@getmagical/cli 0.11.0 → 0.12.1

package/dist/index.js

@@ -2056,13 +2056,13 @@ var require_ast = __commonJS({
         helperExpression: function helperExpression(node) {
           return node.type === "SubExpression" || (node.type === "MustacheStatement" || node.type === "BlockStatement") && !!(node.params && node.params.length || node.hash);
         },
-        scopedId: function scopedId(path22) {
-          return /^\.|this\b/.test(path22.original);
+        scopedId: function scopedId(path23) {
+          return /^\.|this\b/.test(path23.original);
         },
         // an ID is simple if it only has one part, and that part is not
         // `..` or `this`.
-        simpleId: function simpleId(path22) {
-          return path22.parts.length === 1 && !AST.helpers.scopedId(path22) && !path22.depth;
+        simpleId: function simpleId(path23) {
+          return path23.parts.length === 1 && !AST.helpers.scopedId(path23) && !path23.depth;
         }
       }
     };
@@ -3132,12 +3132,12 @@ var require_helpers2 = __commonJS({
         loc
       };
     }
-    function prepareMustache(path22, params, hash, open2, strip, locInfo) {
+    function prepareMustache(path23, params, hash, open2, strip, locInfo) {
       var escapeFlag = open2.charAt(3) || open2.charAt(2), escaped = escapeFlag !== "{" && escapeFlag !== "&";
       var decorator = /\*/.test(open2);
       return {
         type: decorator ? "Decorator" : "MustacheStatement",
-        path: path22,
+        path: path23,
         params,
         hash,
         escaped,
@@ -3455,9 +3455,9 @@ var require_compiler = __commonJS({
       },
       DecoratorBlock: function DecoratorBlock(decorator) {
         var program2 = decorator.program && this.compileProgram(decorator.program);
-        var params = this.setupFullMustacheParams(decorator, program2, void 0), path22 = decorator.path;
+        var params = this.setupFullMustacheParams(decorator, program2, void 0), path23 = decorator.path;
         this.useDecorators = true;
-        this.opcode("registerDecorator", params.length, path22.original);
+        this.opcode("registerDecorator", params.length, path23.original);
       },
       PartialStatement: function PartialStatement(partial) {
         this.usePartial = true;
@@ -3521,46 +3521,46 @@ var require_compiler = __commonJS({
         }
       },
       ambiguousSexpr: function ambiguousSexpr(sexpr, program2, inverse) {
-        var path22 = sexpr.path, name = path22.parts[0], isBlock = program2 != null || inverse != null;
-        this.opcode("getContext", path22.depth);
+        var path23 = sexpr.path, name = path23.parts[0], isBlock = program2 != null || inverse != null;
+        this.opcode("getContext", path23.depth);
         this.opcode("pushProgram", program2);
         this.opcode("pushProgram", inverse);
-        path22.strict = true;
-        this.accept(path22);
+        path23.strict = true;
+        this.accept(path23);
         this.opcode("invokeAmbiguous", name, isBlock);
       },
       simpleSexpr: function simpleSexpr(sexpr) {
-        var path22 = sexpr.path;
-        path22.strict = true;
-        this.accept(path22);
+        var path23 = sexpr.path;
+        path23.strict = true;
+        this.accept(path23);
         this.opcode("resolvePossibleLambda");
       },
       helperSexpr: function helperSexpr(sexpr, program2, inverse) {
-        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path22 = sexpr.path, name = path22.parts[0];
+        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path23 = sexpr.path, name = path23.parts[0];
         if (this.options.knownHelpers[name]) {
           this.opcode("invokeKnownHelper", params.length, name);
         } else if (this.options.knownHelpersOnly) {
           throw new _exception2["default"]("You specified knownHelpersOnly, but used the unknown helper " + name, sexpr);
         } else {
-          path22.strict = true;
-          path22.falsy = true;
-          this.accept(path22);
-          this.opcode("invokeHelper", params.length, path22.original, _ast2["default"].helpers.simpleId(path22));
+          path23.strict = true;
+          path23.falsy = true;
+          this.accept(path23);
+          this.opcode("invokeHelper", params.length, path23.original, _ast2["default"].helpers.simpleId(path23));
         }
       },
-      PathExpression: function PathExpression(path22) {
-        this.addDepth(path22.depth);
-        this.opcode("getContext", path22.depth);
-        var name = path22.parts[0], scoped = _ast2["default"].helpers.scopedId(path22), blockParamId = !path22.depth && !scoped && this.blockParamIndex(name);
+      PathExpression: function PathExpression(path23) {
+        this.addDepth(path23.depth);
+        this.opcode("getContext", path23.depth);
+        var name = path23.parts[0], scoped = _ast2["default"].helpers.scopedId(path23), blockParamId = !path23.depth && !scoped && this.blockParamIndex(name);
         if (blockParamId) {
-          this.opcode("lookupBlockParam", blockParamId, path22.parts);
+          this.opcode("lookupBlockParam", blockParamId, path23.parts);
         } else if (!name) {
           this.opcode("pushContext");
-        } else if (path22.data) {
+        } else if (path23.data) {
           this.options.data = true;
-          this.opcode("lookupData", path22.depth, path22.parts, path22.strict);
+          this.opcode("lookupData", path23.depth, path23.parts, path23.strict);
         } else {
-          this.opcode("lookupOnContext", path22.parts, path22.falsy, path22.strict, scoped);
+          this.opcode("lookupOnContext", path23.parts, path23.falsy, path23.strict, scoped);
         }
       },
       StringLiteral: function StringLiteral(string) {
@@ -3910,16 +3910,16 @@ var require_util2 = __commonJS({
     }
     exports.urlGenerate = urlGenerate;
     function normalize(aPath) {
-      var path22 = aPath;
+      var path23 = aPath;
       var url = urlParse(aPath);
       if (url) {
         if (!url.path) {
           return aPath;
         }
-        path22 = url.path;
+        path23 = url.path;
       }
-      var isAbsolute = exports.isAbsolute(path22);
-      var parts = path22.split(/\/+/);
+      var isAbsolute = exports.isAbsolute(path23);
+      var parts = path23.split(/\/+/);
       for (var part, up = 0, i = parts.length - 1; i >= 0; i--) {
         part = parts[i];
         if (part === ".") {
@@ -3936,15 +3936,15 @@ var require_util2 = __commonJS({
           }
         }
       }
-      path22 = parts.join("/");
-      if (path22 === "") {
-        path22 = isAbsolute ? "/" : ".";
+      path23 = parts.join("/");
+      if (path23 === "") {
+        path23 = isAbsolute ? "/" : ".";
       }
       if (url) {
-        url.path = path22;
+        url.path = path23;
         return urlGenerate(url);
       }
-      return path22;
+      return path23;
     }
     exports.normalize = normalize;
     function join(aRoot, aPath) {
@@ -6727,8 +6727,8 @@ var require_printer = __commonJS({
       return this.accept(sexpr.path) + " " + params + hash;
     };
     PrintVisitor.prototype.PathExpression = function(id) {
-      var path22 = id.parts.join("/");
-      return (id.data ? "@" : "") + "PATH:" + path22;
+      var path23 = id.parts.join("/");
+      return (id.data ? "@" : "") + "PATH:" + path23;
     };
     PrintVisitor.prototype.StringLiteral = function(string) {
       return '"' + string.value + '"';
@@ -7219,7 +7219,7 @@ function getErrorMessage(error) {
 
 // src/program.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import path21 from "node:path";
+import path22 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 
 // ../common/dist/src/stdlib/json.util.js
@@ -12979,8 +12979,8 @@ var RENDER_TEMPLATE_ERROR_REASON_CATALOG = defineErrorReasonCatalog()([
 ]);
 var storeReferencePathPattern = String.raw`store(?:\.[$A-Z_a-z][\w$]*)*`;
 var storeReferenceMarkdownLinkTemplateRegex = new RegExp(String.raw`(?<open>\{\{\{?)\s*\[(?<path>${storeReferencePathPattern})\]\(\s*<?https?:\/\/\k<path>>?\s*\)\s*(?<close>\}\}\}?)`, "gu");
-function normalizeAutomationStoreTemplateLinkMatch([_match, open2, path22]) {
-  return open2 === "{{{" ? `{{{${path22}}}}` : `{{${path22}}}`;
+function normalizeAutomationStoreTemplateLinkMatch([_match, open2, path23]) {
+  return open2 === "{{{" ? `{{{${path23}}}}` : `{{${path23}}}`;
 }
 function normalizeAutomationStoreTemplateLinks(template) {
   return template.replaceAll(storeReferenceMarkdownLinkTemplateRegex, (...args) => normalizeAutomationStoreTemplateLinkMatch(args));
@@ -14173,18 +14173,18 @@ var specialCommands = {
 // ../common/dist/src/utils/automation-store-path.util.js
 var AUTOMATION_STORE_ROOT_PATH = "store";
 var relativeStorePathRegex = /^[$A-Z_a-z][\w$]*(?:\.[$A-Z_a-z][\w$]*)*$/u;
-function normalizeStoreMutationPath(path22) {
-  const trimmedPath = path22.trim();
+function normalizeStoreMutationPath(path23) {
+  const trimmedPath = path23.trim();
   const rootPrefix = `${AUTOMATION_STORE_ROOT_PATH}.`;
   const relativePath = trimmedPath.startsWith(rootPrefix) ? trimmedPath.slice(rootPrefix.length) : trimmedPath;
   if (!relativeStorePathRegex.test(relativePath)) {
     return Err({
       type: "invalid-automation-store-path",
-      path: path22,
+      path: path23,
       categories: ["customer_usage"],
       statusCode: 400,
       nonRetryable: true,
-      message: `Automation store path "${path22}" is invalid.`,
+      message: `Automation store path "${path23}" is invalid.`,
       suggestedAction: "Use a dot path relative to the automation store, such as patient.name or provider.clinic."
