@eigenpal/cli 0.5.8 → 0.5.10

package/CHANGELOG.md

@@ -1,6 +1,12 @@
 # @eigenpal/cli
 
-## 1.0.0
+## 0.5.10
+
+### Patch Changes
+
+- aee7e0c: Add hidden Git source commands for editing trigger policy and encrypted secrets.
+
+## 0.5.9
 
 ### Major Changes
 
@@ -333,6 +339,10 @@ actual) { ... }` declaration around your statements. Parameter order is
 
   Also scrubs internal references from CLI source ahead of open-sourcing — generic placeholder names in docstrings and test fixtures, internal-tracker IDs stripped from comments, and one user-facing error message updated to point at the public issue tracker.
 
+- 75caaec: `eigenpal workflow push` and `eigenpal workflow validate` now surface non-fatal **schema-quality warnings** when an output schema is loose enough to hurt downstream typing: categorical fields like `category`/`status`/`kind` declared as plain strings (no `enum`), `transform.script` functions returning `any`/`unknown`, untyped objects (`type: object` with no `properties`), and untyped arrays (`type: array` with no `items`). Warnings print to stderr and never block the push.
+
+  Updated the bundled CLI skill (`workflow-yaml.md`) with a "Be specific with types" section teaching `enum` fields, per-value meanings inline in `description`, and how `transform.script` TS literal unions auto-produce JSON Schema enums.
+
 - be693a3: `EIGENPAL_API_KEY` is now a complete profile bypass — when set, the active profile's `baseUrl` is also ignored (previously the env key was paired with the profile's URL, which is always wrong because an API key is provisioned for one server).
 
   In CI:

package/dist/cli.js

@@ -28107,7 +28107,8 @@ var init_parser = __esm(() => {
     maxConcurrency: exports_external.number().min(1).max(30).default(3),
     pagesPerBatch: exports_external.number().min(1).max(20).default(5),
     prompt: exports_external.string().optional().describe("Custom prompt for LLM-based parsing"),
-    languages: exports_external.array(exports_external.string()).optional().describe("OCR language hints")
+    languages: exports_external.array(exports_external.string()).optional().describe("OCR language hints"),
+    tenantId: exports_external.string().optional()
   });
   ParserInputSchema = exports_external.object({
     data: exports_external.instanceof(Buffer).or(exports_external.instanceof(Uint8Array)),
@@ -65788,8 +65789,16 @@ function convertTsTypeToJsonSchema(node, ctx) {
     case "TSVoidKeyword":
       return {};
     case "TSAnyKeyword":
-    case "TSUnknownKeyword":
+    case "TSUnknownKeyword": {
+      const keyword = node.type === "TSAnyKeyword" ? "any" : "unknown";
+      ctx.warnings.push({
+        code: "weak-return-type",
+        message: `\`${keyword}\` produces an empty schema, so downstream steps can't autocomplete this field or its descendants. Describe the actual shape (\`{ name: string; total: number }\`) or a literal union (\`"low" | "medium" | "high"\`) for the strongest downstream typing.`,
+        start: node.start ?? undefined,
+        end: node.end ?? undefined
+      });
       return {};
+    }
     case "TSNeverKeyword":
       return { not: {} };
     case "TSArrayType":
@@ -66138,13 +66147,15 @@ function compileTypedScript(opts) {
     });
   }
   const convertIssues = [];
+  const convertWarnings = [];
   const inScopeSchemas = new Map(Object.entries(opts.inScopeSchemas ?? {}));
   const localAliases = collectLocalAliases(aliasDecls);
   const returnSchema = opts.kind === "evaluator" ? { type: "number" } : convertTsTypeToJsonSchema(returnTsType, {
     localAliases,
     inScopeSchemas,
     resolving: new Set,
-    issues: convertIssues
+    issues: convertIssues,
+    warnings: convertWarnings
   });
   if (convertIssues.length > 0) {
     return {
@@ -66157,10 +66168,7 @@ function compileTypedScript(opts) {
   }
   let stripped;
   try {
-    const out = import_sucrase.transform(opts.source, {
-      transforms: ["typescript"]
-    });
-    stripped = out.code;
+    stripped = import_sucrase.transform(opts.source, { transforms: ["typescript"] }).code;
   } catch (err) {
     const e2 = err;
     return failWith({
@@ -66174,7 +66182,8 @@ function compileTypedScript(opts) {
       js: stripped,
       returnSchema,
       paramNames: actualParamNames
-    }
+    },
+    warnings: convertWarnings
   };
 }
 function failWith(issue2) {
@@ -68012,7 +68021,63 @@ var init_eval = __esm(() => {
   init_workflow_tool_metadata();
 });
 
