, ALLOWED_TYPES, SUBSCHEMA_OBJECT_KEYWORDS, SUBSCHEMA_LIST_KEYWORDS, SUBSCHEMA_MAP_KEYWORDS, MAX_SCHEMA_DEPTH, toolIdParam, listToolsQuery, toolAgentQuery, deleteToolQuery, toolConnectionsQuery, nativeToolIdSchema, addNativeToolBody, addMcpToolBody, createCustomToolBody, updateCustomToolBody, updateToolExecutionConfigBody, initialValueCreateSchema, initialValueUpdateSchema, stateIdParam, listStatesQuery, stateNameSchema, createStateBody, updateStateBody, reorderStatesBody, variantAiModeSchema, experimentStatusSchema, overlayUpdateSchema, experimentIdParam, variantIdParam, listExperimentsQuery, listVariantsQuery, listOverridesQuery, deleteOverrideQuery, createExperimentBody, updateExperimentBody, setExperimentStatusBody, createVariantBody, updateVariantBody, upsertOverrideBody, orgTagIdParam, listOrgTagsQuery, createOrgTagBody, updateOrgTagBody, orgCredentialIdParam, listOrgCredentialsQuery, createOrgCredentialBody, updateOrgCredentialBody, orgResourceIdParam, orgResourceFileIdParam, orgResourceFolderIdParam, hubOrgResourceParam, listOrgResourcesQuery, orgIdQuery, createOrgResourceBody, updateOrgResourceBody, createOrgResourceFolderBody, updateOrgResourceFolderBody, uploadOrgResourceFileBody, updateOrgResourceFileBody, uploadOrgSkillZipBody, linkOrgResourceBody, resourceIdParam, listResourcesQuery, createResourceBody, updateResourceBody, syncSkillsBody, resourceFileIdParam, listResourceFilesQuery, createResourceFileBody, updateResourceFileBody, uploadResourceFileBody, uploadSkillZipBody, resourceFolderIdParam, listResourceFoldersQuery, createResourceFolderBody, updateResourceFolderBody, agentResourceQuery, hubResourceQuery, linkAgentResourceBody, updateAgentResourceBody, unlinkAgentResourceQuery, navItemSchema, hubCountResetBody, navItemCountResetBody, typingBody, analyticsHubIdParam, analyticsVariableIdParam, updateVariablePinBody, updateAnalyticsViewBody, NUMERIC_FILTER_OPS, TEXT_FILTER_OPS, CATEGORICAL_FILTER_OPS, VARIABLE_FILTER_OPS, STRUCTURED_QUERY_OPS, STRUCTURED_QUERY_AGGREGATIONS, filterValueSchema, conversationsBody, analyticsConversationIdParam, messagesQuery, conversationDetailDataQuery, analyticsDataBody, structuredQueryBody, analyticsSqlBody, analyticsSqlSchemaQuery, EVAL_PACING_PRESET_NAMES, PACING_INTERVAL_MIN_MS, PACING_INTERVAL_MAX_MS, EVAL_RUN_DEADLINE_MIN_MS, EVAL_RUN_DEADLINE_MAX_MS, paginationSchema2, evalIdParam, sessionIdParam, scenarioSetIdParam, hubIdQuery, EVAL_INPUT_ROLES, EVAL_INPUT_ROLE_LIST, ROLE_ECHO_MAX, createEvalBody, updateEvalBody, getEvalsQuery, toggleEvalBody, bulkToggleEvalsBody, pacingConfigSchema, sessionConfigSchema, createSessionBody, getSessionsQuery, getSessionResultsQuery, getSessionRunsQuery, evalAnalyticsQuery, getSessionCostQuery, compareSessionsQuery, evalsSqlBody, evalsSqlSchemaQuery, exportResultsQuery, validateEvalBody, hubAgentsQuery, createScenarioSetBody, updateScenarioSetBody, scenarioSetsHubQuery, createScenarioFromConversationBody, createJourneyFromConversationBody, journeyIdParam, journeyToolCallSchema, journeyTurnSchema, journeyStepOverrideSchema, fixtureField, createJourneyBody, updateJourneyBody, getConversationsQuery, getMessagesQuery, appMessageSenderType, appMessageReceiverType, appMessageBody, updateUserBody, updateProfileBody, pathnameRegex, updatePreferencesBody, registerPushTokenBody, deletePushTokenQuery, activityQuery, deletionModeSchema, deletionRequestBody, archiveHubIdParam, archiveConversationParams, archiveListQuery, archiveMessageObservabilityParams, conversationIdParam, claimBody, releaseBody, transferBody, closeBody, additionalContextPayloadSchema, kanbanUpdateBody, annotateConversationBody, observabilityParams, observabilityListParams, deleteUserConversationsBody, sendMessageBody, listConversationsQuery, getConversationDetailParams, getConversationDetailQuery, listWhatsAppTemplatesQuery, sendWhatsAppTemplateBody, billingOrgIdParam, subscriptionItemParams, spendCapBody, growthPacksBody, portalSessionBody, checkoutSessionBody, updateBillingCurrencyBody, invoicesQuery, downloadBody, uploadQuery, signUrlBody, outboundSchemaQuery, templateIdParam, listTemplatesQuery, deleteTemplateQuery, templateStatusQuery, createTemplateBody, updateTemplateBody, submitTemplateBody, testTemplateBody, contactIdParam, listContactsQuery, createContactBody, updateContactBody, listIdParam, listListsQuery, listListContactsQuery, createListBody, updateListBody, addListContactsBody, removeListContactsBody, scheduleIdParam, listSchedulesQuery, listExecutionsQuery, createScheduleBody, updateScheduleBody, uuidPattern, ciUuidSchema, hubAsCodeConfigSchema, ciPullHubIdParam, ciBranchParam, ciPullQuery, ciHubsQuery, ciLookupQuery, ciBranchesQuery, ciSyncBody, ciPushBody, ciDiffBody, ciPublishBody, ciPublishPreviewBody, ciSyncMcpBody, ciOrgResourcesParam, orgResourcesConfigSchema, ciOrgResourcesPushBody, ciOrgResourcesDiffBody, adminOrgIdParam, adminOrgAdminIdParam, adminUserIdParam, adminPlanIdParam, adminHubIdParam, adminOrganizationsQuery, adminUserSearchQuery, kanbanSlugMigrationQuery, adjustQuotaBody, updatePlanBody, addAdminUserBody, updatePlatformConfigBody, updateFreeOrgLimitBody, adminSetOrgHarnessBody, adminSetHubHarnessBody, adminScopedTargetBody, updatePricingPlanBody, dataExplorerSearchQuery, dataExplorerOrgIdParam, dataExplorerHubIdParam, dataExplorerConvIdParam, dataExplorerDoInstancesQuery, dataExplorerNsIdParam, dataExplorerKvKeysQuery, dataExplorerKvKeyParam, uuidOrHexId, dataExplorerDeleteOrgParam, dataExplorerDeleteHubParam, dataExplorerDeleteConvParam, dataExplorerDeleteUserParam, dataExplorerDeleteQuery, dataExplorerKvDeleteQuery, pitrDoNamespace, pitrBookmarkParam, pitrRestoreBody, healthSamplingTriggerBody, dataExplorerDebugDoType, DEBUG_READ_MAX_LIMIT, DEBUG_READ_DEFAULT_LIMIT, DEBUG_DO_HEX_PREFIX, debugDoEntityId, debugTableName, dataExplorerDebugTablesParam, dataExplorerDebugRowsParam, dataExplorerDebugRowsQuery, dataExplorerDebugAnalyticsTable, debugUuid, dataExplorerDebugAnalyticsRowsParam, dataExplorerDebugAnalyticsRowsQuery, debugHubConvParam, debugMessageIdQuery, sandboxEgressPolicy, SANDBOX_EXEC_MAX_CMD_LENGTH, SANDBOX_EXEC_MAX_ALLOWLIST, SANDBOX_EXEC_MAX_TIMEOUT_MS, adminSandboxExecBody, whatsappCallbackBody, authMeResponse, wsTicketResponse, sessionCheckResponse, logoutResponse, magicCodeSendBody, magicCodeSendResponse, magicCodeVerifyBody, magicCodeVerifyResponse, browserParams, browserFoldersQuery, browserFilesQuery, stateOperationBody, conversationListResourcesQuery, conversationReadResourceQuery, listPendingSchedulesQuery, listHubAggregateSchedulesQuery, reportSourceSchema, intakeReportSourceSchema, reportClassificationSchema, reportStatusSchema, reportLocaleSchema, reportMessageAuthorRoleSchema, sentryRefStatusSchema, createReportBody, editReportBody, contestReportBody, reporterListQuery, listReportsQuery, GITHUB_ISSUE_URL_REGEX, githubIssueUrlSchema, transitionReportBody, groupReportsBody, holdReportBody, clickhouseReadyResponse, bootstrapQuery, requestSnapshotChunkMessage, MAX_NAME_LENGTH, MAX_VALUE_LENGTH, MAX_TAGS, MAX_TAG_LENGTH, MAX_SCOPE_HUBS, MAX_SCOPE_TAGS, vaultSecretScopeSchema, vaultCreateBody, vaultUpdateBody, PERMISSIONS, MAX_NAME_LENGTH2, MAX_HUBS_PER_GRANT, MAX_HUB_TAGS_PER_GRANT, MAX_GRANTS, permissionEnum, grantScopeSchema, grantSchema, createTokenBody, tokenOrgIdParam, tokenGrantScopeSchema, tokenGrantSchema, tokenMetadataSchema, listTokensResponse, createTokenResponse, orgTokenSummarySchema, listOrgTokensResponse, invitePreviewQuery, invitePreviewResponse, discordTier, discordBillingCycle, discordMetadata, discordOAuthStartResponse, discordOAuthFinalizeBody, discordOAuthFinalizeResponse, discordDisconnectResponse, jsonSchemaSchema, hubUserIdentity, stateValueEntry, getHubUserContextResponse, updateHubUserBody, updateHubUserResponse, unlockHubUserNameResponse, stateResetParams, stateResetResponse, hubAlertsParam, hubAlertSeverity, hubAlert, hubAlertsListResponse, noticeSeveritySchema, noticeStatusSchema, NOTICE_SCOPE_REGEX, noticeScopeSchema, noticeLinkSchema, createNoticeBody, updateNoticeBody, listNoticesQuery, noticeIdParamSchema, templateLocaleSchema, TEMPLATE_SLUG_REGEX, templateSlugSchema, templateStatusSchema, templateFileMapSchema, templateTextSchema, templateUsesEntrySchema, templateUsesSchema, templateYamlLocaleEntry, templateYamlWayaiBlock, templateTagsSchema, templateYamlSchema, templateHeroSchema, templatePushLocaleSchema, templatePushBody, templateListQuery, templateSlugParam, templateDetailQuery, ADMIN_SKILL_NAME_REGEX, adminSkillNameParam, WAYAI_WORKSPACE_LAYOUT, MAX_RESOURCE_FILE_SIZE;
 var init_dist = __esm({
   "../../packages/core/dist/index.js"() {
     "use strict";
@@ -5459,6 +5620,68 @@ var init_dist = __esm({
     init_zod();
     init_zod();
     init_zod();
+    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    HEX_RE = /^[0-9a-f]{16,}$/;
+    WORKOS_ID_RE = /^(?:user|org)_[0-9A-HJKMNP-TV-Z]{26}$/;
+    OPAQUE_SECRET_RE = /^[A-Za-z0-9_-]{21,}$/;
+    BASE64_SECRET_RE = /^[A-Za-z0-9+/]{20,}={0,2}$/;
+    BASE64_MARKER_RE = /[+=]/;
+    TOKEN_RE = new RegExp(
+      [
+        // WayAI API tokens and WebSocket tickets.
+        "(?:way|wst)_[A-Za-z0-9._-]{8,}",
+        // Authorization header values, including base64 Basic credentials.
