@eigenpal/cli 0.15.1 → 0.16.0

package/dist/cli.js

@@ -7685,6 +7685,7 @@ var init_common = __esm(() => {
     AUTOMATION_TRIGGER: "atr",
     FILE_SOURCE_CONFIG: "fsc",
     FILE_UPLOAD: "fup",
+    EMAIL_SERVER: "ems",
     WEBHOOK_ENDPOINT: "whep",
     WEBHOOK_EVENT: "whev",
     WEBHOOK_DELIVERY: "whdl",
@@ -15429,6 +15430,250 @@ var init_validation = __esm(() => {
   init_workspace_schema();
 });
 
+// ../types/src/email-servers.ts
+function defaultSmtpPort(security, port) {
+  return port ?? SMTP_DEFAULT_PORT_BY_SECURITY[security];
+}
+function refineSmtpCredentialPair(data, ctx) {
+  const hasUsername = data.username !== undefined;
+  const hasPassword = data.password !== undefined;
+  if (hasUsername !== hasPassword) {
+    ctx.addIssue({
+      code: "custom",
+      path: hasUsername ? ["password"] : ["username"],
+      message: "SMTP username and password must both be set or both omitted"
+    });
+  }
+}
+function refineSmtpNoneRejectsCredentials(data, ctx) {
+  if (data.security !== "none")
+    return;
+  if (typeof data.username === "string") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["username"],
+      message: SMTP_NONE_CREDENTIALS_MESSAGE
+    });
+  }
+  if (data.password !== undefined) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["password"],
+      message: SMTP_NONE_CREDENTIALS_MESSAGE
+    });
+  }
+}
+function hasTransport(patch) {
+  return "transport" in patch;
+}
+function smtpDestinationChanged(existingTransport, patch, storedSmtp) {
+  if (existingTransport !== "smtp")
+    return false;
+  const hostChanged = storedSmtp?.host != null && storedSmtp.host !== patch.host;
+  const usernameChanged = typeof patch.username === "string" && patch.username !== (storedSmtp?.username ?? null);
+  return hostChanged || usernameChanged;
+}
+function planEmailServerSecretUpdate(input) {
+  if (!hasTransport(input.patch)) {
+    return { resendApiKey: "retain", smtpPassword: "retain", caPem: "retain" };
+  }
+  if (input.patch.transport === "resend") {
+    return {
+      resendApiKey: input.patch.apiKey !== undefined ? "set" : "retain",
+      smtpPassword: "clear",
+      caPem: "clear"
+    };
+  }
+  const password = input.patch.password !== undefined ? "set" : input.patch.username === null ? "clear" : input.existingTransport !== "smtp" ? "clear" : smtpDestinationChanged(input.existingTransport, input.patch, input.storedSmtp) ? "clear" : "retain";
+  const caPem = input.patch.caPem === null ? "clear" : input.patch.caPem !== undefined ? "set" : input.existingTransport === "smtp" ? "retain" : "clear";
+  return {
+    resendApiKey: "clear",
+    smtpPassword: password,
+    caPem
+  };
+}
+function planSmtpAuthActions(existingTransport, patch, storedSmtp) {
+  const secrets = planEmailServerSecretUpdate({ existingTransport, storedSmtp, patch });
+  const username = patch.username === null ? "clear" : typeof patch.username === "string" ? "set" : existingTransport === "smtp" ? "retain" : "clear";
+  return { username, password: secrets.smtpPassword };
+}
+function actionLeavesPresent(action, storedPresent) {
+  if (action === "set")
+    return true;
+  if (action === "clear")
+    return false;
+  return storedPresent;
+}
+function getEmailServerUpdateError(existingTransport, patch, storedSmtp) {
+  if (hasTransport(patch) && patch.transport === "smtp") {
+    const auth = planSmtpAuthActions(existingTransport, patch, storedSmtp);
+    const hasUsername = actionLeavesPresent(auth.username, Boolean(storedSmtp?.username));
+    const hasPassword = actionLeavesPresent(auth.password, storedSmtp?.passwordConfigured === true);
+    if (patch.security === "none" && (hasUsername || hasPassword)) {
+      return SMTP_NONE_CREDENTIALS_MESSAGE;
+    }
+    if (smtpDestinationChanged(existingTransport, patch, storedSmtp) && patch.password === undefined && hasUsername && storedSmtp?.passwordConfigured === true) {
+      return SMTP_TARGET_PASSWORD_MESSAGE;
+    }
+    if (hasUsername !== hasPassword) {
+      return SMTP_CREDENTIAL_PAIR_MESSAGE;
+    }
+  }
+  if (!hasTransport(patch))
+    return null;
+  if (patch.transport === existingTransport)
+    return null;
+  if (patch.transport === "resend" && patch.apiKey === undefined) {
+    return "Resend API key is required when changing transport to resend";
+  }
+  return null;
+}
+var EMAIL_SERVER_TRANSPORTS, SMTP_SECURITY_MODES, SMTP_DEFAULT_PORT_BY_SECURITY, EMAIL_SERVER_ID_PREFIX, EMAIL_SERVER_ID_PATTERN, EmailServerIdSchema, EmailServerNameSchema, EmailServerFromEmailSchema, FROM_NAME_UNSAFE, EmailServerFromNameSchema, SmtpHostSchema, SmtpPortSchema, SmtpSecuritySchema, SmtpUsernameSchema, SecretStringSchema, fromFields, SMTP_NONE_CREDENTIALS_MESSAGE = "SMTP credentials cannot be used with security 'none'", SMTP_CREDENTIAL_PAIR_MESSAGE = "SMTP username and password must both be present or both absent", SMTP_TARGET_PASSWORD_MESSAGE = "A new SMTP password is required when the host or username changes", CreateResendEmailServerRequestSchema, CreateSmtpEmailServerRequestSchema, CreateEmailServerRequestSchema, UpdateMetadataOnlySchema, UpdateResendEmailServerRequestSchema, UpdateSmtpEmailServerRequestSchema, UpdateEmailServerRequestSchema, PublicEmailServerTimestamps, PublicResendEmailServerSchema, PublicSmtpEmailServerSchema, EmailServerSchema, ListEmailServersResponseSchema, DeleteEmailServerResponseSchema, TestEmailServerRequestSchema, TestEmailServerResponseSchema;
+var init_email_servers = __esm(() => {
+  init_zod();
+  init_common();
+  EMAIL_SERVER_TRANSPORTS = ["resend", "smtp"];
+  SMTP_SECURITY_MODES = ["starttls", "tls", "none"];
+  SMTP_DEFAULT_PORT_BY_SECURITY = {
+    starttls: 587,
+    tls: 465,
+    none: 25
+  };
+  EMAIL_SERVER_ID_PREFIX = ID_PREFIXES.EMAIL_SERVER;
+  EMAIL_SERVER_ID_PATTERN = /^ems_[A-Za-z0-9_-]+$/;
+  EmailServerIdSchema = string2().regex(EMAIL_SERVER_ID_PATTERN, "Expected ems_… id").max(128);
+  EmailServerNameSchema = string2().trim().min(1).max(128);
+  EmailServerFromEmailSchema = string2().trim().email();
+  FROM_NAME_UNSAFE = /[\p{Cc}<>]/u;
+  EmailServerFromNameSchema = string2().trim().min(1).max(128).refine((value) => !FROM_NAME_UNSAFE.test(value), {
+    message: "fromName cannot contain control characters or angle brackets"
+  });
+  SmtpHostSchema = string2().trim().min(1).max(253);
+  SmtpPortSchema = number2().int().min(1).max(65535);
+  SmtpSecuritySchema = _enum(SMTP_SECURITY_MODES);
+  SmtpUsernameSchema = string2().min(1).max(256);
+  SecretStringSchema = string2().min(1);
+  fromFields = {
+    fromEmail: EmailServerFromEmailSchema,
+    fromName: EmailServerFromNameSchema
+  };
+  CreateResendEmailServerRequestSchema = object({
+    name: EmailServerNameSchema,
+    enabled: boolean2().optional().default(true),
+    transport: literal("resend"),
+    apiKey: SecretStringSchema,
+    ...fromFields
+  }).strict();
+  CreateSmtpEmailServerRequestSchema = object({
+    name: EmailServerNameSchema,
+    enabled: boolean2().optional().default(true),
+    transport: literal("smtp"),
+    host: SmtpHostSchema,
+    port: SmtpPortSchema.optional(),
+    security: SmtpSecuritySchema.optional().default("starttls"),
+    username: SmtpUsernameSchema.optional(),
+    password: SecretStringSchema.optional(),
+    caPem: SecretStringSchema.optional(),
+    ...fromFields
+  }).strict().superRefine((data, ctx) => {
+    refineSmtpCredentialPair(data, ctx);
+    refineSmtpNoneRejectsCredentials(data, ctx);
+  }).transform((data) => ({
+    ...data,
+    port: defaultSmtpPort(data.security, data.port)
+  }));
+  CreateEmailServerRequestSchema = discriminatedUnion("transport", [
+    CreateResendEmailServerRequestSchema,
+    CreateSmtpEmailServerRequestSchema
+  ]).meta({ id: "CreateEmailServerRequest" });
+  UpdateMetadataOnlySchema = object({
+    name: EmailServerNameSchema.optional(),
+    enabled: boolean2().optional()
+  }).strict().superRefine((value, ctx) => {
+    if (value.name === undefined && value.enabled === undefined) {
+      ctx.addIssue({
+        code: "custom",
+        message: "at least one field is required"
+      });
+    }
+  });
+  UpdateResendEmailServerRequestSchema = object({
+    name: EmailServerNameSchema.optional(),
+    enabled: boolean2().optional(),
+    transport: literal("resend"),
+    apiKey: SecretStringSchema.optional(),
+    ...fromFields
+  }).strict();
+  UpdateSmtpEmailServerRequestSchema = object({
+    name: EmailServerNameSchema.optional(),
+    enabled: boolean2().optional(),
+    transport: literal("smtp"),
+    host: SmtpHostSchema,
+    port: SmtpPortSchema,
+    security: SmtpSecuritySchema,
+    username: SmtpUsernameSchema.nullable().optional(),
+    password: SecretStringSchema.optional(),
+    caPem: SecretStringSchema.nullable().optional(),
+    ...fromFields
+  }).strict().superRefine(refineSmtpNoneRejectsCredentials);
+  UpdateEmailServerRequestSchema = union([
+    UpdateResendEmailServerRequestSchema,
+    UpdateSmtpEmailServerRequestSchema,
+    UpdateMetadataOnlySchema
+  ]).meta({ id: "UpdateEmailServerRequest" });
+  PublicEmailServerTimestamps = {
+    id: EmailServerIdSchema,
+    name: EmailServerNameSchema,
+    enabled: boolean2(),
+    createdAt: union([string2(), exports_coerce.date()]),
+    updatedAt: union([string2(), exports_coerce.date()])
+  };
+  PublicResendEmailServerSchema = object({
+    ...PublicEmailServerTimestamps,
+    transport: literal("resend"),
+    fromEmail: EmailServerFromEmailSchema,
+    fromName: EmailServerFromNameSchema,
+    apiKeyConfigured: literal(true)
+  }).strict().meta({ id: "PublicResendEmailServer" });
+  PublicSmtpEmailServerSchema = object({
+    ...PublicEmailServerTimestamps,
+    transport: literal("smtp"),
+    fromEmail: EmailServerFromEmailSchema,
+    fromName: EmailServerFromNameSchema,
+    host: SmtpHostSchema,
+    port: SmtpPortSchema,
+    security: SmtpSecuritySchema,
+    username: string2().nullable(),
+    passwordConfigured: boolean2(),
+    caPemConfigured: boolean2()
+  }).strict().meta({ id: "PublicSmtpEmailServer" });
+  EmailServerSchema = discriminatedUnion("transport", [PublicResendEmailServerSchema, PublicSmtpEmailServerSchema]).meta({ id: "EmailServer" });
+  ListEmailServersResponseSchema = object({
+    data: array(EmailServerSchema),
+    total: number2().int(),
+    limit: number2().int(),
+    offset: number2().int()
+  }).meta({ id: "ListEmailServersResponse" });
+  DeleteEmailServerResponseSchema = object({
+    deleted: literal(true),
+    id: EmailServerIdSchema
+  }).strict().meta({ id: "DeleteEmailServerResponse" });
+  TestEmailServerRequestSchema = object({
+    to: EmailServerFromEmailSchema
+  }).strict().meta({ id: "TestEmailServerRequest" });
+  TestEmailServerResponseSchema = discriminatedUnion("ok", [
+    object({
+      ok: literal(true),
+      transport: _enum(EMAIL_SERVER_TRANSPORTS),
+      messageId: string2().min(1)
+    }).strict(),
+    object({
+      ok: literal(false),
+      error: string2().min(1)
+    }).strict()
+  ]).meta({ id: "TestEmailServerResponse" });
+});
+
 // ../../node_modules/@babel/parser/lib/index.js
 var require_lib = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", {
@@ -52892,6 +53137,61 @@ var init_typed_script = __esm(() => {
   init_compile();
 });
 
