@dench.com/cli 3.7.0-staging.387 → 3.8.1-staging.390

package/app-sdk.d.ts

@@ -12,6 +12,67 @@
 // ── Operation request/response types (from cli/lib/api-schemas.ts) ──────
 
 export interface ApiRequests {
+  /** List workspace-shared reusable setups and ready revisions (metadata only). — `dench env list` — GET /api/v1/environments */
+  "environments.list": {
+    limit?: number;
+    cursor?: string;
+  };
+  /** Inspect a saved setup, its manifest, and an optional immutable revision. — `dench env show` — GET /api/v1/environments/{name} */
+  "environments.get": {
+    name: string;
+    revision?: string;
+  };
+  /** Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving. — `dench env save` — POST /api/v1/environments/uploads */
+  "environments.upload": {
+    kind: "source";
+    size: number;
+    sha256: string;
+  };
+  /** Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task. — `dench env save` — POST /api/v1/environments/{name} */
+  "environments.save": {
+    name: string;
+    manifest: {
+      version: 1;
+      name: string;
+      purpose: string;
+      files: string[];
+      prepare: string[];
+      verify: string[];
+      env?: Record<string, string>;
+      secretEnv?: Record<string, string>;
+      secretFiles?: {
+        path: string;
+        secret: string;
+        mutable?: boolean;
+      }[];
+      statePaths?: string[];
+      portable?: boolean;
+    };
+    uploadId: string;
+    storageId: string;
+    sha256: string;
+  };
+  /** Retire a saved setup from new selection; retain immutable revisions and active job evidence. — `dench env delete` — DELETE /api/v1/environments/{name} */
+  "environments.delete": {
+    name: string;
+  };
+  /** List workspace-shared credential names, kinds and versions; never values. — `dench secrets list` — GET /api/v1/secrets */
+  "secrets.list": {
+    limit?: number;
+    cursor?: string;
+  };
+  /** Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts. — `dench secrets set` — PUT /api/v1/secrets/{name} */
+  "secrets.set": {
+    name: string;
+    kind: "env" | "file";
+    value: string;
+    expectedVersion?: number;
+  };
+  /** Revoke a workspace credential for future resolution, optionally checking its version. — `dench secrets delete` — DELETE /api/v1/secrets/{name} */
+  "secrets.delete": {
+    name: string;
+    expectedVersion?: number;
+  };
   /** Create an idempotent empty campaign draft with the caller's available sender pools. Does not launch or send. — `dench campaign draft` — POST /api/v1/campaigns/drafts */
   "campaigns.drafts.create": {
     /** Your stable id for this request, 8-64 characters. Retrying with the same id returns the same draft instead of creating another. */
@@ -699,6 +760,7 @@ export interface ApiRequests {
   };
   /** Start a new chat-turn workflow. — `dench chat new` — POST /api/v1/chat/threads */
   "chat.new": {
+    environment?: string;
     /** The user message that starts the turn. */
     prompt: string;
     model?: string;
@@ -2532,7 +2594,7 @@ export interface ApiRequests {
   "campaigns.get": {
     sequenceId: string;
   };
-  /** Campaign funnel: enrolled, contacted, invited, accepted, messaged, replied, opens and clicks. — `dench campaign get` — GET /api/v1/campaigns/{sequenceId}/analytics */
+  /** Campaign funnel: enrolled, contacted, invited, accepted, messaged, replied, opens and clicks, and for a workflow how many people took each If / else and Wait for them to accept path (branchStats). — `dench campaign get` — GET /api/v1/campaigns/{sequenceId}/analytics */
   "campaigns.analytics": {
     sequenceId: string;
   };
@@ -2581,13 +2643,13 @@ export interface ApiRequests {
     /** Cold emails per day, 1-100. */
     dailySendCap?: number;
   };
-  /** Replace every step of a draft campaign (email, wait, LinkedIn visit, connection request, message, post reaction, InMail). Steps are checked first: a field the step type would drop, missing text or {TOKEN} single braces are rejected, not saved. Configure sender pools on the campaign; step sender ids are legacy-only. — `dench campaign steps set` — PUT /api/v1/campaigns/{sequenceId}/steps */
+  /** Replace every step of a draft campaign (email, wait, LinkedIn visit, connection request, message, post reaction, InMail, If / else, Wait for them to accept). A workflow (stepModel workflow, or steps with key, next, yesNext or noNext) branches: condition and wait_for_connection steps continue on yesNext or noNext, other steps on next; each points at another step's key or end. Steps are checked first: a field the step type would drop, missing text, {TOKEN} single braces or paths that don't hold together are rejected, not saved. Configure sender pools on the campaign; step sender ids are legacy-only. — `dench campaign steps set` — PUT /api/v1/campaigns/{sequenceId}/steps */
   "campaigns.steps.replace": {
     sequenceId: string;
-    /** Every step, in send order. Rejected, not trimmed: a field the step type would drop (onlyIf off email/post-like steps, a body on a visit, reply-in-thread on the first email), a missing subject or required body, an overlength note/message/InMail subject, out-of-range wait/withdrawal/post-age values, and {TOKEN} single braces, which would be sent as typed. */
+    /** Every step, in send order (a workflow may list them in any order; they are stored in path order). Rejected, not trimmed: a field the step type would drop (onlyIf off email/post-like steps, a body on a visit, reply-in-thread on the first email, condition fields its check ignores), a missing subject or required body, an overlength note/message/InMail subject, out-of-range wait/withdrawal/post-age/acceptance values, {TOKEN} single braces, which would be sent as typed, and workflow paths that don't hold together (duplicate keys, a target that isn't a key or end, a condition or wait_for_connection without both yesNext and noNext, or any other step with them). */