+        "(?:Bearer|Basic)\\s+[A-Za-z0-9._~+/=-]{8,}",
+        // JWTs — WorkOS session/access tokens. `eyJ` is base64 for `{"`.
+        "eyJ[A-Za-z0-9._-]{10,}",
+        // Stripe secret/publishable/restricted keys and webhook signing secrets.
+        "(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{8,}",
+        "whsec_[A-Za-z0-9]{8,}"
+        // NOTE: LLM provider keys are NOT here — they need a delimiter-preserving
+        // boundary, so they live in PROVIDER_TOKEN_RE below.
+      ].join("|"),
+      "g"
+    );
+    SENSITIVE_FIELDS = [
+      "password",
+      "token",
+      "secret",
+      "api_key",
+      "apikey",
+      "api-key",
+      "authorization",
+      "auth",
+      "credential",
+      "private_key",
+      "privatekey",
+      "access_token",
+      "refresh_token",
+      "session_id",
+      "sessionid",
+      "cookie",
+      "jwt"
+    ];
+    SENSITIVE_KEY_ALTERNATION = SENSITIVE_FIELDS.map(
+      (field) => field.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+    ).join("|");
+    SENSITIVE_KEY_PATTERN = `[A-Za-z0-9_.-]*(?:${SENSITIVE_KEY_ALTERNATION})[A-Za-z0-9_.-]*`;
+    JSON_CREDENTIAL_RE = new RegExp(
+      `("${SENSITIVE_KEY_PATTERN}"\\s*:\\s*)"(?:[^"\\\\]|\\\\.)*"`,
+      "gi"
+    );
+    QUERY_CREDENTIAL_RE = new RegExp(
+      `((?:^|[?&;\\s])${SENSITIVE_KEY_PATTERN}=)[^&;\\s"']+`,
+      "gi"
+    );
+    REDACTED = "[REDACTED]";
+    PROVIDER_TOKEN_RE = new RegExp(
+      "(^|[^A-Za-z0-9])(?:" + [
+        "sk-[A-Za-z0-9_-]{16,}",
+        "AIza[A-Za-z0-9_-]{16,}",
+        "xai-[A-Za-z0-9_-]{16,}"
+      ].join("|") + ")",
+      "g"
+    );
     APP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("wayai.AppError");
     AppError = class extends Error {
       constructor(message, code, statusCode = 500, details) {
@@ -5490,7 +5713,7 @@ var init_dist = __esm({
     LLM_PROVIDER_HTTP_BRAND = /* @__PURE__ */ Symbol.for("wayai.LlmProviderHttpError");
     LlmProviderHttpError = class extends Error {
       constructor(message, status, provider, providerError) {
-        super(message);
+        super(redactSecrets(message));
         this.status = status;
         this.provider = provider;
         this.providerError = providerError;
@@ -5596,6 +5819,30 @@ var init_dist = __esm({
     idParamSchema = external_exports.object({
       id: uuidSchema
     });
+    clientOptionalString = external_exports.string().nullish().transform((v) => v ?? void 0);
+    clientOptionalBoolean = external_exports.boolean().nullish().transform((v) => v ?? void 0);
+    clientOptionalNumber = external_exports.number().nullish().transform((v) => v ?? void 0);
+    messageAttachment = external_exports.object({
+      /**
+       * Capped at the same 255 the storage layer already truncates names to, so nothing
+       * legitimate is lost — every filesystem caps there, and `sanitizeFileName` sliced
+       * longer names anyway.
+       *
+       * The bound is load-bearing, not hygiene: the RAW name is written to R2
+       * `customMetadata.originalFileName`, and R2 rejects oversized metadata. An unbounded
+       * name let a client make the R2 write throw a generic storage error — indistinguishable
+       * from a real outage — which pages us via `logger.error` and, on the app channel, is
+       * read as "we lost the file" and escalates the user to a human. Client input must not
+       * be able to impersonate an infrastructure failure (gh #3365).
+       */
+      file_name: external_exports.string().max(255),
+      /** Base64. Bounded by the route's bodyLimit, not by this schema. */
+      file_binary: external_exports.string(),
+      file_size: clientOptionalNumber,
+      file_extension: clientOptionalString
+    });
+    MAX_MESSAGE_BODY_BYTES = 10 * 1024 * 1024;
+    MAX_ATTACHMENTS_PER_MESSAGE = 20;
     primaryRegionSchema = external_exports.enum([
       "wnam",
       "enam",
@@ -5756,7 +6003,7 @@ var init_dist = __esm({
       eventName: external_exports.string().optional(),
       additional_instructions: external_exports.string().optional(),
       additional_context_schema: external_exports.record(external_exports.unknown()).refine(
-        (s) => JSON.stringify(s).length <= MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES,
+        (s) => withinJsonLength(s, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES),
         `additional_context_schema must be at most ${MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES} bytes when JSON-serialized`
       ).optional(),
       followups: external_exports.array(followupSchema).max(MAX_FOLLOWUPS_PER_STATUS, `followups must have at most ${MAX_FOLLOWUPS_PER_STATUS} entries`).optional(),
@@ -5982,6 +6229,9 @@ var init_dist = __esm({
     replicatePreviewBody = external_exports.object({
       preview_label: previewLabelField
     });
+    updateChannelTestIdentitiesBody = external_exports.object({
+      test_identities: external_exports.array(external_exports.string().max(320)).max(1e3)
+    });
     claimCodeChannelParam = external_exports.object({
       id: uuidSchema,
       channelId: uuidSchema
@@ -6632,12 +6882,15 @@ var init_dist = __esm({
     hubIdQuery = external_exports.object({
       hub_id: external_exports.string().uuid()
     });
+    EVAL_INPUT_ROLES = ["user", "system"];
+    EVAL_INPUT_ROLE_LIST = EVAL_INPUT_ROLES.map((r) => `"${r}"`).join(" or ");
+    ROLE_ECHO_MAX = 40;
     createEvalBody = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    });
+    }).superRefine(refineEvalMessageTextRole);
     updateEvalBody = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    });
+    }).superRefine(refineEvalMessageTextRole);
     getEvalsQuery = external_exports.object({
       hub_id: external_exports.string().uuid(),
       agent_id: external_exports.string().uuid().optional(),
@@ -6809,6 +7062,15 @@ var init_dist = __esm({
       hub_user_id: external_exports.string().optional(),
       search_filter: external_exports.string().optional(),
       hub_id: external_exports.string().uuid().optional(),
+      // NON-authorizing single-hub narrow. Unlike `hub_id` (which runs the
+      // grant-gated `loadHub('hub:read')` and so throws for grant-less end users /
+      // team members), `scope_hub_id` INTERSECTS the caller's already-resolved hub
+      // roster server-side. Intersecting the caller's own roster IS the
+      // authorization — a hub the caller isn't in narrows to empty and leaks
+      // nothing. Continuous history sends it to take the single-hub ended-index
+      // path (one HubDO read, accurate uncapped total) instead of the all-hub
+      // fan-out it would otherwise discard client-side (gh #3319).
+      scope_hub_id: external_exports.string().uuid().optional(),
       conversation_id: external_exports.string().uuid().optional(),
       // 'ended' = recently-closed, served warm from the HubDO index (≤ retention
       // window). 'archived' = the full closed-conversation history from ClickHouse.
@@ -6849,17 +7111,8 @@ var init_dist = __esm({
         });
       }
     });
-    clientOptionalString = external_exports.string().nullish().transform((v) => v ?? void 0);
-    clientOptionalBoolean = external_exports.boolean().nullish().transform((v) => v ?? void 0);
     appMessageSenderType = external_exports.enum(["user", "team"]);
     appMessageReceiverType = external_exports.enum(["user", "team", "agent", "assistant"]).transform((v) => v === "assistant" ? "agent" : v);
-    appMessageAttachment = external_exports.object({
-      file_name: external_exports.string(),
-      file_binary: external_exports.string(),
-      file_size: external_exports.number().nullish().transform((v) => v ?? void 0),
-      file_extension: clientOptionalString
-    });
-    MAX_ATTACHMENTS_PER_MESSAGE = 20;
     appMessageBody = external_exports.object({
       // Message content — three historical aliases. All optional: an attachment-only
       // or voice-only message carries no text.
@@ -6888,7 +7141,7 @@ var init_dist = __esm({
       // Pre-generated by the client so the optimistic bubble and the stored row share
       // a key (transcription live-updates land on the same row instead of duplicating).
       message_id: clientOptionalString,
-      attachments: external_exports.array(appMessageAttachment).max(MAX_ATTACHMENTS_PER_MESSAGE).nullish().transform((v) => v ?? void 0),
+      attachments: external_exports.array(messageAttachment).max(MAX_ATTACHMENTS_PER_MESSAGE).nullish().transform((v) => v ?? void 0),
       // Base64-encoded audio for STT. Size-capped in the route (the cap is a byte
       // budget tied to the /channels/* bodyLimit, not a shape rule).
       audio_file: clientOptionalString
@@ -7015,7 +7268,7 @@ var init_dist = __esm({
       hub_type: external_exports.enum(["chat", "task"]).default("chat"),
       user_id: external_exports.string().optional()
     });
-    additionalContextPayloadSchema = external_exports.record(external_exports.unknown()).refine((r) => JSON.stringify(r).length <= 16384, {
+    additionalContextPayloadSchema = external_exports.record(external_exports.unknown()).refine((r) => withinJsonLength(r, 16384), {
       message: "additional_context payload must be at most 16384 bytes when JSON-serialized"
     });
     kanbanUpdateBody = external_exports.object({
@@ -7059,11 +7312,27 @@ var init_dist = __esm({
     ]);
     sendMessageBody = external_exports.object({
       hub_id: external_exports.string().uuid(),
-      message: external_exports.string().min(1).max(5e4),
+      /**
+       * Optional ONLY when `attachments` carries the payload — see the refinement below.
+       * An attachment-only message (a photo with no caption) is the ordinary WhatsApp
+       * gesture, so the endpoint that exists to rehearse inbound flows has to express it.
+       * Mirrors `appMessageBody`, where content is optional for the same reason.
+       */
+      message: external_exports.string().min(1).max(5e4).optional(),
       /** For chat hubs: optional — automatically continues the user's active conversation (or creates one).
        *  For task hubs: required to continue an existing conversation. Omit to start a new task conversation. */
-      conversation_id: external_exports.string().uuid().optional()
-    });
+      conversation_id: external_exports.string().uuid().optional(),
+      /**
+       * Base64 attachments, delivered over the hub's `app` channel exactly as a real
+       * channel delivers them. Total bytes are bounded by the route's bodyLimit —
+       * `/api/*` carries no global one (only `/webhooks/*` and `/channels/*` do), so the
+       * route declares its own rather than inheriting an unbounded upload path.