+// ../types/src/git-source/cutover.ts
+function resolveAgentSourceCutover(settings) {
+  const parsed = AgentSourceCutoverSettingsSchema.safeParse(settings ?? {});
+  if (!parsed.success)
+    return { mode: "legacy", reason: "invalid_settings" };
+  const agents = parsed.data.gitBackedSource?.agents;
+  if (!agents)
+    return { mode: "legacy", reason: "settings_missing" };
+  if (agents.migrationState === "rolled_back")
+    return { mode: "legacy", reason: "rolled_back" };
+  if (agents.runtime !== "git")
+    return { mode: "legacy", reason: "runtime_legacy" };
+  if (agents.migrationState !== "cutover") {
+    return { mode: "legacy", reason: "migration_not_cutover" };
+  }
+  return { mode: "git", reason: "cutover_enabled" };
+}
+function isGitBackedAgentSourceEnabled(settings) {
+  return resolveAgentSourceCutover(settings).mode === "git";
+}
+var AgentSourceRuntimeModeSchema, AgentSourceMigrationStateSchema, AgentSourceCutoverSettingsSchema;
+var init_cutover = __esm(() => {
+  init_zod();
+  AgentSourceRuntimeModeSchema = exports_external.enum(["legacy", "git"]);
+  AgentSourceMigrationStateSchema = exports_external.enum([
+    "disabled",
+    "shadow",
+    "validated",
+    "cutover",
+    "rolled_back"
+  ]);
+  AgentSourceCutoverSettingsSchema = exports_external.object({
+    gitBackedSource: exports_external.object({
+      agents: exports_external.object({
+        runtime: AgentSourceRuntimeModeSchema.optional(),
+        migrationState: AgentSourceMigrationStateSchema.optional(),
+        legacySourceRetained: exports_external.boolean().optional(),
+        rollbackReason: exports_external.string().optional()
+      }).passthrough().optional()
+    }).passthrough().optional()
+  }).passthrough();
+});
+
 // ../types/src/git-source/grammar.ts
+function parseAutomationTarget(target) {
+  const parsed = AutomationTargetSchema.parse(target);
+  const [rawPackageName, rawRef] = parsed.split("@");
+  const packagePath = dottedPackageNameToPath(rawPackageName);
+  const [type, ...slugParts] = packagePath.split("/");
+  return {
+    packageName: DottedPackageNameSchema.parse(rawPackageName),
+    packagePath,
+    type,
+    slug: slugParts.join("/"),
+    ref: SourceVersionRefSchema.parse(rawRef ?? "latest")
+  };
+}
 function pathToDottedPackageName(path2) {
   const parsed = SourcePackagePathSchema.parse(path2);
   return DottedPackageNameSchema.parse(parsed.split("/").join("."));
@@ -68344,7 +68409,16 @@ var init_manifests = __esm(() => {
     api: exports_external.boolean().optional(),
     email: exports_external.object({
       enabled: exports_external.boolean().default(true),
-      aliases: exports_external.array(exports_external.string().email()).default([])
+      aliases: exports_external.array(exports_external.union([
+        exports_external.string().includes("@"),
+        exports_external.object({
+          address: exports_external.string().includes("@"),
+          allowlist: exports_external.array(exports_external.string()).default([]),
+          replyConfig: exports_external.record(exports_external.string(), exports_external.unknown()).default({}),
+          requireSenderAuth: exports_external.boolean().default(true),
+          enabled: exports_external.boolean().optional()
+        }).strict()
+      ])).default([])
     }).strict().optional()
   }).strict();
   CommonPackageManifestFields = {
@@ -68413,10 +68487,63 @@ var init_manifests = __esm(() => {
   SOURCE_TEMPLATE_FILE_PATTERN = /\.(?:docx|xlsx)$/i;
 });
 
+// ../types/src/git-source/secrets.ts
+var SOURCE_SECRETS_FILENAME = "secrets.enc.yaml", SecretNameSchema, Base64LikeSchema, EncryptedSecretValueSchema, SourceSecretEntrySchema, SourceSecretsFileSchema;
+var init_secrets = __esm(() => {
+  init_zod();
+  init_manifests();
+  SecretNameSchema = exports_external.string().regex(/^[A-Z][A-Z0-9_]*$/, "Secret names must be uppercase env-style identifiers");
+  Base64LikeSchema = exports_external.string().min(1).regex(/^[A-Za-z0-9+/=_-]+$/, {
+    message: "Encrypted secret fields must be encoded strings"
+  });
+  EncryptedSecretValueSchema = exports_external.object({
+    algorithm: exports_external.literal("aes-256-gcm"),
+    keyId: exports_external.string().min(1),
+    nonce: Base64LikeSchema,
+    ciphertext: Base64LikeSchema,
+    tag: Base64LikeSchema
+  }).strict();
+  SourceSecretEntrySchema = exports_external.object({
+    description: exports_external.string().optional(),
+    encrypted: EncryptedSecretValueSchema.optional()
+  }).passthrough().superRefine((entry, ctx) => {
+    const raw = entry;
+    if ("value" in raw || "plaintext" in raw || "secret" in raw) {
+      ctx.addIssue({
+        code: "custom",
+        message: "secrets.enc.yaml must not contain plaintext secret values"
+      });
+    }
+    if (!raw.encrypted) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["encrypted"],
+        message: "Encrypted secret values are required"
+      });
+    }
+    const extraKeys = Object.keys(raw).filter((key) => key !== "description" && key !== "encrypted");
+    for (const key of extraKeys) {
+      if (key === "value" || key === "plaintext" || key === "secret")
+        continue;
+      ctx.addIssue({
+        code: "custom",
+        path: [key],
+        message: `Unknown secret metadata field: ${key}`
+      });
+    }
+  });
+  SourceSecretsFileSchema = exports_external.object({
+    schemaVersion: SourceManifestSchemaVersionSchema,
+    secrets: exports_external.record(SecretNameSchema, SourceSecretEntrySchema)
+  }).strict();
+});
+
 // ../types/src/git-source/index.ts
 var init_git_source = __esm(() => {
+  init_cutover();
   init_grammar();
   init_manifests();
+  init_secrets();
 });
 