     steps: Array<{
-      /** Step type. */
-      type: "email" | "wait" | "linkedin_visit" | "linkedin_connection" | "linkedin_message" | "linkedin_like_post" | "linkedin_inmail";
+      /** Step type. condition (If / else) and wait_for_connection (Wait for them to accept) send nothing; they continue on yesNext or noNext and make the campaign a workflow. */
+      type: "wait" | "email" | "linkedin_connection" | "linkedin_message" | "linkedin_visit" | "linkedin_like_post" | "linkedin_inmail" | "condition" | "wait_for_connection";
       /** wait steps: hours to wait before the next step. */
       waitHours?: number;
       /** Legacy email step sender. Pool campaigns choose senders in emailMailboxAccountIds on the campaign, not on individual steps. */
@@ -2602,35 +2664,57 @@ export interface ApiRequests {
       emailReplyToPrevious?: boolean;
       /** email and linkedin_like_post only: always (default), connected or not_connected. InMail automatically skips connected people; do not set a condition on it. */
       onlyIf?: "always" | "connected" | "not_connected";
-      /** Legacy LinkedIn step sender. Pool campaigns use the campaign's linkedinAccountIds instead. */
+      /** Legacy LinkedIn step sender (also on wait_for_connection, and on a condition that checks linkedin_connected). Pool campaigns use the campaign's linkedinAccountIds instead. */
       linkedinAccountId?: string;
       /** linkedin_connection: the invite note (optional, up to 300 chars; sent without it if LinkedIn refuses the note); linkedin_message: the required message (up to 3000 chars); linkedin_inmail: the required message (up to 1900 chars). */
       linkedinMessageBody?: string;
       /** linkedin_message: what to do when the invite is still pending. */
       linkedinMessageMode?: "skip_if_not_connected" | "wait_until_connected";
-      /** linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-2160 hours for acceptance (default 720). After a connection step this mode is the default. */
+      /** linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-2160 hours for acceptance (default 720); after a connection step this mode is the default in a linear campaign. wait_for_connection: wait 24-2160 hours (1-90 days, default 720) before taking the Not accepted path. */
       connectionTimeoutHours?: number;
       /** linkedin_like_post only: the reaction to leave (default like). */
       likeReaction?: "like" | "celebrate" | "support" | "love" | "insightful" | "funny";
       /** linkedin_like_post only: select the newest eligible original post from the last 1-365 days (default 30). */
       likeMaxPostAgeDays?: number;
+      /** linkedin_like_post only: before the immediately preceding wait starts, check for eligible posts. If none exist, skip that wait and the like step, keeping following waits. Defaults to false when omitted. */
+      likeSkipPreviousWait?: boolean;
       /** linkedin_like_post only: skip consecutive following wait steps whenever the reaction step is skipped (default true). False keeps those waits. */
       likeSkipNextWait?: boolean;
+      /** linkedin_like_post only: how many recent posts to react to, 1-3 (default 1). */
+      likeCount?: number;
       /** linkedin_inmail only: optional subject, up to 200 characters; merge tokens allowed. Clear with an empty string. */
       inmailSubject?: string;
       /** linkedin_connection only: withdraw a still-pending invitation sent by this campaign after 168-2160 hours (7-90 days). Omitted means off on creation; null turns it off on edit. */
       withdrawAfterHours?: number | null;
+      /** Workflow steps: this step's id, unique in the campaign, which next, yesNext and noNext point at (not "end"). Left out, one is made. */
+      key?: string;
+      /** Workflow steps: where a step that isn't a condition or wait_for_connection goes; left out, the following step: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      next?: string;
+      /** Workflow steps: condition and wait_for_connection only, required: where the Yes (Accepted) path goes: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      yesNext?: string;
+      /** Workflow steps: condition and wait_for_connection only, required: where the No (Not accepted) path goes: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      noNext?: string;
+      /** condition only, required: linkedin_connected, has_email, opened_last_email (needs an email before it on every path) or field_value. Fixed once the campaign launches. */
+      check?: "linkedin_connected" | "has_email" | "opened_last_email" | "field_value";
+      /** condition with check=field_value: the lead field to check, like "Job Title" or "Source" (the campaign itself changes Status, Last touch and LinkedIn connection). Fixed once the campaign launches. */
+      conditionField?: string;
+      /** condition with check=field_value: is, is_not, contains, is_empty or is_not_empty (all case-insensitive). Fixed once the campaign launches. */
+      conditionOperator?: "is" | "is_not" | "is_empty" | "is_not_empty" | "contains";
+      /** condition with check=field_value and is, is_not or contains: the text to compare with. Editable after launch. */
+      conditionValue?: string;
     }>;
+    /** linear: steps run in order. workflow: steps have keys and paths (next, yesNext, noNext) and may include condition and wait_for_connection. Left out, a workflow stays one and steps with keys, paths or those types make one; nothing turns a workflow back into a list. When replacing a workflow's steps, send workflow, so steps without keys or paths are checked here the way they will be saved. */