     });
   }
@@ -14197,16 +14197,16 @@ function findAutomationStorePathOverlap(paths) {
     ...new Set(paths.map(getCanonicalAutomationStoreMutationPath))
   ].toSorted((left, right) => (left === AUTOMATION_STORE_ROOT_PATH ? 0 : left.split(".").length) - (right === AUTOMATION_STORE_ROOT_PATH ? 0 : right.split(".").length));
   for (const [index, ancestorPath] of canonicalPaths.entries()) {
-    const descendantPath = canonicalPaths.slice(index + 1).find((path22) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path22.startsWith(`${ancestorPath}.`));
+    const descendantPath = canonicalPaths.slice(index + 1).find((path23) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path23.startsWith(`${ancestorPath}.`));
     if (descendantPath !== void 0) {
       return { ancestorPath, descendantPath };
     }
   }
   return void 0;
 }
-function getCanonicalAutomationStoreMutationPath(path22) {
-  const normalizedPath = normalizeStoreMutationPath(path22);
-  return normalizedPath._tag === "Ok" ? normalizedPath.value : path22.trim();
+function getCanonicalAutomationStoreMutationPath(path23) {
+  const normalizedPath = normalizeStoreMutationPath(path23);
+  return normalizedPath._tag === "Ok" ? normalizedPath.value : path23.trim();
 }
 
 // ../common/dist/src/utils/automation-store-mapping-path.util.js
@@ -14253,7 +14253,7 @@ var mappingDefinitionV1Schema = z14.object({
 
 // ../common/dist/src/zod-schemas/queue-work-item.schema.js
 var queueWorkItemEntrySchema = z15.object({
-  targetAutomationId: brandedStringValidator("publishedAutomationId").describe("The configured target automation. Its version is resolved from the saved caller configuration."),
+  targetAutomationId: brandedStringValidator("automationId").describe("The configured target automation. Its version is resolved from the saved caller configuration."),
   agentId: brandedStringValidator("agentId").describe("The configured root agent to start."),
   seedMappingId: brandedStringValidator("storeMappingId").optional().describe("The saved send mapping to initialize the target Store. Omit only when target defaults satisfy required fields."),
   delegatedValues: z15.array(z15.object({
@@ -14799,9 +14799,9 @@ var baseToolDeclarations = {
           path: []
         });
       }
-      const canonicalUpdatePaths = updates.map(({ path: path22 }) => getCanonicalAutomationStoreMutationPath(path22));
+      const canonicalUpdatePaths = updates.map(({ path: path23 }) => getCanonicalAutomationStoreMutationPath(path23));
       const canonicalClearPathSet = new Set(clears.map(getCanonicalAutomationStoreMutationPath));
-      const conflictedUpdatePath = canonicalUpdatePaths.find((path22) => canonicalClearPathSet.has(path22));
+      const conflictedUpdatePath = canonicalUpdatePaths.find((path23) => canonicalClearPathSet.has(path23));
       if (conflictedUpdatePath !== void 0) {
         context.addIssue({
           code: "custom",
@@ -15341,9 +15341,9 @@ var magicalApiKeyPermissionPresets = [
 import { z as z28 } from "zod";
 
 // ../common/dist/src/utils/agent-knowledge-base-assets.util.js
-function getIsKnowledgeBaseAssetPathAllowed(path22) {
-  const pathSegments = path22.split("/");
-  if (path22.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
+function getIsKnowledgeBaseAssetPathAllowed(path23) {
+  const pathSegments = path23.split("/");
+  if (path23.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
     return false;
   }
   const isTopLevelAssetPath = pathSegments[0] === "assets";
@@ -15398,29 +15398,29 @@ var ApiEmbeddedFileContentTypes = [
 ];
 var API_EMBEDDED_FILE_PATH_PATTERN = /^(?:\[\*\]|[A-Za-z_$][\w$-]*)(?:\[\*\]|\.[A-Za-z_$][\w$-]*)*$/u;
 var API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN = /\[\*\]|[A-Za-z_$][\w$-]*/gu;
-function parseApiEmbeddedFilePath(path22) {
-  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path22)) {
+function parseApiEmbeddedFilePath(path23) {
+  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path23)) {
     return void 0;
   }
-  return [...path22.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
+  return [...path23.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
 }
 var apiAgentEmbeddedFileSchema = z20.object({
-  path: z20.string().trim().min(1, "Embedded file path is required.").refine((path22) => parseApiEmbeddedFilePath(path22) !== void 0, {
+  path: z20.string().trim().min(1, "Embedded file path is required.").refine((path23) => parseApiEmbeddedFilePath(path23) !== void 0, {
     message: "Embedded file path must use object properties and [*] array wildcards."
   }).describe("Path to a Base64 value relative to the projected API response. Supports object properties and [*] array wildcards."),
   contentType: z20.enum(ApiEmbeddedFileContentTypes).describe("File type of the decoded Base64 value. Use auto to detect PDF, PNG, or JPEG from each file\u2019s contents. Unrecognized files are skipped.")