 // ../types/src/storage/paths.ts
@@ -68720,11 +68847,13 @@ __export(exports_src, {
   runInputKey: () => runInputKey,
   rootS3Path: () => rootS3Path,
   resolveEffectiveMimeType: () => resolveEffectiveMimeType,
+  resolveAgentSourceCutover: () => resolveAgentSourceCutover,
   requiresSpecializedParser: () => requiresSpecializedParser,
   pathToDottedPackageName: () => pathToDottedPackageName,
   parseStepType: () => parseStepType,
   parseReleaseTag: () => parseReleaseTag,
   parseFileKey: () => parseFileKey,
+  parseAutomationTarget: () => parseAutomationTarget,
   noopTracingContext: () => noopTracingContext,
   mapOCRAttributes: () => mapOCRAttributes,
   mapLLMAttributes: () => mapLLMAttributes,
@@ -68739,6 +68868,7 @@ __export(exports_src, {
   isOutputSchemaUnknown: () => isOutputSchemaUnknown,
   isNonSuccessTerminalExecutionStatus: () => isNonSuccessTerminalExecutionStatus,
   isLocalAgentResourcePath: () => isLocalAgentResourcePath,
+  isGitBackedAgentSourceEnabled: () => isGitBackedAgentSourceEnabled,
   isFilePathDescriptor: () => isFilePathDescriptor,
   isFileOutput: () => isFileOutput,
   hasTriggerMethod: () => hasTriggerMethod,
@@ -68854,6 +68984,7 @@ __export(exports_src, {
   SpanKindMap: () => SpanKindMap,
   SpanKind: () => import_api.SpanKind,
   SourceVersionRefSchema: () => SourceVersionRefSchema,
+  SourceSecretsFileSchema: () => SourceSecretsFileSchema,
   SourcePackageTypeSchema: () => SourcePackageTypeSchema,
   SourcePackageSegmentSchema: () => SourcePackageSegmentSchema,
   SourcePackagePathSchema: () => SourcePackagePathSchema,
@@ -68863,6 +68994,7 @@ __export(exports_src, {
   SharedResourcePackageManifestSchema: () => SharedResourcePackageManifestSchema,
   SharedEvaluatorReferenceSchema: () => SharedEvaluatorReferenceSchema,
   SharedEvaluatorCompositionItemSchema: () => SharedEvaluatorCompositionItemSchema,
+  SecretNameSchema: () => SecretNameSchema,
   ScopeStackSchema: () => ScopeStackSchema,
   ScopeEntryTypeSchema: () => ScopeEntryTypeSchema,
   ScopeEntrySchema: () => ScopeEntrySchema,
@@ -68871,6 +69003,7 @@ __export(exports_src, {
   STEP_EXECUTION_STATUSES: () => STEP_EXECUTION_STATUSES,
   SOURCE_VERSION_RANGE_PATTERN: () => SOURCE_VERSION_RANGE_PATTERN,
   SOURCE_SEMVER_PATTERN: () => SOURCE_SEMVER_PATTERN,
+  SOURCE_SECRETS_FILENAME: () => SOURCE_SECRETS_FILENAME,
   SOURCE_PACKAGE_SEGMENT_PATTERN: () => SOURCE_PACKAGE_SEGMENT_PATTERN,
   SOURCE_MANIFEST_FILENAME: () => SOURCE_MANIFEST_FILENAME,
   SOURCE_COMMIT_SHA_PATTERN: () => SOURCE_COMMIT_SHA_PATTERN,
@@ -68954,6 +69087,7 @@ __export(exports_src, {
   EvalOverridesSchema: () => EvalOverridesSchema,
   EvalExampleMetaSchema: () => EvalExampleMetaSchema,
   EvalConfigYamlSchema: () => EvalConfigYamlSchema,
+  EncryptedSecretValueSchema: () => EncryptedSecretValueSchema,
   EmailTriggerMethodSchema: () => EmailTriggerMethodSchema,
   Eigenpal: () => Eigenpal,
   EXECUTION_TYPES: () => EXECUTION_TYPES,
@@ -69016,6 +69150,9 @@ __export(exports_src, {
   AiParseConfigSchema: () => AiParseConfigSchema,
   AiExtractOutputSchema: () => AiExtractOutputSchema,
   AiExtractConfigSchema: () => AiExtractConfigSchema,
+  AgentSourceRuntimeModeSchema: () => AgentSourceRuntimeModeSchema,
+  AgentSourceMigrationStateSchema: () => AgentSourceMigrationStateSchema,
+  AgentSourceCutoverSettingsSchema: () => AgentSourceCutoverSettingsSchema,
   AgentPackageManifestSchema: () => AgentPackageManifestSchema,
   ActionTypeValue: () => ActionTypeValue,
   ActionTypeSchema: () => ActionTypeSchema,
@@ -181601,7 +181738,7 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 // package.json
 var package_default = {
   name: "@eigenpal/cli",
-  version: "0.5.8",
+  version: "0.5.10",
   description: "Eigenpal CLI — author and run document workflows from your terminal. Agent-ready.",
   keywords: [
     "eigenpal",
@@ -181641,6 +181778,8 @@ var package_default = {
   scripts: {
     dev: "bun src/cli.ts",
     build: "bun run generate:skill && bun build src/cli.ts --outdir dist --target node --format esm && rm -rf dist/templates dist/skill && cp -R src/templates dist/templates && cp -R src/skill dist/skill",
+    generate: "bun run generate:cli-docs && bun run generate:skill",
+    "generate:check": "bun run generate:cli-docs:check && bun run generate:skill:check",
     "generate:skill": "bun scripts/generate-skill-reference.ts",
     "generate:skill:check": "bun scripts/generate-skill-reference.ts --check",
     "generate:cli-docs": "bun scripts/generate-cli-docs.ts",
@@ -184106,7 +184245,7 @@ init_src();
 init_zod();
 var import_yaml2 = __toESM(require_dist(), 1);
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
+import { createCipheriv, createHash as createHash2, randomBytes } from "node:crypto";
 import {
   existsSync as existsSync3,
   mkdirSync as mkdirSync2,
@@ -184269,6 +184408,9 @@ function listRelativeFiles(dir) {
 function readYamlFile(filePath) {
   return import_yaml2.default.parse(readFileSync3(filePath, "utf8"));
 }
+function writeYamlFile(filePath, value) {
+  writeFileSync2(filePath, import_yaml2.default.stringify(value));
+}
 function packageManifestExists(gitRoot, packagePath) {
   return existsSync3(path2.join(gitRoot, packagePath, "eigenpal.yaml"));
 }
@@ -184279,6 +184421,28 @@ function releaseTagExists(gitRoot, packagePath, version2) {
 function readPackageManifest(packageRoot) {
   return SourcePackageManifestSchema.parse(readYamlFile(path2.join(packageRoot, "eigenpal.yaml")));
 }
+function requirePackageContext(opts = {}) {
+  const context = resolveGitSourceContext(opts);
+  if (!context.gitRoot || !context.packageRoot || !context.packagePath) {
+    throw new Error("Run this command inside a source package, or pass --dir.");
+  }
+  return {
+    gitRoot: context.gitRoot,
+    packageRoot: context.packageRoot,
+    packagePath: context.packagePath
+  };
+}
+function readMutablePackageManifest(packageRoot) {
+  const manifest = readYamlFile(path2.join(packageRoot, "eigenpal.yaml"));
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    throw new Error("Package eigenpal.yaml must be a YAML object.");
+  }
+  return manifest;
+}
+function writeMutablePackageManifest(packageRoot, manifest) {
+  SourcePackageManifestSchema.parse(manifest);
+  writeYamlFile(path2.join(packageRoot, "eigenpal.yaml"), manifest);
+}
 function parsePackageRef(input) {
   const [rawPackage, rawRef, extra] = input.split("@");
   if (!rawPackage || extra !== undefined) {
@@ -185087,6 +185251,144 @@ async function sync(target, opts) {
   }
   await syncLatestAutomation(new ApiClient(resolveConfig(opts)), packagePath);
 }
+function setEmailTriggerAlias(email3, opts) {
+  const context = requirePackageContext(opts);
+  const manifest = readMutablePackageManifest(context.packageRoot);
+  const triggers = { ...manifest.triggers ?? {} };
+  const emailConfig = { ...triggers.email ?? {} };
+  const aliases = Array.isArray(emailConfig.aliases) ? [...emailConfig.aliases] : [];
+  const nextAlias = {
+    address: email3,
+    enabled: !opts.disabled,
+    allowlist: opts.allow ?? [],
+    replyConfig: {
+      ...opts.replyOn ? { on: opts.replyOn } : {},
+      ...opts.replyMode ? { mode: opts.replyMode } : {}
+    },
+    requireSenderAuth: opts.requireSenderAuth ?? true
+  };
+  const filtered = aliases.filter((alias) => typeof alias === "string" ? alias.toLowerCase() !== email3.toLowerCase() : alias.address?.toLowerCase() !== email3.toLowerCase());
+  manifest.triggers = {
+    ...triggers,
+    email: { ...emailConfig, enabled: true, aliases: [...filtered, nextAlias] }
+  };
+  writeMutablePackageManifest(context.packageRoot, manifest);
+  success2(`Updated email trigger ${ui.bold(email3)} in eigenpal.yaml.`);
+}
+function setApiTrigger(enabled, opts) {
+  const context = requirePackageContext(opts);
+  const manifest = readMutablePackageManifest(context.packageRoot);
+  const triggers = { ...manifest.triggers ?? {} };
+  manifest.triggers = { ...triggers, api: enabled };