+// ../types/src/workflow/email-recipients.ts
+function splitRecipientTokens(value) {
+  const tokens = [];
+  let start = 0;
+  let templateClose;
+  for (let index = 0;index < value.length; index++) {
+    if (templateClose) {
+      if (value.startsWith(templateClose, index)) {
+        index++;
+        templateClose = undefined;
+      }
+      continue;
+    }
+    if (value.startsWith("{{", index)) {
+      templateClose = "}}";
+      index++;
+      continue;
+    }
+    if (value.startsWith("{%", index)) {
+      templateClose = "%}";
+      index++;
+      continue;
+    }
+    if (value[index] === ",") {
+      tokens.push(value.slice(start, index));
+      start = index + 1;
+    }
+  }
+  tokens.push(value.slice(start));
+  return tokens;
+}
+function countDeterministicEmailRecipients(value) {
+  if (value === undefined || value === null)
+    return 0;
+  const parts = Array.isArray(value) ? value : [value];
+  let count = 0;
+  for (const part of parts) {
+    if (typeof part !== "string")
+      continue;
+    const tokens = splitRecipientTokens(part).map((token) => token.trim()).filter((token) => token.length > 0);
+    count += tokens.length;
+  }
+  return count;
+}
+function countActionEmailRecipients(fields) {
+  return countDeterministicEmailRecipients(fields.to) + countDeterministicEmailRecipients(fields.cc) + countDeterministicEmailRecipients(fields.bcc);
+}
+function actionEmailRecipientCountExceedsLimit(fields) {
+  return countActionEmailRecipients(fields) > ACTION_EMAIL_MAX_RECIPIENTS;
+}
+var ACTION_EMAIL_MAX_RECIPIENTS = 10, ACTION_EMAIL_RECIPIENT_LIMIT_MESSAGE;
+var init_email_recipients = __esm(() => {
+  ACTION_EMAIL_RECIPIENT_LIMIT_MESSAGE = `At most ${ACTION_EMAIL_MAX_RECIPIENTS} recipients combined across to, cc, and bcc`;
+});
+
 // ../types/src/workflow/script-function.ts
 var SCRIPT_FN_MAX_BYTES = 50000;
 
@@ -52998,7 +53298,8 @@ var init_steps = __esm(() => {
   ACTION_STEP_TYPES = [
     "action.http",
     "action.invoke-workflow",
-    "action.website-reader"
+    "action.website-reader",
+    "action.email"
   ];
   CONTROL_STEP_TYPES = [
     "control.if",
@@ -53128,15 +53429,17 @@ function getStepSchema(stepType) {
 function listStepTypes() {
   return [...STEP_TYPES];
 }
-var OptionalReasoningEffortSchema, AiParseConfigSchema, AiParseOutputSchema, AiExtractConfigSchema, AiExtractOutputSchema, VisionPageRangeSchema, AiVisionConfigSchema, AiVisionOutputSchema, AiSplitConfigSchema, AiSplitSectionSchema, AiSplitOutputSchema, AiSegmentConfigSchema, AiSegmentOutputSchema, AiClassifyConfigSchema, AiClassifyOutputSchema, ClassifyPagesLabelSchema2, AiClassifyPagesConfigSchema, AiClassifyPagesOutputSchema, TransformSetConfigSchema, TransformSetOutputSchema, TransformRemoveConfigSchema, TransformRemoveOutputSchema, TransformCombineConfigSchema, TransformCombineOutputSchema, TransformSplitConfigSchema, TransformSplitOutputSchema, TransformMergeConfigSchema, TransformMergeOutputSchema, TransformTemplateConfigSchema, TransformTemplateOutputSchema, TransformPdfEmbedConfigSchema, TransformPdfEmbedOutputSchema, TransformXlsxToJsonConfigSchema, TransformXlsxToJsonOutputSchema, JsonToXlsxAuthoringRowsSchema, JsonToXlsxSheetConfigSchema, TransformJsonToXlsxConfigSchema, TransformJsonToXlsxOutputSchema, TransformScriptConfigSchema, TransformScriptOutputSchema, ParsedDocPageSchema, TransformTextChunkerConfigSchema, TransformTextChunkerOutputSchema, RegexNormalizerSchema, RegexFormatSchema, REGEX_FLAGS, RegexFieldSchema, TransformRegexExtractConfigSchema, TransformRegexExtractOutputSchema, ActionHttpConfigSchema, ActionHttpOutputSchema, ActionInvokeWorkflowConfigSchema, ActionInvokeWorkflowOutputSchema, ActionWebsiteReaderConfigSchema, ActionWebsiteReaderOutputSchema, ControlIfConfigSchema, ControlIfOutputSchema, ControlSwitchConfigSchema, ControlSwitchOutputSchema, ControlForeachConfigSchema, ControlForeachOutputSchema, ControlParallelMapConfigSchema, ControlParallelMapOutputSchema, ControlParallelConfigSchema, ControlParallelOutputSchema, ControlWaitConfigSchema, ControlWaitOutputSchema, ControlFailConfigSchema, ControlFailOutputSchema, STEP_SCHEMAS;
+var OptionalReasoningEffortSchema, AiParseConfigSchema, AiParseOutputSchema, AiExtractConfigSchema, AiExtractOutputSchema, VisionPageRangeSchema, AiVisionConfigSchema, AiVisionOutputSchema, AiSplitConfigSchema, AiSplitSectionSchema, AiSplitOutputSchema, AiSegmentConfigSchema, AiSegmentOutputSchema, AiClassifyConfigSchema, AiClassifyOutputSchema, ClassifyPagesLabelSchema2, AiClassifyPagesConfigSchema, AiClassifyPagesOutputSchema, TransformSetConfigSchema, TransformSetOutputSchema, TransformRemoveConfigSchema, TransformRemoveOutputSchema, TransformCombineConfigSchema, TransformCombineOutputSchema, TransformSplitConfigSchema, TransformSplitOutputSchema, TransformMergeConfigSchema, TransformMergeOutputSchema, TransformTemplateConfigSchema, TransformTemplateOutputSchema, TransformPdfEmbedConfigSchema, TransformPdfEmbedOutputSchema, TransformXlsxToJsonConfigSchema, TransformXlsxToJsonOutputSchema, JsonToXlsxAuthoringRowsSchema, JsonToXlsxSheetConfigSchema, TransformJsonToXlsxConfigSchema, TransformJsonToXlsxOutputSchema, TransformScriptConfigSchema, TransformScriptOutputSchema, ParsedDocPageSchema, TransformTextChunkerConfigSchema, TransformTextChunkerOutputSchema, RegexNormalizerSchema, RegexFormatSchema, REGEX_FLAGS, RegexFieldSchema, TransformRegexExtractConfigSchema, TransformRegexExtractOutputSchema, ActionHttpConfigSchema, ActionHttpOutputSchema, ActionInvokeWorkflowConfigSchema, ActionInvokeWorkflowOutputSchema, ActionWebsiteReaderConfigSchema, ActionWebsiteReaderOutputSchema, ACTION_EMAIL_MAX_ATTACHMENTS = 10, ACTION_EMAIL_MAX_ATTACHMENT_BYTES, ACTION_EMAIL_BODY_MAX_BYTES, emailBodyMaxBytes = (value) => new TextEncoder().encode(value).byteLength <= ACTION_EMAIL_BODY_MAX_BYTES, ActionEmailRecipientListSchema, ActionEmailToSchema, ActionEmailOptionalRecipientsSchema, ActionEmailAttachmentSchema, ActionEmailConfigSchema, ActionEmailOutputSchema, ControlIfConfigSchema, ControlIfOutputSchema, ControlSwitchConfigSchema, ControlSwitchOutputSchema, ControlForeachConfigSchema, ControlForeachOutputSchema, ControlParallelMapConfigSchema, ControlParallelMapOutputSchema, ControlParallelConfigSchema, ControlParallelOutputSchema, ControlWaitConfigSchema, ControlWaitOutputSchema, ControlFailConfigSchema, ControlFailOutputSchema, STEP_SCHEMAS;
 var init_step_configs = __esm(() => {
   init_zod();
   init_ai_client();
   init_common();
+  init_email_servers();
   init_parser();
   init_json_to_xlsx();
   init_xlsx_to_json();
   init_typed_script();
+  init_email_recipients();
   init_steps();
   OptionalReasoningEffortSchema = ReasoningEffortSchema.optional().describe("Reasoning effort for models that support it. Omit to preserve the current provider default.");
   AiParseConfigSchema = object({
@@ -53661,6 +53964,54 @@ var init_step_configs = __esm(() => {
     length: number2().describe("Content length in characters"),
     url: string2().describe("Final URL after redirects")
   });
+  ACTION_EMAIL_MAX_ATTACHMENT_BYTES = 12 * 1024 * 1024;
+  ACTION_EMAIL_BODY_MAX_BYTES = 50 * 1024;
+  ActionEmailRecipientListSchema = array(string2().min(1));
+  ActionEmailToSchema = union([
+    string2().min(1, "To is required"),
+    ActionEmailRecipientListSchema.min(1, "To requires at least one recipient")
+  ]);
+  ActionEmailOptionalRecipientsSchema = union([
+    string2().min(1),
+    ActionEmailRecipientListSchema
+  ]);
+  ActionEmailAttachmentSchema = union([
+    string2().min(1).describe("File id or template expression that resolves to a file id"),
+    object({
+      fileId: string2().min(1).describe("File id or template expression that resolves to a file id"),
+      filename: string2().min(1).optional().describe("Optional download filename override")
+    })
+  ]);
+  ActionEmailConfigSchema = object({
+    server: EmailServerIdSchema.describe("Outbound email server id (`ems_…`)"),
+    to: ActionEmailToSchema.describe("Primary recipient(s). String, comma-separated list, or nonempty string array. Combined with cc and bcc, at most 10 recipients."),
+    cc: ActionEmailOptionalRecipientsSchema.optional().describe("Carbon-copy recipient(s). String, comma-separated list, or string array. Combined with to and bcc, at most 10 recipients."),
+    bcc: ActionEmailOptionalRecipientsSchema.optional().describe("Blind carbon-copy recipient(s). String, comma-separated list, or string array. Combined with to and cc, at most 10 recipients."),
+    replyTo: string2().min(1).optional().describe("Reply-To address (supports template expressions)"),
+    subject: string2().min(1, "Subject is required").describe("Email subject"),
+    text: string2().min(1, "Body is required").refine(emailBodyMaxBytes, {
+      message: `Email body must be at most ${ACTION_EMAIL_BODY_MAX_BYTES} bytes`
+    }).describe("Plain-text email body (max 50KiB)"),
+    attachments: array(ActionEmailAttachmentSchema).max(ACTION_EMAIL_MAX_ATTACHMENTS, `At most ${ACTION_EMAIL_MAX_ATTACHMENTS} attachments`).optional().describe("Optional same-run attachments as { fileId, filename? } or a bare fileId string (12MiB combined)")
+  }).superRefine((config, ctx) => {
+    if (actionEmailRecipientCountExceedsLimit(config)) {
+      ctx.addIssue({
+        code: "custom",
+        message: ACTION_EMAIL_RECIPIENT_LIMIT_MESSAGE,
+        path: ["to"]
+      });
+    }
+  });
+  ActionEmailOutputSchema = object({
+    serverId: EmailServerIdSchema.describe("Email server that sent (or would have sent) the message"),
+    messageId: string2().nullable().describe("Provider message id. Null when delivery was skipped (evaluation runs)."),
+    provider: _enum(["resend", "smtp"]).nullable().describe("Email provider that sent the message. Null when delivery was skipped."),
+    to: array(string2()).describe("Normalized To recipients"),
+    cc: array(string2()).describe("Normalized Cc recipients"),
+    bcc: array(string2()).describe("Normalized Bcc recipients"),
+    attachmentCount: number2().int().nonnegative().describe("Number of attachments sent"),
+    totalBytes: number2().int().nonnegative().describe("Total attachment size in bytes")
+  });
   ControlIfConfigSchema = object({
     condition: string2().min(1, "Condition is required").describe("LiquidJS expression that evaluates to boolean")
   });
@@ -53914,6 +54265,15 @@ var init_step_configs = __esm(() => {
       outputSchema: ActionWebsiteReaderOutputSchema,
       configInWith: true
     },
+    "action.email": {
+      type: "action.email",
+      category: "action",
+      name: "Send Email",
+      description: "Send an email with optional attachments via a selected email server. At most 10 recipients combined across to, cc, and bcc.",
+      configSchema: ActionEmailConfigSchema,
+      outputSchema: ActionEmailOutputSchema,
+      configInWith: true
+    },
     "control.if": {
       type: "control.if",
       category: "control",
@@ -55423,6 +55783,7 @@ var init_src = __esm(() => {
   init_eval();
   init_git_source();
   init_triggers();
+  init_email_servers();
   init_webhooks();
   init_typed_script();
 });
@@ -205368,7 +205729,7 @@ import { fileURLToPath as fileURLToPath8 } from "url";
 // package.json
 var package_default = {
   name: "@eigenpal/cli",
-  version: "0.15.1",
+  version: "0.16.0",
   description: "Eigenpal CLI — author and run document workflows from your terminal. Agent-ready.",
   keywords: [
     "eigenpal",
@@ -240643,18 +241004,471 @@ function matchingSnippet(content, terms) {
   return line.replace(/^[#>*\s-]+/, "").replace(/[`[\]{}]/g, "").trim().slice(0, 140);
 }
 