+    stepModel?: "linear" | "workflow";
     /** Send {single braces} exactly as typed instead of rejecting them. Merge tokens always use {{double braces}}. */
     allowSingleBraces?: boolean;
   };
-  /** Edit the text, waits and conditions of a launched (or paused) campaign's steps in place. Each step keeps its id, type and place; pass the stepId and the updatedAt you read, and only the fields you change. Messages already sent or being prepared keep their text; drafts use campaigns.steps.replace. — `dench campaign steps edit` — PATCH /api/v1/campaigns/{sequenceId}/steps */
+  /** Edit the text, waits and conditions of a launched (or paused) campaign's steps in place. Each step keeps its id, type and place; pass the stepId and the updatedAt you read, and only the fields you change. A workflow keeps its paths and what each If / else checks (key, next, yesNext, noNext, check, conditionField, conditionOperator); conditionValue and acceptance waits stay editable. Messages already sent or being prepared keep their text; drafts use campaigns.steps.replace. — `dench campaign steps edit` — PATCH /api/v1/campaigns/{sequenceId}/steps */
   "campaigns.steps.update": {
     sequenceId: string;
-    /** The steps to change. Rejected, not trimmed: a field the step type would drop, an overlength note/message/InMail subject, out-of-range wait/withdrawal/post-age values, and {TOKEN} single braces. */
+    /** The steps to change. Rejected, not trimmed: a field the step type would drop, an overlength note/message/InMail subject, out-of-range wait/withdrawal/post-age/acceptance values, {TOKEN} single braces, and a changed path or If / else check. */
     steps: Array<{
       /** The step's current type. A launched step's type can't change. */
-      type: "email" | "wait" | "linkedin_visit" | "linkedin_connection" | "linkedin_message" | "linkedin_like_post" | "linkedin_inmail";
+      type: "wait" | "email" | "linkedin_connection" | "linkedin_message" | "linkedin_visit" | "linkedin_like_post" | "linkedin_inmail" | "condition" | "wait_for_connection";
       /** wait steps: hours to wait before the next step. */
       waitHours?: number;
       /** Legacy email step sender. Pool campaigns choose senders in emailMailboxAccountIds on the campaign, not on individual steps. */
@@ -2645,24 +2729,44 @@ export interface ApiRequests {
       emailReplyToPrevious?: boolean;
       /** email and linkedin_like_post only: always (default), connected or not_connected. InMail automatically skips connected people; do not set a condition on it. */
       onlyIf?: "always" | "connected" | "not_connected";
-      /** Legacy LinkedIn step sender. Pool campaigns use the campaign's linkedinAccountIds instead. */
+      /** Legacy LinkedIn step sender (also on wait_for_connection, and on a condition that checks linkedin_connected). Pool campaigns use the campaign's linkedinAccountIds instead. */
       linkedinAccountId?: string;
       /** linkedin_connection: the invite note (optional, up to 300 chars; sent without it if LinkedIn refuses the note); linkedin_message: the required message (up to 3000 chars); linkedin_inmail: the required message (up to 1900 chars). */
       linkedinMessageBody?: string;
       /** linkedin_message: what to do when the invite is still pending. */
       linkedinMessageMode?: "skip_if_not_connected" | "wait_until_connected";
-      /** linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-2160 hours for acceptance (default 720). After a connection step this mode is the default. */
+      /** linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-2160 hours for acceptance (default 720); after a connection step this mode is the default in a linear campaign. wait_for_connection: wait 24-2160 hours (1-90 days, default 720) before taking the Not accepted path. */
       connectionTimeoutHours?: number;
       /** linkedin_like_post only: the reaction to leave (default like). */
       likeReaction?: "like" | "celebrate" | "support" | "love" | "insightful" | "funny";
       /** linkedin_like_post only: select the newest eligible original post from the last 1-365 days (default 30). */
       likeMaxPostAgeDays?: number;
+      /** linkedin_like_post only: before the immediately preceding wait starts, check for eligible posts. If none exist, skip that wait and the like step, keeping following waits. Defaults to false when omitted. */
+      likeSkipPreviousWait?: boolean;
       /** linkedin_like_post only: skip consecutive following wait steps whenever the reaction step is skipped (default true). False keeps those waits. */
       likeSkipNextWait?: boolean;
+      /** linkedin_like_post only: how many recent posts to react to, 1-3 (default 1). */
+      likeCount?: number;
       /** linkedin_inmail only: optional subject, up to 200 characters; merge tokens allowed. Clear with an empty string. */
       inmailSubject?: string;
       /** linkedin_connection only: withdraw a still-pending invitation sent by this campaign after 168-2160 hours (7-90 days). Omitted means off on creation; null turns it off on edit. */
       withdrawAfterHours?: number | null;
+      /** Workflow steps: this step's id, unique in the campaign, which next, yesNext and noNext point at (not "end"). Left out, one is made. */
+      key?: string;
+      /** Workflow steps: where a step that isn't a condition or wait_for_connection goes; left out, the following step: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      next?: string;
+      /** Workflow steps: condition and wait_for_connection only, required: where the Yes (Accepted) path goes: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      yesNext?: string;
