@claypi/cli 0.0.4 → 0.1.0

package/dist/index.js

@@ -47835,7 +47835,7 @@ var require_lodash = __commonJS({
           function object() {
           }
           return function(proto) {
-            if (!isObject6(proto)) {
+            if (!isObject7(proto)) {
               return {};
             }
             if (objectCreate) {
@@ -48237,7 +48237,7 @@ var require_lodash = __commonJS({
           if (result2 !== undefined2) {
             return result2;
           }
-          if (!isObject6(value)) {
+          if (!isObject7(value)) {
             return value;
           }
           var isArr = isArray4(value);
@@ -48584,7 +48584,7 @@ var require_lodash = __commonJS({
           return true;
         }
         function baseIsNative(value) {
-          if (!isObject6(value) || isMasked(value)) {
+          if (!isObject7(value) || isMasked(value)) {
             return false;
           }
           var pattern = isFunction4(value) ? reIsNative : reIsHostCtor;
@@ -48624,7 +48624,7 @@ var require_lodash = __commonJS({
           return result2;
         }
         function baseKeysIn(object) {
-          if (!isObject6(object)) {
+          if (!isObject7(object)) {
             return nativeKeysIn(object);
           }
           var isProto = isPrototype(object), result2 = [];
@@ -48669,7 +48669,7 @@ var require_lodash = __commonJS({
           }
           baseFor(source, function(srcValue, key) {
             stack || (stack = new Stack());
-            if (isObject6(srcValue)) {
+            if (isObject7(srcValue)) {
               baseMergeDeep(object, source, key, srcIndex, baseMerge, customizer, stack);
             } else {
               var newValue = customizer ? customizer(safeGet(object, key), srcValue, key + "", object, source, stack) : undefined2;
@@ -48709,7 +48709,7 @@ var require_lodash = __commonJS({
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
-              } else if (!isObject6(objValue) || isFunction4(objValue)) {
+              } else if (!isObject7(objValue) || isFunction4(objValue)) {
                 newValue = initCloneObject(srcValue);
               }
             } else {
@@ -48848,7 +48848,7 @@ var require_lodash = __commonJS({
           return shuffleSelf(array, baseClamp(n, 0, array.length));
         }
         function baseSet(object, path7, value, customizer) {
-          if (!isObject6(object)) {
+          if (!isObject7(object)) {
             return object;
           }
           path7 = castPath(path7, object);
@@ -48862,7 +48862,7 @@ var require_lodash = __commonJS({
               var objValue = nested[key];
               newValue = customizer ? customizer(objValue, key, nested) : undefined2;
               if (newValue === undefined2) {
-                newValue = isObject6(objValue) ? objValue : isIndex(path7[index + 1]) ? [] : {};
+                newValue = isObject7(objValue) ? objValue : isIndex(path7[index + 1]) ? [] : {};
               }
             }
             assignValue(nested, key, newValue);
@@ -49332,7 +49332,7 @@ var require_lodash = __commonJS({
                 return new Ctor(args[0], args[1], args[2], args[3], args[4], args[5], args[6]);
             }
             var thisBinding = baseCreate(Ctor.prototype), result2 = Ctor.apply(thisBinding, args);
-            return isObject6(result2) ? result2 : thisBinding;
+            return isObject7(result2) ? result2 : thisBinding;
           };
         }
         function createCurry(func, bitmask, arity) {
@@ -49668,7 +49668,7 @@ var require_lodash = __commonJS({
           return objValue;
         }
         function customDefaultsMerge(objValue, srcValue, key, object, source, stack) {
-          if (isObject6(objValue) && isObject6(srcValue)) {
+          if (isObject7(objValue) && isObject7(srcValue)) {
             stack.set(srcValue, objValue);
             baseMerge(objValue, srcValue, undefined2, customDefaultsMerge, stack);
             stack["delete"](srcValue);
@@ -50016,7 +50016,7 @@ var require_lodash = __commonJS({
           return !!length && (type == "number" || type != "symbol" && reIsUint.test(value)) && (value > -1 && value % 1 == 0 && value < length);
         }
         function isIterateeCall(value, index, object) {
-          if (!isObject6(object)) {
+          if (!isObject7(object)) {
             return false;
           }
           var type = typeof index;
@@ -50059,7 +50059,7 @@ var require_lodash = __commonJS({
           return value === proto;
         }
         function isStrictComparable(value) {
-          return value === value && !isObject6(value);
+          return value === value && !isObject7(value);
         }
         function matchesStrictComparable(key, srcValue) {
           return function(object) {
@@ -50941,7 +50941,7 @@ var require_lodash = __commonJS({
             throw new TypeError2(FUNC_ERROR_TEXT);
           }
           wait = toNumber(wait) || 0;
-          if (isObject6(options)) {
+          if (isObject7(options)) {
             leading = !!options.leading;
             maxing = "maxWait" in options;
             maxWait = maxing ? nativeMax(toNumber(options.maxWait) || 0, wait) : maxWait;
@@ -51111,7 +51111,7 @@ var require_lodash = __commonJS({
           if (typeof func != "function") {
             throw new TypeError2(FUNC_ERROR_TEXT);
           }
-          if (isObject6(options)) {
+          if (isObject7(options)) {
             leading = "leading" in options ? !!options.leading : leading;
             trailing = "trailing" in options ? !!options.trailing : trailing;
           }
@@ -51219,7 +51219,7 @@ var require_lodash = __commonJS({
           return typeof value == "number" && nativeIsFinite(value);
         }
         function isFunction4(value) {
-          if (!isObject6(value)) {
+          if (!isObject7(value)) {
             return false;
           }
           var tag = baseGetTag4(value);
@@ -51231,7 +51231,7 @@ var require_lodash = __commonJS({
         function isLength(value) {
           return typeof value == "number" && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER;
         }
-        function isObject6(value) {
+        function isObject7(value) {
           var type = typeof value;
           return value != null && (type == "object" || type == "function");
         }
@@ -51338,9 +51338,9 @@ var require_lodash = __commonJS({
           if (isSymbol(value)) {
             return NAN;
           }
-          if (isObject6(value)) {
+          if (isObject7(value)) {
             var other = typeof value.valueOf == "function" ? value.valueOf() : value;
-            value = isObject6(other) ? other + "" : other;
+            value = isObject7(other) ? other + "" : other;
           }
           if (typeof value != "string") {
             return value === 0 ? value : +value;
@@ -51561,7 +51561,7 @@ var require_lodash = __commonJS({
             var Ctor = object && object.constructor;
             if (isArrLike) {
               accumulator = isArr ? new Ctor() : [];
-            } else if (isObject6(object)) {
+            } else if (isObject7(object)) {
               accumulator = isFunction4(Ctor) ? baseCreate(getPrototype(object)) : {};
             } else {
               accumulator = {};
@@ -51846,7 +51846,7 @@ var require_lodash = __commonJS({
         }
         function truncate3(string, options) {
           var length = DEFAULT_TRUNC_LENGTH, omission = DEFAULT_TRUNC_OMISSION;
-          if (isObject6(options)) {
+          if (isObject7(options)) {
             var separator = "separator" in options ? options.separator : separator;
             length = "length" in options ? toInteger(options.length) : length;
             omission = "omission" in options ? baseToString(options.omission) : omission;
@@ -51976,13 +51976,13 @@ var require_lodash = __commonJS({
         });
         function mixin(object, source, options) {
           var props = keys(source), methodNames = baseFunctions(source, props);
-          if (options == null && !(isObject6(source) && (methodNames.length || !props.length))) {
+          if (options == null && !(isObject7(source) && (methodNames.length || !props.length))) {
             options = source;
             source = object;
             object = this;
             methodNames = baseFunctions(source, keys(source));
           }
-          var chain2 = !(isObject6(options) && "chain" in options) || !!options.chain, isFunc = isFunction4(object);
+          var chain2 = !(isObject7(options) && "chain" in options) || !!options.chain, isFunc = isFunction4(object);
           arrayEach(methodNames, function(methodName) {
             var func = source[methodName];
             object[methodName] = func;
@@ -52328,7 +52328,7 @@ var require_lodash = __commonJS({
         lodash.isNil = isNil;
         lodash.isNull = isNull;
         lodash.isNumber = isNumber;
-        lodash.isObject = isObject6;
+        lodash.isObject = isObject7;
         lodash.isObjectLike = isObjectLike4;
         lodash.isPlainObject = isPlainObject5;
         lodash.isRegExp = isRegExp2;
@@ -56770,7 +56770,7 @@ function withLoginHint(message) {
 }
 var MissingApiKeyError = class extends Error {
   constructor() {
-    super("No API key configured. Run `clay login` to set one.");
+    super("No API key configured. Run `clay login` to set one, or set the CLAY_API_KEY environment variable.");
     this.name = "MissingApiKeyError";
   }
 };
@@ -56816,6 +56816,12 @@ var UploadFailedError = class extends Error {
     this.name = "UploadFailedError";
   }
 };
+var FileWriteError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FileWriteError";
+  }
+};
 var HttpStatusError = class extends Error {
   status;
   retryAfter;
@@ -56839,6 +56845,12 @@ function mapError(err) {
       exitCode: EXIT_CODES.VALIDATION
     };
   }
+  if (err instanceof FileWriteError) {
+    return {
+      envelope: { code: "validation_error", message: err.message },
+      exitCode: EXIT_CODES.VALIDATION
+    };
+  }
   if (err instanceof ApiKeyInvalidCharactersError) {
     return {
       envelope: { code: "validation_error", message: err.message },
@@ -61378,11 +61390,15 @@ function clearDefaultProfile() {
 // src/auth/api-key-provider.ts
 var ApiKeyProvider = class {
   getApiKey() {
-    const key = getDefaultApiKey();
-    if (key === void 0 || key === "") {
-      return Promise.reject(new MissingApiKeyError());
+    const stored = getDefaultApiKey();
+    if (stored !== void 0 && stored !== "") {
+      return Promise.resolve(stored);
+    }
+    const fromEnv = process.env.CLAY_API_KEY?.trim();
+    if (fromEnv !== void 0 && fromEnv !== "") {
+      return Promise.resolve(fromEnv);
     }
-    return Promise.resolve(key);
+    return Promise.reject(new MissingApiKeyError());
   }
 };
 