+  writeMutablePackageManifest(context.packageRoot, manifest);
+  success2(`${enabled ? "Enabled" : "Disabled"} API trigger in eigenpal.yaml.`);
+}
+function encryptLocalSecret(input) {
+  if (input.key.byteLength !== 32)
+    throw new Error("Secret encryption key must be 32 bytes.");
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", input.key, nonce);
+  cipher.setAAD(Buffer.from(JSON.stringify({
+    keyId: input.keyId,
+    organizationId: input.organizationId,
+    sourcePath: input.sourcePath,
+    secretName: input.secretName
+  })));
+  const ciphertext = Buffer.concat([cipher.update(input.plaintext, "utf8"), cipher.final()]);
+  return {
+    algorithm: "aes-256-gcm",
+    keyId: input.keyId,
+    nonce: nonce.toString("base64url"),
+    ciphertext: ciphertext.toString("base64url"),
+    tag: cipher.getAuthTag().toString("base64url")
+  };
+}
+function readSecretsFile(packageRoot) {
+  const filePath = path2.join(packageRoot, SOURCE_SECRETS_FILENAME);
+  if (!existsSync3(filePath))
+    return { schemaVersion: 1, secrets: {} };
+  return SourceSecretsFileSchema.parse(readYamlFile(filePath));
+}
+function writeSecretsFile(packageRoot, value) {
+  const secretsFile = SourceSecretsFileSchema.parse(value);
+  writeYamlFile(path2.join(packageRoot, SOURCE_SECRETS_FILENAME), secretsFile);
+}
+async function readSecretInput(opts) {
+  const selected = [opts.stdin, opts.valueFile].filter(Boolean).length;
+  if (selected > 1)
+    throw new Error("Pass only one of --stdin or --value-file.");
+  if (opts.stdin)
+    return readFileSync3(0, "utf8").replace(/\n$/, "");
+  if (opts.valueFile)
+    return readFileSync3(opts.valueFile, "utf8").replace(/\n$/, "");
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    const { password, isCancel, cancel } = await Promise.resolve().then(() => (init_dist4(), exports_dist));
+    const answer = await password({ message: "Secret value" });
+    if (isCancel(answer)) {
+      cancel("Cancelled");
+      process.exit(1);
+    }
+    return String(answer);
+  }
+  throw new Error("Secret value input is required in noninteractive mode.");
+}
+async function setSecret(name, opts) {
+  const context = requirePackageContext(opts);
+  const sourcePath = `${context.packagePath}/${SOURCE_SECRETS_FILENAME}`;
+  const secretsFile = readSecretsFile(context.packageRoot);
+  const secrets = { ...secretsFile.secrets };
+  secrets[name] = {
+    ...opts.description ? { description: opts.description } : {},
+    encrypted: encryptLocalSecret({
+      plaintext: await readSecretInput(opts),
+      keyId: opts.keyId,
+      key: readSecretKeyFile(opts.keyFile),
+      organizationId: opts.organizationId,
+      sourcePath,
+      secretName: name
+    })
+  };
+  writeSecretsFile(context.packageRoot, { schemaVersion: 1, secrets });
+  success2(`Encrypted ${ui.bold(name)} into secrets.enc.yaml.`);
+}
+function unsetSecret(name, opts) {
+  const context = requirePackageContext(opts);
+  const secretsFile = readSecretsFile(context.packageRoot);
+  const secrets = { ...secretsFile.secrets };
+  delete secrets[name];
+  writeSecretsFile(context.packageRoot, { schemaVersion: 1, secrets });
+  success2(`Removed ${ui.bold(name)} from secrets.enc.yaml.`);
+}
+async function importSecrets(envFile, opts) {
+  const content = readFileSync3(envFile, "utf8");
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const idx = trimmed.indexOf("=");
+    if (idx === -1)
+      continue;
+    const context = requirePackageContext(opts);
+    const sourcePath = `${context.packagePath}/${SOURCE_SECRETS_FILENAME}`;
+    const secretsFile = readSecretsFile(context.packageRoot);
+    const secrets = { ...secretsFile.secrets };
+    const name = trimmed.slice(0, idx);
+    secrets[name] = {
+      encrypted: encryptLocalSecret({
+        plaintext: trimmed.slice(idx + 1),
+        keyId: opts.keyId,
+        key: readSecretKeyFile(opts.keyFile),
+        organizationId: opts.organizationId,
+        sourcePath,
+        secretName: name
+      })
+    };
+    writeSecretsFile(context.packageRoot, { schemaVersion: 1, secrets });
+  }
+}
+function readSecretKeyFile(keyFile) {
+  return Buffer.from(readFileSync3(keyFile, "utf8").trim(), "base64url");
+}
 async function install(packageRef, opts) {
   const config2 = resolveConfig(opts);
   const context = resolveGitSourceContext();
@@ -185390,6 +185692,16 @@ function parseReleaseVersion(value) {
   }
   return value;
 }
+function parseBoolean(value) {
+  if (value === "true" || value === "enabled" || value === "on")
+    return true;
+  if (value === "false" || value === "disabled" || value === "off")
+    return false;
+  throw new InvalidArgumentError("Expected true/false, enabled/disabled, or on/off");
+}
+function collect2(value, previous) {
+  return [...previous, value];
+}
 function parseType(value) {
   if (!["agent", "workflow"].includes(value))
     throw new InvalidArgumentError("type must be agent or workflow");
@@ -185420,6 +185732,14 @@ function registerGitCommands(program2) {
   addJsonFlag(withBaseUrl(git.command("versions <package>"))).description("List package release versions.").action(action(versions2));
   withBaseUrl(git.command("release")).description("Create and push a package release tag.").argument("<version>", "Version or bump level", parseReleaseVersion).argument("[dir]", "Package directory").addOption(new Option("-m, --message <message>", "Annotated tag message").makeOptionMandatory()).action(action(async (versionOrBump, dir, opts) => release(versionOrBump, dir, opts)));
   withBaseUrl(git.command("sync [automation]")).description("Sync an automation from the latest Git source release.").option("--dir <dir>", "Directory to inspect").action(action(sync));
+  const trigger = git.command("trigger").description("Edit trigger policy in eigenpal.yaml.");
+  trigger.command("api <enabled>").description("Enable or disable API trigger policy in eigenpal.yaml.").option("--dir <dir>", "Directory to inspect").action(action(async (enabled, opts) => setApiTrigger(parseBoolean(enabled), opts)));
+  const triggerEmail = trigger.command("email").description("Edit email trigger policy.");
+  triggerEmail.command("set <email>").description("Add or update an email trigger alias in eigenpal.yaml.").option("--dir <dir>", "Directory to inspect").option("--disabled", "Write the alias as disabled").option("--allow <entry>", "Allowed sender entry; repeatable", collect2, []).option("--reply-on <never|always>", "Reply behavior").option("--reply-mode <sender|all>", "Reply recipient mode").option("--no-require-sender-auth", "Disable sender-auth checks for this alias").action(action(async (email3, opts) => setEmailTriggerAlias(email3, opts)));
+  const secret = git.command("secret").description("Edit encrypted secrets.enc.yaml.");
+  secret.command("set <name>").description("Encrypt and set a secret value in secrets.enc.yaml.").option("--dir <dir>", "Directory to inspect").option("--stdin", "Read the secret value from stdin").option("--value-file <path>", "Read the secret value from a file").requiredOption("--key-id <id>", "Organization decrypt key id").requiredOption("--key-file <path>", "File containing the base64url-encoded organization key").requiredOption("--organization-id <id>", "Organization id for authenticated data").option("--description <text>", "Secret description").action(action(setSecret));
+  secret.command("unset <name>").description("Remove a secret from secrets.enc.yaml.").option("--dir <dir>", "Directory to inspect").action(action(async (name, opts) => unsetSecret(name, opts)));
+  secret.command("import <env-file>").description("Import KEY=value entries from an env file into secrets.enc.yaml.").option("--dir <dir>", "Directory to inspect").requiredOption("--key-id <id>", "Organization decrypt key id").requiredOption("--key-file <path>", "File containing the base64url-encoded organization key").requiredOption("--organization-id <id>", "Organization id for authenticated data").action(action(importSecrets));
 }
 