+      /** Workflow steps: condition and wait_for_connection only, required: where the No (Not accepted) path goes: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      noNext?: string;
+      /** condition only, required: linkedin_connected, has_email, opened_last_email (needs an email before it on every path) or field_value. Fixed once the campaign launches. */
+      check?: "linkedin_connected" | "has_email" | "opened_last_email" | "field_value";
+      /** condition with check=field_value: the lead field to check, like "Job Title" or "Source" (the campaign itself changes Status, Last touch and LinkedIn connection). Fixed once the campaign launches. */
+      conditionField?: string;
+      /** condition with check=field_value: is, is_not, contains, is_empty or is_not_empty (all case-insensitive). Fixed once the campaign launches. */
+      conditionOperator?: "is" | "is_not" | "is_empty" | "is_not_empty" | "contains";
+      /** condition with check=field_value and is, is_not or contains: the text to compare with. Editable after launch. */
+      conditionValue?: string;
       /** The step's _id from campaigns.get steps[]. */
       stepId: string;
       /** The step's updatedAt when you read it. If someone saved it since, the edit is refused instead of overwriting theirs. */
@@ -3235,30 +3339,34 @@ export interface ApiRequests {
   "browser.session.status": Record<string, unknown>;
   /** Stop a Dench Browser session and release the remote browser. — `dench browser session stop` — DELETE /api/v1/browser/sessions/{sessionId} */
   "browser.session.stop": Record<string, unknown>;
-  /** Read IDENTITY.md. — `dench identity show` — GET /api/v1/agent-config/identity */
+  /** Read IDENTITY.md. — `dench context --sections identity` — GET /api/v1/agent-config/identity */
   "agentConfig.identity.show": Record<string, unknown>;
-  /** Update IDENTITY.md. — `dench identity edit` — PUT /api/v1/agent-config/identity */
+  /** Update IDENTITY.md. — `dench context set identity` — PUT /api/v1/agent-config/identity */
   "agentConfig.identity.edit": {
     content: string;
   };
-  /** Read ORGANISATION.md. — `dench organisation show` — GET /api/v1/agent-config/organisation */
+  /** Read ORGANISATION.md. — `dench context --sections organisation` — GET /api/v1/agent-config/organisation */
   "agentConfig.organisation.show": Record<string, unknown>;
-  /** Update ORGANISATION.md. — `dench organisation edit` — PUT /api/v1/agent-config/organisation */
+  /** Update ORGANISATION.md. — `dench context set organisation` — PUT /api/v1/agent-config/organisation */
   "agentConfig.organisation.edit": {
     content: string;
   };
-  /** Read USER.md. — `dench user show` — GET /api/v1/agent-config/user */
+  /** Read USER.md. — `dench context --sections user` — GET /api/v1/agent-config/user */
   "agentConfig.user.show": Record<string, unknown>;
-  /** Update USER.md. — `dench user edit` — PUT /api/v1/agent-config/user */
+  /** Update USER.md. — `dench context set user` — PUT /api/v1/agent-config/user */
   "agentConfig.user.edit": {
     content: string;
   };
-  /** Read tool notes. — `dench tools show` — GET /api/v1/agent-config/tools */
+  /** Read tool notes. — `dench context --sections tools` — GET /api/v1/agent-config/tools */
   "agentConfig.tools.show": Record<string, unknown>;
-  /** Update tool notes. — `dench tools edit` — PUT /api/v1/agent-config/tools */
+  /** Update tool notes. — `dench context set tools` — PUT /api/v1/agent-config/tools */
   "agentConfig.tools.edit": {
     content: string;
   };
+  /** Update standing workspace rules; credentials belong in secrets and runnable setup in environments. — `dench context set rules` — PUT /api/v1/context/rules */
+  "workspace.context.rules.set": {
+    content: string;
+  };
   /** Read aggregate memory. — `dench mem show` — GET /api/v1/agent-config/mem */
   "agentConfig.mem.show": Record<string, unknown>;
   /** Update aggregate memory. — `dench mem set` — PUT /api/v1/agent-config/mem */
@@ -3347,6 +3455,20 @@ export interface ApiRequests {
 }
 
 export interface ApiResponses {
+  "environments.list": unknown;
+  "environments.get": unknown;
+  "environments.upload": unknown;
+  "environments.save": unknown;
+  "environments.delete": unknown;
+  "secrets.list": unknown;
+  "secrets.set": {
+    name: string;
+    kind: "env" | "file";
+    version: number;
+    revision: number;
+    status: "stored";
+  };
+  "secrets.delete": unknown;
   "campaigns.drafts.create": {
     sequenceId: string;
   };
@@ -6037,6 +6159,8 @@ export interface ApiResponses {
     }[];
     dailySendCap?: number;
     stepCount: number;
+    /** linear: steps run in order. workflow: steps have keys and paths (next, yesNext, noNext) and may include condition and wait_for_connection. Left out, a workflow stays one and steps with keys, paths or those types make one; nothing turns a workflow back into a list. */
+    stepModel?: "linear" | "workflow";
     totalEnrolled: number;
     activeCount: number;
     pausedCount: number;
@@ -6086,6 +6210,8 @@ export interface ApiResponses {
       }[];
       dailySendCap?: number;
       stepCount: number;
+      /** linear: steps run in order. workflow: steps have keys and paths (next, yesNext, noNext) and may include condition and wait_for_connection. Left out, a workflow stays one and steps with keys, paths or those types make one; nothing turns a workflow back into a list. */
+      stepModel?: "linear" | "workflow";
       totalEnrolled: number;
       activeCount: number;
       pausedCount: number;
@@ -6100,9 +6226,10 @@ export interface ApiResponses {
       updatedAt: number;
       [key: string]: unknown;