@@ -61451,6 +61467,13 @@ var timeoutApiFetcher = (args) => tsRestFetchApi({
     signal: withTimeoutSignal(requestTimeoutMs(), args.fetchOptions?.signal)
   }
 });
+var largeTransferTimeoutApiFetcher = (args) => tsRestFetchApi({
+  ...args,
+  fetchOptions: {
+    ...args.fetchOptions,
+    signal: withTimeoutSignal(uploadTimeoutMs(), args.fetchOptions?.signal)
+  }
+});
 async function fetchWithTimeout(input, init3, timeoutMs = requestTimeoutMs()) {
   return fetch(input, { ...init3, signal: withTimeoutSignal(timeoutMs, init3?.signal) });
 }
@@ -61460,7 +61483,7 @@ var PUBLIC_API_V0_PREFIX = "/public/v0";
 var cache = /* @__PURE__ */ new Map();
 function createPublicApiClient(contract, apiKey) {
   return initClient(contract, {
-    baseUrl: `${normalizeBaseUrl(process.env.CLAY_BASE_URL)}${PUBLIC_API_V0_PREFIX}`,
+    baseUrl: `${normalizeBaseUrl(process.env.CLAY_API_URL)}${PUBLIC_API_V0_PREFIX}`,
     baseHeaders: {
       [CLAY_API_KEY_HEADER]: apiKey,
       ...cliAttributionHeaders()
@@ -61485,26 +61508,30 @@ function invalidatePublicApiClient() {
 
 // src/clients/v3-client.ts
 var cache2 = /* @__PURE__ */ new Map();
-async function v3Client(contract) {
-  const cached2 = cache2.get(contract);
+var largeTransferCache = /* @__PURE__ */ new Map();
+async function v3Client(contract, options = {}) {
+  const useLargeTransfer = options.timeout === "large-transfer";
+  const store = useLargeTransfer ? largeTransferCache : cache2;
+  const cached2 = store.get(contract);
   if (cached2 !== void 0) {
     return cached2;
   }
   const apiKey = await tokenProvider.getApiKey();
   const client = initClient(contract, {
-    baseUrl: `${normalizeBaseUrl(process.env.CLAY_BASE_URL)}/v3`,
+    baseUrl: `${normalizeBaseUrl(process.env.CLAY_API_URL)}/v3`,
     baseHeaders: {
       [CLAY_API_KEY_HEADER]: apiKey,
       ...cliAttributionHeaders()
     },
     validateResponse: true,
-    api: timeoutApiFetcher
+    api: useLargeTransfer ? largeTransferTimeoutApiFetcher : timeoutApiFetcher
   });
-  cache2.set(contract, client);
+  store.set(contract, client);
   return client;
 }
 function invalidateV3Client() {
   cache2.clear();
+  largeTransferCache.clear();
 }
 
 // ../../node_modules/@sentry/node/build/esm/integrations/http.js
@@ -82695,7 +82722,7 @@ Examples:
 // src/commands/logout.ts
 function registerLogout(program3) {
   program3.command("logout").description(
-    "Remove the saved API key from the config file. Idempotent \u2014 succeeds even if no key is currently saved. Subsequent authenticated commands will fail with auth_missing_api_key (exit 3) until you run `clay login` again."
+    "Remove the saved API key from the config file. Idempotent \u2014 succeeds even if no key is currently saved. Subsequent authenticated commands will fail with auth_missing_api_key (exit 3) until you run `clay login` again \u2014 unless CLAY_API_KEY is set in the environment, which logout cannot remove and which keeps the CLI authenticated."
   ).addHelpText(
     "after",
     `
@@ -82703,10 +82730,11 @@ Output (success, exit 0):
   { "ok": true }
   Removes only the "default" profile; other profiles in the file are preserved.
   Idempotent \u2014 if no key is saved (or the config file is missing), the command is a no-op and still exits 0.
+  Does not unset the CLAY_API_KEY environment variable; if it is set, the CLI stays authenticated via that fallback after logout.
 