 }).strict();
 var apiAgentEmbeddedFilesSchema = z20.array(apiAgentEmbeddedFileSchema).superRefine((embeddedFiles, context) => {
   const paths = /* @__PURE__ */ new Set();
-  for (const [index, { path: path22 }] of embeddedFiles.entries()) {
-    if (paths.has(path22)) {
+  for (const [index, { path: path23 }] of embeddedFiles.entries()) {
+    if (paths.has(path23)) {
       context.addIssue({
         code: z20.ZodIssueCode.custom,
-        message: `Embedded file path "${path22}" can only be configured once.`,
+        message: `Embedded file path "${path23}" can only be configured once.`,
         path: [index, "path"]
       });
     }
-    paths.add(path22);
+    paths.add(path23);
   }
 }).describe("Base64 values to decode, upload as permanent files, and replace with file references in the projected API response.");
 
@@ -15430,13 +15430,13 @@ var API_REQUEST_FILE_PATH_PATTERN = /^[A-Za-z_$][\w$-]*(?:\.[A-Za-z_$][\w$-]*)*$
 var API_REQUEST_BASE64_FILE_HELPER_PATTERN = /^\s*\{\{\s*base64File\s+(?<sourceInput>[^{}\s]+)\s*\}\}\s*$/u;
 var API_REQUEST_BASE64_FILE_HELPER_USAGE_PATTERN = /\{\{\s*base64File\b/u;
 var API_REQUEST_BASE64_FILE_HELPER_EXAMPLE = "{{base64File fileInput}}";
-function parseApiRequestFilePath(path22) {
-  if (!API_REQUEST_FILE_PATH_PATTERN.test(path22)) {
+function parseApiRequestFilePath(path23) {
+  if (!API_REQUEST_FILE_PATH_PATTERN.test(path23)) {
     return void 0;
   }
-  return path22.split(".");
+  return path23.split(".");
 }
-function inspectApiRequestBase64FileHelperValue({ path: path22, value }) {
+function inspectApiRequestBase64FileHelperValue({ path: path23, value }) {
   const match = API_REQUEST_BASE64_FILE_HELPER_PATTERN.exec(value);
   if (match === null) {
     return API_REQUEST_BASE64_FILE_HELPER_USAGE_PATTERN.test(value) ? {
@@ -15444,7 +15444,7 @@ function inspectApiRequestBase64FileHelperValue({ path: path22, value }) {
       issues: [
         {
           message: `Use ${API_REQUEST_BASE64_FILE_HELPER_EXAMPLE} as the entire JSON field value.`,
-          path: path22
+          path: path23
         }
       ]
     } : { helpers: [], issues: [] };
@@ -15456,24 +15456,24 @@ function inspectApiRequestBase64FileHelperValue({ path: path22, value }) {
       issues: [
         {
           message: "Base64 file helper input must use an object property path.",
-          path: path22
+          path: path23
         }
       ]
     };
   }
   return {
-    helpers: [{ destinationPath: path22, sourceInput }],
+    helpers: [{ destinationPath: path23, sourceInput }],
     issues: []
   };
 }
-function inspectApiRequestBase64FileHelpers(body, path22 = []) {
+function inspectApiRequestBase64FileHelpers(body, path23 = []) {
   if (typeof body === "string") {
-    return inspectApiRequestBase64FileHelperValue({ path: path22, value: body });
+    return inspectApiRequestBase64FileHelperValue({ path: path23, value: body });
   }
   if (Array.isArray(body)) {
     return body.reduce((inspection, value, index) => {
       const nestedInspection = inspectApiRequestBase64FileHelpers(value, [
-        ...path22,
+        ...path23,
         index
       ]);
       return {
@@ -15487,7 +15487,7 @@ function inspectApiRequestBase64FileHelpers(body, path22 = []) {
   }
   return Object.entries(body).reduce((inspection, [key, value]) => {
     const nestedInspection = inspectApiRequestBase64FileHelpers(value, [
-      ...path22,
+      ...path23,
       key
     ]);
     return {
@@ -15531,10 +15531,10 @@ function validateApiRequestBase64FileHelpers({ body, bodyType, context, supports
   }
 }
 var apiAgentRequestFileEncodingSchema = z21.object({
-  sourceInput: z21.string().trim().min(1, "File input is required.").refine((path22) => parseApiRequestFilePath(path22) !== void 0, {
+  sourceInput: z21.string().trim().min(1, "File input is required.").refine((path23) => parseApiRequestFilePath(path23) !== void 0, {
     message: "File input must use an object property path."
   }).describe("API Agent input containing the file reference to encode."),
-  destinationPath: z21.string().trim().min(1, "Request field is required.").refine((path22) => parseApiRequestFilePath(path22) !== void 0, {
+  destinationPath: z21.string().trim().min(1, "Request field is required.").refine((path23) => parseApiRequestFilePath(path23) !== void 0, {
     message: "Request field must use an object property path."
   }).describe("JSON request body path where the encoded value is inserted."),
   encoding: z21.literal("base64").describe("Encoding applied to the source file before insertion.")
@@ -15894,30 +15894,30 @@ function hasControlCharacter(value) {
   }
   return false;
 }
-function isNormalizedRepoPath(path22) {
-  if (path22 === "/") {
+function isNormalizedRepoPath(path23) {
+  if (path23 === "/") {
     return true;
   }
-  if (path22.length === 0 || path22.startsWith("/") || path22.startsWith("\\") || path22.includes("\\") || hasControlCharacter(path22) || windowsAbsolutePathPattern.test(path22)) {
+  if (path23.length === 0 || path23.startsWith("/") || path23.startsWith("\\") || path23.includes("\\") || hasControlCharacter(path23) || windowsAbsolutePathPattern.test(path23)) {
     return false;
   }
-  return path22.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
+  return path23.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
 }
-function normalizeRepoPath(path22) {
-  if (path22 === "/") {
-    return path22;
+function normalizeRepoPath(path23) {
+  if (path23 === "/") {
+    return path23;
   }
-  return path22.replaceAll(/\/+$/gu, "");
+  return path23.replaceAll(/\/+$/gu, "");
 }
 var skillPathPattern = /^(?:skills\/.+|automations\/[^/]+\/skills\/.+|automations\/[^/]+\/agents\/[^/]+\/skills\/.+)$/u;
 var skillRootPathPattern = /^(?:skills\/[^/]+|automations\/[^/]+\/skills\/[^/]+|automations\/[^/]+\/agents\/[^/]+\/skills\/[^/]+)$/u;
 var repoPathSchema = z28.string().min(1).transform(normalizeRepoPath).refine(isNormalizedRepoPath, {
   message: "Path must be a normalized repository-relative path."
 });
-var registeredSkillPathSchema = repoPathSchema.refine((path22) => skillPathPattern.test(path22), {
+var registeredSkillPathSchema = repoPathSchema.refine((path23) => skillPathPattern.test(path23), {
   message: "Skill paths must be under root, automation, or automation-agent skills."
 });
-var registeredSkillRootPathSchema = registeredSkillPathSchema.refine((path22) => skillRootPathPattern.test(path22) && !path22.endsWith("/SKILL.md"), {
+var registeredSkillRootPathSchema = registeredSkillPathSchema.refine((path23) => skillRootPathPattern.test(path23) && !path23.endsWith("/SKILL.md"), {
   message: "Registered skill paths must identify a skill root directory."
 });
 var knowledgeBasePluginPermissionSchema = z28.object({
@@ -16354,6 +16354,364 @@ var automationRunStartConfigSchema = automationRunConfigBaseSchema.omit({
   networkTrafficCapture: networkTrafficCaptureSchema.nullable().optional().describe("Network traffic capture preference for this run. Omit to apply the implicit recording policy, pass null to explicitly disable capture, or pass a record/replay config to explicitly enable capture.")
 });
 
+// ../common/dist/src/zod-schemas/verification-records/verification-record-enums.schema.js
+import { z as z31 } from "zod";
+var verificationCheckKindSchema = z31.enum([
+  "automated_check",
+  "human_review"
+]);
+var verificationBatchKindSchema = z31.enum(["automated_batch"]);
+var automatedVerificationRecordKindSchema = z31.enum([
+  "automated_check",
+  "automated_batch"
+]);
+var verificationRecordStatusSchema = z31.enum([
+  "started",
+  "completed",
+  "failed"
+]);
+var verificationFailureCodeSchema = z31.enum([
+  "credential",
+  "fetch_incomplete",
+  "run_not_judgeable",
+  "answer_invalid",
+  "answer_missing",
+  "worker_lost",
+  "sampling_failed",
+  "grouping_failed",
+  "reporting_failed",
+  "agent_error",
+  "other"
+]);
+var verificationVerdictSchema = z31.enum([
+  "verified",
+  "issues_found",
+  "unverifiable_only",
+  "partial_clean",
+  "partial_issues_found",
+  "partial_unverifiable"
+]);
+var verificationRunCompletionSchema = z31.enum([
+  "complete",
+  "incomplete"
+]);
+var verificationAccuracyEligibilitySchema = z31.enum([
+  "included",
+  "excluded",
+  "unresolved"
+]);
+var principalTypeSchema = z31.enum([
+  "otto",
+  "session",
+  "workos-oauth",
+  "workos-user-api-key"
+]);
+
+// ../common/dist/src/zod-schemas/verification-records/verification-record.schema.js
+import { z as z32 } from "zod";
+var VERIFICATION_RECORD_SCHEMA_VERSION = 1;
+var VERIFICATION_RECORD_UPLOAD_MAX_ITEMS = 50;
+var safeCountSchema = z32.number().int().min(0).max(Number.MAX_SAFE_INTEGER);
+var nullableCountSchema = safeCountSchema.nullable();
+var utcDateTimeSchema = z32.iso.datetime({ offset: false });
+function uniqueStringArraySchema(elementSchema) {
+  return z32.array(elementSchema).refine((items) => new Set(items).size === items.length, {
+    message: "Array items must be unique."