 // src/commands/init.ts
@@ -186018,15 +186338,15 @@ function pruneEmptyDirs(root) {
   if (!existsSync5(root))
     return;
   const stack = [];
-  const collect2 = (dir) => {
+  const collect3 = (dir) => {
     for (const entry of readdirSync3(dir)) {
       const full = join3(dir, entry);
       if (lstatSync(full).isDirectory())
-        collect2(full);
+        collect3(full);
     }
     stack.push(dir);
   };
-  collect2(root);
+  collect3(root);
   for (const dir of stack) {
     try {
       if (readdirSync3(dir).length === 0)
@@ -188043,6 +188363,155 @@ function parseWorkflow(yaml) {
   }
   return result.data;
 }
+// ../workflow-yaml/src/validate-quality.ts
+init_src();
+var CATEGORICAL_NAMES = new Set([
+  "category",
+  "subcategory",
+  "kind",
+  "status",
+  "type",
+  "subtype",
+  "level",
+  "severity",
+  "priority",
+  "state",
+  "stage",
+  "tier",
+  "classification",
+  "monitoring",
+  "frequency",
+  "reference",
+  "sectionname",
+  "code",
+  "flag",
+  "signal",
+  "mode",
+  "phase"
+]);
+var SEPARATOR_LIST_RE = /(?:^|[\s(])((?:[A-Za-z0-9_-]{1,20})(?:\s*[|,/]\s*[A-Za-z0-9_-]{1,20}){1,7})(?:$|[\s).])/;
+function validateSchemaQuality(workflow2) {
+  const warnings = [];
+  for (let i5 = 0;i5 < workflow2.steps.length; i5++) {
+    const step = workflow2.steps[i5];
+    if (!step)
+      continue;
+    const basePath = `steps.${i5}`;
+    walkStep(step, basePath, warnings);
+  }
+  return warnings;
+}
+function walkStep(step, basePath, out) {
+  if (step.type === "ai.extract") {
+    const schema = step.with?.schema;
+    if (schema && typeof schema === "object") {
+      walkSchema(schema, `${basePath}.with.schema`, out);
+    }
+    return;
+  }
+  if (step.type === "transform.script") {
+    const cfg = step.with;
+    const source2 = typeof cfg?.function === "string" ? cfg.function : null;
+    if (!source2)
+      return;
+    const paramNames = cfg?.inputs && typeof cfg.inputs === "object" && !Array.isArray(cfg.inputs) ? Object.keys(cfg.inputs) : [];
+    const compiled = compileTypedScript({ kind: "transform", source: source2, paramNames });
+    if (!compiled.ok)
+      return;
+    for (const w10 of compiled.warnings) {
+      if (w10.code === "weak-return-type") {
+        out.push({
+          code: "weak-script-return",
+          field: `${basePath}.with.function`,
+          message: `transform.script return type is too loose: ${w10.message}`,
+          hint: 'Replace `unknown`/`any` with a concrete shape, or use a TS literal union (e.g. `"low" | "medium" | "high"`) when the value belongs to a closed set.'
+        });
+      }
+    }
+    const schema = compiled.result.returnSchema;
+    if (schema.type === "object" && (!schema.properties || Object.keys(schema.properties).length === 0) && schema.additionalProperties !== false) {
+      out.push({
+        code: "untyped-object",
+        field: `${basePath}.with.function`,
+        message: "transform.script returns an untyped object. Downstream steps cannot autocomplete its fields.",
+        hint: "Describe the actual shape in the return annotation: `function script(...): { name: string; total: number }`."
+      });
+    }
+    return;
+  }
+  const withAny = step.with;
+  const nestedSteps = withAny?.steps;
+  if (Array.isArray(nestedSteps)) {
+    for (let i5 = 0;i5 < nestedSteps.length; i5++) {
+      const s5 = nestedSteps[i5];
+      if (s5)
+        walkStep(s5, `${basePath}.with.steps.${i5}`, out);
+    }
+  }
+  const nestedBranches = withAny?.branches;
+  if (Array.isArray(nestedBranches)) {
+    for (let b8 = 0;b8 < nestedBranches.length; b8++) {
+      const branch = nestedBranches[b8];
+      if (branch && Array.isArray(branch.steps)) {
+        for (let i5 = 0;i5 < branch.steps.length; i5++) {
+          const s5 = branch.steps[i5];
+          if (s5)
+            walkStep(s5, `${basePath}.with.branches.${b8}.steps.${i5}`, out);
+        }
+      }
+    }
+  }
+}
+function walkSchema(schema, basePath, out) {
+  const type = schema.type;
+  if (type === "object" && (!schema.properties || Object.keys(schema.properties).length === 0) && schema.additionalProperties !== false) {
+    out.push({
+      code: "untyped-object",
+      field: basePath,
+      message: "Object schema has no properties. The LLM has no guidance on what fields to emit and downstream autocomplete is empty.",
+      hint: "Add concrete fields under `properties`, or set `additionalProperties: false` if the object is intentionally open."
+    });
+  }
+  if (type === "array" && (schema.items === undefined || isEmptyObject(schema.items))) {
+    out.push({
+      code: "untyped-array-items",
+      field: basePath,
+      message: "Array items are untyped. The LLM does not know what shape each element should take.",
+      hint: "Add an `items:` block describing the element type, e.g. `items: { type: object, properties: { ... } }`."
+    });
+  }
+  if (schema.properties && typeof schema.properties === "object") {
+    for (const [name, raw] of Object.entries(schema.properties)) {
+      if (!raw || typeof raw !== "object")
+        continue;
+      const prop = raw;
+      const propType = prop.type;
+      const propEnum = Array.isArray(prop.enum) && prop.enum.length > 0;
+      const lower = name.toLowerCase();
+      const description = typeof prop.description === "string" ? prop.description : "";
+      const looksCategoricalByName = CATEGORICAL_NAMES.has(lower);
+      const looksCategoricalByDescription = description.length > 0 && SEPARATOR_LIST_RE.test(description);
+      if (propType === "string" && !propEnum && (looksCategoricalByName || looksCategoricalByDescription) && !looksLikeFreeform(prop)) {
+        out.push({
+          code: "categorical-missing-enum",
+          field: `${basePath}.properties.${name}`,
+          message: `Field \`${name}\` looks categorical but has no \`enum\`. Coded values extract more reliably when the LLM is constrained to a closed set.`,
+          hint: "In the workflow builder, switch the field type to `Enum` and list the allowed values. In raw YAML, add `enum: ['value1', 'value2', ...]` to the field, and write the per-value meanings into the field's `description`."
+        });
+      }
+      walkSchema(prop, `${basePath}.properties.${name}`, out);
+    }
+  }
+  if (schema.items && typeof schema.items === "object" && !Array.isArray(schema.items)) {