 Examples:
   $ clay logout
-  $ clay logout && clay whoami   # confirms the key was removed (whoami \u2192 auth_missing_api_key, exit 3)
+  $ clay logout && clay whoami   # confirms the key was removed (whoami \u2192 auth_missing_api_key, exit 3, when CLAY_API_KEY is unset)
 `
   ).action(() => {
     clearDefaultProfile();
@@ -83819,6 +83847,18 @@ var FetchSmartleadCampaignDayWiseAnalyticsRequest = external_exports.object({
     campaign_ids: external_exports.string().optional()
   })
 });
+var FetchSmartleadCampaignsForClientIdRequest = external_exports.object({});
+var SmartleadCampaignListItem = external_exports.object({
+  id: external_exports.number(),
+  name: external_exports.string(),
+  status: SmartleadCampaignStatusSchema,
+  created_at: external_exports.string(),
+  updated_at: external_exports.string(),
+  send_as_plain_text: external_exports.boolean()
+});
+var FetchSmartleadCampaignsForClientIdResponse = external_exports.object({
+  campaigns: external_exports.array(SmartleadCampaignListItem)
+});
 var SmartleadMasterInboxReply = external_exports.object({
   // An ID used to identify a specific email reply for a lead (e.g. to mark Unread/Read).
   // This is the unique ID for a given reply in the master inbox.
@@ -84693,6 +84733,7 @@ var ConditionalBinaryOperator = /* @__PURE__ */ ((ConditionalBinaryOperator2) =>
   ConditionalBinaryOperator2["Before"] = "Before";
   ConditionalBinaryOperator2["After"] = "After";
   ConditionalBinaryOperator2["On"] = "On";
+  ConditionalBinaryOperator2["SimilarTo"] = "SimilarTo";
   ConditionalBinaryOperator2["Empty"] = "Empty";
   ConditionalBinaryOperator2["NotEmpty"] = "NotEmpty";
   return ConditionalBinaryOperator2;
@@ -85192,6 +85233,7 @@ var SchedulePeriodUnit = /* @__PURE__ */ ((SchedulePeriodUnit2) => {
   SchedulePeriodUnit2["Quarter"] = "quarterly";
   return SchedulePeriodUnit2;
 })(SchedulePeriodUnit || {});
+var SCHEDULE_PERIOD_UNITS = Object.values(SchedulePeriodUnit);
 var ScheduleSettings = external_exports.object({
   periodUnit: external_exports.nativeEnum(SchedulePeriodUnit),
   periodAmount: external_exports.number().int().positive()
@@ -85850,6 +85892,15 @@ var FunctionUpdateToolInput = FunctionUpdateToolRequest.extend({
   toolId: external_exports.string(),
   outputFormat: MCPOutputFormat.optional()
 });
+var EnrichmentUpsertToolRequest = UpsertToolBase.extend({
+  type: external_exports.literal("enrichment"),
+  actionPackageId: external_exports.string(),
+  actionKey: external_exports.string(),
+  appAccountId: external_exports.string().nullable().optional()
+});
+var EnrichmentUpdateToolRequest = UpdateToolBase.extend({
+  type: external_exports.literal("enrichment")
+});
 var EnrichmentCreateToolInput = external_exports.object({
   workspaceId: external_exports.number(),
   type: external_exports.literal("enrichment"),
@@ -85858,13 +85909,17 @@ var EnrichmentCreateToolInput = external_exports.object({
   description: external_exports.string().max(500).nullable().optional(),
   access: ToolAccess
 });
-var EnrichmentUpdateToolInput = UpdateToolBase.extend({
+var EnrichmentUpsertToolInput = UpsertToolBase.extend({
+  type: external_exports.literal("enrichment"),
   workspaceId: external_exports.number(),
-  toolId: external_exports.string(),
-  type: external_exports.literal("enrichment")
+  id: external_exports.string()
+});
+var EnrichmentUpdateToolInput = EnrichmentUpdateToolRequest.extend({
+  workspaceId: external_exports.number(),
+  toolId: external_exports.string()
 });
 var CreateToolInputSchema = external_exports.discriminatedUnion("type", [FunctionCreateToolInput, EnrichmentCreateToolInput]);
-var UpsertToolInputSchema = external_exports.discriminatedUnion("type", [FunctionUpsertToolInput]);
+var UpsertToolInputSchema = external_exports.discriminatedUnion("type", [FunctionUpsertToolInput, EnrichmentUpsertToolInput]);
 var UpdateToolInputSchema = external_exports.discriminatedUnion("type", [FunctionUpdateToolInput, EnrichmentUpdateToolInput]);
 
 // ../../libs/api-contract/src/public-api-v0/tools-contract.ts
@@ -85875,8 +85930,10 @@ var RunToolItemSchema = external_exports.object({
   inputs: external_exports.record(external_exports.unknown())
 });
 var MAX_RUN_ITEMS = 100;
+var WEBHOOK_ID_DESCRIPTION = "ID of a registered Clay webhook to notify when the run finishes.";
 var RunToolRequestSchema = external_exports.object({
-  items: external_exports.array(RunToolItemSchema).min(1).max(MAX_RUN_ITEMS)
+  items: external_exports.array(RunToolItemSchema).min(1).max(MAX_RUN_ITEMS),
+  webhook_id: external_exports.string().min(1).max(MAX_ID_LENGTH).optional().describe(WEBHOOK_ID_DESCRIPTION)
 });
 var RunToolResponseSchema = external_exports.object({
   tool_run_id: external_exports.string(),
@@ -85910,7 +85967,8 @@ var BatchUploadUrlResponseSchema = external_exports.object({
   file_id: external_exports.string()
 });
 var StartBatchRequestSchema = external_exports.object({
-  file_id: external_exports.string()
+  file_id: external_exports.string(),
+  webhook_id: external_exports.string().min(1).max(MAX_ID_LENGTH).optional().describe(WEBHOOK_ID_DESCRIPTION)
 });
 var StartBatchResponseSchema = external_exports.object({
   tool_run_id: external_exports.string(),
@@ -86041,8 +86099,14 @@ var ToolAccess2 = external_exports.object({
   integrations: external_exports.array(ToolSurface).transform((arr) => [...new Set(arr)])
 });
 var CreateToolRequestSchema = external_exports.discriminatedUnion("type", [FunctionCreateToolRequest]);
-var UpsertToolRequestSchema = external_exports.discriminatedUnion("type", [FunctionUpsertToolRequest]);
-var UpdateToolRequestSchema = external_exports.discriminatedUnion("type", [FunctionUpdateToolRequest]);
+var UpsertToolRequestSchema = external_exports.discriminatedUnion("type", [
+  FunctionUpsertToolRequest,
+  EnrichmentUpsertToolRequest
+]);
+var UpdateToolRequestSchema = external_exports.discriminatedUnion("type", [
+  FunctionUpdateToolRequest,
+  EnrichmentUpdateToolRequest
+]);
 var ToolResponse = external_exports.object({
   id: external_exports.string(),
   type: ToolType,
@@ -86610,7 +86674,7 @@ function readRunToolRequest(source) {
   } catch (err) {
     throw new InvalidArgumentError(`--input: not valid JSON (${err.message})`);
   }
-  const request2 = RunToolRequestSchema.safeParse(parsed);
+  const request2 = RunToolRequestSchema.pick({ items: true }).safeParse(parsed);
   if (!request2.success) {
     const issue = request2.error.issues[0];
     const path7 = issue?.path.length ? ` at ${issue.path.join(".")}` : "";
@@ -86676,7 +86740,7 @@ function buildStartCommand() {
   const cmd = new Command("start");
   cmd.description(
     "Start an async tool run through the API & CLI integration. Returns immediately; this command does not poll or wait."
-  ).argument("<toolId>", "Tool id, e.g. function:tbl_abc123").option("--input <file|->", "Inline run body JSON. Use - to read from stdin.").option("--bulk <file.jsonl>", 'Batch run input JSONL file. Each line is { "id": <string>, "inputs": <object> }.').addHelpText(
+  ).argument("<toolId>", "Tool id, e.g. function:tbl_abc123").option("--input <file|->", "Inline run body JSON. Use - to read from stdin.").option("--bulk <file.jsonl>", 'Batch run input JSONL file. Each line is { "id": <string>, "inputs": <object> }.').option("--webhook-id <id>", "Registered webhook id (wh_...) to notify when the run finishes.").addHelpText(
     "after",
     `
 Output (success, exit 0):
@@ -86700,7 +86764,9 @@ Examples:
   $ clay tools update function:tbl_x --integrations api
   $ cat input.json | clay tools runs start function:tbl_x --input -
   $ clay tools runs start function:tbl_x --input input.json | jq -r '.toolRunId'
+  $ clay tools runs start function:tbl_x --input input.json --webhook-id wh_abc123 | jq -r '.toolRunId'
   $ clay tools runs start function:tbl_x --bulk rows.jsonl
+  $ clay tools runs start function:tbl_x --bulk rows.jsonl --webhook-id wh_abc123
 `
   ).action(async (toolId, opts) => {
     const hasInput = opts.input !== void 0;
@@ -86711,6 +86777,7 @@ Examples:
     const client = await publicApiClient(publicApiToolsContract);
     if (opts.input !== void 0) {
       const body2 = readRunToolRequest(opts.input);
+      body2.webhook_id = opts.webhookId;
       const response2 = await unwrap(client.runTool({ params: { tool_id: toolId }, body: body2 }));
       writeJson(projectInlineStart(response2));
       return;
@@ -86722,7 +86789,10 @@ Examples:
     const upload = await unwrap(client.runToolBatchUploadUrl({ params: { tool_id: toolId } }));
     await uploadJsonl(upload.upload_url, body);
     const response = await unwrap(
-      client.startToolRunBatch({ params: { tool_id: toolId }, body: { file_id: upload.file_id } })
+      client.startToolRunBatch({
+        params: { tool_id: toolId },
+        body: { file_id: upload.file_id, webhook_id: opts.webhookId }
+      })
     );
     writeJson(projectBulkStart(response, upload.file_id));
   });
@@ -86851,6 +86921,9 @@ Subcommands:
   update    Update name, description, entity-type, or integrations.
   runs      Start async tool runs and fetch run status/results.
 