+// src/lib/api-paths.ts
+var API_PREFIX = "/v1";
+function apiPath(suffix) {
+  if (suffix === "/v1" || suffix.startsWith("/v1/"))
+    return suffix;
+  if (suffix === "/api/v1" || suffix.startsWith("/api/v1/")) {
+    return `${API_PREFIX}${suffix.slice("/api/v1".length)}`;
+  }
+  const normalized = suffix.startsWith("/") ? suffix : `/${suffix}`;
+  return `${API_PREFIX}${normalized}`;
+}
+
+// src/lib/email-servers-cli.ts
+init_src();
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
+var SECRET_KEYS = new Set(["apiKey", "password", "caPem", "ciphertext"]);
+var SMTP_UPDATE_TARGET_FIELDS = ["host", "port", "security", "fromEmail", "fromName"];
+var SMTP_UPDATE_FLAG_BY_FIELD = {
+  host: "--host",
+  port: "--port",
+  security: "--security",
+  fromEmail: "--from-email",
+  fromName: "--from-name"
+};
+function assertCompleteSmtpUpdateTarget(body) {
+  if (body.transport !== "smtp")
+    return;
+  const missing = SMTP_UPDATE_TARGET_FIELDS.filter((field) => body[field] === undefined || body[field] === "");
+  if (missing.length === 0)
+    return;
+  const flags = missing.map((field) => SMTP_UPDATE_FLAG_BY_FIELD[field]).join(", ");
+  throw new Error(`SMTP updates that set --transport smtp require a complete target (host, port, security, from-email, from-name). Missing: ${flags}. Update does not default --security/--port (create still defaults to starttls and the matching port). Metadata-only updates omit --transport.`);
+}
+function countTruthy(values) {
+  return values.filter(Boolean).length;
+}
+function assertExclusiveConfigSource(explicitFieldCount, opts, command) {
+  const configSources = countTruthy([opts.configJson, opts.configFile]);
+  if (configSources > 1) {
+    throw new Error("Pass only one of --config-json or --config-file.");
+  }
+  if (configSources > 0 && explicitFieldCount > 0) {
+    throw new Error(`${command} accepts either explicit flags or --config-json/--config-file, not both.`);
+  }
+  if (configSources === 0 && explicitFieldCount === 0 && command === "create") {
+    throw new Error("create requires explicit fields or --config-json/--config-file (plus secret input for Resend or authenticated SMTP).");
+  }
+}
+function readConfigObject(opts) {
+  if (opts.configJson) {
+    let parsed;
+    try {
+      parsed = JSON.parse(opts.configJson);
+    } catch {
+      throw new Error("--config-json must be valid JSON.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("--config-json must be a JSON object.");
+    }
+    return parsed;
+  }
+  if (opts.configFile) {
+    const filePath = opts.configFile === "-" ? undefined : resolve4(opts.configFile);
+    let raw;
+    try {
+      raw = opts.configFile === "-" ? readFileSync14(0, "utf8") : readFileSync14(filePath, "utf8");
+    } catch (err) {
+      const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+      if (code === "ENOENT") {
+        throw new Error(`Config file not found: ${resolve4(opts.configFile)}`);
+      }
+      throw err;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error("--config-file must contain a JSON object.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("--config-file must contain a JSON object.");
+    }
+    return parsed;
+  }
+  return {};
+}
+function rejectInlineSecrets(body) {
+  for (const key of SECRET_KEYS) {
+    if (key in body && body[key] != null) {
+      throw new Error(`Secret field "${key}" cannot be set in --config-json/--config-file. Use the matching *-stdin or *-file flag, or answer the secure prompt.`);
+    }
+  }
+}
+async function readSecretInput2(label, opts, required) {
+  const selected = countTruthy([opts.stdin, opts.file]);
+  if (selected > 1) {
+    throw new Error(`Pass only one of --${label}-stdin or --${label}-file.`);
+  }
+  if (opts.stdin) {
+    return readFileSync14(0, "utf8").replace(/\n$/, "");
+  }
+  if (opts.file) {
+    const filePath = opts.file === "-" ? undefined : resolve4(opts.file);
+    try {
+      return (opts.file === "-" ? readFileSync14(0, "utf8") : readFileSync14(filePath, "utf8")).replace(/\n$/, "");
+    } catch (err) {
+      const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+      if (code === "ENOENT") {
+        throw new Error(`Secret file not found: ${resolve4(opts.file)}`);
+      }
+      throw err;
+    }
+  }
+  if (!required)
+    return;
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    await Promise.resolve().then(() => init_dist4());
+    const answer = await Ce({ message: `${label} (input hidden)` });
+    if (q(answer)) {
+      me("Cancelled");
+      process.exit(1);
+    }
+    return String(answer);
+  }
+  throw new Error(`${label} is required in noninteractive mode (use --${label}-stdin or --${label}-file).`);
+}
+function parseEnabled(opts) {
+  if (opts.enabled && opts.disabled) {
+    throw new Error("Pass only one of --enabled or --disabled.");
+  }
+  if (opts.disabled)
+    return false;
+  if (opts.enabled)
+    return true;
+  return;
+}
+async function buildCreateRequest(opts) {
+  const explicitCount = countTruthy([
+    opts.name,
+    opts.transport,
+    opts.fromEmail,
+    opts.fromName,
+    opts.enabled,
+    opts.disabled,
+    opts.host,
+    opts.port,
+    opts.security,
+    opts.username
+  ]);
+  assertExclusiveConfigSource(explicitCount, opts, "create");
+  const body = {};
+  if (countTruthy([opts.configJson, opts.configFile]) > 0) {
+    Object.assign(body, readConfigObject(opts));
+    rejectInlineSecrets(body);
+  }
+  if (opts.name !== undefined)
+    body.name = opts.name;
+  if (opts.transport !== undefined)
+    body.transport = opts.transport;
+  if (opts.fromEmail !== undefined)
+    body.fromEmail = opts.fromEmail;
+  if (opts.fromName !== undefined)
+    body.fromName = opts.fromName;
+  const enabled = parseEnabled(opts);
+  if (enabled !== undefined)
+    body.enabled = enabled;
+  if (opts.host !== undefined)
+    body.host = opts.host;
+  if (opts.port !== undefined)
+    body.port = opts.port;
+  if (opts.security !== undefined)
+    body.security = opts.security;
+  if (opts.username !== undefined)
+    body.username = opts.username;
+  const apiKey = await readSecretInput2("api-key", { stdin: opts.apiKeyStdin, file: opts.apiKeyFile }, false);
+  if (apiKey !== undefined)
+    body.apiKey = apiKey;
+  const password = await readSecretInput2("password", { stdin: opts.passwordStdin, file: opts.passwordFile }, false);
+  if (password !== undefined)
+    body.password = password;
+  const caPem = await readSecretInput2("ca-pem", { stdin: opts.caPemStdin, file: opts.caPemFile }, false);
+  if (caPem !== undefined)
+    body.caPem = caPem;
+  const transport = body.transport;
+  if (transport === "resend" && body.apiKey === undefined) {
+    body.apiKey = await readSecretInput2("api-key", { stdin: opts.apiKeyStdin, file: opts.apiKeyFile }, true);
+  }
+  if (body.transport === "smtp" && typeof body.username === "string" && body.username.length > 0 && body.password === undefined) {
+    body.password = await readSecretInput2("password", { stdin: opts.passwordStdin, file: opts.passwordFile }, true);
+  }
+  return CreateEmailServerRequestSchema.parse(body);
+}
+async function buildUpdateRequest(input) {
+  const { existing, opts } = input;
+  const explicitCount = countTruthy([
+    opts.name,
+    opts.transport,
+    opts.fromEmail,
+    opts.fromName,
+    opts.enabled,
+    opts.disabled,
+    opts.host,
+    opts.port,
+    opts.security,
+    opts.username,
+    opts.clearCaPem,
+    opts.clearUsername
+  ]);
+  assertExclusiveConfigSource(explicitCount, opts, "update");
+  const body = {};
+  if (countTruthy([opts.configJson, opts.configFile]) > 0) {
+    Object.assign(body, readConfigObject(opts));
+    rejectInlineSecrets(body);
+  }
+  if (opts.name !== undefined)
+    body.name = opts.name;
+  const enabled = parseEnabled(opts);
+  if (enabled !== undefined)
+    body.enabled = enabled;
+  if (opts.transport !== undefined)
+    body.transport = opts.transport;
+  if (opts.fromEmail !== undefined)
+    body.fromEmail = opts.fromEmail;
+  if (opts.fromName !== undefined)
+    body.fromName = opts.fromName;
+  if (opts.host !== undefined)
+    body.host = opts.host;
+  if (opts.port !== undefined)
+    body.port = opts.port;
+  if (opts.security !== undefined)
+    body.security = opts.security;
+  if (opts.clearUsername)
+    body.username = null;
+  else if (opts.username !== undefined)
+    body.username = opts.username;
+  if (opts.clearCaPem)
+    body.caPem = null;
+  const apiKey = await readSecretInput2("api-key", { stdin: opts.apiKeyStdin, file: opts.apiKeyFile }, false);
+  if (apiKey !== undefined)
+    body.apiKey = apiKey;
+  const password = await readSecretInput2("password", { stdin: opts.passwordStdin, file: opts.passwordFile }, false);
+  if (password !== undefined)
+    body.password = password;
+  const caPem = await readSecretInput2("ca-pem", { stdin: opts.caPemStdin, file: opts.caPemFile }, false);
+  if (caPem !== undefined)
+    body.caPem = caPem;
+  if (Object.keys(body).length === 0) {
+    throw new Error("No changes requested. Pass fields to update or --config-json/--config-file.");
+  }
+  assertCompleteSmtpUpdateTarget(body);
+  if (body.transport === "resend" && existing.transport !== "resend" && body.apiKey === undefined) {
+    body.apiKey = await readSecretInput2("api-key", { stdin: opts.apiKeyStdin, file: opts.apiKeyFile }, true);
+  }
+  if (body.transport === "smtp" && body.password === undefined) {
+    const targetUsername = body.username === null ? null : typeof body.username === "string" ? body.username : existing.username ?? null;
+    const destinationChanged = existing.transport !== "smtp" || typeof body.host === "string" && existing.host !== undefined && body.host !== existing.host || targetUsername !== (existing.username ?? null);
+    if (destinationChanged && targetUsername) {
+      body.password = await readSecretInput2("password", { stdin: opts.passwordStdin, file: opts.passwordFile }, true);
+    }
+  }
+  const patch = UpdateEmailServerRequestSchema.parse(body);
+  const transportError = getEmailServerUpdateError(existing.transport, patch, {
+    host: existing.host,
+    username: existing.username,
+    passwordConfigured: existing.passwordConfigured
+  });
+  if (transportError)
+    throw new Error(transportError);
+  return patch;
+}
+function redactValue(key, value) {
+  if (SECRET_KEYS.has(key))
+    return "[redacted]";
+  if (value && typeof value === "object") {
+    if (Array.isArray(value))
+      return value.map((item) => redactUnknown(item));
+    return redactUnknown(value);
+  }
+  return value;
+}
+function redactUnknown(value) {
+  if (value == null || typeof value !== "object")
+    return value;
+  if (Array.isArray(value))
+    return value.map((item) => redactUnknown(item));
+  const out = {};
+  for (const [key, nested] of Object.entries(value)) {
+    out[key] = redactValue(key, nested);
+  }
+  return out;
+}
+function redactEmailServerPayload(value) {
+  return redactUnknown(value);
+}
+function formatEmailServerHuman(server) {
+  const lines = [];
+  lines.push(`${server.id}  ${server.name}${server.enabled ? "" : "  (disabled)"}`);
+  lines.push(`  transport   ${server.transport}`);
+  lines.push(`  from        ${server.fromName} <${server.fromEmail}>`);
+  if (server.transport === "resend") {
+    lines.push(`  api key     configured`);
+  } else {