+  });
+}
+var phaseNameSchema = z32.enum([
+  "sampling",
+  "shared_preparation",
+  "preparation",
+  "review",
+  "checks",
+  "combining",
+  "grouping",
+  "reporting"
+]);
+var measuredPhaseSplitSchema = z32.strictObject({
+  model_ms: safeCountSchema,
+  tool_ms: safeCountSchema,
+  idle_ms: safeCountSchema,
+  tool_calls: safeCountSchema
+});
+var unavailablePhaseSplitSchema = z32.strictObject({
+  model_ms: z32.null(),
+  tool_ms: z32.null(),
+  idle_ms: z32.null(),
+  tool_calls: z32.null()
+});
+var phaseBaseShape = {
+  name: phaseNameSchema,
+  started_at: utcDateTimeSchema.nullable(),
+  ended_at: utcDateTimeSchema.nullable(),
+  ms: nullableCountSchema,
+  after_finish: z32.boolean()
+};
+var verificationPhaseSchema = z32.union([
+  z32.strictObject({
+    ...phaseBaseShape,
+    ms: safeCountSchema,
+    ...measuredPhaseSplitSchema.shape
+  }),
+  z32.strictObject({ ...phaseBaseShape, ...unavailablePhaseSplitSchema.shape })
+]);
+var verificationTimingSchema = z32.strictObject({
+  started_at: utcDateTimeSchema,
+  finished_at: utcDateTimeSchema.nullable(),
+  elapsed_ms: nullableCountSchema,
+  phases: z32.array(verificationPhaseSchema),
+  flags: uniqueStringArraySchema(z32.enum(["mark_missing", "finished_by_coordinator", "idle_gap"])),
+  preparation_detail_ms: z32.record(z32.string(), safeCountSchema).nullable()
+});
+var verificationRuntimeSchema = z32.strictObject({
+  harness: z32.enum(["claude-code", "codex", "unsupported"]),
+  configured_model: z32.string().nullable(),
+  session_id: z32.string().nullable(),
+  agent_id: z32.string().nullable(),
+  invocation: z32.enum(["interactive", "scheduled", "worker", "unknown"]),
+  scheduled_task_id: z32.string().nullable(),
+  auth_mode: z32.enum(["saved_login", "api_key", "unknown"]),
+  credential_ref: z32.string().nullable()
+});
+var nativeUsageSchema = z32.strictObject({
+  cache_creation_input_tokens: safeCountSchema.optional(),
+  cache_creation: z32.strictObject({
+    ephemeral_5m_input_tokens: safeCountSchema.optional(),
+    ephemeral_1h_input_tokens: safeCountSchema.optional()
+  }).optional(),
+  cache_write_input_tokens: safeCountSchema.optional(),
+  service_tier: z32.string().nullable().optional()
+}).nullable();
+var verificationUsageEntrySchema = z32.strictObject({
+  phase: phaseNameSchema,
+  model: z32.string().nullable(),
+  inputTokens: nullableCountSchema,
+  outputTokens: nullableCountSchema,
+  cachedInputTokens: nullableCountSchema,
+  reasoningTokens: nullableCountSchema.optional(),
+  totalTokens: nullableCountSchema,
+  native: nativeUsageSchema,
+  note: z32.string().max(64).regex(/^[\d_a-z]+$/u).nullable()
+});
+var verificationFailureSchema = z32.strictObject({
+  phase: z32.enum([...phaseNameSchema.options, "unknown"]),
+  code: z32.string(),
+  message: z32.string().max(200)
+}).nullable();
+var linearIssueRefSchema = z32.strictObject({
+  id: z32.string().min(1),
+  identifier: z32.string().min(1),
+  url: z32.string().min(1),
+  action: z32.enum(["created", "bumped", "reopened"]),
+  fingerprint: z32.string().nullable()
+});
+var coverageSchema = z32.strictObject({
+  critical_steps: z32.strictObject({
+    checked: nullableCountSchema,
+    identified: nullableCountSchema,
+    identified_is_lower_bound: z32.boolean().nullable()
+  }),
+  screenshots: z32.strictObject({
+    reviewed: nullableCountSchema,
+    inventory: nullableCountSchema,
+    blank: nullableCountSchema,
+    unavailable: nullableCountSchema
+  }),
+  instructions: z32.strictObject({
+    read: nullableCountSchema,
+    agent_runs: nullableCountSchema
+  }),
+  unsupported_outcomes: nullableCountSchema
+}).nullable();
+var trackingSchema = z32.strictObject({
+  destination: z32.enum(["linear", "none"]),
+  mode: z32.enum(["off", "dry-run", "live"]),
+  status: z32.enum([
+    "not-configured",
+    "disabled",
+    "previewed",
+    "applied",
+    "blocked",
+    "partial"
+  ]),
+  project_id: z32.string().nullable(),
+  findings_in: nullableCountSchema,
+  groups_out: nullableCountSchema,
+  failures: z32.array(z32.strictObject({
+    code: z32.string().min(1).max(64).regex(/^[\d_a-z]+$/u),
+    message: z32.string().max(200),
+    action: z32.string().max(64).nullable(),
+    issue_refs: uniqueStringArraySchema(z32.string().min(1))
+  }))
+}).nullable();
+var reportingSchema = z32.strictObject({
+  surface: z32.enum(["markdown", "slack", "linear", "none", "unknown"]),
+  delivered: z32.boolean().nullable(),
+  permalink: z32.string().nullable()
+}).nullable();
+var recordBaseShape = {
+  schema_version: z32.literal(VERIFICATION_RECORD_SCHEMA_VERSION),
+  idempotency_key: z32.uuid(),
+  organization_id: z32.string().min(1),
+  deployment: z32.enum(["us", "uk", "stg"]),
+  runtime: verificationRuntimeSchema,
+  timing: verificationTimingSchema,
+  usage: z32.array(verificationUsageEntrySchema),
+  linear_issue_refs: z32.array(linearIssueRefSchema),
+  revision: z32.number().int().min(1)
+};
+var checkShape = {
+  ...recordBaseShape,
+  kind: z32.literal(verificationCheckKindSchema.enum.automated_check),
+  automation_id: z32.string().nullable(),
+  batch_id: z32.uuid().nullable(),
+  run_id: z32.uuid(),
+  work_item_id: z32.string().nullable(),
+  coverage: coverageSchema,
+  tracking: trackingSchema,
+  reporting: reportingSchema
+};
+var automatedCheckRecordSchema = z32.discriminatedUnion("status", [
+  z32.strictObject({
+    ...checkShape,
+    status: z32.literal(verificationRecordStatusSchema.enum.started),
+    failure: z32.null(),
+    output: z32.null(),
+    output_valid: z32.null()
+  }),
+  z32.strictObject({
+    ...checkShape,
+    status: z32.literal(verificationRecordStatusSchema.enum.completed),
+    failure: z32.null(),
+    output: z32.json().refine((output) => output !== null),
+    output_valid: z32.literal(true)
+  }),
+  z32.strictObject({
+    ...checkShape,
+    status: z32.literal(verificationRecordStatusSchema.enum.failed),
+    failure: verificationFailureSchema.unwrap(),
+    output: z32.json(),
+    output_valid: z32.boolean().nullable()
+  }).superRefine((record, context) => {
+    const answerInvalid = record.failure.code === "answer_invalid";
+    const knownFailureCode = verificationFailureCodeSchema.safeParse(record.failure.code).success;
+    if (answerInvalid && record.output_valid !== false) {
+      context.addIssue({
+        code: "custom",
+        path: ["output_valid"],
+        message: "Invalid answers require output_valid false."
+      });
+    }
+    if (knownFailureCode && !answerInvalid && (record.output !== null || record.output_valid !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["output"],
+        message: "Non-answer failures cannot include output."
+      });
+    }
+  })
+]).superRefine((record, context) => {
+  const isStarted = record.status === "started";
+  const hasStartedTiming = record.timing.finished_at === null && record.timing.elapsed_ms === null;
+  const hasTerminalTiming = record.timing.finished_at !== null && record.timing.elapsed_ms !== null;
+  if (isStarted ? !hasStartedTiming : !hasTerminalTiming) {
+    context.addIssue({
+      code: "custom",
+      path: ["timing"],
+      message: "Started records require unfinished timing; terminal records require finished timing."
+    });
+  }
+  if (record.batch_id !== null && (record.tracking !== null || record.reporting !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["batch_id"],
+      message: "Batch children cannot include tracking or reporting results."