+These are workspace function tools. For workflow building blocks (actions you add
+to a node\u2019s "tools"), see \`clay workflows actions\` instead.
+
 See \`clay tools <subcommand> --help\` for per-subcommand JSON shape, error codes, and examples.
 `
   );
@@ -86861,6 +86934,277 @@ See \`clay tools <subcommand> --help\` for per-subcommand JSON shape, error code
   program3.addCommand(tools);
 }
 
+// ../../libs/api-contract/src/webhooks/contract.ts
+var WebhookSummary = external_exports.object({
+  id: external_exports.string(),
+  url: external_exports.string(),
+  createdAt: external_exports.string()
+});
+var WebhookCreatedResponse = WebhookSummary.extend({
+  signingSecret: external_exports.string()
+});
+var ListWebhooksResponse = external_exports.object({
+  data: external_exports.array(WebhookSummary),
+  cursor: external_exports.string().nullable()
+});
+var WebhookTestResult = external_exports.object({
+  id: external_exports.string(),
+  status: external_exports.enum(["success", "failed"]),
+  statusCode: external_exports.number().int().optional()
+});
+var CreateWebhookBody = external_exports.object({
+  url: external_exports.string().url()
+});
+var webhooksContract = {
+  createWebhook: {
+    method: "POST",
+    path: "/workspaces/:workspaceId/webhooks",
+    pathParams: external_exports.object({
+      workspaceId: external_exports.string()
+    }),
+    body: CreateWebhookBody,
+    responses: {
+      201: WebhookCreatedResponse
+    },
+    summary: "Create a webhook for a workspace; returns the signing secret once",
+    metadata: { team: "rep-tools" /* RepTools */ }
+  },
+  listWebhooks: {
+    method: "GET",
+    path: "/workspaces/:workspaceId/webhooks",
+    pathParams: external_exports.object({
+      workspaceId: external_exports.string()
+    }),
+    query: external_exports.object({
+      cursor: external_exports.string().optional(),
+      limit: external_exports.coerce.number().int().positive().max(200).optional()
+    }),
+    responses: {
+      200: ListWebhooksResponse
+    },
+    summary: "List active webhooks for a workspace (cursor-paginated, newest first)",
+    metadata: { team: "rep-tools" /* RepTools */ }
+  },
+  deleteWebhook: {
+    method: "DELETE",
+    path: "/workspaces/:workspaceId/webhooks/:webhookId",
+    pathParams: external_exports.object({
+      workspaceId: external_exports.string(),
+      webhookId: external_exports.string()
+    }),
+    body: external_exports.object({}),
+    responses: {
+      200: external_exports.object({ success: external_exports.literal(true) }),
+      404: external_exports.object({ message: external_exports.string() })
+    },
+    summary: "Soft-delete a webhook",
+    metadata: { team: "rep-tools" /* RepTools */ }
+  },
+  testWebhook: {
+    method: "POST",
+    path: "/workspaces/:workspaceId/webhooks/:webhookId/test",
+    pathParams: external_exports.object({
+      workspaceId: external_exports.string(),
+      webhookId: external_exports.string()
+    }),
+    body: external_exports.object({}),
+    responses: {
+      200: WebhookTestResult,
+      404: external_exports.object({ message: external_exports.string() })
+    },
+    summary: "Send a signed test event to a webhook and report the delivery outcome",
+    metadata: { team: "rep-tools" /* RepTools */ }
+  }
+};
+
+// src/commands/webhooks/create.ts
+function buildCreateCommand() {
+  const cmd = new Command("create");
+  cmd.description(
+    "Create a webhook. The signing secret is returned exactly once \u2014 capture it now; it can never be read again."
+  ).argument("<url>", "HTTPS endpoint that will receive signed webhook deliveries.").addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  {
+    "id": <string>,
+    "url": <string>,
+    "createdAt": <string>,
+    "signingSecret": <string>
+  }
+
+Common errors:
+  validation_error (exit 2)  <url> is not a valid URL.
+  auth_forbidden   (exit 3)  Key lacks permission to manage webhooks.
+  not_found        (exit 6)  Webhooks are not enabled for this workspace.
+
+Examples:
+  $ clay webhooks create https://example.com/hooks/clay
+  $ clay webhooks create https://example.com/hooks/clay | jq -r '.signingSecret'
+`
+  ).action(async (url) => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(webhooksContract);
+    const webhook = await unwrap(client.createWebhook({ params: { workspaceId }, body: { url } }));
+    writeJson({
+      id: webhook.id,
+      url: webhook.url,
+      createdAt: webhook.createdAt,
+      signingSecret: webhook.signingSecret
+    });
+  });
+  return cmd;
+}
+
+// src/commands/webhooks/delete.ts
+function buildDeleteCommand() {
+  const cmd = new Command("delete");
+  cmd.description("Delete a webhook by id").argument("<webhookId>", "Webhook id, e.g. the `id` returned by `clay webhooks list`.").addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  { "ok": true }
+
+Common errors:
+  auth_forbidden   (exit 3)  Key lacks permission to manage webhooks.
+  not_found        (exit 6)  No webhook with that id in this workspace.
+
+Examples:
+  $ clay webhooks delete whk_abc123
+  $ clay webhooks list | jq -r '.data[0].id' | xargs clay webhooks delete
+`
+  ).action(async (webhookId) => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(webhooksContract);
+    await unwrap(client.deleteWebhook({ params: { workspaceId, webhookId }, body: {} }));
+    writeJson({ ok: true });
+  });
+  return cmd;
+}
+
+// src/commands/webhooks/list.ts
+function buildListCommand4() {
+  const cmd = new Command("list");
+  cmd.description("List active webhooks with the most recently created first").option("--limit <n>", "Max webhooks to return per page (1-200, default 50).", parseLimitFlag).option("--cursor <token>", "Resume from a previous response's `cursor` to fetch the next page.").addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  {
+    "data": [
+      {
+        "id": <string>,
+        "url": <string>,
+        "createdAt": <string>
+      }
+    ],
+    "cursor": <string|undefined>
+  }
+
+Pagination:
+  Page size and position are flags:
+    --limit <n>       max webhooks per call (1-200, default 50)
+    --cursor <token>  resume from a previous response's \`cursor\`
+  When more results exist, the response includes a top-level \`cursor\`; pass it back via
+  --cursor to fetch the next page.
+
+Common errors:
+  validation_error (exit 2)  --limit is not a positive integer.
+  auth_forbidden   (exit 3)  Key lacks permission to manage webhooks.
+  not_found        (exit 6)  Webhooks are not enabled for this workspace.
+
+Examples:
+  $ clay webhooks list
+  $ clay webhooks list --limit 100 | jq -r '.data[].url'
+  $ clay webhooks list --limit 100 --cursor "$CURSOR"
+`
+  ).action(async (opts) => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(webhooksContract);
+    const page = await unwrap(
+      client.listWebhooks({
+        params: { workspaceId },
+        query: {
+          limit: opts.limit,
+          cursor: opts.cursor
+        }
+      })
+    );
+    writeJson({
+      data: page.data.map((w) => ({
+        id: w.id,
+        url: w.url,
+        createdAt: w.createdAt
+      })),
+      ...page.cursor === null ? {} : { cursor: page.cursor }
+    });
+  });
+  return cmd;
+}
+
+// src/commands/webhooks/test.ts
+function buildTestCommand() {
+  const cmd = new Command("test");
+  cmd.description("Send a signed test event to a webhook and report the delivery outcome.").argument("<webhookId>", "Webhook id, e.g. the `id` returned by `clay webhooks list`.").addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  {
+    "id": <string>,
+    "status": "success" | "failed",
+    "statusCode": <number|undefined>
+  }
+
+status values:
+  success  The endpoint accepted the delivery (2xx response).
+  failed   The endpoint rejected the delivery or was unreachable.
+
+Common errors:
+  auth_forbidden   (exit 3)  Key lacks permission to manage webhooks.
+  not_found        (exit 6)  No webhook with that id in this workspace.
+
+Examples:
+  $ clay webhooks test whk_abc123
+  $ clay webhooks test whk_abc123 | jq -r '.status'
+`
+  ).action(async (webhookId) => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(webhooksContract);
+    const result = await unwrap(client.testWebhook({ params: { workspaceId, webhookId }, body: {} }));
+    writeJson({
+      id: result.id,
+      status: result.status,
+      ...result.statusCode === void 0 ? {} : { statusCode: result.statusCode }
+    });
+  });
+  return cmd;
+}
+
+// src/commands/webhooks/index.ts
+function registerWebhooks(program3) {
+  const webhooks = applyClaySettings(
+    new Command("webhooks").description(
+      "Manage webhooks in the authenticated workspace. Subcommands: create, list, delete, test."
+    )
+  );
+  webhooks.addHelpText(
+    "after",
+    `
+Subcommands:
+  create    Create a webhook; returns the signing secret exactly once.
+  list      List active webhooks in the workspace (newest first).
+  delete    Delete a webhook by id.
+  test      Send a signed test event to a webhook and report the outcome.
+
+See \`clay webhooks <subcommand> --help\` for per-subcommand JSON shape, error codes, and examples.
+`
+  );
+  webhooks.addCommand(applyClaySettings(buildCreateCommand()));
+  webhooks.addCommand(applyClaySettings(buildListCommand4()));
+  webhooks.addCommand(applyClaySettings(buildDeleteCommand()));
+  webhooks.addCommand(applyClaySettings(buildTestCommand()));
+  program3.addCommand(webhooks);
+}
+
 // src/commands/whoami.ts
 function registerWhoami(program3) {
   program3.command("whoami").description(
@@ -86898,6 +87242,204 @@ Examples:
   });
 }
 