+    lines.push(`  host        ${server.host}:${server.port} (${server.security})`);
+    lines.push(`  username    ${server.username ?? "-"}`);
+    lines.push(`  password    ${server.passwordConfigured ? "configured" : "not configured"}`);
+    lines.push(`  ca pem      ${server.caPemConfigured ? "configured" : "not configured"}`);
+  }
+  lines.push(`  updated     ${server.updatedAt instanceof Date ? server.updatedAt.toISOString() : server.updatedAt}`);
+  return lines.join(`
+`);
+}
+
+// src/commands/email-servers.ts
+var LIST_COLUMNS = [
+  { key: "id", header: "id" },
+  { key: "name", header: "name" },
+  { key: "transport", header: "transport" },
+  {
+    key: "enabled",
+    header: "enabled",
+    format: (value) => value ? "yes" : "no"
+  },
+  { key: "fromEmail", header: "from" },
+  {
+    key: "host",
+    header: "host",
+    format: (_value, row) => row.transport === "smtp" ? String(row.host) : "-"
+  },
+  {
+    key: "updatedAt",
+    header: "updated",
+    format: (value) => formatTimestamp(value)
+  }
+];
+function buildClient2(opts) {
+  const config = resolveConfig(opts);
+  requireApiKey(config);
+  return new ApiClient(config);
+}
+function printJson2(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+function sharedCreateOptions(cmd) {
+  return cmd.option("--config-json <json>", "JSON object (non-secret fields only; use secret *-stdin/*-file flags)").option("--config-file <path>", "JSON file path (`-` reads stdin; non-secret fields only)").option("--name <name>", "Display name").option("--transport <kind>", "Transport: resend or smtp").option("--from-email <email>", "From address").option("--from-name <name>", "From display name (no control characters or <>)").option("--enabled", "Enable the server (default on create)").option("--disabled", "Disable the server").option("--host <host>", "SMTP host (required on update when --transport smtp)").option("--port <n>", "SMTP port. Required on update when --transport smtp; create defaults from --security", intArg).option("--security <mode>", "SMTP security: starttls, tls, or none (unauthenticated trusted relays; credentials are rejected). Required on update when --transport smtp; create defaults to starttls").option("--username <user>", "SMTP username (non-secret)").option("--api-key-stdin", "Read the Resend API key from stdin").option("--api-key-file <path>", "Read the Resend API key from a file (`-` for stdin)").option("--password-stdin", "Read the SMTP password from stdin").option("--password-file <path>", "Read the SMTP password from a file (`-` for stdin)").option("--ca-pem-stdin", "Read a custom SMTP CA PEM from stdin").option("--ca-pem-file <path>", "Read a custom SMTP CA PEM from a file (`-` for stdin)");
+}
+function sharedUpdateOptions(cmd) {
+  return sharedCreateOptions(cmd).option("--clear-ca-pem", "Remove a stored custom SMTP CA certificate").option("--clear-username", "Clear stored SMTP username/password pair");
+}
+var EMAIL_SERVERS_EXAMPLES = `
+Examples:
+  $ eigenpal email-servers list --json
+  $ eigenpal email-servers get ems_... --json
+  $ eigenpal email-servers create --transport resend --name Alerts \\
+      --from-email alerts@example.com --from-name Alerts --api-key-stdin
+  $ eigenpal email-servers create --transport smtp --name "Corp SMTP" --host smtp.example.com \\
+      --from-email noreply@example.com --from-name Eigenpal
+  $ eigenpal email-servers create --config-file ./resend.json --api-key-file ./re.key
+  $ eigenpal email-servers update ems_... --name "Ops alerts"
+  $ eigenpal email-servers update ems_... --transport smtp --host smtp.example.com \\
+      --port 587 --security starttls --from-email noreply@example.com \\
+      --from-name Eigenpal --password-stdin
+  $ eigenpal email-servers delete ems_... --yes
+  $ eigenpal email-servers test ems_... --to you@example.com
+
+Secrets never belong on the command line. Provide Resend API keys, SMTP passwords,
+and CA PEM material via --*-stdin, --*-file, or the secure TTY prompt.
+`;
+function registerEmailServersCommands(program) {
+  const emailServers = program.command("email-servers").alias("email-server").description("Manage outbound email servers (ems_…): list, inspect, create, update, delete, and send a real test message.").addHelpText("after", EMAIL_SERVERS_EXAMPLES);
+  const listCmd = emailServers.command("list").description("List outbound email servers for the current workspace.");
+  addJsonFlag(withBaseUrl(withPagination(listCmd))).action(action(async (opts) => {
+    const client = buildClient2(opts);
+    const raw = await client.get(apiPath("/email-servers"), {
+      limit: String(opts.limit),
+      offset: String(opts.offset)
+    });
+    renderListResult(raw, LIST_COLUMNS, {
+      json: opts.json,
+      entityLabel: "email server"
+    });
+  }));
+  const getCmd = emailServers.command("get <id>").description("Inspect one email server. Human output is redacted even if the API regresses.");
+  addJsonFlag(withBaseUrl(getCmd)).action(action(async (id, opts) => {
+    const client = buildClient2(opts);
+    const raw = await client.get(apiPath(`/email-servers/${encodeURIComponent(id)}`));
+    const redacted = redactEmailServerPayload(raw);
+    if (opts.json) {
+      printJson2(redacted);
+      return;
+    }
+    console.log(formatEmailServerHuman(redacted));
+  }));
+  const createCmd = emailServers.command("create").description("Create an outbound email server. Resend requires an API key; SMTP accepts optional username/password except with --security none, plus optional CA PEM, and defaults to starttls on port 587.");
+  addJsonFlag(withBaseUrl(sharedCreateOptions(createCmd))).action(action(async (opts) => {
+    const body = await buildCreateRequest(opts);
+    const client = buildClient2(opts);
+    const created = await client.post(apiPath("/email-servers"), body);
+    const redacted = redactEmailServerPayload(created);
+    if (opts.json) {
+      printJson2(redacted);
+      return;
+    }
+    success(`Created ${ui.bold(redacted.id)} (${redacted.transport})`);
+    console.log(formatEmailServerHuman(redacted));
+  }));
+  const updateCmd = emailServers.command("update <id>").description("Update metadata or replace transport configuration. Omitted secrets are retained. Passing --transport smtp requires --host, --port, --security, --from-email, and --from-name (no security/port defaults). Metadata-only updates omit --transport.");
+  addJsonFlag(withBaseUrl(sharedUpdateOptions(updateCmd))).action(action(async (id, opts) => {
+    const client = buildClient2(opts);
+    const existing = await client.get(apiPath(`/email-servers/${encodeURIComponent(id)}`));
+    const body = await buildUpdateRequest({ existing, opts });
+    const updated = await client.patch(apiPath(`/email-servers/${encodeURIComponent(id)}`), body);
+    const redacted = redactEmailServerPayload(updated);
+    if (opts.json) {
+      printJson2(redacted);
+      return;
+    }
+    success(`Updated ${ui.bold(redacted.id)}`);
+    console.log(formatEmailServerHuman(redacted));
+  }));
+  const deleteCmd = emailServers.command("delete <id>").description("Soft-delete an outbound email server.").option("--yes", "Required for non-TTY shells", false);
+  addJsonFlag(withBaseUrl(deleteCmd)).action(action(async (id, opts) => {
+    if (!opts.yes && !process.stdout.isTTY) {
+      throw new Error("email-servers delete is destructive and requires --yes when run non-interactively");
+    }
+    const client = buildClient2(opts);
+    const result = await client.delete(apiPath(`/email-servers/${encodeURIComponent(id)}`));
+    if (opts.json) {
+      printJson2(result);
+      return;
+    }
+    success(`Deleted ${ui.bold(id)}`);
+  }));
+  const testCmd = emailServers.command("test <id>").description("Send a real connectivity test email through the stored server to --to. Disabled servers fail with a conflict.").requiredOption("--to <email>", "Recipient for the live test message");
+  addJsonFlag(withBaseUrl(testCmd)).action(action(async (id, opts) => {
+    const client = buildClient2(opts);
+    const result = await client.post(apiPath(`/email-servers/${encodeURIComponent(id)}/test`), {
+      to: opts.to
+    });
+    if (opts.json) {
+      printJson2(result);
+      if (!result.ok)
+        process.exit(1);
+      return;
+    }
+    if (result.ok) {
+      success(`Test email sent via ${ui.bold(result.transport)} (${ui.dim(result.messageId)})`);
+      return;
+    }
+    throw new Error(result.error);
+  }));
+}
+
 // src/commands/init/index.ts
 init_dist4();
 import {
   copyFileSync,
-  existsSync as existsSync14,
+  existsSync as existsSync15,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   statSync as statSync4,
   writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname4, join as join7, relative as relative2, resolve as resolve4 } from "node:path";
+import { dirname as dirname4, join as join7, relative as relative2, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 var TEMPLATE_NAMES = ["blank", "pdf-extraction", "text-classification"];
 var TEMPLATE_DESCRIPTIONS = {
@@ -240667,11 +241481,11 @@ function isValidProjectName(name) {
 }
 function resolveTemplatesRoot() {
   const here = dirname4(fileURLToPath6(import.meta.url));
-  const srcCandidate = resolve4(here, "..", "..", "templates");
-  if (existsSync14(srcCandidate))
+  const srcCandidate = resolve5(here, "..", "..", "templates");
+  if (existsSync15(srcCandidate))
     return srcCandidate;
-  const distCandidate = resolve4(here, "templates");
-  if (existsSync14(distCandidate))
+  const distCandidate = resolve5(here, "templates");
+  if (existsSync15(distCandidate))
     return distCandidate;
   throw new Error(`Cannot locate bundled templates. Looked in:
   ${srcCandidate}
@@ -240681,9 +241495,9 @@ async function init(name, opts) {
   if (!isValidProjectName(name)) {
     throw new Error(`Invalid project name "${name}". Use lowercase kebab/snake-case (e.g. parse-invoices), max 60 chars.`);
   }
-  const target = resolve4(process.cwd(), opts.dir ?? name);
+  const target = resolve5(process.cwd(), opts.dir ?? name);
   assertSafeTargetDir(target, opts.dir);
-  if (existsSync14(target) && readdirSync4(target).length > 0) {
+  if (existsSync15(target) && readdirSync4(target).length > 0) {
     throw new Error(`Target directory ${relative2(process.cwd(), target)} exists and is not empty.`);
   }
   let template;
@@ -240698,7 +241512,7 @@ async function init(name, opts) {
     template = await promptForTemplate();
   }
   const sourceRoot = join7(resolveTemplatesRoot(), template);
-  if (!existsSync14(sourceRoot)) {
+  if (!existsSync15(sourceRoot)) {
     throw new Error(`Template directory missing on disk: ${sourceRoot}`);
   }
   const written = copyTemplate(sourceRoot, target, name);
@@ -240751,7 +241565,7 @@ function copyTemplate(src, dst, projectName) {
       }
       mkdirSync5(dirname4(targetPath), { recursive: true });
       if (isTextFile(sourcePath)) {
-        const text = readFileSync14(sourcePath, "utf-8").replaceAll(PLACEHOLDER, projectName);
+        const text = readFileSync15(sourcePath, "utf-8").replaceAll(PLACEHOLDER, projectName);
         writeFileSync7(targetPath, text);
       } else {
         copyFileSync(sourcePath, targetPath);
@@ -240878,20 +241692,6 @@ function multipartMaxBytesFromEnv(raw = env.EIGENPAL_MULTIPART_MAX_BYTES) {
 