+       */
+      attachments: external_exports.array(messageAttachment).max(MAX_ATTACHMENTS_PER_MESSAGE).optional()
+    }).refine(
+      (b) => (b.message?.length ?? 0) > 0 || (b.attachments?.length ?? 0) > 0,
+      { message: "message or attachments required" }
+    );
     listConversationsQuery = external_exports.object({
       hub_id: external_exports.string().uuid(),
       status: external_exports.enum(["agent", "team", "ended"]).optional(),
@@ -7275,6 +7544,7 @@ var init_dist = __esm({
       refineHubAsCodeCustomTools(config, ctx);
       refineHubAsCodeKanbanStatuses(config, ctx);
       refineHubAsCodeLanes(config, ctx);
+      refineHubAsCodeEvals(config, ctx);
     });
     ciPullHubIdParam = external_exports.object({
       hub_id: ciUuidSchema
@@ -8418,7 +8688,7 @@ function findHubByFolderName(workspaceDir, hubFolderName) {
 function resolveHubFolderBySelector(hubsDir, selector) {
   const asPath = path2.resolve(selector);
   if (isDirectory(asPath) && fs2.existsSync(path2.join(asPath, "hub.yaml"))) return asPath;
-  if (UUID_RE.test(selector)) {
+  if (UUID_RE2.test(selector)) {
     const match = scanWorkspaceHubs(hubsDir).find((h) => h.hubId === selector);
     return match ? match.hubFolder : null;
   }
@@ -8525,7 +8795,7 @@ function resolveActiveHubId(args2) {
   const workspaceDir = workspace?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
   const wsLabel = hubsDirLabel(gitRoot);
   if (!workspaceDir || !fs2.existsSync(workspaceDir)) {
-    if (selector && UUID_RE.test(selector)) return selector;
+    if (selector && UUID_RE2.test(selector)) return selector;
     console.error(`No ${wsLabel}/ directory found. Run \`wayai pull --hub <uuid>\` to fetch a hub, or pass --hub <uuid>.`);
     process.exit(1);
   }
@@ -8535,7 +8805,7 @@ function resolveActiveHubId(args2) {
       (h) => h.hubId === selector || path2.basename(h.hubFolder) === selector
     );
     if (match) return match.hubId;
-    if (UUID_RE.test(selector)) return selector;
+    if (UUID_RE2.test(selector)) return selector;
     console.error(`No hub matching --hub ${selector} found in ${wsLabel}/.`);
     process.exit(1);
   }
@@ -8608,7 +8878,7 @@ function readRepoConfig(root) {
       }
       return null;
     }
-    if (!UUID_RE.test(config.organization_id)) return null;
+    if (!UUID_RE2.test(config.organization_id)) return null;
     const presentLegacy = LEGACY_FIELDS.filter((f) => config[f] !== void 0);
     warnAboutLegacyFields(presentLegacy);
     const organizationName = typeof config.organization_name === "string" && config.organization_name.trim() ? config.organization_name.trim() : void 0;
@@ -8784,7 +9054,7 @@ function parseDateArg(date, position) {
 }
 async function resolveOrganizationId(client, orgIdFlag) {
   if (orgIdFlag) {
-    if (!UUID_RE.test(orgIdFlag)) {
+    if (!UUID_RE2.test(orgIdFlag)) {
       console.error("Invalid --org value. Expected a UUID.");
       process.exit(1);
     }
@@ -8842,12 +9112,12 @@ function isNewerVersion(latest, current) {
   }
   return false;
 }
-var UUID_RE, slugify, OWN_HELP_COMMANDS;
+var UUID_RE2, slugify, OWN_HELP_COMMANDS;
 var init_utils = __esm({
   "src/lib/utils.ts"() {
     "use strict";
     init_dist();
-    UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     slugify = slugifySkillName;
     OWN_HELP_COMMANDS = /* @__PURE__ */ new Set([
       "eval",
@@ -8868,9 +9138,9 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path27 = getVersionCachePath(filename);
-    if (!existsSync4(path27)) return null;
-    const parsed = JSON.parse(readFileSync5(path27, "utf-8"));
+    const path28 = getVersionCachePath(filename);
+    if (!existsSync4(path28)) return null;
+    const parsed = JSON.parse(readFileSync5(path28, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -8890,10 +9160,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path27 = getVersionCachePath(filename);
-  const dir = dirname3(path27);
+  const path28 = getVersionCachePath(filename);
+  const dir = dirname3(path28);
   if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(path27, JSON.stringify(cache));
+  writeFileSync2(path28, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -8932,14 +9202,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path27 = join7(projectRoot, rel);
-    if (!existsSync5(path27)) continue;
+    const path28 = join7(projectRoot, rel);
+    if (!existsSync5(path28)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path27, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path28, "utf-8"));
     } catch {
     }
-    found.push({ path: path27, version });
+    found.push({ path: path28, version });
   }
   return found;
 }
@@ -9361,7 +9631,7 @@ async function exchangeCodeForTokens(authkitDomain, clientId, code, codeVerifier
   });
   if (!response.ok) {
     const body = await response.text();
-    throw new Error(`Token exchange failed (${response.status}): ${redactSecrets(body)}`);
+    throw new Error(`Token exchange failed (${response.status}): ${maskSecretsInMessage(body)}`);
   }
   return response.json();
 }
@@ -9387,7 +9657,7 @@ async function refreshAccessToken(authkitDomain, clientId, refreshToken) {
       }
       if (isInvalidGrant) throw new Error("SESSION_EXPIRED");
     }
-    throw new Error(`Token refresh failed (${status}): ${redactSecrets(body)}`);
+    throw new Error(`Token refresh failed (${status}): ${maskSecretsInMessage(body)}`);
   }
   return response.json();
 }
@@ -9519,7 +9789,7 @@ var init_auth = __esm({
     init_config();
     init_token_store();
     init_sentry();
-    init_redact();
+    init_mask_secrets();
     OAUTH_CALLBACK_PORT = 3829;
     AUTHKIT_DOMAIN = "https://sprightly-comic-51.authkit.app";
     AUTHKIT_CLIENT_ID = "client_01KMZHB50KENM5SV90ZA80VXK4";
@@ -9842,12 +10112,12 @@ function readBinding() {
       throw err;
     }
     const trimmed = raw.trim();
-    return UUID_RE.test(trimmed) ? trimmed : null;
+    return UUID_RE2.test(trimmed) ? trimmed : null;
   }
   return null;
 }
 function writeBinding(hubId) {
-  if (!UUID_RE.test(hubId)) {
+  if (!UUID_RE2.test(hubId)) {
     throw new Error(`Invalid hub_id (must be a UUID): ${hubId}`);
   }
   const bindingPath = getBindingPath();
@@ -10317,7 +10587,7 @@ async function initCommand(args2) {
   );
 }
 async function initDirect(client, orgId) {
-  if (!UUID_RE.test(orgId)) {
+  if (!UUID_RE2.test(orgId)) {
     console.error("Invalid organization ID. Expected a UUID.");
     process.exit(1);
   }
@@ -11297,7 +11567,7 @@ function resolveHubTarget(workspaceDir, selector) {
       (h) => h.hubId === selector || path14.basename(h.hubFolder) === selector
     );
     if (match) return { hubId: match.hubId, hubFolder: match.hubFolder };
-    if (UUID_RE.test(selector)) return { hubId: selector, hubFolder: null };
+    if (UUID_RE2.test(selector)) return { hubId: selector, hubFolder: null };
     console.error(`No hub matching --hub ${selector} found in ${wsLabel}/. Pass a UUID for first-time pulls.`);
     process.exit(1);
   }
@@ -11800,7 +12070,7 @@ New hub: "${newHub.hubName}" (${hubType})`);
   });
   const createdHub = createResult.data[0];
   const hubId = createdHub.hub_id;
-  if (!UUID_RE.test(hubId)) {
+  if (!UUID_RE2.test(hubId)) {
     console.error(`Invalid hub_id received from server: ${hubId}`);
     process.exit(1);
   }
@@ -12066,6 +12336,18 @@ var init_diff = __esm({
 });
 
 // ../../packages/core/dist/contracts/index.js
+function jsonLengthOrNull2(value) {
+  try {
+    const json = JSON.stringify(value);
+    return typeof json === "string" ? json.length : null;
+  } catch {
+    return null;
+  }
+}
+function withinJsonLength2(value, max) {
+  const length = jsonLengthOrNull2(value);
+  return length !== null && length <= max;
+}
 function normalizeAuthType2(raw) {
   if (VALID_AUTH_TYPES3.has(raw)) return raw;
   return LEGACY_AUTH_TYPE_MAP3[raw] ?? raw;
@@ -12136,12 +12418,12 @@ function typeMatches2(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema2(schema, path27, errors, opts = {}) {
+function validateSchema2(schema, path28, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH2) {
     errors.push({
-      path: path27 || "<root>",
+      path: path28 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH2} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -12149,7 +12431,7 @@ function validateSchema2(schema, path27, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path27,
+      path: path28,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -12157,14 +12439,14 @@ function validateSchema2(schema, path27, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path27 ? `${path27}.type` : "type",
+        path: path28 ? `${path28}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches2(schema.type, ALLOWED_TYPES2)) {
     errors.push({
-      path: `${path27}.type`,
+      path: `${path28}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES2].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -12173,25 +12455,25 @@ function validateSchema2(schema, path27, errors, opts = {}) {
     if (typeof e === "string") {
       const isPlaceholder = PLACEHOLDER_TOKENS2.includes(e);
       errors.push({
-        path: `${path27}.enum`,
+        path: `${path28}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path27}.enum`,
+        path: `${path28}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path27}.enum`,
+        path: `${path28}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive2(e[i])) {
           errors.push({
-            path: `${path27}.enum[${i}]`,
+            path: `${path28}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -12201,7 +12483,7 @@ function validateSchema2(schema, path27, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path27}.${key}`,
+        path: `${path28}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -12210,45 +12492,45 @@ function validateSchema2(schema, path27, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path27}.properties`,
+        path: `${path28}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema2(propSchema, `${path27}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema2(propSchema, `${path28}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes2(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema2(sub, `${path27}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema2(sub, `${path28}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema2(schema.items, `${path27}.items`, errors, { depth: depth + 1 });
+      validateSchema2(schema.items, `${path28}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS2) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema2(schema[key], `${path27}.${key}`, errors, { depth: depth + 1 });
+      validateSchema2(schema[key], `${path28}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS2) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema2(sub, `${path27}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema2(sub, `${path28}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS2) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema2(sub, `${path27}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema2(sub, `${path28}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path27}.${k}`;
+    const fieldPath = `${path28}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS2) {
       if (v === token) {
@@ -12313,6 +12595,45 @@ function refineToolConfig2(value, ctx) {
     }
   }
 }
+function describeRole2(role) {
+  if (typeof role === "string") {
+    return JSON.stringify(role.length > ROLE_ECHO_MAX2 ? `${role.slice(0, ROLE_ECHO_MAX2)}\u2026` : role);
+  }
+  if (role === null) return "null";
+  if (Array.isArray(role)) return "an array";
+  if (typeof role === "object") return "an object";
+  return `a ${typeof role}`;
+}
+function asEvalInputRecord2(input) {
+  const value = typeof input === "string" ? (() => {
+    try {
+      return JSON.parse(input);
+    } catch {
+      return null;
+    }
+  })() : input;
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function evalInputRoleError2(input) {
+  const record = asEvalInputRecord2(input);
+  if (record === null) return null;
+  const role = record.role;
+  if (role === void 0 || role === null) return null;
+  if (typeof role === "string" && EVAL_INPUT_ROLES2.includes(role)) {
+    return null;
+  }
+  return `role must be ${EVAL_INPUT_ROLE_LIST2} (received ${describeRole2(role)}) \u2014 an eval trigger is what the responder answers, and an assistant or tool role gives it nothing to answer`;
+}
+function refineEvalMessageTextRole2(value, ctx) {
+  const error = evalInputRoleError2(value.eval.message_text);
+  if (error) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["eval", "message_text", "role"],
+      message: error
+    });
+  }
+}
 function refineHubAsCodeCustomTools2(config, ctx) {
   const agents = config.agents;
   if (!Array.isArray(agents)) return;
@@ -12404,10 +12725,26 @@ function refineHubAsCodeLanes2(config, ctx) {
     }
   }
 }
-function isSafeTemplatePath2(path27) {
-  if (path27.length === 0 || path27.length > 300) return false;
-  if (path27.startsWith("/") || path27.includes("\\")) return false;
-  const segments = path27.split("/");
+function refineHubAsCodeEvals2(config, ctx) {
+  const evals = config.evals;
+  if (!Array.isArray(evals)) return;
+  for (let e = 0; e < evals.length; e++) {
+    const entry = evals[e];
+    const error = evalInputRoleError2(entry?.input);
+    if (error) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["evals", e, "input", "role"],
+        // Named, not just indexed — the YAML author has files, not an array.