+// ../../libs/api-contract/src/terracotta/clay-actions/contract.ts
+var terracottaClayActionsContract = {
+  getClayActions: {
+    method: "GET",
+    path: "/workspaces/:workspaceId/tc-clay-actions",
+    pathParams: external_exports.object({
+      workspaceId: external_exports.string()
+    }),
+    responses: {
+      // Returns raw JSON array of action objects — no strict schema since
+      // the shape comes from the clay_actions.json catalog file
+      200: external_exports.unknown()
+    },
+    summary: "Get filtered and annotated Clay actions catalog for a workspace",
+    metadata: { team: "workflows" /* Workflows */ }
+  },
+  getClayActionSchema: {
+    method: "GET",
+    path: "/workspaces/:workspaceId/tc-clay-action-schemas/:packageId/:actionKey",
+    pathParams: external_exports.object({
+      workspaceId: external_exports.string(),
+      packageId: external_exports.string(),
+      actionKey: external_exports.string()
+    }),
+    responses: {
+      200: external_exports.unknown(),
+      404: external_exports.object({ error: external_exports.string() })
+    },
+    summary: "Get input schema for a specific Clay action by packageId and actionKey",
+    metadata: { team: "workflows" /* Workflows */ }
+  }
+};
+
+// src/commands/workflows/actions/projection.ts
+var ACTION_FIELDS = [
+  "type",
+  "actionKey",
+  "functionId",
+  "name",
+  "displayName",
+  "description",
+  "packageId",
+  "packageDisplayName",
+  "packageDescription",
+  "documentationUri",
+  "categories",
+  "actionLabels",
+  "creditCost",
+  "usesPrivateKeyCost",
+  "paymentType",
+  "outputParameters",
+  "dataStrengths",
+  "whyUseful",
+  "useCaseExamples",
+  "providerDescription",
+  "clayUseCase",
+  "configuredTools",
+  "availableAppAccounts",
+  "priorityTier"
+];
+function isObject6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function projectAction(entry) {
+  if (!isObject6(entry)) {
+    throw new IncompatibleApiServerError("Clay actions catalog entry was not an object.");
+  }
+  const projected = {};
+  for (const field of ACTION_FIELDS) {
+    if (entry[field] !== void 0) {
+      projected[field] = entry[field];
+    }
+  }
+  return projected;
+}
+function projectActions(body) {
+  if (!Array.isArray(body)) {
+    throw new IncompatibleApiServerError("Clay actions catalog was not a JSON array.");
+  }
+  return body.map(projectAction);
+}
+function projectActionSchema(body) {
+  if (!isObject6(body)) {
+    throw new IncompatibleApiServerError("Clay action schema response was not an object.");
+  }
+  if (typeof body.packageId !== "string" || typeof body.actionKey !== "string" || typeof body.displayName !== "string" || !Array.isArray(body.inputParameters)) {
+    throw new IncompatibleApiServerError("Clay action schema response is missing required fields.");
+  }
+  return {
+    packageId: body.packageId,
+    actionKey: body.actionKey,
+    displayName: body.displayName,
+    inputParameters: body.inputParameters
+  };
+}
+
+// src/commands/workflows/actions/list.ts
+function buildListCommand5() {
+  const cmd = new Command("list");
+  cmd.description('Dump the Clay action catalog \u2014 the building blocks for a workflow node\u2019s "tools".').addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  { "data": [ <action>, ... ] }
+
+  Each action carries its full documented field set so the catalog stays
+  greppable: "type", "actionKey", "functionId", "name", "displayName",
+  "description", "packageId", "packageDisplayName", "packageDescription",
+  "documentationUri", "categories", "actionLabels", "creditCost",
+  "usesPrivateKeyCost", "paymentType", "outputParameters", "dataStrengths",
+  "whyUseful", "useCaseExamples", "providerDescription", "clayUseCase",
+  "configuredTools", "availableAppAccounts", "priorityTier" (lower ranks higher).
+  Fields are present only when the catalog supplies them.
+
+  The catalog is large (~1.5k entries). The intended flow is dump-then-filter:
+  write it to a file once, then grep/jq it repeatedly. To *use* an action in a
+  node\u2019s tools, take its "packageId" + "actionKey" (or reuse a
+  "configuredTools[].toolId"); fetch its inputs with \`workflows actions schema\`.
+
+  Not to be confused with \`clay tools\`, which lists workspace *function tools* \u2014
+  a different concept. Use this command for workflow building blocks.
+
+Common errors:
+  auth_forbidden   (exit 3)  API key lacks permission for this command (insufficient scope).
+
+Examples:
+  $ clay workflows actions list > catalog.json
+  $ jq -r '.data[] | select(.name | test("email";"i")) | "\\(.packageId) \\(.actionKey)"' catalog.json
+  $ clay workflows actions list | jq '.data | length'
+`
+  ).action(async () => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(terracottaClayActionsContract);
+    const result = await unwrap(client.getClayActions({ params: { workspaceId } }));
+    writeJson({ data: projectActions(result) });
+  });
+  return cmd;
+}
+
+// src/commands/workflows/actions/schema.ts
+function buildSchemaCommand() {
+  const cmd = new Command("schema");
+  cmd.description("Fetch the input schema for one Clay action, to wire it into a node\u2019s tools.").argument("<packageId>", "Action package id, from `workflows actions list`").argument("<actionKey>", "Action key, from `workflows actions list`").addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  {
+    "packageId": <string>,
+    "actionKey": <string>,
+    "displayName": <string>,
+    "inputParameters": [ <parameter>, ... ]
+  }
+
+  "inputParameters" is an array of the action\u2019s input parameters \u2014 one entry per
+  field you can pass when adding this action to a node\u2019s "tools" (each typically
+  has name/displayName/type/required/description).
+
+Common errors:
+  validation_error (exit 2)  packageId and actionKey arguments are required.
+  not_found        (exit 6)  No action with that packageId/actionKey.
+  auth_forbidden   (exit 3)  API key lacks permission for this command (insufficient scope).
+
+Examples:
+  $ clay workflows actions schema 56058efe-4757-4fe7-a44b-39c2d730c47a find-email-from-name
+  $ clay workflows actions schema <packageId> <actionKey> | jq '.inputParameters'
+`
+  ).action(async (packageId, actionKey) => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(terracottaClayActionsContract);
+    const result = await unwrap(client.getClayActionSchema({ params: { workspaceId, packageId, actionKey } }));
+    writeJson(projectActionSchema(result));
+  });
+  return cmd;
+}
+
+// src/commands/workflows/actions/index.ts
+function buildActionsCommand() {
+  const cmd = new Command("actions");
+  cmd.description("Browse the Clay action catalog \u2014 the building blocks for a workflow node\u2019s tools.").addHelpText(
+    "after",
+    `
+Subcommands:
+  list      Dump the full action catalog (greppable JSON).
+  schema    Fetch one action\u2019s input schema by packageId + actionKey.
+
+These are workflow building blocks (actions you add to a node\u2019s "tools"). For
+workspace *function tools*, a different concept, see \`clay tools\`.
+
+Examples:
+  $ clay workflows actions list > catalog.json
+  $ clay workflows actions schema <packageId> <actionKey> | jq '.inputParameters'
+`
+  );
+  cmd.addCommand(applyClaySettings(buildListCommand5()));
+  cmd.addCommand(applyClaySettings(buildSchemaCommand()));
+  return cmd;
+}
+
 // ../../libs/shared/src/agents/json-schema-validation.ts
 var JSONSchemaType = external_exports.enum(["string", "number", "integer", "boolean", "array", "object"]);
 var BaseJSONSchemaProperty = external_exports.object({
@@ -88362,6 +88904,15 @@ var SerializedWorkflow = external_exports.object({
 var SerializedWorkflows = external_exports.object({
   workflows: external_exports.array(SerializedWorkflow)
 });
+var WORKFLOW_LIST_MAX_PAGE_SIZE = 200;
+var ListWorkflowsQuerySchema = external_exports.object({
+  cursor: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().positive().max(WORKFLOW_LIST_MAX_PAGE_SIZE).optional()
+});
+var ListWorkflowsResponseSchema = external_exports.object({
+  workflows: external_exports.array(SerializedWorkflow),
+  nextCursor: external_exports.string().nullable()
+});
 