+    });
+  }
+});
+var batchShape = {
+  ...recordBaseShape,
+  kind: z32.literal(verificationBatchKindSchema.enum.automated_batch),
+  automation_id: z32.string().min(1),
+  scope: z32.strictObject({
+    from: utcDateTimeSchema,
+    to: utcDateTimeSchema,
+    filters: z32.strictObject({
+      status: uniqueStringArraySchema(z32.string().min(1)),
+      invocation_type: uniqueStringArraySchema(z32.string().min(1))
+    }),
+    phrasing: z32.string().nullable()
+  }),
+  sampling: z32.strictObject({
+    requested: z32.string().min(1),
+    method: z32.enum(["random", "all", "explicit", "unknown"]),
+    pool: z32.strictObject({
+      total: nullableCountSchema,
+      published_total: nullableCountSchema,
+      paused: nullableCountSchema,
+      active: nullableCountSchema,
+      truncated: z32.boolean().nullable()
+    }),
+    selected: nullableCountSchema,
+    target: nullableCountSchema,
+    note: z32.string().nullable()
+  }).nullable(),
+  checks: z32.array(z32.strictObject({
+    run_id: z32.string().min(1),
+    check_keys: uniqueStringArraySchema(z32.uuid())
+  })).nullable(),
+  summary: z32.strictObject({
+    analyzed: nullableCountSchema,
+    eligible: nullableCountSchema,
+    verified: nullableCountSchema,
+    incomplete_by_category: z32.strictObject({
+      platform: nullableCountSchema.optional(),
+      agent: nullableCountSchema.optional(),
+      instructed: nullableCountSchema.optional(),
+      human: nullableCountSchema.optional(),
+      expected: nullableCountSchema.optional(),
+      unknown: nullableCountSchema.optional()
+    }).nullable(),
+    failed_checks: nullableCountSchema
+  }).nullable(),
+  tracking: trackingSchema,
+  reporting: reportingSchema
+};
+var automatedBatchRecordSchema = z32.discriminatedUnion("status", [
+  z32.strictObject({
+    ...batchShape,
+    status: z32.literal(verificationRecordStatusSchema.enum.started),
+    failure: z32.null()
+  }),
+  z32.strictObject({
+    ...batchShape,
+    status: z32.literal(verificationRecordStatusSchema.enum.completed),
+    failure: z32.null()
+  }),
+  z32.strictObject({
+    ...batchShape,
+    status: z32.literal(verificationRecordStatusSchema.enum.failed),
+    failure: verificationFailureSchema.unwrap()
+  })
+]).superRefine((record, context) => {
+  const isStarted = record.status === "started";
+  const hasStartedTiming = record.timing.finished_at === null && record.timing.elapsed_ms === null;
+  const hasTerminalTiming = record.timing.finished_at !== null && record.timing.elapsed_ms !== null;
+  if (isStarted ? !hasStartedTiming : !hasTerminalTiming) {
+    context.addIssue({
+      code: "custom",
+      path: ["timing"],
+      message: "Started records require unfinished timing; terminal records require finished timing."
+    });
+  }
+});
+var verificationRecordSchema = z32.union([
+  automatedCheckRecordSchema,
+  automatedBatchRecordSchema
+]);
+var verificationRecordPayloadSchema = z32.custom((value) => verificationRecordSchema.safeParse(value).success, { message: "Invalid verification record payload." });
+
 // ../common/dist/src/utils/automation-run-evidence.util.js
 var PORTAL_FILE_EXTENSIONS = [".csv", ".pdf"];
 var MAX_SCAN_DEPTH = 8;
@@ -16570,13 +16928,13 @@ function getMentionedStandardCommand(instructions) {
   const normalizedInstructions = instructions.toLowerCase();
   return STANDARD_COMMAND_NAMES.find((commandName) => normalizedInstructions.includes(commandName.toLowerCase())) ?? null;
 }
-function assertCustomInstructionsCommand({ commands, path: path22 }) {
-  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path22}[${commandIndex.toString()}]` }] : []);
+function assertCustomInstructionsCommand({ commands, path: path23 }) {
+  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path23}[${commandIndex.toString()}]` }] : []);
   if (customCommands.length === 0) {
     return;
   }
   if (customCommands.length > MAX_CUSTOM_COMMAND_COUNT) {
-    throw createInvalidValueError(`${path22} contains ${customCommands.length.toString()} custom commands. Use at most ${MAX_CUSTOM_COMMAND_COUNT.toString()} short custom commands per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
+    throw createInvalidValueError(`${path23} contains ${customCommands.length.toString()} custom commands. Use at most ${MAX_CUSTOM_COMMAND_COUNT.toString()} short custom commands per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
   }
   for (const customCommand of customCommands) {
     const instructions = getCustomInstructions(customCommand.command);
@@ -16634,7 +16992,7 @@ function encodeS3Crc32Checksum(checksum) {
 }
 
 // ../mcp-registry/src/operation-specs.ts
-import { z as z31 } from "zod";
+import { z as z33 } from "zod";
 
 // ../mcp-registry/src/operation-spec.ts
 function stripLeadingGraphqlComments(document) {
@@ -16885,26 +17243,26 @@ function jsonOption({
     valueType: "json"
   };
 }
-var jsonObjectSchema = z31.record(z31.string(), z31.unknown());
-var evalRunStatusSchema = z31.enum([
+var jsonObjectSchema = z33.record(z33.string(), z33.unknown());
+var evalRunStatusSchema = z33.enum([
   "QUEUED",
   "RUNNING",
   "COMPLETE",
   "FAILED",
   "CANCELLED"
 ]);
-var evalInputChoicesSchema = z31.record(
-  z31.string(),
-  z31.array(z31.unknown()).min(1)
+var evalInputChoicesSchema = z33.record(
+  z33.string(),
+  z33.array(z33.unknown()).min(1)
 );
-var registeredEvalRunInputSchema = z31.object({
-  description: z31.string().min(1).optional(),
+var registeredEvalRunInputSchema = z33.object({
+  description: z33.string().min(1).optional(),
   input: evalInputChoicesSchema,
-  maxConcurrency: z31.number().int().positive().default(1),
-  name: z31.string().min(1).optional(),
-  repeatCount: z31.number().int().positive().default(1),
-  slug: z31.string().min(1),
-  tags: z31.array(z31.string().min(1)).default([])
+  maxConcurrency: z33.number().int().positive().default(1),
+  name: z33.string().min(1).optional(),
+  repeatCount: z33.number().int().positive().default(1),
+  slug: z33.string().min(1),
+  tags: z33.array(z33.string().min(1)).default([])
 });
 var registeredEvalSelection = `    slug
     name
@@ -16958,7 +17316,7 @@ function isRecord3(value) {
 function validateCustomInstructionsCommands({
   commands,
   ctx,
-  path: path22
+  path: path23
 }) {
   if (!Array.isArray(commands)) {
     return;
@@ -16966,18 +17324,18 @@ function validateCustomInstructionsCommands({
   const validationResult = fromThrowable(() => {
     assertCustomInstructionsCommand({
       commands: commands.map((command) => isRecord3(command) ? command : {}),
-      path: path22.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
+      path: path23.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
     });
   }, "invalid-custom-instructions-command");
   if (isErr(validationResult)) {
     ctx.addIssue({
       code: "custom",
       message: `${getErrorMessage2(validationResult.error.cause)} Run mgcl catalog commands to find the standard command for this work.`,
-      path: path22
+      path: path23
     });
   }
 }
-var automationPatchOperationsSchema = z31.array(z31.unknown()).min(1).superRefine((operations, ctx) => {
+var automationPatchOperationsSchema = z33.array(z33.unknown()).min(1).superRefine((operations, ctx) => {
   for (const [operationIndex, operation] of operations.entries()) {
     if (!isRecord3(operation)) {
       continue;
@@ -17023,10 +17381,10 @@ var updateAutomationInputSchema = automationInputSchema([
   "newAgents",
   "updatedAgents"
 ]);
-var runDraftNetworkTrafficCaptureInputSchema = z31.object({
-  record: z31.boolean().nullable().optional(),
-  recordMode: z31.enum(NETWORK_TRAFFIC_CAPTURE_RECORD_MODES).nullable().optional(),
-  replay: z31.object({ recordingId: z31.uuid() }).strict().nullable().optional()
+var runDraftNetworkTrafficCaptureInputSchema = z33.object({
+  record: z33.boolean().nullable().optional(),
+  recordMode: z33.enum(NETWORK_TRAFFIC_CAPTURE_RECORD_MODES).nullable().optional(),
+  replay: z33.object({ recordingId: z33.uuid() }).strict().nullable().optional()
 }).strict().superRefine((value, ctx) => {
   const hasRecord = value.record !== null && value.record !== void 0;
   const hasRecordMode = value.recordMode !== null && value.recordMode !== void 0;
@@ -17125,6 +17483,10 @@ var apiKeyAccessPolicies = {
     type: "denied",
     reason: "Shared library operations do not have a public API-key permission."