     };
+    /** The steps in order, each with its _id. condition and wait_for_connection steps also carry a readable label. */
     steps: Array<{
-      /** Step type. */
-      type: "email" | "wait" | "linkedin_visit" | "linkedin_connection" | "linkedin_message" | "linkedin_like_post" | "linkedin_inmail";
+      /** Step type. condition (If / else) and wait_for_connection (Wait for them to accept) send nothing; they continue on yesNext or noNext and make the campaign a workflow. */
+      type: "wait" | "email" | "linkedin_connection" | "linkedin_message" | "linkedin_visit" | "linkedin_like_post" | "linkedin_inmail" | "condition" | "wait_for_connection";
       /** wait steps: hours to wait before the next step. */
       waitHours?: number;
       /** Legacy email step sender. Pool campaigns choose senders in emailMailboxAccountIds on the campaign, not on individual steps. */
@@ -6117,24 +6244,44 @@ export interface ApiResponses {
       emailReplyToPrevious?: boolean;
       /** email and linkedin_like_post only: always (default), connected or not_connected. InMail automatically skips connected people; do not set a condition on it. */
       onlyIf?: "always" | "connected" | "not_connected";
-      /** Legacy LinkedIn step sender. Pool campaigns use the campaign's linkedinAccountIds instead. */
+      /** Legacy LinkedIn step sender (also on wait_for_connection, and on a condition that checks linkedin_connected). Pool campaigns use the campaign's linkedinAccountIds instead. */
       linkedinAccountId?: string;
       /** linkedin_connection: the invite note (optional, up to 300 chars; sent without it if LinkedIn refuses the note); linkedin_message: the required message (up to 3000 chars); linkedin_inmail: the required message (up to 1900 chars). */
       linkedinMessageBody?: string;
       /** linkedin_message: what to do when the invite is still pending. */
       linkedinMessageMode?: "skip_if_not_connected" | "wait_until_connected";
-      /** linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-2160 hours for acceptance (default 720). After a connection step this mode is the default. */
+      /** linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-2160 hours for acceptance (default 720); after a connection step this mode is the default in a linear campaign. wait_for_connection: wait 24-2160 hours (1-90 days, default 720) before taking the Not accepted path. */
       connectionTimeoutHours?: number;
       /** linkedin_like_post only: the reaction to leave (default like). */
       likeReaction?: "like" | "celebrate" | "support" | "love" | "insightful" | "funny";
       /** linkedin_like_post only: select the newest eligible original post from the last 1-365 days (default 30). */
       likeMaxPostAgeDays?: number;
+      /** linkedin_like_post only: before the immediately preceding wait starts, check for eligible posts. If none exist, skip that wait and the like step, keeping following waits. Defaults to false when omitted. */
+      likeSkipPreviousWait?: boolean;
       /** linkedin_like_post only: skip consecutive following wait steps whenever the reaction step is skipped (default true). False keeps those waits. */
       likeSkipNextWait?: boolean;
+      /** linkedin_like_post only: how many recent posts to react to, 1-3 (default 1). */
+      likeCount?: number;
       /** linkedin_inmail only: optional subject, up to 200 characters; merge tokens allowed. Clear with an empty string. */
       inmailSubject?: string;
       /** linkedin_connection only: withdraw a still-pending invitation sent by this campaign after 168-2160 hours (7-90 days). Omitted means off on creation; null turns it off on edit. */
       withdrawAfterHours?: number | null;
+      /** Workflow steps: this step's id, unique in the campaign, which next, yesNext and noNext point at (not "end"). Left out, one is made. */
+      key?: string;
+      /** Workflow steps: where a step that isn't a condition or wait_for_connection goes; left out, the following step: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      next?: string;
+      /** Workflow steps: condition and wait_for_connection only, required: where the Yes (Accepted) path goes: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      yesNext?: string;
+      /** Workflow steps: condition and wait_for_connection only, required: where the No (Not accepted) path goes: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      noNext?: string;
+      /** condition only, required: linkedin_connected, has_email, opened_last_email (needs an email before it on every path) or field_value. Fixed once the campaign launches. */
+      check?: "linkedin_connected" | "has_email" | "opened_last_email" | "field_value";
+      /** condition with check=field_value: the lead field to check, like "Job Title" or "Source" (the campaign itself changes Status, Last touch and LinkedIn connection). Fixed once the campaign launches. */
+      conditionField?: string;
+      /** condition with check=field_value: is, is_not, contains, is_empty or is_not_empty (all case-insensitive). Fixed once the campaign launches. */
+      conditionOperator?: "is" | "is_not" | "is_empty" | "is_not_empty" | "contains";
+      /** condition with check=field_value and is, is_not or contains: the text to compare with. Editable after launch. */
+      conditionValue?: string;
       [key: string]: unknown;
     }>;
     enrollments: Record<string, unknown>[];
@@ -6170,6 +6317,14 @@ export interface ApiResponses {
     replyRate: number;
     openRate: number;
     clickRate: number;
+    /** Workflows only: each condition and wait_for_connection step, in step order, with how many people took each path. */
+    branchStats?: {