+        message: `eval "${entry?.name ?? "<unnamed>"}": ${error}`
+      });
+    }
+  }
+}
+function isSafeTemplatePath2(path28) {
+  if (path28.length === 0 || path28.length > 300) return false;
+  if (path28.startsWith("/") || path28.includes("\\")) return false;
+  const segments = path28.split("/");
   return segments.every(
     (seg) => seg.length > 0 && seg !== "." && seg !== ".." && /^[A-Za-z0-9._-]+$/.test(seg)
   );
@@ -12435,14 +12772,14 @@ function isPlainObject(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 }
-function isSanitizableSliceFile(path27) {
-  if (!/\.ya?ml$/i.test(path27)) return false;
-  return path27 !== "resources" && !path27.startsWith("resources/");
+function isSanitizableSliceFile(path28) {
+  if (!/\.ya?ml$/i.test(path28)) return false;
+  return path28 !== "resources" && !path28.startsWith("resources/");
 }
 function distinctUsesBackends(uses) {
   return [...new Set((uses ?? []).map((u) => u.backend))];
 }
-var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, clientOptionalString2, clientOptionalBoolean2, appMessageSenderType2, appMessageReceiverType2, appMessageAttachment2, MAX_ATTACHMENTS_PER_MESSAGE2, appMessageBody2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminHubIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminSetOrgHarnessBody2, adminSetHubHarnessBody2, adminScopedTargetBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
+var uuidSchema2, paginationSchema3, timestampSchema2, idParamSchema2, clientOptionalString2, clientOptionalBoolean2, clientOptionalNumber2, messageAttachment2, MAX_MESSAGE_BODY_BYTES2, MAX_ATTACHMENTS_PER_MESSAGE2, primaryRegionSchema2, placementSourceSchema2, orgIdParam2, orgAdminIdParam2, createOrganizationBody2, updateOrganizationBody2, addOrgAdminBody2, AUTH_TYPE3, ORG_CREDENTIAL_AUTH_TYPES3, AUTH_TYPE_DISPLAY3, LEGACY_AUTH_TYPE_MAP3, VALID_AUTH_TYPES3, AGENT_ROLES2, SAFE_USER_ID_REGEX2, SUPPORTED_LOCALES2, SUMMARIZATION_THRESHOLD_MIN2, SUMMARIZATION_THRESHOLD_MAX2, summarizationThresholdField2, monitorConfigField2, agentIdParam2, listAgentsQuery2, agentConnectionsQuery2, createAgentBody2, updateAgentBody2, AGENT_PARAMETER_TYPES2, AGENT_PARAMETER_NAME_REGEX2, agentParameterCreateSchema2, MAX_AGENT_PARAMETERS_PER_REQUEST2, createAgentParametersBody2, SLUG_REGEX2, slugSchema2, INVISIBLE_NAME_CHARS2, MAX_KANBAN_STATUSES2, MAX_FOLLOWUPS_PER_STATUS2, MAX_LANES2, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2, RESERVED_TEMPLATE_DUMP_NAME2, kanbanStatusSlugSchema2, followupSchema2, EXCLUSIVE_FLAG_PAIRS2, kanbanStatusSchema2, kanbanStatusesArraySchema2, laneSchema2, lanesArraySchema2, hubIdParam2, hubAdminIdParam2, hubUserIdParam2, hubIdentityIdParam2, hubTeamIdParam2, hubTeamUserDeleteParam2, hubSchemaQuery2, PREVIEW_LABEL_MAX_LENGTH2, MAX_ENDED_INDEX_RETENTION_DAYS2, previewLabelField2, createHubBody2, updateHubBody2, addHubAdminBody2, addHubIdentityAuthorizationBody2, contactDecisionBody2, approveContactBody2, listContactAccessQuery2, createHubTeamBody2, updateHubTeamBody2, addHubTeamUserBody2, reassignHubUserBody2, replicatePreviewBody2, updateChannelTestIdentitiesBody2, claimCodeChannelParam2, claimCodeDeleteParam2, connectionIdParam2, connectorIdParam2, listConnectionsQuery2, deleteConnectionQuery2, addConnectionBody2, editConnectionBody2, PRODUCTION_DIRECT_FIELDS2, setProductionCredentialBody2, registerWhatsappQuery2, registerWhatsappBody2, retryProvisioningQuery2, resendDomainStatusQuery2, PLACEHOLDER_TOKENS2, ALLOWED_TYPES2, SUBSCHEMA_OBJECT_KEYWORDS2, SUBSCHEMA_LIST_KEYWORDS2, SUBSCHEMA_MAP_KEYWORDS2, MAX_SCHEMA_DEPTH2, toolIdParam2, listToolsQuery2, toolAgentQuery2, deleteToolQuery2, toolConnectionsQuery2, nativeToolIdSchema2, addNativeToolBody2, addMcpToolBody2, createCustomToolBody2, updateCustomToolBody2, updateToolExecutionConfigBody2, initialValueCreateSchema2, initialValueUpdateSchema2, stateIdParam2, listStatesQuery2, stateNameSchema2, createStateBody2, updateStateBody2, reorderStatesBody2, variantAiModeSchema2, experimentStatusSchema2, overlayUpdateSchema2, experimentIdParam2, variantIdParam2, listExperimentsQuery2, listVariantsQuery2, listOverridesQuery2, deleteOverrideQuery2, createExperimentBody2, updateExperimentBody2, setExperimentStatusBody2, createVariantBody2, updateVariantBody2, upsertOverrideBody2, orgTagIdParam2, listOrgTagsQuery2, createOrgTagBody2, updateOrgTagBody2, orgCredentialIdParam2, listOrgCredentialsQuery2, createOrgCredentialBody2, updateOrgCredentialBody2, orgResourceIdParam2, orgResourceFileIdParam2, orgResourceFolderIdParam2, hubOrgResourceParam2, listOrgResourcesQuery2, orgIdQuery2, createOrgResourceBody2, updateOrgResourceBody2, createOrgResourceFolderBody2, updateOrgResourceFolderBody2, uploadOrgResourceFileBody2, updateOrgResourceFileBody2, uploadOrgSkillZipBody2, linkOrgResourceBody2, resourceIdParam2, listResourcesQuery2, createResourceBody2, updateResourceBody2, syncSkillsBody2, resourceFileIdParam2, listResourceFilesQuery2, createResourceFileBody2, updateResourceFileBody2, uploadResourceFileBody2, uploadSkillZipBody2, resourceFolderIdParam2, listResourceFoldersQuery2, createResourceFolderBody2, updateResourceFolderBody2, agentResourceQuery2, hubResourceQuery2, linkAgentResourceBody2, updateAgentResourceBody2, unlinkAgentResourceQuery2, navItemSchema2, hubCountResetBody2, navItemCountResetBody2, typingBody2, analyticsHubIdParam2, analyticsVariableIdParam2, updateVariablePinBody2, updateAnalyticsViewBody2, NUMERIC_FILTER_OPS2, TEXT_FILTER_OPS2, CATEGORICAL_FILTER_OPS2, VARIABLE_FILTER_OPS2, STRUCTURED_QUERY_OPS2, STRUCTURED_QUERY_AGGREGATIONS2, filterValueSchema2, conversationsBody2, analyticsConversationIdParam2, messagesQuery2, conversationDetailDataQuery2, analyticsDataBody2, structuredQueryBody2, analyticsSqlBody2, analyticsSqlSchemaQuery2, EVAL_PACING_PRESET_NAMES2, PACING_INTERVAL_MIN_MS2, PACING_INTERVAL_MAX_MS2, EVAL_RUN_DEADLINE_MIN_MS2, EVAL_RUN_DEADLINE_MAX_MS2, paginationSchema22, evalIdParam2, sessionIdParam2, scenarioSetIdParam2, hubIdQuery2, EVAL_INPUT_ROLES2, EVAL_INPUT_ROLE_LIST2, ROLE_ECHO_MAX2, createEvalBody2, updateEvalBody2, getEvalsQuery2, toggleEvalBody2, bulkToggleEvalsBody2, pacingConfigSchema2, sessionConfigSchema2, createSessionBody2, getSessionsQuery2, getSessionResultsQuery2, getSessionRunsQuery2, evalAnalyticsQuery2, getSessionCostQuery2, compareSessionsQuery2, evalsSqlBody2, evalsSqlSchemaQuery2, exportResultsQuery2, validateEvalBody2, hubAgentsQuery2, createScenarioSetBody2, updateScenarioSetBody2, scenarioSetsHubQuery2, createScenarioFromConversationBody2, createJourneyFromConversationBody2, journeyIdParam2, journeyToolCallSchema2, journeyTurnSchema2, journeyStepOverrideSchema2, fixtureField2, createJourneyBody2, updateJourneyBody2, getConversationsQuery2, getMessagesQuery2, appMessageSenderType2, appMessageReceiverType2, appMessageBody2, updateUserBody2, updateProfileBody2, pathnameRegex2, updatePreferencesBody2, registerPushTokenBody2, deletePushTokenQuery2, activityQuery2, deletionModeSchema2, deletionRequestBody2, archiveHubIdParam2, archiveConversationParams2, archiveListQuery2, archiveMessageObservabilityParams2, conversationIdParam2, claimBody2, releaseBody2, transferBody2, closeBody2, additionalContextPayloadSchema2, kanbanUpdateBody2, annotateConversationBody2, observabilityParams2, observabilityListParams2, deleteUserConversationsBody2, sendMessageBody2, listConversationsQuery2, getConversationDetailParams2, getConversationDetailQuery2, listWhatsAppTemplatesQuery2, sendWhatsAppTemplateBody2, billingOrgIdParam2, subscriptionItemParams2, spendCapBody2, growthPacksBody2, portalSessionBody2, checkoutSessionBody2, updateBillingCurrencyBody2, invoicesQuery2, downloadBody2, uploadQuery2, signUrlBody2, outboundSchemaQuery2, templateIdParam2, listTemplatesQuery2, deleteTemplateQuery2, templateStatusQuery2, createTemplateBody2, updateTemplateBody2, submitTemplateBody2, testTemplateBody2, contactIdParam2, listContactsQuery2, createContactBody2, updateContactBody2, listIdParam2, listListsQuery2, listListContactsQuery2, createListBody2, updateListBody2, addListContactsBody2, removeListContactsBody2, scheduleIdParam2, listSchedulesQuery2, listExecutionsQuery2, createScheduleBody2, updateScheduleBody2, uuidPattern2, ciUuidSchema2, hubAsCodeConfigSchema2, ciPullHubIdParam2, ciBranchParam2, ciPullQuery2, ciHubsQuery2, ciLookupQuery2, ciBranchesQuery2, ciSyncBody2, ciPushBody2, ciDiffBody2, ciPublishBody2, ciPublishPreviewBody2, ciSyncMcpBody2, ciOrgResourcesParam2, orgResourcesConfigSchema2, ciOrgResourcesPushBody2, ciOrgResourcesDiffBody2, adminOrgIdParam2, adminOrgAdminIdParam2, adminUserIdParam2, adminPlanIdParam2, adminHubIdParam2, adminOrganizationsQuery2, adminUserSearchQuery2, kanbanSlugMigrationQuery2, adjustQuotaBody2, updatePlanBody2, addAdminUserBody2, updatePlatformConfigBody2, updateFreeOrgLimitBody2, adminSetOrgHarnessBody2, adminSetHubHarnessBody2, adminScopedTargetBody2, updatePricingPlanBody2, dataExplorerSearchQuery2, dataExplorerOrgIdParam2, dataExplorerHubIdParam2, dataExplorerConvIdParam2, dataExplorerDoInstancesQuery2, dataExplorerNsIdParam2, dataExplorerKvKeysQuery2, dataExplorerKvKeyParam2, uuidOrHexId2, dataExplorerDeleteOrgParam2, dataExplorerDeleteHubParam2, dataExplorerDeleteConvParam2, dataExplorerDeleteUserParam2, dataExplorerDeleteQuery2, dataExplorerKvDeleteQuery2, pitrDoNamespace2, pitrBookmarkParam2, pitrRestoreBody2, healthSamplingTriggerBody2, dataExplorerDebugDoType2, DEBUG_READ_MAX_LIMIT2, DEBUG_READ_DEFAULT_LIMIT2, DEBUG_DO_HEX_PREFIX2, debugDoEntityId2, debugTableName2, dataExplorerDebugTablesParam2, dataExplorerDebugRowsParam2, dataExplorerDebugRowsQuery2, dataExplorerDebugAnalyticsTable2, debugUuid2, dataExplorerDebugAnalyticsRowsParam2, dataExplorerDebugAnalyticsRowsQuery2, debugHubConvParam2, debugMessageIdQuery2, sandboxEgressPolicy2, SANDBOX_EXEC_MAX_CMD_LENGTH2, SANDBOX_EXEC_MAX_ALLOWLIST2, SANDBOX_EXEC_MAX_TIMEOUT_MS2, adminSandboxExecBody2, whatsappCallbackBody2, authMeResponse2, wsTicketResponse2, sessionCheckResponse2, logoutResponse2, magicCodeSendBody2, magicCodeSendResponse2, magicCodeVerifyBody2, magicCodeVerifyResponse2, browserParams2, browserFoldersQuery2, browserFilesQuery2, stateOperationBody2, conversationListResourcesQuery2, conversationReadResourceQuery2, listPendingSchedulesQuery2, listHubAggregateSchedulesQuery2, reportSourceSchema2, intakeReportSourceSchema2, reportClassificationSchema2, reportStatusSchema2, reportLocaleSchema2, reportMessageAuthorRoleSchema2, sentryRefStatusSchema2, createReportBody2, editReportBody2, contestReportBody2, reporterListQuery2, listReportsQuery2, GITHUB_ISSUE_URL_REGEX2, githubIssueUrlSchema2, transitionReportBody2, groupReportsBody2, holdReportBody2, clickhouseReadyResponse2, bootstrapQuery2, requestSnapshotChunkMessage2, MAX_NAME_LENGTH3, MAX_VALUE_LENGTH2, MAX_TAGS2, MAX_TAG_LENGTH2, MAX_SCOPE_HUBS2, MAX_SCOPE_TAGS2, vaultSecretScopeSchema2, vaultCreateBody2, vaultUpdateBody2, PERMISSIONS2, MAX_NAME_LENGTH22, MAX_HUBS_PER_GRANT2, MAX_HUB_TAGS_PER_GRANT2, MAX_GRANTS2, permissionEnum2, grantScopeSchema2, grantSchema2, createTokenBody2, tokenOrgIdParam2, tokenGrantScopeSchema2, tokenGrantSchema2, tokenMetadataSchema2, listTokensResponse2, createTokenResponse2, orgTokenSummarySchema2, listOrgTokensResponse2, invitePreviewQuery2, invitePreviewResponse2, discordTier2, discordBillingCycle2, discordMetadata2, discordOAuthStartResponse2, discordOAuthFinalizeBody2, discordOAuthFinalizeResponse2, discordDisconnectResponse2, jsonSchemaSchema2, hubUserIdentity2, stateValueEntry2, getHubUserContextResponse2, updateHubUserBody2, updateHubUserResponse2, unlockHubUserNameResponse2, stateResetParams2, stateResetResponse2, hubAlertsParam2, hubAlertSeverity2, hubAlert2, hubAlertsListResponse2, noticeSeveritySchema2, noticeStatusSchema2, NOTICE_SCOPE_REGEX2, noticeScopeSchema2, noticeLinkSchema2, createNoticeBody2, updateNoticeBody2, listNoticesQuery2, noticeIdParamSchema2, templateLocaleSchema2, TEMPLATE_SLUG_REGEX2, templateSlugSchema2, templateStatusSchema2, templateFileMapSchema2, TEMPLATE_INSTANCE_ID_KEYS, TEMPLATE_OPAQUE_BLOB_KEYS, TEMPLATE_AUTHOR_DATA_KEYS, templateTextSchema2, templateUsesEntrySchema2, templateUsesSchema2, templateYamlLocaleEntry2, templateYamlWayaiBlock2, templateTagsSchema2, templateYamlSchema2, templateHeroSchema2, templatePushLocaleSchema2, templatePushBody2, templateListQuery2, templateSlugParam2, templateDetailQuery2, ADMIN_SKILL_NAME_REGEX2, adminSkillNameParam2;
 var init_contracts = __esm({
   "../../packages/core/dist/contracts/index.js"() {
     "use strict";
@@ -12503,6 +12840,30 @@ var init_contracts = __esm({
     idParamSchema2 = external_exports.object({
       id: uuidSchema2
     });
+    clientOptionalString2 = external_exports.string().nullish().transform((v) => v ?? void 0);
+    clientOptionalBoolean2 = external_exports.boolean().nullish().transform((v) => v ?? void 0);
+    clientOptionalNumber2 = external_exports.number().nullish().transform((v) => v ?? void 0);
+    messageAttachment2 = external_exports.object({
+      /**
+       * Capped at the same 255 the storage layer already truncates names to, so nothing
+       * legitimate is lost — every filesystem caps there, and `sanitizeFileName` sliced
+       * longer names anyway.
+       *
+       * The bound is load-bearing, not hygiene: the RAW name is written to R2
+       * `customMetadata.originalFileName`, and R2 rejects oversized metadata. An unbounded
+       * name let a client make the R2 write throw a generic storage error — indistinguishable
+       * from a real outage — which pages us via `logger.error` and, on the app channel, is
+       * read as "we lost the file" and escalates the user to a human. Client input must not
+       * be able to impersonate an infrastructure failure (gh #3365).
+       */
+      file_name: external_exports.string().max(255),
+      /** Base64. Bounded by the route's bodyLimit, not by this schema. */
+      file_binary: external_exports.string(),
+      file_size: clientOptionalNumber2,
+      file_extension: clientOptionalString2
+    });
+    MAX_MESSAGE_BODY_BYTES2 = 10 * 1024 * 1024;
+    MAX_ATTACHMENTS_PER_MESSAGE2 = 20;
     primaryRegionSchema2 = external_exports.enum([
       "wnam",
       "enam",
@@ -12706,7 +13067,7 @@ var init_contracts = __esm({
       eventName: external_exports.string().optional(),
       additional_instructions: external_exports.string().optional(),
       additional_context_schema: external_exports.record(external_exports.unknown()).refine(
-        (s) => JSON.stringify(s).length <= MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2,
+        (s) => withinJsonLength2(s, MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2),
         `additional_context_schema must be at most ${MAX_ADDITIONAL_CONTEXT_SCHEMA_BYTES2} bytes when JSON-serialized`
       ).optional(),
       followups: external_exports.array(followupSchema2).max(MAX_FOLLOWUPS_PER_STATUS2, `followups must have at most ${MAX_FOLLOWUPS_PER_STATUS2} entries`).optional(),
@@ -12932,6 +13293,9 @@ var init_contracts = __esm({
     replicatePreviewBody2 = external_exports.object({
       preview_label: previewLabelField2
     });
+    updateChannelTestIdentitiesBody2 = external_exports.object({
+      test_identities: external_exports.array(external_exports.string().max(320)).max(1e3)
+    });
     claimCodeChannelParam2 = external_exports.object({
       id: uuidSchema2,
       channelId: uuidSchema2
@@ -13582,12 +13946,15 @@ var init_contracts = __esm({
     hubIdQuery2 = external_exports.object({
       hub_id: external_exports.string().uuid()
     });
+    EVAL_INPUT_ROLES2 = ["user", "system"];
+    EVAL_INPUT_ROLE_LIST2 = EVAL_INPUT_ROLES2.map((r) => `"${r}"`).join(" or ");
+    ROLE_ECHO_MAX2 = 40;
     createEvalBody2 = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    });
+    }).superRefine(refineEvalMessageTextRole2);
     updateEvalBody2 = external_exports.object({
       eval: external_exports.record(external_exports.unknown())
-    });
+    }).superRefine(refineEvalMessageTextRole2);
     getEvalsQuery2 = external_exports.object({
       hub_id: external_exports.string().uuid(),
       agent_id: external_exports.string().uuid().optional(),
@@ -13759,6 +14126,15 @@ var init_contracts = __esm({
       hub_user_id: external_exports.string().optional(),
       search_filter: external_exports.string().optional(),
       hub_id: external_exports.string().uuid().optional(),
+      // NON-authorizing single-hub narrow. Unlike `hub_id` (which runs the
+      // grant-gated `loadHub('hub:read')` and so throws for grant-less end users /
+      // team members), `scope_hub_id` INTERSECTS the caller's already-resolved hub
+      // roster server-side. Intersecting the caller's own roster IS the
+      // authorization — a hub the caller isn't in narrows to empty and leaks
+      // nothing. Continuous history sends it to take the single-hub ended-index
+      // path (one HubDO read, accurate uncapped total) instead of the all-hub
+      // fan-out it would otherwise discard client-side (gh #3319).
+      scope_hub_id: external_exports.string().uuid().optional(),
       conversation_id: external_exports.string().uuid().optional(),
       // 'ended' = recently-closed, served warm from the HubDO index (≤ retention
       // window). 'archived' = the full closed-conversation history from ClickHouse.
@@ -13799,17 +14175,8 @@ var init_contracts = __esm({
         });
       }
     });
-    clientOptionalString2 = external_exports.string().nullish().transform((v) => v ?? void 0);
-    clientOptionalBoolean2 = external_exports.boolean().nullish().transform((v) => v ?? void 0);
     appMessageSenderType2 = external_exports.enum(["user", "team"]);
     appMessageReceiverType2 = external_exports.enum(["user", "team", "agent", "assistant"]).transform((v) => v === "assistant" ? "agent" : v);
-    appMessageAttachment2 = external_exports.object({
-      file_name: external_exports.string(),
-      file_binary: external_exports.string(),
-      file_size: external_exports.number().nullish().transform((v) => v ?? void 0),
-      file_extension: clientOptionalString2
-    });
-    MAX_ATTACHMENTS_PER_MESSAGE2 = 20;
     appMessageBody2 = external_exports.object({
       // Message content — three historical aliases. All optional: an attachment-only
       // or voice-only message carries no text.
@@ -13838,7 +14205,7 @@ var init_contracts = __esm({
       // Pre-generated by the client so the optimistic bubble and the stored row share
       // a key (transcription live-updates land on the same row instead of duplicating).
       message_id: clientOptionalString2,
-      attachments: external_exports.array(appMessageAttachment2).max(MAX_ATTACHMENTS_PER_MESSAGE2).nullish().transform((v) => v ?? void 0),
+      attachments: external_exports.array(messageAttachment2).max(MAX_ATTACHMENTS_PER_MESSAGE2).nullish().transform((v) => v ?? void 0),
       // Base64-encoded audio for STT. Size-capped in the route (the cap is a byte
       // budget tied to the /channels/* bodyLimit, not a shape rule).
       audio_file: clientOptionalString2
@@ -13965,7 +14332,7 @@ var init_contracts = __esm({
       hub_type: external_exports.enum(["chat", "task"]).default("chat"),
       user_id: external_exports.string().optional()
     });
-    additionalContextPayloadSchema2 = external_exports.record(external_exports.unknown()).refine((r) => JSON.stringify(r).length <= 16384, {
+    additionalContextPayloadSchema2 = external_exports.record(external_exports.unknown()).refine((r) => withinJsonLength2(r, 16384), {
       message: "additional_context payload must be at most 16384 bytes when JSON-serialized"
     });
     kanbanUpdateBody2 = external_exports.object({
@@ -14009,11 +14376,27 @@ var init_contracts = __esm({
     ]);
     sendMessageBody2 = external_exports.object({
       hub_id: external_exports.string().uuid(),
-      message: external_exports.string().min(1).max(5e4),
+      /**
+       * Optional ONLY when `attachments` carries the payload — see the refinement below.