   },
+  verificationRecordUploadDenied: {
+    type: "denied",
+    reason: "Verification-record uploads do not have a public API-key write permission."
+  },
   skillsRead: {
     type: "allOf",
     permissions: ["skills:read"]
@@ -17295,21 +17657,29 @@ var agentPluginsSelection = `      plugins {
           canEdit
         }
       }`;
-var automationRunsInputSchema = z31.object({
-  automationId: z31.string().min(1).optional(),
-  from: z31.string().min(1).optional(),
-  status: z31.array(z31.string().min(1)).optional(),
-  invocationType: z31.array(z31.string().min(1)).optional(),
-  limit: z31.number().int().positive().optional(),
-  orderBy: z31.enum(["createdAtAsc", "createdAtDesc", "random"]).optional(),
-  page: z31.number().int().nonnegative().optional(),
-  to: z31.string().min(1).optional(),
-  workflowIds: z31.array(z31.string().min(1)).optional(),
-  workItemId: z31.string().min(1).optional()
+var automationRunsInputSchema = z33.object({
+  automationId: z33.string().min(1).optional(),
+  search: z33.string().refine((value) => !value.includes("\0"), {
+    message: "Search cannot contain NUL characters."
+  }).optional(),
+  from: z33.string().min(1).optional(),
+  status: z33.array(z33.string().min(1)).optional(),
+  invocationType: z33.array(z33.string().min(1)).optional(),
+  limit: z33.number().int().positive().optional(),
+  orderBy: z33.enum(["createdAtAsc", "createdAtDesc", "random"]).optional(),
+  page: z33.number().int().nonnegative().optional(),
+  to: z33.string().min(1).optional(),
+  workflowIds: z33.array(z33.string().min(1)).optional(),
+  workItemId: z33.string().min(1).optional()
 }).refine(({ orderBy, page }) => orderBy !== "random" || (page ?? 0) === 0, {
   message: "Random ordering reshuffles on every call, so --page cannot be combined with --order-by random."
 });
 var automationRunsCliOptions = [
+  stringOption({
+    inputKey: "search",
+    flagName: "search",
+    description: "Case-insensitive substring search of run inputs, Data Store values, run IDs, and automation names. Outer whitespace is ignored; % and _ are SQL wildcards."
+  }),
   stringOption({
     inputKey: "automationId",
     flagName: "automation-id",
@@ -17362,11 +17732,170 @@ var automationRunsCliOptions = [
   })
 ];
 var operationSpecs = [
+  createOperationSpec({
+    operationName: "VerificationRecordUpload",
+    apiKeyAccess: apiKeyAccessPolicies.verificationRecordUploadDenied,
+    kind: "mutation",
+    inputSchema: z33.object({
+      records: z33.array(jsonObjectSchema).min(1).max(VERIFICATION_RECORD_UPLOAD_MAX_ITEMS)
+    }),
+    cli: {
+      name: "upload-verification-records",
+      path: ["verification-records", "upload"],
+      description: `Upload one to ${VERIFICATION_RECORD_UPLOAD_MAX_ITEMS} verification records from JSON.`,
+      resultKey: "verificationRecordUpload",
+      options: [
+        stringOption({
+          clientOnly: true,
+          description: "Path to a JSON array, or - to read stdin.",
+          flagName: "input-file",
+          inputKey: "inputFile",
+          required: true
+        })
+      ]
+    },
+    mcp: { exposed: false, fileName: "verificationRecordUpload.graphql" },
+    scope: "organization",
+    document: `# Upload verification records and return one result per input record
+mutation VerificationRecordUpload($records: [JSON!]!) {
+  verificationRecordUpload(records: $records)
+}`
+  }),
+  createOperationSpec({
+    operationName: "VerificationRecordGet",
+    apiKeyAccess: apiKeyAccessPolicies.runRead,
+    kind: "query",
+    inputSchema: z33.object({
+      id: z33.string().min(1),
+      kind: z33.enum(["automated_check", "automated_batch"])
+    }),
+    cli: {
+      name: "get-verification-record",
+      path: ["verification-records", "get"],
+      description: "Get one verification record by ID and kind.",
+      resultKey: "verificationRecordGet",
+      options: [
+        stringOption({
+          description: "Verification record ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        }),
+        stringOption({
+          description: "Record kind: automated_check or automated_batch.",
+          flagName: "kind",
+          inputKey: "kind",
+          required: true
+        })
+      ]
+    },
+    mcp: { exposed: false, fileName: "verificationRecordGet.graphql" },
+    scope: "organization",
+    document: `# Get one verification record by its table-disambiguated identity
+query VerificationRecordGet($id: ID!, $kind: String!) {
+  verificationRecordGet(id: $id, kind: $kind)
+}`
+  }),
+  createOperationSpec({
+    operationName: "VerificationRecordList",
+    apiKeyAccess: apiKeyAccessPolicies.runRead,
+    kind: "query",
+    inputSchema: z33.object({
+      automationId: z33.string().min(1).optional(),
+      automationRunId: z33.string().min(1).optional(),
+      batchId: z33.string().min(1).optional(),
+      subjectCheckId: z33.string().min(1).optional(),
+      kind: z33.enum(["automated_check", "automated_batch"]).optional(),
+      from: z33.string().min(1).optional(),
+      to: z33.string().min(1).optional(),
+      limit: z33.number().int().min(1).max(100).default(20),
+      cursor: z33.string().min(1).optional()
+    }),
+    cli: {
+      name: "list-verification-records",
+      path: ["verification-records", "list"],
+      description: "List verification records with filters and pagination.",
+      resultKey: "verificationRecordList",
+      options: [
+        stringOption({
+          description: "Filter by automation ID.",
+          flagName: "automation-id",
+          inputKey: "automationId"
+        }),
+        stringOption({
+          description: "Filter by automation run ID.",
+          flagName: "automation-run-id",
+          inputKey: "automationRunId"
+        }),
+        stringOption({
+          description: "Filter checks by parent batch record ID.",
+          flagName: "batch-id",
+          inputKey: "batchId"
+        }),
+        stringOption({
+          description: "Reserved for future human reviews. Current automated records have no subject check and do not match this filter.",
+          flagName: "subject-check-id",
+          inputKey: "subjectCheckId"
+        }),
+        stringOption({
+          description: "Record kind: automated_check or automated_batch.",
+          flagName: "kind",
+          inputKey: "kind"
+        }),
+        stringOption({
+          description: "Inclusive started-at lower bound as an ISO timestamp.",
+          flagName: "from",
+          inputKey: "from"
+        }),
+        stringOption({
+          description: "Inclusive started-at upper bound as an ISO timestamp.",
+          flagName: "to",
+          inputKey: "to"
+        }),
+        numberOption({
+          description: "Maximum records to return. Defaults to 20; maximum 100.",
+          flagName: "limit",
+          inputKey: "limit"
+        }),
+        stringOption({
+          description: "Opaque pagination cursor from a previous response.",
+          flagName: "cursor",
+          inputKey: "cursor"
+        })
+      ]
+    },
+    mcp: { exposed: false, fileName: "verificationRecordList.graphql" },
+    scope: "organization",
+    document: `# List verification records with optional filters and cursor pagination
+query VerificationRecordList(
+  $automationId: ID
+  $automationRunId: ID
+  $batchId: ID
+  $subjectCheckId: ID
+  $kind: String
+  $from: String
+  $to: String
+  $limit: Int
+  $cursor: String
+) {
+  verificationRecordList(
+    automationId: $automationId
+    automationRunId: $automationRunId
+    batchId: $batchId
+    subjectCheckId: $subjectCheckId
+    kind: $kind
+    from: $from
+    to: $to
+    limit: $limit
+    cursor: $cursor
+  )
+}`
+  }),
   createOperationSpec({
     operationName: "Classify",
     apiKeyAccess: apiKeyAccessPolicies.baseline,
     kind: "query",
-    inputSchema: z31.object({ input: jsonObjectSchema }),
+    inputSchema: z33.object({ input: jsonObjectSchema }),
     cli: {
       name: "classify",
       path: ["classify"],
@@ -17405,9 +17934,9 @@ query Classify($input: JSON!) {
     operationName: "KnowledgeFiles",
     apiKeyAccess: apiKeyAccessPolicies.knowledgeRead,
     kind: "query",
-    inputSchema: z31.object({
-      path: z31.string().min(1).optional(),
-      ref: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      path: z33.string().min(1).optional(),
+      ref: z33.string().min(1).optional()
     }),
     cli: {
       name: "list-knowledge-files",
@@ -17450,10 +17979,10 @@ query KnowledgeFiles($path: String, $ref: String) {