 // ../../libs/api-contract/src/terracotta/workflows/contract.ts
 var terracottaWorkflowsContract = {
@@ -88377,6 +88928,19 @@ var terracottaWorkflowsContract = {
     summary: "Get workflows for workspace",
     metadata: { team: "workflows" /* Workflows */ }
   },
+  listWorkflows: {
+    method: "GET",
+    path: "/workspaces/:workspaceId/tc-workflows-paginated",
+    pathParams: external_exports.object({
+      workspaceId: external_exports.string()
+    }),
+    query: ListWorkflowsQuerySchema.optional(),
+    responses: {
+      200: ListWorkflowsResponseSchema
+    },
+    summary: "List workflows for workspace (paginated)",
+    metadata: { team: "workflows" /* Workflows */ }
+  },
   getWorkflow: {
     method: "GET",
     path: "/workspaces/:workspaceId/tc-workflows/:workflowId",
@@ -88496,8 +89060,7 @@ var terracottaWorkflowsContract = {
       workflowId: external_exports.string()
     }),
     body: external_exports.object({
-      name: external_exports.string().max(255).optional(),
-      lastRunAt: external_exports.string().datetime().optional()
+      name: external_exports.string().max(255).optional()
     }),
     responses: {
       200: external_exports.object({ workflow: SerializedWorkflow })
@@ -88576,7 +89139,7 @@ function parseNameFlag(value) {
   }
   return trimmed;
 }
-function buildCreateCommand() {
+function buildCreateCommand2() {
   const cmd = new Command("create");
   cmd.description("Create a new empty workflow.").requiredOption("--name <name>", "Workflow name.", parseNameFlag).addHelpText(
     "after",
@@ -88639,7 +89202,7 @@ Examples:
 }
 
 // src/commands/workflows/list.ts
-function buildListCommand4() {
+function buildListCommand6() {
   const cmd = new Command("list");
   cmd.description("List workflows in the workspace.").option(
     "--limit <n>",
@@ -88678,6 +89241,130 @@ Examples:
   return cmd;
 }
 
+// src/commands/workflows/runs/download-file.ts
+var import_node_fs10 = require("fs");
+var import_node_path7 = require("path");
+
+// ../../libs/api-contract/src/terracotta/code-tool/interfaces.ts
+var ToolExecutionRequest = external_exports.object({
+  toolId: external_exports.string().describe('Tool ID in format "actionPackageId:actionKey"'),
+  inputs: external_exports.record(external_exports.unknown()).describe("Tool input parameters")
+});
+var ToolExecutionResponse = external_exports.object({
+  success: external_exports.boolean(),
+  result: external_exports.unknown().optional(),
+  error: external_exports.string().optional()
+});
+var ToolExecutionErrorResponse = external_exports.object({
+  error: external_exports.string()
+});
+var SandboxFileDownloadRequest = external_exports.object({
+  filePath: external_exports.string().describe("Path to the file in the sandbox filesystem")
+});
+var SandboxFileDownloadErrorResponse = external_exports.object({
+  error: external_exports.string()
+});
+
+// ../../libs/api-contract/src/terracotta/code-tool/contract.ts
+var terracottaCodeToolContract = {
+  executeToolFromCode: {
+    method: "POST",
+    path: "/terracotta/internal/workflow-run/:workflowRunId/step/:stepId/execute-tool",
+    pathParams: external_exports.object({
+      workflowRunId: external_exports.string(),
+      stepId: external_exports.string()
+    }),
+    responses: {
+      200: ToolExecutionResponse,
+      401: ToolExecutionErrorResponse,
+      403: ToolExecutionErrorResponse,
+      422: ToolExecutionErrorResponse,
+      500: ToolExecutionErrorResponse
+    },
+    body: ToolExecutionRequest,
+    summary: "Execute a tool from code node",
+    description: "Internal endpoint for executing Clay actions from Python code running in Daytona sandboxes",
+    metadata: { team: "workflows" /* Workflows */ }
+  },
+  downloadFileFromSandbox: {
+    method: "POST",
+    path: "/terracotta/internal/workflow-run/:workflowRunId/download-file",
+    pathParams: external_exports.object({
+      workflowRunId: external_exports.string()
+    }),
+    responses: {
+      200: external_exports.object({
+        success: external_exports.literal(true),
+        fileData: external_exports.string().describe("Base64-encoded file contents"),
+        filename: external_exports.string().describe("Basename of the file")
+      }),
+      401: SandboxFileDownloadErrorResponse,
+      403: SandboxFileDownloadErrorResponse,
+      404: SandboxFileDownloadErrorResponse,
+      500: SandboxFileDownloadErrorResponse
+    },
+    body: SandboxFileDownloadRequest,
+    summary: "Download a file from a workflow run sandbox",
+    description: "Downloads a file from the Daytona sandbox associated with a workflow run. Returns the raw file contents as a binary response.",
+    metadata: { team: "workflows" /* Workflows */ }
+  }
+};
+
+// src/commands/workflows/runs/download-file.ts
+function buildDownloadFileCommand() {
+  const cmd = new Command("download-file");
+  cmd.description("Download a file written by a code node from a workflow run sandbox onto local disk.").argument("<workflowId>", "Workflow id, e.g. wf_abc123").argument("<runId>", "Run id, e.g. wfr_xyz789").requiredOption(
+    "--path <sandbox-path>",
+    "Absolute path of the file inside the run sandbox, e.g. /home/daytona/report.csv"
+  ).option(
+    "--output <local>",
+    "Local path to write the file to. Defaults to the basename of --path in the current directory."
+  ).addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  { "path": <string>, "size": <number> }
+
+  "path" is the local path the file was written to; "size" is its size in bytes.
+  The file contents are written to disk only \u2014 never to stdout \u2014 so the JSON
+  envelope stays clean for piping. Code nodes run in an ephemeral per-run sandbox
+  (cwd /home/daytona) that is torn down after the run, so download artifacts
+  before the run is archived.
+
+  The run is resolved by runId alone \u2014 workflowId is positional only for parity
+  with the other "runs" subcommands and is NOT validated against the run. Passing
+  a runId that belongs to a different workflow still downloads from that run, so
+  make sure the runId is correct (e.g. from "runs get"/"runs start" output).
+
+Common errors:
+  validation_error (exit 2)  workflowId, runId, or --path is missing, or --output could not be written.
+  not_found        (exit 6)  No run with that runId, or no file at --path in its sandbox.
+  auth_forbidden   (exit 3)  API key lacks permission for this command (insufficient scope).
+
+Examples:
+  $ clay workflows runs download-file wf_abc123 wfr_xyz789 --path /home/daytona/report.csv
+  $ clay workflows runs download-file wf_abc123 wfr_xyz789 --path /home/daytona/out.json --output ./out.json
+  $ clay workflows runs download-file wf_abc123 wfr_xyz789 --path /home/daytona/report.csv | jq -r '.size'
+`
+  ).action(async (_workflowId, runId, opts) => {
+    const client = await v3Client(terracottaCodeToolContract, { timeout: "large-transfer" });
+    const result = await unwrap(
+      client.downloadFileFromSandbox({ params: { workflowRunId: runId }, body: { filePath: opts.path } })
+    );
+    const outputPath = opts.output ?? (0, import_node_path7.basename)(opts.path);
+    const bytes = Buffer.from(result.fileData, "base64");
+    try {
+      (0, import_node_fs10.writeFileSync)(outputPath, bytes);
+    } catch (err) {
+      throw new FileWriteError(
+        `Could not write to ${outputPath}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    writeJson({ path: outputPath, size: bytes.length });
+  });
+  return cmd;
+}
+
 // ../../libs/shared/src/agents/human-feedback.ts
 var ApproveContinuation = external_exports.object({
   type: external_exports.literal("ApproveContinuation")
@@ -89426,11 +90113,12 @@ function buildRunsCommand2() {
     "after",
     `
 Subcommands:
-  start    Start a workflow run.
-  get      Fetch status, progress, and per-node summary for a run.
-  steps    List the individual execution steps of a run, with filters.
-  pause    Pause an active run.
-  resume   Resume a paused run.
+  start          Start a workflow run.
+  get            Fetch status, progress, and per-node summary for a run.
+  steps          List the individual execution steps of a run, with filters.
+  pause          Pause an active run.
+  resume         Resume a paused run.
+  download-file  Download a file written by a code node from a run sandbox.
 