 // src/lib/upload-reusable-file.ts
 import { randomUUID } from "node:crypto";
-
-// src/lib/api-paths.ts
-var API_PREFIX = "/v1";
-function apiPath(suffix) {
-  if (suffix === "/v1" || suffix.startsWith("/v1/"))
-    return suffix;
-  if (suffix === "/api/v1" || suffix.startsWith("/api/v1/")) {
-    return `${API_PREFIX}${suffix.slice("/api/v1".length)}`;
-  }
-  const normalized = suffix.startsWith("/") ? suffix : `/${suffix}`;
-  return `${API_PREFIX}${normalized}`;
-}
-
-// src/lib/upload-reusable-file.ts
 function newIdempotencyKey() {
   return randomUUID();
 }
@@ -241046,8 +241846,8 @@ function parseInputFileSpecs(inputFile) {
 
 // src/lib/format-eigenpal.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "fs";
-import { join as join8, resolve as resolve5 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync16 } from "fs";
+import { join as join8, resolve as resolve6 } from "path";
 var PRETTRC_NAMES = [
   ".prettierrc",
   ".prettierrc.json",
@@ -241060,14 +241860,14 @@ var PRETTRC_NAMES = [
 ];
 function hasPrettierConfig(cwd) {
   for (const name of PRETTRC_NAMES) {
-    if (existsSync15(join8(cwd, name)))
+    if (existsSync16(join8(cwd, name)))
       return true;
   }
   try {
     const pkgPath = join8(cwd, "package.json");
-    if (!existsSync15(pkgPath))
+    if (!existsSync16(pkgPath))
       return false;
-    const raw = readFileSync15(pkgPath, "utf-8");
+    const raw = readFileSync16(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return pkg != null && typeof pkg === "object" && "prettier" in pkg;
   } catch {
@@ -241076,8 +241876,8 @@ function hasPrettierConfig(cwd) {
 }
 function formatEigenpalDirIfAvailable(dir) {
   const cwd = process.cwd();
-  const absDir = resolve5(cwd, dir);
-  if (!existsSync15(absDir))
+  const absDir = resolve6(cwd, dir);
+  if (!existsSync16(absDir))
     return;
   if (!hasPrettierConfig(cwd))
     return;
@@ -241204,17 +242004,17 @@ async function rerunTarget(runId, opts) {
 init_dist4();
 import { createHash as createHash5 } from "node:crypto";
 import {
-  existsSync as existsSync16,
+  existsSync as existsSync17,
   lstatSync,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync16,
+  readFileSync as readFileSync17,
   readdirSync as readdirSync5,
   rmSync as rmSync2,
   rmdirSync,
   unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync8
 } from "node:fs";
-import { sep as PATH_SEP, dirname as dirname5, join as join10, relative as relative3, resolve as resolve6 } from "node:path";
+import { sep as PATH_SEP, dirname as dirname5, join as join10, relative as relative3, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // src/commands/skill/tools.ts
@@ -241289,11 +242089,11 @@ var TOOLS = [
 var MANIFEST_NAME = ".eigenpal-manifest.json";
 function resolveSkillSource() {
   const here = dirname5(fileURLToPath7(import.meta.url));
-  const srcCandidate = resolve6(here, "..", "..", "skill");
-  if (existsSync16(srcCandidate))
+  const srcCandidate = resolve7(here, "..", "..", "skill");
+  if (existsSync17(srcCandidate))
     return srcCandidate;
-  const distCandidate = resolve6(here, "skill");
-  if (existsSync16(distCandidate))
+  const distCandidate = resolve7(here, "skill");
+  if (existsSync17(distCandidate))
     return distCandidate;
   throw new Error(`Cannot locate bundled skill content. Looked in:
   ${srcCandidate}
@@ -241330,15 +242130,15 @@ async function installSkill(opts) {
   for (const relativePath of sourceFiles) {
     const sourcePath = join10(source, relativePath);
     const targetPath = join10(target, relativePath);
-    const sourceBytes = templateSourceFile(relativePath, readFileSync16(sourcePath), cliVersion);
+    const sourceBytes = templateSourceFile(relativePath, readFileSync17(sourcePath), cliVersion);
     const sourceHash = sha256(sourceBytes);
-    if (!existsSync16(targetPath)) {
+    if (!existsSync17(targetPath)) {
       mkdirSync6(dirname5(targetPath), { recursive: true });
       writeFileSync8(targetPath, sourceBytes);
       written += 1;
       continue;
     }
-    const targetBytes = readFileSync16(targetPath);
+    const targetBytes = readFileSync17(targetPath);
     const targetHash = sha256(targetBytes);
     if (targetHash === sourceHash) {
       skipped += 1;
@@ -241370,9 +242170,9 @@ async function installSkill(opts) {
   const manifestEntries = [];
   for (const relativePath of sourceFiles) {
     const targetPath = join10(target, relativePath);
-    if (!existsSync16(targetPath))
+    if (!existsSync17(targetPath))
       continue;
-    manifestEntries.push({ path: relativePath, sha256: sha256(readFileSync16(targetPath)) });
+    manifestEntries.push({ path: relativePath, sha256: sha256(readFileSync17(targetPath)) });
   }
   const manifest = {
     cliVersion,
@@ -241403,19 +242203,19 @@ async function uninstallSkill(opts) {
   } else if (!opts.yes) {
     throw new Error(nonInteractiveYesRequired("Uninstall skill from custom --target path"));
   }
-  const targetReal = resolve6(target);
+  const targetReal = resolve7(target);
   const safeBase = targetReal + PATH_SEP;
   let removed = 0;
   let kept = 0;
   for (const entry of manifest.files) {
-    const path = resolve6(targetReal, entry.path);
+    const path = resolve7(targetReal, entry.path);
     if (path !== targetReal && !path.startsWith(safeBase)) {
       console.error(`Refusing to touch ${path}: manifest path escapes ${targetReal}`);
       continue;
     }
-    if (!existsSync16(path))
+    if (!existsSync17(path))
       continue;
-    const currentHash = sha256(readFileSync16(path));
+    const currentHash = sha256(readFileSync17(path));
     if (currentHash !== entry.sha256 && !opts.yes) {
       kept += 1;
       continue;
@@ -241616,10 +242416,10 @@ function hintFor(tool, installed, detected) {
   return tool.relativePath;
 }
 function isInstalled(cwd, tool) {
-  return existsSync16(join10(cwd, tool.relativePath, MANIFEST_NAME));
+  return existsSync17(join10(cwd, tool.relativePath, MANIFEST_NAME));
 }
 function isProjectUsing(cwd, tool) {
-  return tool.detectPaths.some((p) => existsSync16(join10(cwd, p)));
+  return tool.detectPaths.some((p) => existsSync17(join10(cwd, p)));
 }
 function listFiles(root) {
   const out = [];
@@ -241643,10 +242443,10 @@ function listFiles(root) {
 }
 function readManifest(target) {
   const path = join10(target, MANIFEST_NAME);
-  if (!existsSync16(path))
+  if (!existsSync17(path))
     return null;
   try {
-    return JSON.parse(readFileSync16(path, "utf-8"));
+    return JSON.parse(readFileSync17(path, "utf-8"));
   } catch {
     return null;
   }
@@ -241655,13 +242455,13 @@ function readCliVersion() {
   try {
     const here = dirname5(fileURLToPath7(import.meta.url));
     const candidates = [
-      resolve6(here, "..", "..", "..", "package.json"),
-      resolve6(here, "..", "..", "package.json"),
-      resolve6(here, "..", "package.json")
+      resolve7(here, "..", "..", "..", "package.json"),
+      resolve7(here, "..", "..", "package.json"),
+      resolve7(here, "..", "package.json")
     ];
     for (const candidate of candidates) {
-      if (existsSync16(candidate)) {
-        const pkg = JSON.parse(readFileSync16(candidate, "utf-8"));
+      if (existsSync17(candidate)) {
+        const pkg = JSON.parse(readFileSync17(candidate, "utf-8"));
         if (pkg.name && pkg.name !== "@eigenpal/cli")
           continue;
         if (pkg.version)
@@ -241672,7 +242472,7 @@ function readCliVersion() {
   return "unknown";
 }
 function pruneEmptyDirs(root) {
-  if (!existsSync16(root))
+  if (!existsSync17(root))
     return;
   const stack = [];
   const collect = (dir) => {
@@ -242462,13 +243262,13 @@ function looksLikeFreeform(prop) {
   return prop.pattern !== undefined || prop.format !== undefined;
 }
 // src/commands/workflow/index.ts
-import { existsSync as existsSync22, promises as fs20 } from "node:fs";
+import { existsSync as existsSync23, promises as fs20 } from "node:fs";
 import path18 from "node:path";
 