     operationName: "KnowledgeFileHistory",
     apiKeyAccess: apiKeyAccessPolicies.knowledgeRead,
     kind: "query",
-    inputSchema: z31.object({
-      limit: z31.number().int().positive().max(100).optional(),
-      path: z31.string().min(1),
-      ref: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      limit: z33.number().int().positive().max(100).optional(),
+      path: z33.string().min(1),
+      ref: z33.string().min(1).optional()
     }),
     cli: {
       name: "knowledge-file-history",
@@ -17497,7 +18026,7 @@ query KnowledgeFileHistory($path: String!, $ref: String, $limit: Int) {
     operationName: "KnowledgeFile",
     apiKeyAccess: apiKeyAccessPolicies.knowledgeRead,
     kind: "query",
-    inputSchema: z31.object({ key: z31.string().min(1) }),
+    inputSchema: z33.object({ key: z33.string().min(1) }),
     cli: {
       name: "read-knowledge-file",
       path: ["knowledge", "read"],
@@ -17536,9 +18065,9 @@ query KnowledgeFile($key: String!) {
     operationName: "MemoryFiles",
     apiKeyAccess: apiKeyAccessPolicies.memoryRead,
     kind: "query",
-    inputSchema: z31.object({
-      path: z31.string().min(1).optional(),
-      ref: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      path: z33.string().min(1).optional(),
+      ref: z33.string().min(1).optional()
     }),
     cli: {
       name: "list-memory-files",
@@ -17572,10 +18101,10 @@ query MemoryFiles($path: String, $ref: String) {
     operationName: "MemoryFileHistory",
     apiKeyAccess: apiKeyAccessPolicies.memoryRead,
     kind: "query",
-    inputSchema: z31.object({
-      limit: z31.number().int().positive().max(100).optional(),
-      path: z31.string().min(1),
-      ref: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      limit: z33.number().int().positive().max(100).optional(),
+      path: z33.string().min(1),
+      ref: z33.string().min(1).optional()
     }),
     cli: {
       name: "memory-file-history",
@@ -17619,7 +18148,7 @@ query MemoryFileHistory($path: String!, $ref: String, $limit: Int) {
     operationName: "MemoryFile",
     apiKeyAccess: apiKeyAccessPolicies.memoryRead,
     kind: "query",
-    inputSchema: z31.object({ key: z31.string().min(1) }),
+    inputSchema: z33.object({ key: z33.string().min(1) }),
     cli: {
       name: "read-memory-file",
       path: ["memories", "read"],
@@ -17658,11 +18187,11 @@ query MemoryFile($key: String!) {
     operationName: "CreateFileUpload",
     apiKeyAccess: apiKeyAccessPolicies.filesWrite,
     kind: "mutation",
-    inputSchema: z31.object({
-      checksum: z31.string().min(1),
-      mimeType: z31.string().min(1),
-      name: z31.string().min(1),
-      sizeBytes: z31.number().int().nonnegative()
+    inputSchema: z33.object({
+      checksum: z33.string().min(1),
+      mimeType: z33.string().min(1),
+      name: z33.string().min(1),
+      sizeBytes: z33.number().int().nonnegative()
     }),
     cli: {
       name: "upload",
@@ -17693,9 +18222,9 @@ mutation CreateFileUpload($checksum: String!, $mimeType: String!, $name: String!
     operationName: "GetCaptureContext",
     apiKeyAccess: apiKeyAccessPolicies.captureRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationId: z31.string().min(1).optional(),
-      recordingId: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      automationId: z33.string().min(1).optional(),
+      recordingId: z33.string().min(1).optional()
     }).refine(
       ({ automationId, recordingId }) => [automationId, recordingId].some((value) => value !== void 0),
       { message: "Provide --automation-id or --recording-id." }
@@ -17737,10 +18266,10 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
       reason: "Agent transfer requires user login; shared library access has no API-key permission."
     },
     kind: "query",
-    inputSchema: z31.object({
-      ids: z31.array(z31.string().min(1)).min(1),
-      libraryEntityId: z31.string().min(1).optional(),
-      automationVersionId: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      ids: z33.array(z33.string().min(1)).min(1),
+      libraryEntityId: z33.string().min(1).optional(),
+      automationVersionId: z33.string().min(1).optional()
     }).refine(
       (input) => Boolean(input.libraryEntityId) !== Boolean(input.automationVersionId),
       {
@@ -17783,10 +18312,10 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
       reason: "Agent transfer requires user login; shared library access has no API-key permission."
     },
     kind: "mutation",
-    inputSchema: z31.object({
-      automationId: z31.string().min(1),
-      baseVersionId: z31.string().min(1),
-      data: z31.unknown().refine((value) => value !== void 0, {
+    inputSchema: z33.object({
+      automationId: z33.string().min(1),
+      baseVersionId: z33.string().min(1),
+      data: z33.unknown().refine((value) => value !== void 0, {
         message: "Agent export data is required."
       })
     }),
@@ -17826,9 +18355,9 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
     operationName: "LibraryAssetSearch",
     apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
     kind: "query",
-    inputSchema: z31.object({
-      query: z31.string().min(1).optional(),
-      limit: z31.number().int().min(1).max(50).optional()
+    inputSchema: z33.object({
+      query: z33.string().min(1).optional(),
+      limit: z33.number().int().min(1).max(50).optional()
     }),
     cli: {
       name: "library-asset-search",
@@ -17864,8 +18393,8 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
     operationName: "LibraryAssetWorkbench",
     apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
     kind: "query",
-    inputSchema: z31.object({
-      libraryEntityId: z31.string().min(1)
+    inputSchema: z33.object({
+      libraryEntityId: z33.string().min(1)
     }),
     cli: {
       name: "library-asset-get",
@@ -17892,8 +18421,8 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
     operationName: "CreateLibraryAsset",
     apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
     kind: "mutation",
-    inputSchema: z31.object({
-      assetName: z31.string().trim().min(1).optional()
+    inputSchema: z33.object({
+      assetName: z33.string().trim().min(1).optional()
     }),
     cli: {
       name: "create-library-asset",
@@ -17919,11 +18448,11 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
     operationName: "ConvertAutomationSubtreeToLibraryAsset",
     apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
     kind: "mutation",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      rootAgentId: z31.string().min(1),
-      baseVersionId: z31.string().min(1),
-      assetName: z31.string().trim().min(1).optional()
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      rootAgentId: z33.string().min(1),
+      baseVersionId: z33.string().min(1),
+      assetName: z33.string().trim().min(1).optional()
     }),
     cli: {
       name: "convert-to-library-asset",
@@ -17983,11 +18512,11 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
     operationName: "ImportLibraryAssetToAutomation",
     apiKeyAccess: apiKeyAccessPolicies.libraryDenied,
     kind: "mutation",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      libraryEntityId: z31.string().min(1),
-      baseVersionId: z31.string().min(1),
-      parentAgentId: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      libraryEntityId: z33.string().min(1),
+      baseVersionId: z33.string().min(1),
+      parentAgentId: z33.string().min(1).optional()
     }),
     cli: {
       name: "import-library-asset",
@@ -18048,8 +18577,8 @@ query GetCaptureContext($automationId: ID, $recordingId: ID) {
     operationName: "GetAgents",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      ids: z31.array(z31.string().min(1)).min(1)
+    inputSchema: z33.object({
+      ids: z33.array(z33.string().min(1)).min(1)
     }),
     cli: {
       name: "get-agents",
@@ -18113,10 +18642,10 @@ ${agentPluginsSelection}
     operationName: "GetAgentVersion",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      agentId: z31.string().min(1),
-      versionId: z31.string().min(1)
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      agentId: z33.string().min(1),
+      versionId: z33.string().min(1)
     }),
     cli: {
       name: "get-agent-version",
@@ -18193,9 +18722,9 @@ ${agentPluginsSelection}
     operationName: "GetAgentVersions",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      agentId: z31.string().min(1)
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      agentId: z33.string().min(1)