+    walkSchema(schema.items, `${basePath}.items`, out);
+  }
+}
+function isEmptyObject(v11) {
+  return typeof v11 === "object" && v11 !== null && !Array.isArray(v11) && Object.keys(v11).length === 0;
+}
+function looksLikeFreeform(prop) {
+  return prop.pattern !== undefined || prop.format !== undefined;
+}
 // src/commands/validate.ts
 var import_yaml6 = __toESM(require_dist(), 1);
 import { existsSync as existsSync10, readdirSync as readdirSync7, readFileSync as readFileSync10, statSync as statSync6 } from "fs";
@@ -188061,24 +188530,46 @@ function isDirSafe(path15, issues, field) {
 }
 function validateWorkflowYaml(path15) {
   if (!existsSync10(path15)) {
-    return [{ field: path15, message: "File not found." }];
+    return { issues: [{ field: path15, message: "File not found." }], warnings: [] };
   }
   const text = readFileSync10(path15, "utf-8");
   try {
-    parseWorkflow(text);
-    return [];
+    const definition = parseWorkflow(text);
+    let warnings = [];
+    try {
+      warnings = validateSchemaQuality(definition);
+    } catch {
+      warnings = [];
+    }
+    return { issues: [], warnings };
   } catch (err2) {
     if (err2 instanceof YamlParseError) {
       const where = err2.line !== undefined ? ` (line ${err2.line})` : "";
-      return [{ field: "yaml", message: `${err2.message}${where}` }];
+      return { issues: [{ field: "yaml", message: `${err2.message}${where}` }], warnings: [] };
     }
     if (err2 instanceof WorkflowValidationError) {
-      return err2.errors.map((e8) => ({
-        field: e8.path.length > 0 ? e8.path.map(String).join(".") : "(root)",
-        message: e8.message
-      }));
+      return {
+        issues: err2.errors.map((e8) => ({
+          field: e8.path.length > 0 ? e8.path.map(String).join(".") : "(root)",
+          message: e8.message
+        })),
+        warnings: []
+      };
     }
-    return [{ field: "(root)", message: err2 instanceof Error ? err2.message : String(err2) }];
+    return {
+      issues: [{ field: "(root)", message: err2 instanceof Error ? err2.message : String(err2) }],
+      warnings: []
+    };
+  }
+}
+function printSchemaQualityWarnings(path15, warnings) {
+  if (warnings.length === 0)
+    return;
+  warn(`workflow.yaml ${ui.dim(`(${path15})`)}: ${warnings.length} schema-quality warning${warnings.length === 1 ? "" : "s"}`);
+  for (const w10 of warnings) {
+    warn(`  ${ui.dim(w10.field)} ${w10.message}`);
+    if (w10.hint)
+      warn(`    ${ui.dim("hint:")} ${w10.hint}`);
   }
 }
 function validateEvaluatorsYaml(path15) {
@@ -188261,9 +188752,23 @@ function rootDir(opts) {
   return resolve6(opts.dir ?? process.cwd());
 }
 function registerAllValidateCommand(parent) {
-  parent.command("validate").description("Local-only validation against the templated project layout: ./workflow.yaml + ./evaluators.yaml + ./dataset/. For targeted validation use `evaluators validate` or `dataset validate`.").option("--dir <path>", "Project root (defaults to cwd; resolves the three default paths from here)").action((opts) => {
+  parent.command("validate [path]").description("Local-only validation. Without [path]: runs the templated three-way check (./workflow.yaml + ./evaluators.yaml + ./dataset/). With [path] pointing at a YAML file: validates just that workflow.yaml. For per-noun targeting use `evaluators validate` or `dataset validate`.").option("--dir <path>", "Project root (defaults to cwd; resolves the three default paths from here)").action((path15, opts) => {
+    if (path15) {
+      const target = resolve6(path15);
+      const wfResult2 = validateWorkflowYaml(target);
+      const wfOk2 = printIssues("workflow.yaml", target, wfResult2.issues);
+      if (wfOk2)
+        printSchemaQualityWarnings(target, wfResult2.warnings);
+      if (!wfOk2)
+        process.exit(1);
+      return;
+    }
     const root2 = rootDir(opts);
-    const wfOk = printIssues("workflow.yaml", relPath(root2, join12(root2, "workflow.yaml")), validateWorkflowYaml(join12(root2, "workflow.yaml")));
+    const wfResult = validateWorkflowYaml(join12(root2, "workflow.yaml"));
+    const wfPath = relPath(root2, join12(root2, "workflow.yaml"));
+    const wfOk = printIssues("workflow.yaml", wfPath, wfResult.issues);
+    if (wfOk)
+      printSchemaQualityWarnings(wfPath, wfResult.warnings);
     const evOk = printIssues("evaluators.yaml", relPath(root2, join12(root2, "evaluators.yaml")), validateEvaluatorsYaml(join12(root2, "evaluators.yaml")));
     const dsOk = printIssues("dataset/", relPath(root2, join12(root2, "dataset")), validateDatasetFolder(join12(root2, "dataset")));
     if (!wfOk || !evOk || !dsOk)
@@ -188916,6 +189421,7 @@ flag would otherwise shadow it. Validation failures come back as
         return;
       }
       success2(`Pushed ${ui.bold(workflowId)} (v${result.version ?? nextVersion})`);
+      printSchemaQualityWarnings2(result.warnings);
     } else {
       if (opts.bump) {
         throw new Error("--bump requires --workflow-id (need a current version to bump from). For a new workflow, use --set-version <X.Y.Z> or omit both.");
@@ -188933,6 +189439,7 @@ flag would otherwise shadow it. Validation failures come back as
       const id2 = result.workflow?.id ?? result.id ?? "?";
       const ver = result.version?.version ?? result.workflow?.currentVersion?.version ?? result.currentVersion?.version ?? "?";
       success2(`Created ${ui.bold(id2)} (v${ver})`);
+      printSchemaQualityWarnings2(result.warnings);
     }
   }));
   const moveCmd = parent.command("move <workflow-id>").description("Move a workflow to a folder path, creating folders as needed").requiredOption("--folder <path>", "Target folder path (`/` for root)");
@@ -188950,6 +189457,16 @@ flag would otherwise shadow it. Validation failures come back as
   }));
 }
 var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)$/;
+function printSchemaQualityWarnings2(warnings) {
+  if (!warnings || warnings.length === 0)
+    return;
+  warn(`${warnings.length} schema-quality warning${warnings.length === 1 ? "" : "s"} (push succeeded; sharper types make downstream steps easier to wire):`);
+  for (const w10 of warnings) {
+    warn(`  ${ui.dim(w10.field)} ${w10.message}`);
+    if (w10.hint)
+      warn(`    ${ui.dim("hint:")} ${w10.hint}`);
+  }
+}
 function isBumpLevel(value) {
   return value === "patch" || value === "minor" || value === "major";
 }