 // src/lib/local-templates.ts
 init_src();
-import { existsSync as existsSync17, promises as fs17, realpathSync as realpathSync3, statSync as statSync5 } from "node:fs";
-import { basename, dirname as dirname6, isAbsolute, relative as relative4, resolve as resolve7, sep } from "node:path";
+import { existsSync as existsSync18, promises as fs17, realpathSync as realpathSync3, statSync as statSync5 } from "node:fs";
+import { basename, dirname as dirname6, isAbsolute, relative as relative4, resolve as resolve8, sep } from "node:path";
 
 // src/lib/office-template.ts
 import { createHash as createHash6 } from "node:crypto";
@@ -242709,8 +243509,8 @@ function walkTemplateSteps(steps, visit) {
   }
 }
 function resolveWorkflowProjectRoot(workflowFile) {
-  const abs = resolve7(workflowFile);
-  if (!existsSync17(abs)) {
+  const abs = resolve8(workflowFile);
+  if (!existsSync18(abs)) {
     throw new Error(`Workflow file not found: ${abs}`);
   }
   return dirname6(realpathSync3(abs));
@@ -242729,11 +243529,11 @@ function resolveWorkflowTemplatePath(workflowFile, templatePath, opts = {}) {
     throw new Error(`Invalid local template path "${templatePath}". Use a relative .docx or .xlsx path such as ./templates/foo.xlsx.`);
   }
   const projectRoot = resolveWorkflowProjectRoot(workflowFile);
-  const candidate = resolve7(projectRoot, templatePath);
+  const candidate = resolve8(projectRoot, templatePath);
   if (!opts.allowExternal) {
     assertInsideProject(projectRoot, templatePath, candidate);
   }
-  if (!existsSync17(candidate)) {
+  if (!existsSync18(candidate)) {
     throw new Error(`Local template not found: ${candidate}`);
   }
   const real = realpathSync3(candidate);
@@ -242915,11 +243715,11 @@ function rewriteLocalTemplateYaml(yamlText, resolved) {
 }
 
 // src/commands/workflow/clear.ts
-import { existsSync as existsSync18, readdirSync as readdirSync6, rmSync as rmSync3, statSync as statSync6 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync6, rmSync as rmSync3, statSync as statSync6 } from "fs";
 import { basename as basename2, join as join11 } from "path";
 var EMPTY_REPORT = { removed: 0, kept: 0, touched: 0 };
 function getDirectoryEntries(path) {
-  if (!existsSync18(path))
+  if (!existsSync19(path))
     return [];
   return readdirSync6(path).filter((entry) => statSync6(join11(path, entry)).isDirectory()).sort();
 }
@@ -242940,7 +243740,7 @@ function removeDirEntriesWithRetention(path, removeAll) {
   return { removed, kept: keepSet.size, touched: entries.length };
 }
 function removeJudgeSummaryFilesWithRetention(exampleDir, removeAll) {
-  if (!existsSync18(exampleDir))
+  if (!existsSync19(exampleDir))
     return EMPTY_REPORT;
   const stampByFile = new Map;
   for (const fileName of readdirSync6(exampleDir).sort()) {
@@ -243012,7 +243812,7 @@ async function clearEvalOutputs(dir, exampleNames = [], options = {}) {
   runSection({
     exampleDirs,
     clean: (exampleDir) => removeDirEntriesWithRetention(join11(exampleDir, "executions"), removeAll),
-    shouldCount: (exampleDir) => existsSync18(join11(exampleDir, "executions")),
+    shouldCount: (exampleDir) => existsSync19(join11(exampleDir, "executions")),
     successLabel: "Execution cleanup complete",
     scannedLabel: "examples scanned:",
     seenLabel: "runs seen:       ",
@@ -243024,7 +243824,7 @@ async function clearEvalOutputs(dir, exampleNames = [], options = {}) {
   runSection({
     exampleDirs,
     clean: (exampleDir) => removeJudgeSummaryFilesWithRetention(exampleDir, removeAll),
-    shouldCount: (exampleDir) => existsSync18(exampleDir),
+    shouldCount: (exampleDir) => existsSync19(exampleDir),
     successLabel: "Judge summary cleanup complete",
     scannedLabel: "examples scanned:     ",
     seenLabel: "summary files seen:   ",
@@ -243137,24 +243937,24 @@ function registerStepExecCommands(workflow) {
 
 // src/commands/workflow/templates.ts
 init_src();
-import { existsSync as existsSync19, promises as fs19 } from "node:fs";
-import { basename as basename3, resolve as resolve8 } from "node:path";
-function buildClient2(opts) {
+import { existsSync as existsSync20, promises as fs19 } from "node:fs";
+import { basename as basename3, resolve as resolve9 } from "node:path";
+function buildClient3(opts) {
   const config = resolveConfig(opts);
   requireApiKey(config);
   return new ApiClient(config);
 }
-function printJson2(value) {
+function printJson3(value) {
   console.log(JSON.stringify(value, null, 2));
 }
 async function readJsonFixtureFile(fixturePath) {
   let raw;
   try {
-    raw = await fs19.readFile(resolve8(fixturePath), "utf8");
+    raw = await fs19.readFile(resolve9(fixturePath), "utf8");
   } catch (err) {
     const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
     if (code === "ENOENT") {
-      throw new Error(`JSON fixture file not found: ${resolve8(fixturePath)}`);
+      throw new Error(`JSON fixture file not found: ${resolve9(fixturePath)}`);
     }
     throw err;
   }
@@ -243201,9 +244001,9 @@ function registerTemplateCommands(parent) {
   const templates = parent.command("templates").description("Manage workspace DOCX/XLSX templates (tmpl_…): upload, list, inspect, download, replace, delete, and smoke-fill.").addHelpText("after", TEMPLATES_EXAMPLES);
   const uploadCmd = templates.command("upload <file>").description("Upload a DOCX or XLSX file as a new tmpl_… resource with an immutable tmpr_… revision.").option("--name <name>", "Display name (defaults to the filename without extension)").option("--description <text>", "Optional description");
   addJsonFlag(withBaseUrl(uploadCmd)).action(action(async (file, opts) => {
-    const filePath = resolve8(file);
+    const filePath = resolve9(file);
     const bytes = await fs19.readFile(filePath);
-    const client = buildClient2(opts);
+    const client = buildClient3(opts);
     const template = await uploadWorkspaceTemplate(client, {
       bytes,
       filename: basename3(filePath),
@@ -243211,7 +244011,7 @@ function registerTemplateCommands(parent) {
       description: opts.description
     });
     if (opts.json) {
-      printJson2(template);
+      printJson3(template);
       return;
     }
     success(`Uploaded ${ui.bold(template.id)} revision ${ui.bold(template.currentRevision?.id ?? "-")} (${template.format})`);
@@ -243219,10 +244019,10 @@ function registerTemplateCommands(parent) {
   }));
   const listCmd = templates.command("list").description("List workspace templates.");
   addJsonFlag(withBaseUrl(withPagination(listCmd))).action(action(async (opts) => {
-    const client = buildClient2(opts);
+    const client = buildClient3(opts);
     const result = await listPublicTemplates(client, { limit: opts.limit, offset: opts.offset });
     if (opts.json) {
-      printJson2(result);
+      printJson3(result);
       return;
     }
     console.log(table(result.items.map((row) => ({
@@ -243247,10 +244047,10 @@ function registerTemplateCommands(parent) {
   }));
   const getCmd = templates.command("get <template-id>").alias("inspect").description("Inspect a tmpl_… resource: current tmpr_…, format, checksum, tokens, grammar.");
   addJsonFlag(withBaseUrl(getCmd)).action(action(async (templateId, opts) => {
-    const client = buildClient2(opts);
+    const client = buildClient3(opts);
     const template = await getPublicTemplate(client, templateId);
     if (opts.json) {
-      printJson2(template);
+      printJson3(template);
       return;
     }
     printTemplateHuman(template);
@@ -243259,21 +244059,21 @@ function registerTemplateCommands(parent) {
   withBaseUrl(downloadCmd).action(action(async (templateId, opts) => {
     if (!opts.out)
       throw new Error("Missing --out <path>.");
-    const client = buildClient2(opts);
+    const client = buildClient3(opts);
     const downloaded = await downloadTemplateBytes(client, templateId, opts.revisionId);
     await fs19.writeFile(opts.out, downloaded.bytes);
     success(`Wrote ${ui.bold(opts.out)} ${ui.dim(`(${downloaded.bytes.byteLength} bytes)`)}`);
   }));
   const replaceCmd = templates.command("replace <template-id> <file>").description("Append an immutable revision and advance the tmpl_… pointer.");
   addJsonFlag(withBaseUrl(replaceCmd)).action(action(async (templateId, file, opts) => {
-    const filePath = resolve8(file);
+    const filePath = resolve9(file);
     const bytes = await fs19.readFile(filePath);
-    const client = buildClient2(opts);
+    const client = buildClient3(opts);
     const current = await getPublicTemplate(client, templateId);
     const nextInspection = inspectOfficeTemplateBytes(bytes, basename3(filePath));
     if (current.currentRevision?.sha256 === nextInspection.sha256 || current.sha256 === nextInspection.sha256) {
       if (opts.json) {
-        printJson2({ ...current, reused: true });
+        printJson3({ ...current, reused: true });
         return;
       }
       success(`Checksum matches current revision ${ui.bold(current.currentRevision?.id ?? "-")} — skipped upload`);
@@ -243285,7 +244085,7 @@ function registerTemplateCommands(parent) {
       filename: basename3(filePath)
     });
     if (opts.json) {
-      printJson2(template);
+      printJson3(template);
       return;
     }
     success(`Replaced ${ui.bold(template.id)} → revision ${ui.bold(template.currentRevision?.id ?? "-")}`);
@@ -243296,10 +244096,10 @@ function registerTemplateCommands(parent) {
     if (!opts.yes && !process.stdout.isTTY) {
       throw new Error("templates delete is destructive and requires --yes when run non-interactively");
     }
-    const client = buildClient2(opts);
+    const client = buildClient3(opts);
     const result = await deleteWorkspaceTemplate(client, templateId);
     if (opts.json) {
-      printJson2(result);
+      printJson3(result);
       return;
     }
     success(`Deleted ${ui.bold(templateId)}`);
@@ -243312,13 +244112,13 @@ function registerTemplateCommands(parent) {
     let filename;
     const isTmpl = TemplateIdSchema.safeParse(templateArg).success;
     if (isTmpl) {
-      const client = buildClient2(opts);
+      const client = buildClient3(opts);
       const downloaded = await downloadTemplateBytes(client, templateArg, opts.revisionId);
       bytes = downloaded.bytes;
       filename = downloaded.filename;
     } else {
-      const filePath = resolve8(templateArg);
-      if (!existsSync19(filePath)) {
+      const filePath = resolve9(templateArg);
+      if (!existsSync20(filePath)) {
         throw new Error(`Template file not found: ${filePath}. Pass a local .docx/.xlsx path or a tmpl_… id.`);
       }
       bytes = await fs19.readFile(filePath);
@@ -243340,7 +244140,7 @@ function registerTemplateCommands(parent) {
       bytes: rendered.output.byteLength
     };
     if (opts.json) {
-      printJson2(payload);
+      printJson3(payload);
       return;
     }
     success(`Wrote ${ui.bold(opts.out)} (${rendered.inspection.format}, ${rendered.output.byteLength} bytes)`);
@@ -243360,12 +244160,12 @@ function registerTemplateCommands(parent) {
 
 // src/commands/workflow/validation.ts
 init_src();
-import { existsSync as existsSync21, readdirSync as readdirSync7, readFileSync as readFileSync18, statSync as statSync7 } from "fs";
-import { join as join12, resolve as resolve9 } from "path";
+import { existsSync as existsSync22, readdirSync as readdirSync7, readFileSync as readFileSync19, statSync as statSync7 } from "fs";
+import { join as join12, resolve as resolve10 } from "path";
 