 Examples:
   $ clay workflows runs start wf_abc123 | jq -r '.runId'
@@ -89443,6 +90131,224 @@ Examples:
   cmd.addCommand(applyClaySettings(buildStepsCommand()));
   cmd.addCommand(applyClaySettings(buildPauseCommand()));
   cmd.addCommand(applyClaySettings(buildResumeCommand()));
+  cmd.addCommand(applyClaySettings(buildDownloadFileCommand()));
+  return cmd;
+}
+
+// src/commands/workflows/snapshots/projection.ts
+function projectSnapshotSummary(snapshot) {
+  return {
+    id: snapshot.id,
+    hash: snapshot.hash,
+    createdAt: snapshot.createdAt,
+    nodeCount: snapshot.content.nodes.length,
+    edgeCount: snapshot.content.edges.length
+  };
+}
+function projectNode(n) {
+  return {
+    id: n.id,
+    name: n.name,
+    description: n.description,
+    nodeType: n.nodeType,
+    isInitial: n.isInitial,
+    isTerminal: n.isTerminal,
+    tools: n.tools,
+    position: n.position,
+    // Coalesce null → undefined so absent optional fields are omitted from the
+    // JSON (matching the help's <object|undefined>) rather than emitted as null.
+    nodeConfig: n.nodeConfig ?? void 0,
+    retryConfig: n.retryConfig ?? void 0,
+    scriptVersionId: n.scriptVersionId ?? void 0,
+    currentScriptVersion: n.currentScriptVersion ?? void 0,
+    claygentSnapshot: n.claygentSnapshot ?? void 0
+  };
+}
+function projectEdge(e) {
+  return {
+    id: e.id,
+    sourceNodeId: e.sourceNodeId,
+    targetNodeId: e.targetNodeId,
+    // Rebuild rather than pass through by reference so a future field on the
+    // server edge type does not silently leak into the CLI output.
+    metadata: e.metadata ? { conditionalSourceHandle: e.metadata.conditionalSourceHandle } : null
+  };
+}
+function projectSnapshotGraph(snapshot, options = {}) {
+  const { nodeId } = options;
+  const nodes = nodeId === void 0 ? snapshot.content.nodes : snapshot.content.nodes.filter((n) => n.id === nodeId);
+  return {
+    id: snapshot.id,
+    workflowId: snapshot.workflowId,
+    hash: snapshot.hash,
+    createdAt: snapshot.createdAt,
+    containsCycles: snapshot.content.containsCycles,
+    nodes: nodes.map(projectNode),
+    edges: snapshot.content.edges.map(projectEdge)
+  };
+}
+
+// src/commands/workflows/snapshots/get.ts
+function buildGetCommand5() {
+  const cmd = new Command("get");
+  cmd.description("Fetch a single snapshot\u2019s full workflow graph (nodes, edges, agent prompts, code).").argument("<workflowId>", "Workflow id, e.g. wf_abc123").argument("<snapshotId>", "Snapshot id, from `snapshots list`").option("--node-id <id>", 'Only include the node with this id in "nodes" (edges are left intact).').addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  {
+    "id": <string>,
+    "workflowId": <string>,
+    "hash": <string>,
+    "createdAt": <string>,
+    "containsCycles": <boolean>,
+    "nodes": [ { "id": <string>, "name": <string>, "description": <string|null>,
+                 "nodeType": <string>, "isInitial": <boolean>, "isTerminal": <boolean>,
+                 "tools": <array>, "position": { "x": <number>, "y": <number> },
+                 "nodeConfig": <object|undefined>, "retryConfig": <object|undefined>,
+                 "scriptVersionId": <string|undefined>, "currentScriptVersion": <object|undefined>,
+                 "claygentSnapshot": <object|undefined> } ],
+    "edges": [ { "id": <string>, "sourceNodeId": <string>, "targetNodeId": <string>,
+                "metadata": { "conditionalSourceHandle": <string|undefined> } | null } ]
+  }
+
+  "nodes"/"edges" are the captured graph (the documented fields above) \u2014 stable
+  for diffing two \`snapshots get\` outputs with jq (there is no built-in diff).
+  "claygentSnapshot" holds the agent prompt and model/tool settings on agent
+  nodes. An edge's "metadata.conditionalSourceHandle" names the branch handle on
+  a "conditional" source node, so it identifies which branch the edge routes from.
+  A --node-id that matches no node yields "nodes": [] with exit 0 (not an error);
+  "edges" are still returned in full.
+
+Node type values:
+  agent        Claygent (LLM) node
+  code         Python code node
+  tool         Single-tool action node
+  conditional  Branches on a condition expression
+  fork         Splits execution into parallel branches
+  join         Merges parallel branches
+  map          Fans out over a list
+  reduce       Aggregates map results
+  collect      Collects streamed outputs into a list
+  trigger      Workflow entry-point node
+
+Common errors:
+  validation_error (exit 2)  workflowId and snapshotId arguments are required.
+  not_found        (exit 6)  No workflow or snapshot with that id in this workspace.
+  auth_forbidden   (exit 3)  API key lacks permission for this command (insufficient scope).
+
+Examples:
+  $ clay workflows snapshots get wf_abc123 snap_xyz
+  $ clay workflows snapshots get wf_abc123 snap_xyz --node-id node_3 | jq '.nodes[0]'
+  $ clay workflows snapshots get wf_abc123 snap_xyz | jq -r '.nodes[].name'
+`
+  ).action(async (workflowId, snapshotId, opts) => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(terracottaWorkflowsContract);
+    const result = await unwrap(client.getWorkflowSnapshot({ params: { workspaceId, workflowId, snapshotId } }));
+    writeJson(projectSnapshotGraph(result.snapshot, { nodeId: opts.nodeId }));
+  });
+  return cmd;
+}
+
+// src/commands/workflows/snapshots/list.ts
+function buildListCommand7() {
+  const cmd = new Command("list");
+  cmd.description("List a workflow\u2019s snapshots (automatic version history), newest first.").argument("<workflowId>", "Workflow id, e.g. wf_abc123").addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  { "data": [ { "id": <string>, "hash": <string>, "createdAt": <string>,
+               "nodeCount": <number>, "edgeCount": <number> } ] }
+
+  Snapshots are an immutable, content-addressed capture of the whole workflow
+  graph, auto-created before every node edit and at run start. They are returned
+  newest-first, so data[0] is the most recent. This is the undo log: find the
+  snapshot from just before a bad change, then \`snapshots get\` to inspect it or
+  \`snapshots restore\` to roll back to it.
+
+Common errors:
+  validation_error (exit 2)  workflowId argument is required.
+  not_found        (exit 6)  No workflow with that id in this workspace.
+  auth_forbidden   (exit 3)  API key lacks permission for this command (insufficient scope).
+
+Examples:
+  $ clay workflows snapshots list wf_abc123
+  $ clay workflows snapshots list wf_abc123 | jq -r '.data[0].id'
+  $ clay workflows snapshots list wf_abc123 | jq '.data | length'
+`
+  ).action(async (workflowId) => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(terracottaWorkflowsContract);
+    const result = await unwrap(client.getWorkflowSnapshots({ params: { workspaceId, workflowId } }));
+    writeJson({ data: result.snapshots.map(projectSnapshotSummary) });
+  });
+  return cmd;
+}
+
+// src/commands/workflows/snapshots/restore.ts
+function buildRestoreCommand() {
+  const cmd = new Command("restore");
+  cmd.description("Restore a workflow to a previous snapshot, replacing its current graph.").argument("<workflowId>", "Workflow id, e.g. wf_abc123").argument("<snapshotId>", "Snapshot id to restore to, from `snapshots list`").addHelpText(
+    "after",
+    `
+Output (success, exit 0):
+  { "ok": true }
+
+  Overwrites the workflow\u2019s current graph with the snapshot\u2019s. This is the undo
+  action \u2014 pair it with \`snapshots list\` to find the snapshot from just before
+  an unwanted edit. Restore is destructive and does NOT itself snapshot the
+  current graph; the pre-restore state is recoverable only if it was already
+  captured (snapshots are taken automatically before each edit and at run
+  start). Check \`snapshots list\` first if you might need the current graph back.
+
+Common errors:
+  validation_error (exit 2)  workflowId and snapshotId arguments are required.
+  not_found        (exit 6)  No workflow or snapshot with that id in this workspace.
+  auth_forbidden   (exit 3)  API key lacks permission for this command (insufficient scope).
+
+Examples:
+  $ clay workflows snapshots restore wf_abc123 snap_xyz
+  $ clay workflows snapshots list wf_abc123 | jq -r '.data[0].id' | xargs clay workflows snapshots restore wf_abc123
+`
+  ).action(async (workflowId, snapshotId) => {
+    const workspaceId = await currentWorkspaceId();
+    const client = await v3Client(terracottaWorkflowsContract);
+    const result = await unwrap(
+      client.restoreWorkflowFromSnapshot({ params: { workspaceId, workflowId, snapshotId }, body: {} })
+    );
+    if (!result.success) {
+      throw new IncompatibleApiServerError("Workflow snapshot restore returned success: false.");
+    }
+    writeJson({ ok: true });
+  });
+  return cmd;
+}
+
+// src/commands/workflows/snapshots/index.ts
+function buildSnapshotsCommand() {
+  const cmd = new Command("snapshots");
+  cmd.description("Inspect and restore a workflow\u2019s automatic version history (snapshots).").addHelpText(
+    "after",
+    `
+Subcommands:
+  list      List a workflow\u2019s snapshots, newest first.
+  get       Fetch one snapshot\u2019s full graph (with optional --node-id).
+  restore   Roll a workflow back to a snapshot.
+
+Snapshots are git-style autosaves: an immutable, content-addressed capture of the
+entire workflow graph, taken before every node edit and at run start. They are the
+undo button for agent-driven editing \u2014 \`list\` to find the snapshot before a bad
+change, then \`restore\`. There is no built-in diff; compare two \`get\` outputs with jq.
+
+Examples:
+  $ clay workflows snapshots list wf_abc123 | jq -r '.data[0].id'
+  $ clay workflows snapshots get wf_abc123 snap_xyz | jq '.nodes | length'
+  $ clay workflows snapshots restore wf_abc123 snap_xyz
+`
+  );
+  cmd.addCommand(applyClaySettings(buildListCommand7()));
+  cmd.addCommand(applyClaySettings(buildGetCommand5()));
+  cmd.addCommand(applyClaySettings(buildRestoreCommand()));
   return cmd;
 }
 