package/dist/skill/reference/cli/workflow.md

@@ -20,7 +20,7 @@ Manage workflows: push, pull, run, evaluate.
   - [`eigenpal workflow pull [options] <workflow-id>`](#eigenpal-workflow-pull-options-workflow-id)
   - [`eigenpal workflow push [options]`](#eigenpal-workflow-push-options)
   - [`eigenpal workflow move [options] <workflow-id>`](#eigenpal-workflow-move-options-workflow-id)
-  - [`eigenpal workflow validate [options]`](#eigenpal-workflow-validate-options)
+  - [`eigenpal workflow validate [options] [path]`](#eigenpal-workflow-validate-options-path)
   - [`eigenpal workflow clear-local [options] [examples...]`](#eigenpal-workflow-clear-local-options-examples)
   - [`eigenpal workflow evaluators pull [options] <workflow-id>`](#eigenpal-workflow-evaluators-pull-options-workflow-id)
   - [`eigenpal workflow evaluators push [options] <workflow-id>`](#eigenpal-workflow-evaluators-push-options-workflow-id)
@@ -100,7 +100,7 @@ workflow
 ├── evaluator-type
 │   ├── list|ls
 │   └── get <type>
-├── validate
+├── validate [path]
 ├── clear-local [examples...]
 └── step
     └── exec <type>
@@ -110,14 +110,14 @@ workflow
 