+      stepId: string;
+      /** People who took the Yes (Accepted) path. */
+      yes: number;
+      /** People who took the No (Not accepted) path. */
+      no: number;
+    }[];
     truncated: boolean;
     [key: string]: unknown;
   };
@@ -6182,7 +6337,15 @@ export interface ApiResponses {
     dailySendCap: number | null;
     nextEmailAt: number | null;
     now: Record<string, unknown> | null;
-    next: Record<string, unknown> | null;
+    next: {
+      /** profile, visit, invite, message, like, inmail, withdraw, email, wait or check (an If / else). */
+      kind: string;
+      /** Waiting for them to accept: when the wait ends either way. */
+      acceptanceDeadline?: number;
+      /** kind check: what the If / else checks, e.g. "Has an email address". */
+      label?: string;
+      [key: string]: unknown;
+    } | null;
     paused: Record<string, unknown> | null;
     senders: Record<string, unknown>[];
     [key: string]: unknown;
@@ -6458,8 +6621,8 @@ export interface ApiResponses {
     sequence: Record<string, unknown> | null;
     /** The campaign's steps in order, each with its _id. */
     steps: Array<{
-      /** Step type. */
-      type: "email" | "wait" | "linkedin_visit" | "linkedin_connection" | "linkedin_message" | "linkedin_like_post" | "linkedin_inmail";
+      /** Step type. condition (If / else) and wait_for_connection (Wait for them to accept) send nothing; they continue on yesNext or noNext and make the campaign a workflow. */
+      type: "wait" | "email" | "linkedin_connection" | "linkedin_message" | "linkedin_visit" | "linkedin_like_post" | "linkedin_inmail" | "condition" | "wait_for_connection";
       /** wait steps: hours to wait before the next step. */
       waitHours?: number;
       /** Legacy email step sender. Pool campaigns choose senders in emailMailboxAccountIds on the campaign, not on individual steps. */
@@ -6474,24 +6637,44 @@ export interface ApiResponses {
       emailReplyToPrevious?: boolean;
       /** email and linkedin_like_post only: always (default), connected or not_connected. InMail automatically skips connected people; do not set a condition on it. */
       onlyIf?: "always" | "connected" | "not_connected";
-      /** Legacy LinkedIn step sender. Pool campaigns use the campaign's linkedinAccountIds instead. */
+      /** Legacy LinkedIn step sender (also on wait_for_connection, and on a condition that checks linkedin_connected). Pool campaigns use the campaign's linkedinAccountIds instead. */
       linkedinAccountId?: string;
       /** linkedin_connection: the invite note (optional, up to 300 chars; sent without it if LinkedIn refuses the note); linkedin_message: the required message (up to 3000 chars); linkedin_inmail: the required message (up to 1900 chars). */
       linkedinMessageBody?: string;
       /** linkedin_message: what to do when the invite is still pending. */
       linkedinMessageMode?: "skip_if_not_connected" | "wait_until_connected";
-      /** linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-2160 hours for acceptance (default 720). After a connection step this mode is the default. */
+      /** linkedin_message with linkedinMessageMode=wait_until_connected: wait 1-2160 hours for acceptance (default 720); after a connection step this mode is the default in a linear campaign. wait_for_connection: wait 24-2160 hours (1-90 days, default 720) before taking the Not accepted path. */
       connectionTimeoutHours?: number;
       /** linkedin_like_post only: the reaction to leave (default like). */
       likeReaction?: "like" | "celebrate" | "support" | "love" | "insightful" | "funny";
       /** linkedin_like_post only: select the newest eligible original post from the last 1-365 days (default 30). */
       likeMaxPostAgeDays?: number;
+      /** linkedin_like_post only: before the immediately preceding wait starts, check for eligible posts. If none exist, skip that wait and the like step, keeping following waits. Defaults to false when omitted. */
+      likeSkipPreviousWait?: boolean;
       /** linkedin_like_post only: skip consecutive following wait steps whenever the reaction step is skipped (default true). False keeps those waits. */
       likeSkipNextWait?: boolean;
+      /** linkedin_like_post only: how many recent posts to react to, 1-3 (default 1). */
+      likeCount?: number;
       /** linkedin_inmail only: optional subject, up to 200 characters; merge tokens allowed. Clear with an empty string. */
       inmailSubject?: string;
       /** linkedin_connection only: withdraw a still-pending invitation sent by this campaign after 168-2160 hours (7-90 days). Omitted means off on creation; null turns it off on edit. */
       withdrawAfterHours?: number | null;
+      /** Workflow steps: this step's id, unique in the campaign, which next, yesNext and noNext point at (not "end"). Left out, one is made. */
+      key?: string;
+      /** Workflow steps: where a step that isn't a condition or wait_for_connection goes; left out, the following step: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      next?: string;
+      /** Workflow steps: condition and wait_for_connection only, required: where the Yes (Accepted) path goes: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      yesNext?: string;
+      /** Workflow steps: condition and wait_for_connection only, required: where the No (Not accepted) path goes: another step's key, or "end" to stop there. Fixed once the campaign launches. */
+      noNext?: string;
+      /** condition only, required: linkedin_connected, has_email, opened_last_email (needs an email before it on every path) or field_value. Fixed once the campaign launches. */