+       * An attachment-only message (a photo with no caption) is the ordinary WhatsApp
+       * gesture, so the endpoint that exists to rehearse inbound flows has to express it.
+       * Mirrors `appMessageBody`, where content is optional for the same reason.
+       */
+      message: external_exports.string().min(1).max(5e4).optional(),
       /** For chat hubs: optional — automatically continues the user's active conversation (or creates one).
        *  For task hubs: required to continue an existing conversation. Omit to start a new task conversation. */
-      conversation_id: external_exports.string().uuid().optional()
-    });
+      conversation_id: external_exports.string().uuid().optional(),
+      /**
+       * Base64 attachments, delivered over the hub's `app` channel exactly as a real
+       * channel delivers them. Total bytes are bounded by the route's bodyLimit —
+       * `/api/*` carries no global one (only `/webhooks/*` and `/channels/*` do), so the
+       * route declares its own rather than inheriting an unbounded upload path.
+       */
+      attachments: external_exports.array(messageAttachment2).max(MAX_ATTACHMENTS_PER_MESSAGE2).optional()
+    }).refine(
+      (b) => (b.message?.length ?? 0) > 0 || (b.attachments?.length ?? 0) > 0,
+      { message: "message or attachments required" }
+    );
     listConversationsQuery2 = external_exports.object({
       hub_id: external_exports.string().uuid(),
       status: external_exports.enum(["agent", "team", "ended"]).optional(),
@@ -14225,6 +14608,7 @@ var init_contracts = __esm({
       refineHubAsCodeCustomTools2(config, ctx);
       refineHubAsCodeKanbanStatuses2(config, ctx);
       refineHubAsCodeLanes2(config, ctx);
+      refineHubAsCodeEvals2(config, ctx);
     });
     ciPullHubIdParam2 = external_exports.object({
       hub_id: ciUuidSchema2
@@ -15437,7 +15821,7 @@ async function useCommand(args2) {
     process.exit(1);
   }
   let hubId;
-  if (UUID_RE.test(target)) {
+  if (UUID_RE2.test(target)) {
     hubId = target;
   } else {
     const workspace = detectWorkspace();
@@ -15617,37 +16001,109 @@ var send_message_exports = {};
 __export(send_message_exports, {
   sendMessageCommand: () => sendMessageCommand
 });
+import * as fs17 from "fs";
+import * as path22 from "path";
+function statAttachment(filePath) {
+  let stat;
+  try {
+    stat = fs17.statSync(filePath);
+  } catch {
+    console.error(`Error: file not found: ${filePath}`);
+    process.exit(1);
+  }
+  if (stat.isDirectory()) {
+    console.error(`Error: not a file: ${filePath}`);
+    process.exit(1);
+  }
+  return { filePath, size: stat.size };
+}
+function readAttachment(filePath, size) {
+  const fileName = path22.basename(filePath);
+  const ext = path22.extname(fileName).replace(/^\./, "");
+  return {
+    file_name: fileName,
+    file_binary: fs17.readFileSync(filePath).toString("base64"),
+    file_size: size,
+    ...ext && { file_extension: ext }
+  };
+}
+function usage() {
+  console.error('Usage: wayai send-message [options] ["message text"]');
+  console.error("");
+  console.error("Options:");
+  console.error("  -c, --conversation <id>  Continue an existing conversation");
+  console.error("  -f, --file <path>        Attach a file (repeatable)");
+  console.error("");
+  console.error("The message text is optional when at least one --file is attached.");
+  console.error("The hub type (chat/task) is determined automatically from the hub.");
+  console.error("Chat hubs auto-continue the active conversation (or create one).");
+  console.error("Task hubs create a new conversation unless -c is provided.");
+  process.exit(1);
+}
 async function sendMessageCommand(args2) {
   const hubId = resolveActiveHubId(args2);
   const { config, accessToken } = await requireAuth();
   requireRepoConfig();
   let conversationId;
   let message;
+  const filePaths = [];
   for (let i = 0; i < args2.length; i++) {
     const arg = args2[i];
     if (arg === "-c" || arg === "--conversation") {
       conversationId = args2[++i];
+    } else if (arg === "-f" || arg === "--file") {
+      const filePath = args2[++i];
+      if (!filePath) {
+        console.error("Error: --file requires a path");
+        process.exit(1);
+      }
+      filePaths.push(filePath);
     } else if (!arg.startsWith("-")) {
       message = arg;
     }
   }
-  if (!message) {
-    console.error('Usage: wayai send-message [options] "message text"');
-    console.error("");
-    console.error("Options:");
-    console.error("  -c, --conversation <id>  Continue an existing conversation");
-    console.error("");
-    console.error("The hub type (chat/task) is determined automatically from the hub.");
-    console.error("Chat hubs auto-continue the active conversation (or create one).");
-    console.error("Task hubs create a new conversation unless -c is provided.");
+  if (!message && filePaths.length === 0) usage();
+  if (filePaths.length > MAX_ATTACHMENTS_PER_MESSAGE2) {
+    console.error(`Error: at most ${MAX_ATTACHMENTS_PER_MESSAGE2} files per message (got ${filePaths.length}).`);
+    process.exit(1);
+  }
+  const stats = filePaths.map(statAttachment);
+  const filesTotal = stats.reduce((sum, s) => sum + base64Length(s.size), 0);
+  const fileDetail = () => stats.map((s) => `${path22.basename(s.filePath)} ${asMb(s.size)} MB`).join(", ");
+  if (filesTotal > MAX_MESSAGE_BODY_BYTES2) {
+    console.error(
+      `Error: ${fileDetail()} encode to ~${asMb(filesTotal)} MB, over the ${asMb(MAX_MESSAGE_BODY_BYTES2)} MB per-request limit.`
+    );
+    console.error("Base64 inflates a file by about a third, so ~7 MB of files is the practical ceiling.");
+    process.exit(1);
+  }
+  const attachments = stats.map((s) => readAttachment(s.filePath, s.size));
+  const bodyBytes = Buffer.byteLength(
+    JSON.stringify({
+      hub_id: hubId,
+      ...message && { message },
+      ...conversationId && { conversation_id: conversationId },
+      ...attachments.length > 0 && { attachments }
+    }),
+    "utf8"
+  );
+  if (bodyBytes > MAX_MESSAGE_BODY_BYTES2) {
+    console.error(
+      `Error: the request is ~${asMb(bodyBytes)} MB, over the ${asMb(MAX_MESSAGE_BODY_BYTES2)} MB per-request limit.`
+    );
+    if (stats.length > 0) console.error(`Attachments: ${fileDetail()} (base64 adds about a third).`);
     process.exit(1);
   }
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   const result = await client.sendMessage(hubId, message, {
-    conversationId
+    conversationId,
+    ...attachments.length > 0 && { attachments }
   });
   console.log(`Conversation: ${result.conversation_id}`);
   console.log(`Status: ${result.status}`);
+  if (attachments.length > 0 && result.status !== "error") {
+    console.log(`Attached: ${attachments.map((a) => a.file_name).join(", ")}`);
+  }
   if (result.status_reason) {
     console.log(`Reason: ${result.status_reason}`);
   }
@@ -15664,13 +16120,17 @@ async function sendMessageCommand(args2) {
     console.log("(Agent processing failed \u2014 user message was stored)");
   }
 }
+var asMb, base64Length;
 var init_send_message = __esm({
   "src/commands/send-message.ts"() {
     "use strict";
+    init_contracts();
     init_auth();
     init_repo_config();
     init_workspace();
     init_api_client();
+    asMb = (bytes) => (bytes / 1024 / 1024).toFixed(1);
+    base64Length = (bytes) => Math.ceil(bytes / 3) * 4;
   }
 });
 
@@ -17069,8 +17529,8 @@ var eval_capture_exports = {};
 __export(eval_capture_exports, {
   evalCaptureCommand: () => evalCaptureCommand
 });
-import * as fs17 from "fs";
-import * as path22 from "path";
+import * as fs18 from "fs";
+import * as path23 from "path";
 import * as yaml7 from "js-yaml";
 function isValidSetName(name) {
   if (name.length === 0 || name === "." || name === "..") return false;
@@ -17083,7 +17543,7 @@ function parseArgs13(args2) {
     process.exit(1);
   }
   const conversationId = args2[0];
-  if (!UUID_RE.test(conversationId)) {
+  if (!UUID_RE2.test(conversationId)) {
     console.error(`Invalid conversation ID "${conversationId}". Expected a UUID.`);
     process.exit(1);
   }
@@ -17136,15 +17596,15 @@ async function evalCaptureCommand(args2) {
   const setFolderName = targetSetName;
   const scenarioName = parsed.evalName ?? `Capture ${parsed.conversationId.slice(0, 8)}`;
   const slug = slugify(scenarioName);
-  const evalsDir = path22.join(hubFolder, "evals");
-  const targetDir = path22.join(evalsDir, setFolderName);
-  const targetPath = path22.join(targetDir, `${slug}.yaml`);
-  if (!targetPath.startsWith(evalsDir + path22.sep)) {
-    console.error(`Resolved path "${path22.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
+  const evalsDir = path23.join(hubFolder, "evals");
+  const targetDir = path23.join(evalsDir, setFolderName);
+  const targetPath = path23.join(targetDir, `${slug}.yaml`);
+  if (!targetPath.startsWith(evalsDir + path23.sep)) {
+    console.error(`Resolved path "${path23.relative(hubFolder, targetPath)}" escapes evals/. Aborting.`);
     process.exit(1);
   }
-  if (fs17.existsSync(targetPath)) {
-    console.error(`File already exists: ${path22.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
+  if (fs18.existsSync(targetPath)) {
+    console.error(`File already exists: ${path23.relative(hubFolder, targetPath)}. Use --name to choose a different name.`);
     process.exit(1);
   }
   console.log("Resolving scenario set...");
@@ -17176,9 +17636,9 @@ async function evalCaptureCommand(args2) {
     ...captured.evaluator_instructions ? { evaluator_instructions: captured.evaluator_instructions } : {}
   };
   const yamlObj = buildEvalYamlObject(evalEntry, slug);
-  fs17.mkdirSync(targetDir, { recursive: true });
-  fs17.writeFileSync(targetPath, yaml7.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
-  const relPath = path22.relative(process.cwd(), targetPath);
+  fs18.mkdirSync(targetDir, { recursive: true });
+  fs18.writeFileSync(targetPath, yaml7.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
+  const relPath = path23.relative(process.cwd(), targetPath);
   console.log(`
 Wrote ${relPath}`);
   console.log("Run `wayai pull` to refresh the agent display name, then commit. The scenario is already on the platform.");
@@ -17206,7 +17666,7 @@ function parseArgs14(args2) {
     process.exit(1);
   }
   const conversationId = args2[0];
-  if (!UUID_RE.test(conversationId)) {
+  if (!UUID_RE2.test(conversationId)) {
     console.error(`Invalid conversation ID "${conversationId}". Expected a UUID.`);
     process.exit(1);
   }
@@ -17288,7 +17748,7 @@ async function evalSessionDeleteCommand(args2) {
     console.error("       wayai eval session delete --all");
     process.exit(1);
   }
-  if (sessionId && !UUID_RE.test(sessionId)) {
+  if (sessionId && !UUID_RE2.test(sessionId)) {
     console.error(`Invalid session id: ${sessionId}`);
     process.exit(1);
   }
@@ -18326,7 +18786,7 @@ function parseArgs17(args2) {
   }
   return { connection, orgCredential, field, stdin };
 }
-function usage(msg) {
+function usage2(msg) {