 ### Core
 
-| Command                                                 | Description                                                                                                                                                                            |
-| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- |
-| `eigenpal workflow list                                 | ls [options]`                                                                                                                                                                          | List workflows the caller can read. |
-| `eigenpal workflow pull [options] <workflow-id>`        | Download the YAML definition of the workflow at its current version.                                                                                                                   |
-| `eigenpal workflow push [options]`                      | Create or update a workflow from a YAML file.                                                                                                                                          |
-| `eigenpal workflow move [options] <workflow-id>`        | Move a workflow to a folder path, creating folders as needed                                                                                                                           |
-| `eigenpal workflow validate [options]`                  | Local-only validation against the templated project layout: ./workflow.yaml + ./evaluators.yaml + ./dataset/. For targeted validation use `evaluators validate` or `dataset validate`. |
-| `eigenpal workflow clear-local [options] [examples...]` | Delete local execution artifacts under ./dataset/examples/. Keeps the latest run per example by default.                                                                               |
+| Command                                                 | Description                                                                                                                                                                                                                                                                   |
+| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- |
+| `eigenpal workflow list                                 | ls [options]`                                                                                                                                                                                                                                                                 | List workflows the caller can read. |
+| `eigenpal workflow pull [options] <workflow-id>`        | Download the YAML definition of the workflow at its current version.                                                                                                                                                                                                          |
+| `eigenpal workflow push [options]`                      | Create or update a workflow from a YAML file.                                                                                                                                                                                                                                 |
+| `eigenpal workflow move [options] <workflow-id>`        | Move a workflow to a folder path, creating folders as needed                                                                                                                                                                                                                  |
+| `eigenpal workflow validate [options] [path]`           | Local-only validation. Without [path]: runs the templated three-way check (./workflow.yaml + ./evaluators.yaml + ./dataset/). With [path] pointing at a YAML file: validates just that workflow.yaml. For per-noun targeting use `evaluators validate` or `dataset validate`. |
+| `eigenpal workflow clear-local [options] [examples...]` | Delete local execution artifacts under ./dataset/examples/. Keeps the latest run per example by default.                                                                                                                                                                      |
 
 ### Evaluators
 
@@ -256,9 +256,15 @@ Move a workflow to a folder path, creating folders as needed
 | `--base-url <url>` | no       |         | Server base URL                        |
 | `--json`           | no       |         | Output the raw server response as JSON |
 
-### `eigenpal workflow validate [options]`
+### `eigenpal workflow validate [options] [path]`
 
-Local-only validation against the templated project layout: ./workflow.yaml + ./evaluators.yaml + ./dataset/. For targeted validation use `evaluators validate` or `dataset validate`.
+Local-only validation. Without [path]: runs the templated three-way check (./workflow.yaml + ./evaluators.yaml + ./dataset/). With [path] pointing at a YAML file: validates just that workflow.yaml. For per-noun targeting use `evaluators validate` or `dataset validate`.
+
+### Arguments
+
+| Name   | Required | Variadic | Description |
+| ------ | -------- | -------- | ----------- |
+| `path` | no       | no       |             |
 
 ### Options
 

package/dist/skill/reference/workflow-yaml.md

@@ -191,6 +191,76 @@ The script runs in a WASM sandbox: 5s wall clock, 10 MB heap, no network,
 no filesystem. Trips show up as `script_timeout` / `script_memory_limit`
 on the step execution.
 
+## Be specific with types
+
+Every output schema you write is read three times: by the LLM (for
+`ai.extract`), by downstream steps (autocomplete + template resolution),
+and by the runtime validator. **The more specific the type, the better
+the workflow runs.**
+
+### Use `enum` for coded values
+
+Categorical fields like `category`, `status`, `kind`, `severity`,
+`monitoring`, `frequency` should be enums whenever the value set is
+closed. The LLM is constrained to emit only allowed values, and
+downstream `transform.script` steps know exactly what they'll see.
+
+```yaml
+- name: classify
+  type: ai.extract
+  with:
+    input: '{{ input.text }}'
+    schema:
+      type: object
+      properties:
+        category:
+          type: string
+          enum: ['901', '902']
+          description: |
+            Covenant category.
+            901 = Odkladacie podmienky (conditions precedent).
+            902 = Následné podmienky (subsequent / ongoing covenants).
+      required: [category]
+```
+
+Per-value meanings go inline in the field's `description`. The LLM picks
+them up reliably from there, and the scope browser renders the allowed
+values when downstream steps reference the field.
+
+### `transform.script` — TS literal unions become JSON Schema enums
+
+A TS literal-union return type compiles to a JSON-Schema enum
+automatically. Use it when the function returns a value from a closed set:
+
+```yaml
+- name: severity
+  type: transform.script
+  with:
+    inputs:
+      score: '{{ steps.score.output.value }}'
+    function: |
+      function script(score: number): { level: 'low' | 'medium' | 'high' } {
+        return { level: score > 0.8 ? 'high' : score > 0.4 ? 'medium' : 'low' };
+      }
+```
+
+Downstream steps autocomplete `low | medium | high` for `level`.
+
+### `eigenpal workflow push` warns on weak types
+
+Push surfaces non-fatal **schema-quality warnings** when it sees patterns
+that hurt downstream typing. Common ones:
+
+| Warning code                 | What it means                                                                                |
+| ---------------------------- | -------------------------------------------------------------------------------------------- |
+| `categorical-missing-enum`   | A field named like `category` / `status` / `kind` is a plain `string`. Consider declaring an `enum`. |
+| `weak-script-return`         | A `transform.script` returns `any` or `unknown`. Replace with a concrete shape or a literal union. |
+| `untyped-object`             | A `type: object` field has no `properties`. The LLM has no guidance on what to emit.         |
+| `untyped-array-items`        | A `type: array` field has no `items:` declared.                                              |
+
+Warnings do not block the push. They print to stderr as `! …` lines. Run
+`eigenpal workflow validate` locally to surface them before pushing.
+
 ## Common patterns
 
 ### Conditional branches

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eigenpal/cli",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "description": "Eigenpal CLI — author and run document workflows from your terminal. Agent-ready.",
   "keywords": [
     "eigenpal",
@@ -40,6 +40,8 @@
   "scripts": {
     "dev": "bun src/cli.ts",
     "build": "bun run generate:skill && bun build src/cli.ts --outdir dist --target node --format esm && rm -rf dist/templates dist/skill && cp -R src/templates dist/templates && cp -R src/skill dist/skill",
+    "generate": "bun run generate:cli-docs && bun run generate:skill",
+    "generate:check": "bun run generate:cli-docs:check && bun run generate:skill:check",
     "generate:skill": "bun scripts/generate-skill-reference.ts",
     "generate:skill:check": "bun scripts/generate-skill-reference.ts --check",
     "generate:cli-docs": "bun scripts/generate-cli-docs.ts",