 // src/lib/template-diagnostics.ts
 init_src();
-import { existsSync as existsSync20, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync18 } from "node:fs";
 function walkSteps(steps, pathPrefix, visit) {
   if (!Array.isArray(steps))
     return;
@@ -243490,7 +244290,7 @@ async function diagnoseTemplateSteps(args) {
         });
         continue;
       }
-      if (!existsSync20(absolute)) {
+      if (!existsSync21(absolute)) {
         diagnostics.push({
           field: `${info.fieldPath}.template`,
           message: `File not found: ${absolute}`,
@@ -243499,7 +244299,7 @@ async function diagnoseTemplateSteps(args) {
         continue;
       }
       try {
-        const bytes = readFileSync17(absolute);
+        const bytes = readFileSync18(absolute);
         const inspection = inspectOfficeTemplateBytes(bytes, absolute);
         diagnostics.push(...formatDiagnostics(info, inspection));
       } catch (err) {
@@ -243635,7 +244435,7 @@ function countInvokeWorkflowSteps(steps) {
   return count;
 }
 function validateWorkflowYaml(path) {
-  if (!existsSync21(path)) {
+  if (!existsSync22(path)) {
     return {
       issues: [{ field: path, message: "File not found." }],
       warnings: [],
@@ -243644,7 +244444,7 @@ function validateWorkflowYaml(path) {
       steps: []
     };
   }
-  const text = readFileSync18(path, "utf-8");
+  const text = readFileSync19(path, "utf-8");
   try {
     const definition = parseWorkflow(text);
     let warnings = [];
@@ -243745,10 +244545,10 @@ function printSchemaQualityWarnings(path, warnings) {
   }
 }
 function validateEvaluatorsYaml(path) {
-  if (!existsSync21(path)) {
+  if (!existsSync22(path)) {
     return [{ field: path, message: "File not found." }];
   }
-  const text = readFileSync18(path, "utf-8");
+  const text = readFileSync19(path, "utf-8");
   let parsed;
   try {
     parsed = $parse(text);
@@ -243765,17 +244565,17 @@ function validateEvaluatorsYaml(path) {
 }
 function validateDatasetFolder(root) {
   const issues = [];
-  if (!existsSync21(root)) {
+  if (!existsSync22(root)) {
     return [{ field: root, message: "Folder not found." }];
   }
-  if (existsSync21(join12(root, "manifest.json"))) {
+  if (existsSync22(join12(root, "manifest.json"))) {
     issues.push({
       field: "manifest.json",
       message: "Top-level manifest.json is the legacy format. Re-export the dataset using the folder convention."
     });
   }
   const examplesDir = join12(root, "examples");
-  if (!existsSync21(examplesDir)) {
+  if (!existsSync22(examplesDir)) {
     issues.push({ field: "examples/", message: "No examples/ directory found at dataset root." });
     return issues;
   }
@@ -243791,7 +244591,7 @@ function validateDatasetFolder(root) {
       continue;
     }
     const inputJsonPath = join12(exampleFolder, "input.json");
-    const hasInputJson = existsSync21(inputJsonPath);
+    const hasInputJson = existsSync22(inputJsonPath);
     if (!hasInputJson) {
       issues.push({
         field: `examples/${exampleName}/input.json`,
@@ -243801,7 +244601,7 @@ function validateDatasetFolder(root) {
     }
     let args;
     try {
-      const parsed = JSON.parse(readFileSync18(inputJsonPath, "utf-8"));
+      const parsed = JSON.parse(readFileSync19(inputJsonPath, "utf-8"));
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         issues.push({
           field: `examples/${exampleName}/input.json`,
@@ -243818,7 +244618,7 @@ function validateDatasetFolder(root) {
       continue;
     }
     const inputDir = join12(exampleFolder, "input");
-    if (existsSync21(join12(inputDir, "arguments.json"))) {
+    if (existsSync22(join12(inputDir, "arguments.json"))) {
       issues.push({
         field: `examples/${exampleName}/input/arguments.json`,
         message: "Legacy input/arguments.json is no longer accepted. Use input.json instead."
@@ -243835,7 +244635,7 @@ function validateDatasetFolder(root) {
     }
     const expectedDir = join12(exampleFolder, "expected");
     const expectedJsonPath = join12(exampleFolder, "expected.json");
-    if (existsSync21(expectedDir)) {
+    if (existsSync22(expectedDir)) {
       for (const entry of readdirSync7(expectedDir)) {
         if (entry === "output.json" || entry === "error.json") {
           issues.push({
@@ -243871,10 +244671,10 @@ function validateDatasetFolder(root) {
         }
       }
     }
-    if (existsSync21(expectedJsonPath)) {
+    if (existsSync22(expectedJsonPath)) {
       let parsed;
       try {
-        parsed = JSON.parse(readFileSync18(expectedJsonPath, "utf-8"));
+        parsed = JSON.parse(readFileSync19(expectedJsonPath, "utf-8"));
       } catch {
         issues.push({
           field: `examples/${exampleName}/expected.json`,
@@ -243953,7 +244753,7 @@ function validateFileRefs2(args) {
       });
       continue;
     }
-    if (!existsSync21(join12(args.filesRoot, relative))) {
+    if (!existsSync22(join12(args.filesRoot, relative))) {
       issues.push({
         field: `${args.fieldPrefix}:${ref.jsonPath}`,
         message: `Referenced file does not exist: ${ref.path}.`
@@ -243974,7 +244774,7 @@ function parseDatasetFileRef(path, root) {
   return parts.join("/");
 }
 function rootDir(opts) {
-  return resolve9(opts.dir ?? process.cwd());
+  return resolve10(opts.dir ?? process.cwd());
 }
 async function onlineInvokeIssues(yamlText, opts) {
   const config = resolveConfig(opts);
@@ -243984,8 +244784,8 @@ async function onlineInvokeIssues(yamlText, opts) {
   return res.issues ?? [];
 }
 function discoverWorkflowProjectRoots(rootPath) {
-  const root = resolve9(rootPath);
-  if (existsSync21(join12(root, "workflow.yaml")))
+  const root = resolve10(rootPath);
+  if (existsSync22(join12(root, "workflow.yaml")))
     return [root];
   const candidates = [
     join12(root, "eigenpal", "workflows"),
@@ -243993,9 +244793,9 @@ function discoverWorkflowProjectRoots(rootPath) {
     root.endsWith(join12("eigenpal", "workflows")) ? root : ""
   ].filter(Boolean);
   for (const parent of candidates) {
-    if (!existsSync21(parent) || !statSync7(parent).isDirectory())
+    if (!existsSync22(parent) || !statSync7(parent).isDirectory())
       continue;
-    const projects = readdirSync7(parent, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && existsSync21(join12(parent, entry.name, "workflow.yaml"))).map((entry) => join12(parent, entry.name)).sort();
+    const projects = readdirSync7(parent, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink() && existsSync22(join12(parent, entry.name, "workflow.yaml"))).map((entry) => join12(parent, entry.name)).sort();
     if (projects.length > 0)
       return projects;
   }
@@ -244012,10 +244812,10 @@ async function validateProjectRoot(root, opts) {
   }
   const evOk = printIssues("evaluators.yaml", relPath(root, join12(root, "evaluators.yaml")), validateEvaluatorsYaml(join12(root, "evaluators.yaml")));
   const dsOk = printIssues("dataset/", relPath(root, join12(root, "dataset")), validateDatasetFolder(join12(root, "dataset")));
-  const templateOk = wfOk && existsSync21(wfFile) ? await runTemplateDiagnostics(wfFile, wfResult.steps, opts) : true;
+  const templateOk = wfOk && existsSync22(wfFile) ? await runTemplateDiagnostics(wfFile, wfResult.steps, opts) : true;
   let onlineOk = true;
-  if (wfOk && opts.online && existsSync21(wfFile)) {
-    onlineOk = printIssues("invoke refs (server)", wfPath, await onlineInvokeIssues(readFileSync18(wfFile, "utf-8"), opts));
+  if (wfOk && opts.online && existsSync22(wfFile)) {
+    onlineOk = printIssues("invoke refs (server)", wfPath, await onlineInvokeIssues(readFileSync19(wfFile, "utf-8"), opts));
   }
   return wfOk && evOk && dsOk && templateOk && onlineOk;
 }
@@ -244031,8 +244831,8 @@ Note
 ` + `  project unless you pass --allow-external-templates.
 `);
   withBaseUrl(cmd).action(action(async (path, opts) => {
-    if (path && (!existsSync21(resolve9(path)) || !statSync7(resolve9(path)).isDirectory())) {
-      const target = resolve9(path);
+    if (path && (!existsSync22(resolve10(path)) || !statSync7(resolve10(path)).isDirectory())) {
+      const target = resolve10(path);
       const wfResult = validateWorkflowYaml(target);
       const wfOk = printIssues("workflow.yaml", target, wfResult.issues);
       if (wfOk) {
@@ -244042,13 +244842,13 @@ Note
       const templateOk = wfOk ? await runTemplateDiagnostics(target, wfResult.steps, opts) : true;
       let onlineOk = true;
       if (wfOk && opts.online) {
-        onlineOk = printIssues("invoke refs (server)", target, await onlineInvokeIssues(readFileSync18(target, "utf-8"), opts));
+        onlineOk = printIssues("invoke refs (server)", target, await onlineInvokeIssues(readFileSync19(target, "utf-8"), opts));
       }
       if (!wfOk || !templateOk || !onlineOk)
         process.exit(1);
       return;
     }
-    const requestedRoot = path ? resolve9(path) : rootDir(opts);
+    const requestedRoot = path ? resolve10(path) : rootDir(opts);
     const projects = discoverWorkflowProjectRoots(requestedRoot);
     if (projects.length === 0) {
       if (!await validateProjectRoot(requestedRoot, opts))
@@ -244070,14 +244870,14 @@ Note
 }
 function registerEvaluatorsValidateCommand(parent) {
   parent.command("validate [path]").description("Validate an evaluators YAML file against the EvalConfig schema. Defaults to ./evaluators.yaml.").action((path) => {
-    const target = resolve9(path ?? "evaluators.yaml");
+    const target = resolve10(path ?? "evaluators.yaml");
     if (!printIssues("evaluators", target, validateEvaluatorsYaml(target)))
       process.exit(1);
   });
 }
 function registerDatasetValidateCommand(parent) {
   parent.command("validate [path]").description("Validate a dataset folder against the examples/<name>/{input,expected,meta} convention. Defaults to ./dataset/.").action((path) => {
-    const target = resolve9(path ?? "dataset");
+    const target = resolve10(path ?? "dataset");
     if (!printIssues("dataset", target, validateDatasetFolder(target)))
       process.exit(1);
   });
@@ -244091,20 +244891,20 @@ function relPath(root, target) {
 }
 