   if (msg) console.error(`${msg}
 `);
   console.error("Usage: wayai set-connection-credential --hub <id|name> --connection <name|id> ( --org-credential <name> | --field <field> --stdin )");
@@ -18337,17 +18797,17 @@ function usage(msg) {
 async function setConnectionCredentialCommand(args2) {
   const hubId = resolveActiveHubId(args2);
   const parsed = parseArgs17(args2);
-  if (!parsed.connection) usage("Missing required flag: --connection <name|id>");
+  if (!parsed.connection) usage2("Missing required flag: --connection <name|id>");
   const orgMode = !!parsed.orgCredential;
   const directMode = !!parsed.field;
   if (orgMode === directMode) {
-    usage("Provide exactly one of --org-credential or --field.");
+    usage2("Provide exactly one of --org-credential or --field.");
   }
   if (directMode && !VALID_FIELDS.includes(parsed.field)) {
-    usage(`Invalid --field "${parsed.field}". Valid fields: ${VALID_FIELDS.join(", ")}`);
+    usage2(`Invalid --field "${parsed.field}". Valid fields: ${VALID_FIELDS.join(", ")}`);
   }
   if (directMode && !parsed.stdin) {
-    usage("--field requires --stdin (the secret is read from stdin, never an argument).");
+    usage2("--field requires --stdin (the secret is read from stdin, never an argument).");
   }
   const { organization_id: organizationId } = requireRepoConfig();
   const { config, accessToken } = await requireAuth();
@@ -18359,27 +18819,27 @@ async function setConnectionCredentialCommand(args2) {
     else if (hubs.some((h) => h.production_hub_id === hubId)) environment = "production";
   }
   if (!environment) {
-    usage(`Could not resolve hub "${hubId}". Pull it first (\`wayai pull --hub ${hubId}\`) or check the id.`);
+    usage2(`Could not resolve hub "${hubId}". Pull it first (\`wayai pull --hub ${hubId}\`) or check the id.`);
   }
   const isProduction = environment === "production";
   const { connections } = await client.listConnections(hubId);
   const conn = connections.find(
     (c) => c.connection_id === parsed.connection || c.connection_display_name === parsed.connection
   );
-  if (!conn || !conn.connection_id) usage(`Connection "${parsed.connection}" not found on hub ${hubId}.`);
+  if (!conn || !conn.connection_id) usage2(`Connection "${parsed.connection}" not found on hub ${hubId}.`);
   const connectionId = conn.connection_id;
   const body = { hub_id: hubId };
   if (orgMode) {
     const { data: creds } = await client.listOrgCredentials(organizationId);
     const cred = creds.find((c) => c.credential_display_name === parsed.orgCredential);
-    if (!cred) usage(`Organization credential "${parsed.orgCredential}" not found.`);
+    if (!cred) usage2(`Organization credential "${parsed.orgCredential}" not found.`);
     body.organization_credential_id = cred.organization_credential_id;
   } else {
     if (process.stdin.isTTY) {
-      usage('--field requires the secret on stdin. Example: echo "$SECRET" | wayai set-connection-credential ... --field api_key --stdin');
+      usage2('--field requires the secret on stdin. Example: echo "$SECRET" | wayai set-connection-credential ... --field api_key --stdin');
     }
     const secret = (await readStdin())?.trim();
-    if (!secret) usage("No secret received from stdin.");
+    if (!secret) usage2("No secret received from stdin.");
     body[parsed.field] = secret;
   }
   const target = isProduction ? "production" : "preview";
@@ -18405,23 +18865,23 @@ var init_set_connection_credential = __esm({
 });
 
 // src/lib/org-workspace.ts
-import * as fs18 from "fs";
-import * as path23 from "path";
+import * as fs19 from "fs";
+import * as path24 from "path";
 import * as yaml8 from "js-yaml";
 function getOrgDir(gitRoot) {
   return resolveLayout(gitRoot).orgDir;
 }
 function orgManifestExists(orgDir) {
-  return fs18.existsSync(path23.join(orgDir, ORG_MANIFEST_NAME));
+  return fs19.existsSync(path24.join(orgDir, ORG_MANIFEST_NAME));
 }
 function parseOrgResources(orgDir) {
-  const manifestPath = path23.join(orgDir, ORG_MANIFEST_NAME);
+  const manifestPath = path24.join(orgDir, ORG_MANIFEST_NAME);
   let manifest = {};
-  if (fs18.existsSync(manifestPath)) {
-    manifest = yaml8.load(fs18.readFileSync(manifestPath, "utf-8")) ?? {};
+  if (fs19.existsSync(manifestPath)) {
+    manifest = yaml8.load(fs19.readFileSync(manifestPath, "utf-8")) ?? {};
   }
   const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
-  const resourcesDir = path23.join(orgDir, "resources");
+  const resourcesDir = path24.join(orgDir, "resources");
   const resources = rawResources.map((res) => {
     const resource = { name: res.name };
     if (res.id) resource.id = res.id;
@@ -18433,8 +18893,8 @@ function parseOrgResources(orgDir) {
     if (res.environment) resource.environment = res.environment;
     if (Array.isArray(res.tags)) resource.tags = res.tags;
     if (Array.isArray(res.folders)) resource.folders = res.folders;
-    const resDir = path23.join(resourcesDir, slugify(resource.name));
-    if (fs18.existsSync(resDir)) {
+    const resDir = path24.join(resourcesDir, slugify(resource.name));
+    if (fs19.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) resource.files = files;
     }
@@ -18443,28 +18903,28 @@ function parseOrgResources(orgDir) {
   return { version: 1, resources };
 }
 function writeOrgResources(orgDir, payload) {
-  fs18.mkdirSync(orgDir, { recursive: true });
+  fs19.mkdirSync(orgDir, { recursive: true });
   const resources = payload.resources ?? [];
   const manifestResources = resources.map((r) => {
     const { files: _files, ...rest } = r;
     return rest;
   });
-  fs18.writeFileSync(
-    path23.join(orgDir, ORG_MANIFEST_NAME),
+  fs19.writeFileSync(
+    path24.join(orgDir, ORG_MANIFEST_NAME),
     yaml8.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
     "utf-8"
   );
-  const resourcesDir = path23.join(orgDir, "resources");
+  const resourcesDir = path24.join(orgDir, "resources");
   const currentSlugs = /* @__PURE__ */ new Set();
   for (const resource of resources) {
     const resSlug = slugify(resource.name);
     currentSlugs.add(resSlug);
-    writeResourceFileTree(path23.join(resourcesDir, resSlug), resource.files || []);
+    writeResourceFileTree(path24.join(resourcesDir, resSlug), resource.files || []);
   }
-  if (fs18.existsSync(resourcesDir)) {
-    for (const entry of fs18.readdirSync(resourcesDir, { withFileTypes: true })) {
+  if (fs19.existsSync(resourcesDir)) {
+    for (const entry of fs19.readdirSync(resourcesDir, { withFileTypes: true })) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
-        fs18.rmSync(path23.join(resourcesDir, entry.name), { recursive: true, force: true });
+        fs19.rmSync(path24.join(resourcesDir, entry.name), { recursive: true, force: true });
       }
     }
   }
@@ -18473,7 +18933,7 @@ async function downloadOrgBinaryFiles(orgDir, payload) {
   let count = 0;
   for (const resource of payload.resources ?? []) {
     if (!resource.files) continue;
-    const resDir = path23.join(orgDir, "resources", slugify(resource.name));
+    const resDir = path24.join(orgDir, "resources", slugify(resource.name));
     count += await downloadBinaryFiles(resDir, resource.files);
   }
   if (count > 0) console.log(`Downloaded ${count} binary resource file(s).`);
@@ -18729,20 +19189,20 @@ var init_list = __esm({
 });
 
 // src/lib/template-files.ts
-import * as fs19 from "fs";
-import * as path24 from "path";
+import * as fs20 from "fs";
+import * as path25 from "path";
 function readDirToFileMap(rootDir) {
   const out = {};
   function walk(dir, prefix) {
-    const entries = fs19.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    const entries = fs20.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const abs = path24.join(dir, entry.name);
+      const abs = path25.join(dir, entry.name);
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) walk(abs, rel);
-      else if (entry.isFile()) out[rel] = fs19.readFileSync(abs, "utf-8");
+      else if (entry.isFile()) out[rel] = fs20.readFileSync(abs, "utf-8");
     }
   }
-  if (fs19.existsSync(rootDir)) walk(rootDir, "");
+  if (fs20.existsSync(rootDir)) walk(rootDir, "");
   return out;
 }
 function detectCollisions(targetDir, files) {
@@ -18751,7 +19211,7 @@ function detectCollisions(targetDir, files) {
     if (!isSafeTemplatePath2(rel)) {
       throw new Error(`Refusing to inspect unsafe template path: ${rel}`);
     }
-    if (fs19.existsSync(path24.join(targetDir, rel))) collisions.push(rel);
+    if (fs20.existsSync(path25.join(targetDir, rel))) collisions.push(rel);
   }
   return collisions.sort((a, b) => a.localeCompare(b));
 }
@@ -18761,9 +19221,9 @@ function writeFileMap(targetDir, files) {
     if (!isSafeTemplatePath2(rel)) {
       throw new Error(`Refusing to write unsafe template path: ${rel}`);
     }
-    const abs = path24.join(targetDir, rel);
-    fs19.mkdirSync(path24.dirname(abs), { recursive: true });
-    fs19.writeFileSync(abs, body, "utf-8");
+    const abs = path25.join(targetDir, rel);
+    fs20.mkdirSync(path25.dirname(abs), { recursive: true });
+    fs20.writeFileSync(abs, body, "utf-8");
     written.push(rel);
   }
   return written;
@@ -18771,20 +19231,20 @@ function writeFileMap(targetDir, files) {
 function listDirRelFiles(dir) {
   const out = [];
   function walk(d, prefix) {
-    for (const entry of fs19.readdirSync(d, { withFileTypes: true })) {
+    for (const entry of fs20.readdirSync(d, { withFileTypes: true })) {
       const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
-      if (entry.isDirectory()) walk(path24.join(d, entry.name), rel);
+      if (entry.isDirectory()) walk(path25.join(d, entry.name), rel);
       else if (entry.isFile()) out.push(rel);
     }
   }
-  if (fs19.existsSync(dir)) walk(dir, "");
+  if (fs20.existsSync(dir)) walk(dir, "");
   return out;
 }
 function writeSliceSnapshot(targetDir, files) {
   const keep = new Set(Object.keys(files));
   const removed = listDirRelFiles(targetDir).filter((rel) => !keep.has(rel)).sort((a, b) => a.localeCompare(b));
   const written = writeFileMap(targetDir, files).sort((a, b) => a.localeCompare(b));
-  if (fs19.existsSync(targetDir)) cleanOrphanFiles(targetDir, "", keep);
+  if (fs20.existsSync(targetDir)) cleanOrphanFiles(targetDir, "", keep);
   return { written, removed };
 }
 var init_template_files = __esm({
@@ -18800,7 +19260,7 @@ var templates_exports = {};
 __export(templates_exports, {
   templateCommand: () => templateCommand
 });
-import * as path25 from "path";
+import * as path26 from "path";
 async function templateCommand(args2) {
   const [sub, ...rest] = args2;
   switch (sub) {
@@ -18916,8 +19376,8 @@ async function runTemplatePull(rest) {
     console.log(`Template "${slug}" has no WayAI slice${hint}`);
     return;
   }
-  const targetDir = path25.join(resolveLayout(gitRoot).hubsDir, slug);
-  const relTarget = path25.relative(gitRoot, targetDir);
+  const targetDir = path26.join(resolveLayout(gitRoot).hubsDir, slug);
+  const relTarget = path26.relative(gitRoot, targetDir);
   const collisions = detectCollisions(targetDir, detail.files);