+      check?: "linkedin_connected" | "has_email" | "opened_last_email" | "field_value";
+      /** condition with check=field_value: the lead field to check, like "Job Title" or "Source" (the campaign itself changes Status, Last touch and LinkedIn connection). Fixed once the campaign launches. */
+      conditionField?: string;
+      /** condition with check=field_value: is, is_not, contains, is_empty or is_not_empty (all case-insensitive). Fixed once the campaign launches. */
+      conditionOperator?: "is" | "is_not" | "is_empty" | "is_not_empty" | "contains";
+      /** condition with check=field_value and is, is_not or contains: the text to compare with. Editable after launch. */
+      conditionValue?: string;
       [key: string]: unknown;
     }>;
     /** One run for each step the person has reached, in order. */
@@ -6501,8 +6684,8 @@ export interface ApiResponses {
       stepId: string;
       /** The step's place, from 0. */
       stepIndex: number;
-      /** Step type. */
-      type: "email" | "wait" | "linkedin_visit" | "linkedin_connection" | "linkedin_message" | "linkedin_like_post" | "linkedin_inmail";
+      /** Step type. condition (If / else) and wait_for_connection (Wait for them to accept) send nothing; they continue on yesNext or noNext and make the campaign a workflow. */
+      type: "wait" | "email" | "linkedin_connection" | "linkedin_message" | "linkedin_visit" | "linkedin_like_post" | "linkedin_inmail" | "condition" | "wait_for_connection";
       /** sent: done (a wait that finished is sent too). skipped: see result.reason. retry: will be tried again at retryAt. unknown: needs a look. */
       status: "queued" | "running" | "waiting" | "retry" | "sent" | "skipped" | "failed" | "unknown";
       scheduledAt?: number;
@@ -6513,7 +6696,9 @@ export interface ApiResponses {
       /** The email this run sent, in emailMessages[]. */
       emailMessageId?: string;
       lastError?: string;
-      /** For a skipped step, { reason } says why. */
+      /** wait_for_connection: when it stops waiting for the accept. */
+      timeoutAt?: number;
+      /** For a skipped step, { reason } says why. A finished condition or wait_for_connection has { branch: "yes" | "no" } (Yes / Accepted or No / Not accepted), and { reason } for some No paths. */
       result?: unknown;
       [key: string]: unknown;
     }>;
@@ -7255,6 +7440,7 @@ export interface ApiResponses {
       template?: string;
     };
   };
+  "workspace.context.rules.set": unknown;
   "agentConfig.mem.show": {
     agentConfig: {
       identity: {
@@ -7566,9 +7752,9 @@ export type DenchApiTree = {
       today(args?: Req<"agentConfig.daily.today">): Promise<Res<"agentConfig.daily.today">>;
     };
     identity: {
-      /** Update IDENTITY.md. (`dench identity edit`) */
+      /** Update IDENTITY.md. (`dench context set identity`) */
       edit(args: Req<"agentConfig.identity.edit">): Promise<Res<"agentConfig.identity.edit">>;
-      /** Read IDENTITY.md. (`dench identity show`) */
+      /** Read IDENTITY.md. (`dench context --sections identity`) */
       show(args?: Req<"agentConfig.identity.show">): Promise<Res<"agentConfig.identity.show">>;
     };
     mem: {
@@ -7584,21 +7770,21 @@ export type DenchApiTree = {
       thread(args: Req<"agentConfig.model.thread">): Promise<Res<"agentConfig.model.thread">>;
     };
     organisation: {
-      /** Update ORGANISATION.md. (`dench organisation edit`) */
+      /** Update ORGANISATION.md. (`dench context set organisation`) */
       edit(args: Req<"agentConfig.organisation.edit">): Promise<Res<"agentConfig.organisation.edit">>;
-      /** Read ORGANISATION.md. (`dench organisation show`) */
+      /** Read ORGANISATION.md. (`dench context --sections organisation`) */
       show(args?: Req<"agentConfig.organisation.show">): Promise<Res<"agentConfig.organisation.show">>;
     };
     tools: {
-      /** Update tool notes. (`dench tools edit`) */
+      /** Update tool notes. (`dench context set tools`) */
       edit(args: Req<"agentConfig.tools.edit">): Promise<Res<"agentConfig.tools.edit">>;
-      /** Read tool notes. (`dench tools show`) */
+      /** Read tool notes. (`dench context --sections tools`) */
       show(args?: Req<"agentConfig.tools.show">): Promise<Res<"agentConfig.tools.show">>;
     };
     user: {
-      /** Update USER.md. (`dench user edit`) */
+      /** Update USER.md. (`dench context set user`) */
       edit(args: Req<"agentConfig.user.edit">): Promise<Res<"agentConfig.user.edit">>;
-      /** Read USER.md. (`dench user show`) */
+      /** Read USER.md. (`dench context --sections user`) */
       show(args?: Req<"agentConfig.user.show">): Promise<Res<"agentConfig.user.show">>;
     };
   };
@@ -7679,7 +7865,7 @@ export type DenchApiTree = {
       /** Discover LinkedIn sender ids, labels, availability and remaining capacity visible to the acting workspace member. Never returns provider credentials. (`dench campaign accounts`) */
       linkedin(args?: Req<"campaigns.accounts.linkedin">): Promise<Res<"campaigns.accounts.linkedin">>;
     };
-    /** Campaign funnel: enrolled, contacted, invited, accepted, messaged, replied, opens and clicks. (`dench campaign get`) */
+    /** Campaign funnel: enrolled, contacted, invited, accepted, messaged, replied, opens and clicks, and for a workflow how many people took each If / else and Wait for them to accept path (branchStats). (`dench campaign get`) */
     analytics(args: Req<"campaigns.analytics">): Promise<Res<"campaigns.analytics">>;
     /** Archive a campaign and stop everyone still in flight. This is the app's Delete: campaigns are never erased, and their people, leads and activity stay. (`dench campaign archive`) */