 // src/commands/workflow/index.ts
-function buildClient3(opts) {
+function buildClient4(opts) {
   const config = resolveConfig(opts);
   requireApiKey(config);
   return new ApiClient(config);
 }
 async function buildClientForWorkflow(workflowIdOrSlug, opts) {
-  const client = buildClient3(opts);
+  const client = buildClient4(opts);
   const workflowId = await resolveWorkflowId(client, workflowIdOrSlug);
   return { client, workflowId };
 }
 function descriptionFor(tool) {
   return WORKFLOW_TOOL_METADATA[tool].description;
 }
-function printJson3(value) {
+function printJson4(value) {
   console.log(JSON.stringify(value, null, 2));
 }
 function extractWorkflowVersion(yaml) {
@@ -244205,7 +245005,7 @@ YAML's \`name:\` field). Both:
 function registerWorkflowCoreCommands(parent) {
   const listCmd = parent.command("list").description(descriptionFor("workflow_list")).option("--search <q>", "Filter by name");
   addJsonFlag(withBaseUrl(withPagination(listCmd))).action(action(async (opts) => {
-    const client = buildClient3(opts);
+    const client = buildClient4(opts);
     const params = {
       limit: String(opts.limit),
       offset: String(opts.offset)
@@ -244293,7 +245093,7 @@ new uploads are deleted. The file on disk is not rewritten.
           defaultValue: "workflow.yaml",
           validate: (value) => {
             const p = value || "workflow.yaml";
-            if (!existsSync22(p))
+            if (!existsSync23(p))
               return `Not found: ${p}`;
             return;
           }
@@ -244308,7 +245108,7 @@ new uploads are deleted. The file on disk is not rewritten.
       }
     }
     const yamlOnDisk = await fs20.readFile(filePath, "utf8");
-    const client = buildClient3(opts);
+    const client = buildClient4(opts);
     const definition = parseWorkflowOrThrow(yamlOnDisk);
     const loadedTemplates = await loadLocalTemplatesForPush(filePath, definition.steps, {
       allowExternal: Boolean(opts.allowExternalTemplates)
@@ -244366,7 +245166,7 @@ new uploads are deleted. The file on disk is not rewritten.
         });
         await finalizeCreatedWorkspaceTemplates(client, created);
         if (opts.json) {
-          printJson3(withLocalTemplates(result, resolvedTemplates));
+          printJson4(withLocalTemplates(result, resolvedTemplates));
           return;
         }
         success(`Pushed ${ui.bold(workflowId)} (v${result.version ?? nextVersion})`);
@@ -244380,7 +245180,7 @@ new uploads are deleted. The file on disk is not rewritten.
         });
         await finalizeCreatedWorkspaceTemplates(client, created);
         if (opts.json) {
-          printJson3(withLocalTemplates(result, resolvedTemplates));
+          printJson4(withLocalTemplates(result, resolvedTemplates));
           return;
         }
         const id = result.workflow?.id ?? result.id ?? "?";
@@ -244399,7 +245199,7 @@ new uploads are deleted. The file on disk is not rewritten.
       folderPath: opts.folder
     });
     if (opts.json) {
-      printJson3(result);
+      printJson4(result);
       return;
     }
     const target = opts.folder.trim() === "/" ? "root" : opts.folder;
@@ -244572,7 +245372,7 @@ function registerEvaluatorsCommands(parent) {
       yaml
     });
     if (opts.json) {
-      printJson3(result);
+      printJson4(result);
       return;
     }
     let count = null;
@@ -244680,7 +245480,7 @@ skip in CI). Folder layout reference: \`packages/cli/src/skill/reference/dataset
       }));
       if (issues.length === 0) {
         error2("Import aborted with no structured issues — server-side bug.");
-        printJson3(terminal);
+        printJson4(terminal);
       } else {
         printIssues("dataset", opts.file, issues);
         if (errPayload.limitMb != null && errPayload.actualMb != null) {
@@ -244701,7 +245501,7 @@ skip in CI). Folder layout reference: \`packages/cli/src/skill/reference/dataset
     if (terminal.phase === "done") {
       const done = terminal;
       if (opts.json) {
-        printJson3(done);
+        printJson4(done);
         return;
       }
       const created = done.created ?? 0;
@@ -244719,7 +245519,7 @@ skip in CI). Folder layout reference: \`packages/cli/src/skill/reference/dataset
       }
     } else {
       error2(`Import response had unexpected terminal phase: ${terminal.phase}`);
-      printJson3(terminal);
+      printJson4(terminal);
       process.exit(1);
     }
   }));
@@ -244779,7 +245579,7 @@ exclusive. To attach files without a dataset folder, pass ingress refs in JSON:
     const { client, workflowId } = await buildClientForWorkflow(workflow, opts);
     const result = await client.post(`/v1/automations/${workflowId}/examples`, body);
     if (opts.json) {
-      printJson3(result);
+      printJson4(result);
       return;
     }
     success(`Created example ${ui.bold(opts.name)} (${result.id}) in ${ui.bold(workflowId)}`);
@@ -244805,7 +245605,7 @@ exclusive. To attach files without a dataset folder, pass ingress refs in JSON:
     const { client, workflowId } = await buildClientForWorkflow(workflow, opts);
     const result = await client.patch(`/v1/automations/${workflowId}/examples/${encodeURIComponent(exampleId)}`, body);
     if (opts.json) {
-      printJson3(result);
+      printJson4(result);
       return;
     }
     const fields = Object.keys(body).join(", ");
@@ -244819,7 +245619,7 @@ exclusive. To attach files without a dataset folder, pass ingress refs in JSON:
     const { client, workflowId } = await buildClientForWorkflow(workflow, opts);
     const deleted = await client.delete(`/v1/automations/${workflowId}/examples/${encodeURIComponent(exampleId)}`);
     if (opts.json) {
-      printJson3(deleted);
+      printJson4(deleted);
       return;
     }
     success(`Deleted example ${ui.bold(deleted.name ?? exampleId)} ${ui.dim(`(${exampleId})`)} from ${ui.bold(workflowId)}`);
@@ -244829,7 +245629,7 @@ exclusive. To attach files without a dataset folder, pass ingress refs in JSON:
     const { client, workflowId } = await buildClientForWorkflow(workflow, opts);
     const row = await client.get(`/v1/automations/${workflowId}/examples/${encodeURIComponent(exampleId)}`);
     if (opts.json) {
-      printJson3(row);
+      printJson4(row);
       return;
     }
     renderExampleHuman(row);
@@ -244956,7 +245756,7 @@ returns immediately with \`{ batchId, total }\`; poll
     const total = start.runCount ?? start.total ?? 0;
     if (!opts.wait) {
       if (opts.json) {
-        printJson3({ ...start, batchId: experimentId, total });
+        printJson4({ ...start, batchId: experimentId, total });
         return;
       }
       success(`Started experiment ${ui.bold(experimentId)} ${ui.dim(`(${total} run${total === 1 ? "" : "s"} queued)`)}`);
@@ -244970,7 +245770,7 @@ returns immediately with \`{ batchId, total }\`; poll
       const status = await client.get(`/v1/automations/${workflowId}/experiments/${experimentId}`);
       if (status.status === "completed") {
         if (opts.json) {
-          printJson3({
+          printJson4({
             ...status,
             batchId: experimentId,
             total: status.runCount ?? status.total
@@ -244990,7 +245790,7 @@ returns immediately with \`{ batchId, total }\`; poll
       }
       if (Date.now() >= deadline) {
         if (opts.json) {
-          printJson3({
+          printJson4({
             ...status,
             batchId: experimentId,
             total: status.runCount ?? status.total
@@ -245030,12 +245830,12 @@ returns immediately with \`{ batchId, total }\`; poll
       const summary = summarizeExperimentExecutions(execs);
       if (execs.length === 0) {
         if (opts.json)
-          printJson3({ ...result, summary: rollupForJson(summary) });
+          printJson4({ ...result, summary: rollupForJson(summary) });
         error2(`Experiment ${batchId} still has no executions after retrying — check the batch id.`);
         process.exit(1);
       }
       if (opts.json) {
-        printJson3({ ...result, summary: rollupForJson(summary) });
+        printJson4({ ...result, summary: rollupForJson(summary) });
         return;
       }
       if (opts.short) {
@@ -245067,7 +245867,7 @@ returns immediately with \`{ batchId, total }\`; poll
       maxWait: opts.maxWait,
       onTerminal: (result, summary) => {
         if (wantPayload) {
-          printJson3({ ...result, summary: rollupForJson(summary) });
+          printJson4({ ...result, summary: rollupForJson(summary) });
         } else {
           process.stderr.write(`${ui.dim(`use --include payload (or --json) for the full per-execution snapshot`)}
 `);
@@ -245075,7 +245875,7 @@ returns immediately with \`{ batchId, total }\`; poll
       },
       onDeadline: (result, summary) => {
         if (wantPayload)
-          printJson3({ ...result, summary: rollupForJson(summary) });
+          printJson4({ ...result, summary: rollupForJson(summary) });
       }
     });
   }));
@@ -245099,7 +245899,7 @@ Behavior:
     const { client, workflowId } = await buildClientForWorkflow(workflow, opts);
     const result = await client.post(`/v1/automations/${workflowId}/experiments/${batchId}/cancel`);
     if (opts.json) {
-      printJson3(result);
+      printJson4(result);
       return;
     }
     const c = result.counts;
@@ -245173,7 +245973,7 @@ batches must belong to the same workflow within the caller's tenant.
     if (!Number.isFinite(threshold) || threshold < 0) {
       throw new Error("--regression-threshold must be a non-negative number");
     }
-    const client = buildClient3(opts);
+    const client = buildClient4(opts);
     if (opts.outputs) {
       const [outputsA, outputsB] = await Promise.all([
         fetchExperimentOutputs(client, batchIdA),
@@ -245189,7 +245989,7 @@ batches must belong to the same workflow within the caller's tenant.
         rowsB: outputsB.rows
       });
       if (opts.json)
-        printJson3(outputDiff);
+        printJson4(outputDiff);
       else
         renderExperimentOutputDiffHuman(outputDiff);
       return;
@@ -245207,7 +246007,7 @@ batches must belong to the same workflow within the caller's tenant.
       regressionThreshold: threshold
     });
     if (opts.json) {
-      printJson3(diff);
+      printJson4(diff);
       return;
     }
     renderBatchDiffHuman(diff);
@@ -245245,7 +246045,7 @@ Behavior:
     const dest = opts.pull ? opts.pullOnComplete ?? `./results-${batchId}.${opts.format}` : null;
     if (dest) {
       const dir = path18.dirname(dest);
-      if (!existsSync22(dir)) {
+      if (!existsSync23(dir)) {
         error2(`Destination directory does not exist: ${dir}. Create it first or pass a path under an existing directory.`);
         process.exit(2);
       }
@@ -245492,7 +246292,7 @@ sent to the server is replaced with \`templateId\` + \`templateRevisionId\`.
     const result = await client.post(automationVersionsPath(workflowId), body).catch((err) => rethrowAfterTemplateCleanup(client, created, err));
     await finalizeCreatedWorkspaceTemplates(client, created);
     if (opts.json) {
-      printJson3(withLocalTemplates(result, resolvedTemplates));
+      printJson4(withLocalTemplates(result, resolvedTemplates));
       return;
     }
     const id = typeof result.id === "string" ? result.id : "?";
@@ -245515,7 +246315,7 @@ restore HEAD) return 404 — create a tagged copy first.
     const { client, workflowId } = await buildClientForWorkflow(workflow, opts);
     const result = await client.post(automationVersionsPath(workflowId, `/${encodeURIComponent(versionId)}/promote`));
     if (opts.json) {
-      printJson3(result);
+      printJson4(result);
       return;
     }
     const label = formatWorkflowVersionLabel(result.version);
@@ -245538,7 +246338,7 @@ promoted until you create a tagged copy.
     const body = opts.message ? { message: opts.message } : {};
     const result = await client.post(automationVersionsPath(workflowId, `/${encodeURIComponent(versionId)}/restore`), body);
     if (opts.json) {
-      printJson3(result);
+      printJson4(result);
       return;
     }
     const id = typeof result.id === "string" ? result.id : "?";
@@ -245787,7 +246587,7 @@ var HELP_GROUPS = [
   {
     title: "Authenticate",
     description: "Profiles in ~/.config/eigenpal/credentials.json",
-    commands: ["auth", "status", "models"]
+    commands: ["auth", "status", "models", "email-servers"]
   },
   {
     title: "Workflows",
@@ -246015,6 +246815,7 @@ authCmd.command("use [profile]").description("Switch the active profile (persist
 registerWorkflowCommands(program2);
 registerAgentCommands(program2);
 registerModelsCommands(program2);
+registerEmailServersCommands(program2);
 registerRunCommands(program2);
 registerRunsCommands(program2);
 registerGitCommands(program2);