@@ -89453,18 +90359,22 @@ function registerWorkflows(program3) {
     "after",
     `
 Subcommands:
-  list      List workflows in the workspace.
-  get       Fetch a workflow by id.
-  create    Create a new empty workflow.
-  runs      Start and inspect workflow runs.
+  list       List workflows in the workspace.
+  get        Fetch a workflow by id.
+  create     Create a new empty workflow.
+  runs       Start and inspect workflow runs.
+  snapshots  Inspect and restore a workflow\u2019s version history.
+  actions    Browse the Clay action catalog (node building blocks).
 
 See \`clay workflows <subcommand> --help\` for per-subcommand JSON shape, error codes, and examples.
 `
   );
-  workflows.addCommand(applyClaySettings(buildListCommand4()));
+  workflows.addCommand(applyClaySettings(buildListCommand6()));
   workflows.addCommand(applyClaySettings(buildGetCommand3()));
-  workflows.addCommand(applyClaySettings(buildCreateCommand()));
+  workflows.addCommand(applyClaySettings(buildCreateCommand2()));
   workflows.addCommand(applyClaySettings(buildRunsCommand2()));
+  workflows.addCommand(applyClaySettings(buildSnapshotsCommand()));
+  workflows.addCommand(applyClaySettings(buildActionsCommand()));
   program3.addCommand(workflows);
 }
 
@@ -89523,11 +90433,11 @@ Authentication:
     1. $CLAY_CONFIG_HOME/clay, if set
     2. $XDG_CONFIG_HOME/clay, if set
     3. ~/.config/clay (default)
-  There is no env-var fallback for the API key itself: \`clay login\` is the only way to set a key.
+  If no key is stored, the CLI falls back to the CLAY_API_KEY environment variable (a stored key from \`clay login\` always wins). The env var is the right fit for agents and CI that already export it; the env path is not validated up front, so a bad key surfaces as auth_invalid on the first call.
   Values derived from the key (e.g. the resolved workspace id) are cached alongside in \`<config-dir>/cache.json\`; it is disposable and safe to delete.
 
 Environment variables:
-  CLAY_BASE_URL      Override the Clay backend base URL (default: https://api.clay.com). Intended for Clay engineers pointing at a local dev or staging deploy.
+  CLAY_API_KEY       API key used when none is stored by \`clay login\`. A stored key takes precedence. Surfaces as auth_invalid (exit 3) on first use if invalid.
   CLAY_CONFIG_HOME   Override the parent of the config directory. The CLI appends \`clay/\` to it, matching XDG semantics. Useful for isolating tests or alternate setups. Both config.json and the sibling cache.json live under this directory.
   CLAY_REQUEST_TIMEOUT_MS  Per-request network timeout in milliseconds (default: 60000). Each HTTP request the CLI makes is bounded by this; on expiry the command fails with network_timeout (exit 5).
   CLAY_UPLOAD_TIMEOUT_MS   File-upload timeout in milliseconds (default: 600000). Bounds bulk file uploads (e.g. \`clay tools runs start --bulk\`), which move whole payloads and so get a longer budget than CLAY_REQUEST_TIMEOUT_MS; on expiry the command fails with network_timeout (exit 5).
@@ -89547,6 +90457,7 @@ registerLogout(program2);
 registerTools(program2);
 registerTables(program2);
 registerWorkflows(program2);
+registerWebhooks(program2);
 registerHelp(program2);
 async function main() {
   try {