     archive(args: Req<"campaigns.archive">): Promise<Res<"campaigns.archive">>;
@@ -7793,9 +7979,9 @@ export type DenchApiTree = {
       update(args: Req<"campaigns.sources.update">): Promise<Res<"campaigns.sources.update">>;
     };
     steps: {
-      /** Replace every step of a draft campaign (email, wait, LinkedIn visit, connection request, message, post reaction, InMail). Steps are checked first: a field the step type would drop, missing text or {TOKEN} single braces are rejected, not saved. Configure sender pools on the campaign; step sender ids are legacy-only. (`dench campaign steps set`) */
+      /** Replace every step of a draft campaign (email, wait, LinkedIn visit, connection request, message, post reaction, InMail, If / else, Wait for them to accept). A workflow (stepModel workflow, or steps with key, next, yesNext or noNext) branches: condition and wait_for_connection steps continue on yesNext or noNext, other steps on next; each points at another step's key or end. Steps are checked first: a field the step type would drop, missing text, {TOKEN} single braces or paths that don't hold together are rejected, not saved. Configure sender pools on the campaign; step sender ids are legacy-only. (`dench campaign steps set`) */
       replace(args: Req<"campaigns.steps.replace">): Promise<Res<"campaigns.steps.replace">>;
-      /** Edit the text, waits and conditions of a launched (or paused) campaign's steps in place. Each step keeps its id, type and place; pass the stepId and the updatedAt you read, and only the fields you change. Messages already sent or being prepared keep their text; drafts use campaigns.steps.replace. (`dench campaign steps edit`) */
+      /** Edit the text, waits and conditions of a launched (or paused) campaign's steps in place. Each step keeps its id, type and place; pass the stepId and the updatedAt you read, and only the fields you change. A workflow keeps its paths and what each If / else checks (key, next, yesNext, noNext, check, conditionField, conditionOperator); conditionValue and acceptance waits stay editable. Messages already sent or being prepared keep their text; drafts use campaigns.steps.replace. (`dench campaign steps edit`) */
       update(args: Req<"campaigns.steps.update">): Promise<Res<"campaigns.steps.update">>;
     };
     /** Change a campaign's name, sender pools, send windows, daily email cap, stop-on-reply, start or end. Works until archived; existing conversations keep their assigned sender. (`dench campaign set`) */
@@ -8362,6 +8548,18 @@ export type DenchApiTree = {
       preview(args: Req<"enrichment.search.preview">): Promise<Res<"enrichment.search.preview">>;
     };
   };
+  environments: {
+    /** Retire a saved setup from new selection; retain immutable revisions and active job evidence. (`dench env delete`) */
+    delete(args: Req<"environments.delete">): Promise<Res<"environments.delete">>;
+    /** Inspect a saved setup, its manifest, and an optional immutable revision. (`dench env show`) */
+    get(args: Req<"environments.get">): Promise<Res<"environments.get">>;
+    /** List workspace-shared reusable setups and ready revisions (metadata only). (`dench env list`) */
+    list(args?: Req<"environments.list">): Promise<Res<"environments.list">>;
+    /** Publish an explicitly saved source and manifest for one-time preparation. Returns pending/building until verified; does not run the task. (`dench env save`) */
+    save(args: Req<"environments.save">): Promise<Res<"environments.save">>;
+    /** Reserve an owner-bound source upload. Prefix the uploaded bytes with the returned proof before saving. (`dench env save`) */
+    upload(args: Req<"environments.upload">): Promise<Res<"environments.upload">>;
+  };
   files: {
     /** Read a workspace file's text. (`dench files cat`) */
     content(args?: Req<"files.content">): Promise<Res<"files.content">>;
@@ -8506,6 +8704,14 @@ export type DenchApiTree = {
     /** Search the web through the Dench gateway. (`dench search`) */
     web(args: Req<"search.web">): Promise<Res<"search.web">>;
   };
+  secrets: {
+    /** Revoke a workspace credential for future resolution, optionally checking its version. (`dench secrets delete`) */
+    delete(args: Req<"secrets.delete">): Promise<Res<"secrets.delete">>;
+    /** List workspace-shared credential names, kinds and versions; never values. (`dench secrets list`) */
+    list(args?: Req<"secrets.list">): Promise<Res<"secrets.list">>;
+    /** Encrypt a workspace credential. Use CLI stdin or the secure chat form; return metadata only. Do not put values in chat, manifests or scripts. (`dench secrets set`) */
+    set(args: Req<"secrets.set">): Promise<Res<"secrets.set">>;
+  };
   settings: {
     sync: {
       /** Read the workspace's Sync switches (accounts from email, contacts from LinkedIn, Slack Connect, calendar, dossier, tasks from email, lead auto-qualify, summaries and Brief). All on by default. (`dench settings sync`) */
@@ -8575,6 +8781,10 @@ export type DenchApiTree = {
       /** Return the current Dench workspace context for the bearer. (`dench context`) */
       (args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
       $call(args?: Req<"workspace.context">): Promise<Res<"workspace.context">>;
+      rules: {
+        /** Update standing workspace rules; credentials belong in secrets and runnable setup in environments. (`dench context set rules`) */
+        set(args: Req<"workspace.context.rules.set">): Promise<Res<"workspace.context.rules.set">>;
+      };
       /** Read selected scoped workspace documents and a compact context index without writes. (`dench context --sections`) */
       sections(args?: Req<"workspace.context.sections">): Promise<Res<"workspace.context.sections">>;
     };