   if (dryRun) {
     const planned = Object.keys(detail.files).sort((a, b) => a.localeCompare(b));
@@ -19091,8 +19551,8 @@ var admin_exports = {};
 __export(admin_exports, {
   adminCommand: () => adminCommand
 });
-import * as fs20 from "fs";
-import * as path26 from "path";
+import * as fs21 from "fs";
+import * as path27 from "path";
 import * as yaml10 from "js-yaml";
 async function adminCommand(args2) {
   const [group, ...afterGroup] = args2;
@@ -19414,7 +19874,7 @@ async function runArchiveRead(positional, flagArgs) {
       exitOnApiError(err);
       throw err;
     }
-    fs20.writeFileSync(outPath, zip);
+    fs21.writeFileSync(outPath, zip);
     console.log(`Wrote ${zip.byteLength} bytes to ${outPath}`);
     return;
   }
@@ -19546,15 +20006,15 @@ function loadTemplateManifest(slug) {
     console.error("Not in a git repository. Run from the tutorials/ authoring repo.");
     process.exit(1);
   }
-  const templateDir = path26.join(resolveTemplatesDir(gitRoot), slug);
-  const manifestPath = path26.join(templateDir, "template.yaml");
-  if (!fs20.existsSync(manifestPath)) {
-    console.error(`template.yaml not found at ${path26.relative(gitRoot, manifestPath)}`);
+  const templateDir = path27.join(resolveTemplatesDir(gitRoot), slug);
+  const manifestPath = path27.join(templateDir, "template.yaml");
+  if (!fs21.existsSync(manifestPath)) {
+    console.error(`template.yaml not found at ${path27.relative(gitRoot, manifestPath)}`);
     process.exit(1);
   }
   let manifest;
   try {
-    manifest = templateYamlSchema2.parse(yaml10.load(fs20.readFileSync(manifestPath, "utf-8")));
+    manifest = templateYamlSchema2.parse(yaml10.load(fs21.readFileSync(manifestPath, "utf-8")));
   } catch (err) {
     console.error(`Invalid template.yaml: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
@@ -19584,20 +20044,20 @@ async function runTemplatePush(positional) {
     const wayaiEntry = manifest.wayai.locales[locale];
     let wayaiFiles;
     if (wayaiEntry) {
-      const sliceDir = path26.resolve(templateDir, wayaiEntry.source);
-      if (!fs20.existsSync(sliceDir)) {
+      const sliceDir = path27.resolve(templateDir, wayaiEntry.source);
+      if (!fs21.existsSync(sliceDir)) {
         console.error(`wayai source not found for ${locale}: ${wayaiEntry.source} (resolved ${sliceDir})`);
         process.exit(1);
       }
       if (!isInsideTemplateDir(sliceDir, templateDir)) {
         console.warn(
-          `Note: ${locale} source points at a live hub (${wayaiEntry.source}); it can go stale on a hub recreate. Run \`wayai admin template freeze ${slug} --locale ${locale} --from ${path26.basename(sliceDir)}\` to commit a stable frozen slice.`
+          `Note: ${locale} source points at a live hub (${wayaiEntry.source}); it can go stale on a hub recreate. Run \`wayai admin template freeze ${slug} --locale ${locale} --from ${path27.basename(sliceDir)}\` to commit a stable frozen slice.`
         );
       }
       wayaiFiles = readDirToFileMap(sliceDir);
     }
-    const readmePath = path26.join(templateDir, `README.${locale}.md`);
-    const readmeMarkdown = fs20.existsSync(readmePath) ? fs20.readFileSync(readmePath, "utf-8") : "";
+    const readmePath = path27.join(templateDir, `README.${locale}.md`);
+    const readmeMarkdown = fs21.existsSync(readmePath) ? fs21.readFileSync(readmePath, "utf-8") : "";
     locales[locale] = {
       readmeMarkdown,
       ...wayaiFiles && { wayaiFiles },
@@ -19608,9 +20068,9 @@ async function runTemplatePush(positional) {
   }
   let hero;
   if (manifest.hero) {
-    const heroPath = path26.resolve(templateDir, manifest.hero);
-    if (fs20.existsSync(heroPath)) {
-      hero = { filename: path26.basename(heroPath), dataBase64: fs20.readFileSync(heroPath).toString("base64") };
+    const heroPath = path27.resolve(templateDir, manifest.hero);
+    if (fs21.existsSync(heroPath)) {
+      hero = { filename: path27.basename(heroPath), dataBase64: fs21.readFileSync(heroPath).toString("base64") };
     } else {
       console.error(`Warning: hero not found at ${manifest.hero}; skipping.`);
     }
@@ -19636,7 +20096,7 @@ async function runTemplatePush(positional) {
   }
 }
 function isInsideTemplateDir(dest, templateDir) {
-  return dest === templateDir || dest.startsWith(templateDir + path26.sep);
+  return dest === templateDir || dest.startsWith(templateDir + path27.sep);
 }
 async function runTemplateFreeze(positional, flagArgs) {
   const slug = positional[0];
@@ -19697,7 +20157,7 @@ async function runTemplateFreeze(positional, flagArgs) {
     process.exit(1);
   }
   const entry = manifest.wayai.locales[targetLocale];
-  const dest = path26.resolve(templateDir, entry.source);
+  const dest = path27.resolve(templateDir, entry.source);
   if (!isInsideTemplateDir(dest, templateDir) || dest === templateDir) {
     console.error(
       `source for "${targetLocale}" must be a committed path inside ${slug}/ (e.g. "./${targetLocale}/slice"), but resolved to:
@@ -19716,7 +20176,7 @@ Set it to a subdir of the template folder and re-run freeze.`
     const hubs = scanWorkspaceHubs(hubsDir);
     if (hubs.length) {
       console.error("Available hubs:");
-      for (const h of hubs) console.error(`  ${path26.basename(h.hubFolder)} (${h.hubId})`);
+      for (const h of hubs) console.error(`  ${path27.basename(h.hubFolder)} (${h.hubId})`);
     }
     console.error(`
 Pass --from <folder|uuid>${selector ? "." : " or run `wayai use <hub>` first."}`);
@@ -19724,12 +20184,12 @@ Pass --from <folder|uuid>${selector ? "." : " or run `wayai use <hub>` first."}`
   }
   const liveFiles = readDirToFileMap(hubFolder);
   if (Object.keys(liveFiles).length === 0) {
-    console.error(`Source hub folder has no files to freeze: ${path26.relative(gitRoot, hubFolder)}`);
+    console.error(`Source hub folder has no files to freeze: ${path27.relative(gitRoot, hubFolder)}`);
     process.exit(1);
   }
   const sanitized = sanitizeWayaiSliceFiles(liveFiles);
-  const relDest = path26.relative(gitRoot, dest);
-  const relSrc = path26.relative(gitRoot, hubFolder);
+  const relDest = path27.relative(gitRoot, dest);
+  const relSrc = path27.relative(gitRoot, hubFolder);
   if (dryRun) {
     const existing = new Set(listDirRelFiles(dest));
     const nextKeys = new Set(Object.keys(sanitized));
@@ -19789,7 +20249,7 @@ async function runTemplatePull2(positional, flagArgs) {
     console.log(JSON.stringify(detail, null, 2));
     return;
   }
-  const target = outDir ? path26.resolve(outDir) : path26.join(process.cwd(), "template-store-pull", slug);
+  const target = outDir ? path27.resolve(outDir) : path27.join(process.cwd(), "template-store-pull", slug);
   const written = writeFileMap(target, detail.files);
   console.log(`Pulled "${slug}" from the store \u2192 ${target} (${written.length} file${written.length === 1 ? "" : "s"}).`);
   const uses = detail.uses ?? [];
@@ -19812,13 +20272,13 @@ async function runSkillInstall(positional) {
     throw err;
   }
   const root = findGitRoot() ?? process.cwd();
-  const present = HARNESS_SKILL_DIRS.filter((dir) => fs20.existsSync(path26.join(root, dir)));
+  const present = HARNESS_SKILL_DIRS.filter((dir) => fs21.existsSync(path27.join(root, dir)));
   const targets = present.length > 0 ? present : HARNESS_SKILL_DIRS;
   const fileCount = Object.keys(res.files).length;
   const relDirs = targets.map((harness) => {
-    const targetDir = path26.join(root, harness, "skills", name);
+    const targetDir = path27.join(root, harness, "skills", name);
     writeFileMap(targetDir, res.files);
-    return `${path26.relative(root, targetDir)}/`;
+    return `${path27.relative(root, targetDir)}/`;
   });
   console.log(`Installed skill "${name}" (${fileCount} file${fileCount === 1 ? "" : "s"}) \u2192 ${relDirs.join(", ")}`);
   console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
@@ -19929,7 +20389,7 @@ async function runSandboxExec(positional, flagArgs) {
     process.exit(data.exit_code);
   }
 }
-function parseScopedTargetFlags(flagArgs, usage2) {
+function parseScopedTargetFlags(flagArgs, usage3) {
   let all = false;
   let orgId;
   let hubId;
@@ -19964,7 +20424,7 @@ function parseScopedTargetFlags(flagArgs, usage2) {
   }
   if ((all ? 1 : 0) + (orgId ? 1 : 0) + (hubId ? 1 : 0) !== 1) {
     console.error("Provide exactly ONE of --all, --org <org_id>, or --hub <hub_id>.");
-    console.error(usage2);
+    console.error(usage3);
     process.exit(1);
   }
   if (all) {
@@ -20070,7 +20530,7 @@ async function runHarnessMassDestroy(flagArgs) {
     );
   }
 }
-function resolveHarnessLayer(flagArgs, usage2) {
+function resolveHarnessLayer(flagArgs, usage3) {
   let orgId;
   let hubId;
   for (let i = 0; i < flagArgs.length; i++) {
@@ -20084,13 +20544,13 @@ function resolveHarnessLayer(flagArgs, usage2) {
         break;
       default:
         console.error(`Unknown flag: ${arg}`);
-        console.error(usage2);
+        console.error(usage3);
         process.exit(1);
     }
   }
   if (orgId && hubId) {
     console.error("Provide at most ONE of --org <org_id> or --hub <hub_id> (or neither for the platform layer).");
-    console.error(usage2);
+    console.error(usage3);
     process.exit(1);
   }
   if (orgId) return { kind: "org", orgId };
@@ -21160,7 +21620,7 @@ var init_update = __esm({
 
 // src/index.ts
 init_sentry();
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync19 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname9, join as join25 } from "path";
 
@@ -21185,7 +21645,7 @@ function friendlyHint(err) {
 }
 
 // src/index.ts
-init_redact();
+init_mask_secrets();
 init_utils();
 
 // src/lib/version-refresh.ts
@@ -21342,7 +21802,7 @@ Run \`wayai admin skill install\` to update.`);
 
 // src/index.ts
 var __dirname = dirname9(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync18(join25(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync19(join25(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
@@ -21587,7 +22047,7 @@ Commands:
   use <hub>          Bind this worktree to a specific hub (UUID or folder name)
   migrate            Move a legacy repo to the wayai-ws/{hubs,org} layout
   unbind             Clear the worktree hub binding
-  send-message       Send a test message to a hub (preview or production)
+  send-message       Send a test message to a hub (preview or production; -f <path> to attach a file)
   conversations      List or inspect conversations
   alerts             Show a hub's active connection/credential alerts (run this FIRST when a hub misbehaves)
   analytics          Show analytics summary and metrics (use \`analytics query\` for structured ClickHouse queries)
@@ -21679,7 +22139,7 @@ async function runForeground() {
       captureException2(err);
     }
     await closeSentry();
-    console.error(redactSecrets(err instanceof Error ? err.message : String(err)));
+    console.error(maskSecretsInMessage(err instanceof Error ? err.message : String(err)));
     const hint = friendlyHint(err);
     if (hint) console.error(hint);
     process.exit(1);