     }),
     cli: {
       name: "get-agent-versions",
@@ -18236,11 +18765,11 @@ query GetAgentVersions($draftAutomationId: ID!, $agentId: ID!) {
     operationName: "DiffAgentVersion",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      agentId: z31.string().min(1),
-      versionId: z31.string().min(1),
-      compareVersionId: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      agentId: z33.string().min(1),
+      versionId: z33.string().min(1),
+      compareVersionId: z33.string().min(1).optional()
     }),
     cli: {
       name: "diff-agent-version",
@@ -18303,8 +18832,8 @@ query DiffAgentVersion(
     operationName: "GetAgentRun",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      id: z31.string().min(1)
+    inputSchema: z33.object({
+      id: z33.string().min(1)
     }),
     cli: {
       name: "get-agent-run",
@@ -18342,8 +18871,8 @@ query GetAgentRun($id: ID!) {
     operationName: "GetAutomationAgents",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      ids: z31.array(z31.string().min(1)).min(1)
+    inputSchema: z33.object({
+      ids: z33.array(z33.string().min(1)).min(1)
     }),
     cli: {
       name: "get-automation-agents",
@@ -18387,9 +18916,9 @@ query GetAutomationAgents($ids: [ID!]!) {
     operationName: "GetAutomationDiffFromPublished",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationId: z31.uuid("--automation-id must be a UUID."),
-      branchId: z31.uuid("--branch-id must be a UUID.").optional()
+    inputSchema: z33.object({
+      automationId: z33.uuid("--automation-id must be a UUID."),
+      branchId: z33.uuid("--branch-id must be a UUID.").optional()
     }),
     cli: {
       branchContext: "optional",
@@ -18425,9 +18954,9 @@ query GetAutomationDiffFromPublished($automationId: ID!, $branchId: ID) {
     operationName: "GetAutomationDiffVersions",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      baseVersionId: z31.string().min(1),
-      targetVersionId: z31.string().min(1)
+    inputSchema: z33.object({
+      baseVersionId: z33.string().min(1),
+      targetVersionId: z33.string().min(1)
     }),
     cli: {
       name: "get-automation-diff-versions",
@@ -18469,10 +18998,10 @@ query GetAutomationDiffVersions($baseVersionId: ID!, $targetVersionId: ID!) {
     operationName: "GetAutomationVersionJson",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      versionId: z31.string().min(1),
-      paths: z31.array(z31.string().min(1)).optional(),
-      format: z31.enum(["normalized", "full", "export"]).optional()
+    inputSchema: z33.object({
+      versionId: z33.string().min(1),
+      paths: z33.array(z33.string().min(1)).optional(),
+      format: z33.enum(["normalized", "full", "export"]).optional()
     }),
     cli: {
       name: "get-automation-version-json",
@@ -18508,8 +19037,8 @@ query GetAutomationVersionJson($versionId: ID!, $paths: [String!], $format: Stri
     operationName: "GetAutomationVersionJsonSkeleton",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      versionId: z31.string().min(1)
+    inputSchema: z33.object({
+      versionId: z33.string().min(1)
     }),
     cli: {
       name: "get-automation-version-json-skeleton",
@@ -18535,8 +19064,8 @@ query GetAutomationVersionJsonSkeleton($versionId: ID!) {
     operationName: "GetAutomationRun",
     apiKeyAccess: apiKeyAccessPolicies.runStoreRead,
     kind: "query",
-    inputSchema: z31.object({
-      id: z31.string().min(1)
+    inputSchema: z33.object({
+      id: z33.string().min(1)
     }),
     cli: {
       name: "get-automation-run",
@@ -18581,8 +19110,8 @@ query GetAutomationRun($id: ID!) {
     operationName: "GetAutomationRunAgentRuns",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1)
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1)
     }),
     cli: {
       name: "get-automation-run-agent-runs",
@@ -18620,12 +19149,12 @@ query GetAutomationRunAgentRuns($automationRunId: ID!) {
     operationName: "GetAutomationRunIterations",
     apiKeyAccess: apiKeyAccessPolicies.runStoreRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1),
-      agentRunId: z31.string().min(1).optional(),
-      limit: z31.number().int().positive().optional(),
-      page: z31.number().int().nonnegative().optional(),
-      reverse: z31.boolean().optional()
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1),
+      agentRunId: z33.string().min(1).optional(),
+      limit: z33.number().int().positive().optional(),
+      page: z33.number().int().nonnegative().optional(),
+      reverse: z33.boolean().optional()
     }),
     cli: {
       name: "get-automation-run-iterations",
@@ -18704,8 +19233,8 @@ query GetAutomationRunIterations(
     operationName: "GetFileAsset",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      key: z31.string().min(1)
+    inputSchema: z33.object({
+      key: z33.string().min(1)
     }),
     cli: {
       name: "get-file",
@@ -18746,9 +19275,9 @@ query GetFileAsset($key: String!) {
     operationName: "GetIterationScreenshot",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      iterationId: z31.string().min(1),
-      hasMarks: z31.boolean().default(false)
+    inputSchema: z33.object({
+      iterationId: z33.string().min(1),
+      hasMarks: z33.boolean().default(false)
     }),
     cli: {
       name: "get-iteration-screenshot",
@@ -18783,9 +19312,9 @@ query GetIterationScreenshot($iterationId: ID!, $hasMarks: Boolean = false) {
     operationName: "GetIterationToolResultMedia",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      iterationId: z31.uuid(),
-      mediaId: z31.uuid()
+    inputSchema: z33.object({
+      iterationId: z33.uuid(),
+      mediaId: z33.uuid()
     }),
     cli: {
       name: "get-iteration-tool-result-media",
@@ -18832,8 +19361,8 @@ query GetIterationToolResultMedia($iterationId: ID!, $mediaId: ID!) {
     operationName: "InspectPausedAutomationStep",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      runId: z31.string().min(1)
+    inputSchema: z33.object({
+      runId: z33.string().min(1)
     }),
     cli: {
       name: "inspect-paused-automation-step",
@@ -18896,6 +19425,7 @@ query InspectPausedAutomationStep($runId: ID!) {
     document: `# Query automation run history with optional automation, workflow, and time-window filters
 query GetAutomationRuns(
   $automationId: ID
+  $search: String
   $from: String
   $status: [RunStatus!]
   $invocationType: [InvocationType!]
@@ -18908,6 +19438,7 @@ query GetAutomationRuns(
 ) {
   automationRuns(
     automationId: $automationId
+    search: $search
     from: $from
     status: $status
     invocationType: $invocationType
@@ -18950,6 +19481,7 @@ query GetAutomationRuns(
     document: `# Query automation run history with optional filters and a bounded total
 query GetAutomationRunsPage(
   $automationId: ID
+  $search: String
   $from: String
   $status: [RunStatus!]
   $invocationType: [InvocationType!]
@@ -18962,6 +19494,7 @@ query GetAutomationRunsPage(
 ) {
   automationRunsPage(
     automationId: $automationId
+    search: $search
     from: $from
     status: $status
     invocationType: $invocationType
@@ -18991,6 +19524,7 @@ query GetAutomationRunsPage(
     page
     pageSize
     isTotalTruncated
+    hasMore
   }
 }`
   }),
@@ -18998,8 +19532,8 @@ query GetAutomationRunsPage(
     operationName: "GetWorkItem",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      id: z31.string().min(1)
+    inputSchema: z33.object({
+      id: z33.string().min(1)
     }),
     cli: {
       name: "get-work-item",
@@ -19036,12 +19570,12 @@ query GetWorkItem($id: ID!) {
     operationName: "GetWorkItems",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationId: z31.string().min(1).optional(),
-      parentWorkItemId: z31.string().min(1).optional(),
-      status: z31.array(z31.string().min(1)).optional(),
-      limit: z31.number().int().positive().optional(),
-      page: z31.number().int().nonnegative().optional()
+    inputSchema: z33.object({
+      automationId: z33.string().min(1).optional(),
+      parentWorkItemId: z33.string().min(1).optional(),
+      status: z33.array(z33.string().min(1)).optional(),
+      limit: z33.number().int().positive().optional(),
+      page: z33.number().int().nonnegative().optional()
     }),
     cli: {
       name: "get-work-items",
@@ -19109,7 +19643,7 @@ query GetWorkItems(
     operationName: "ListWorkflows",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({}),
+    inputSchema: z33.object({}),
     cli: {
       name: "list-workflows",
       path: ["workflows", "list"],
@@ -19130,8 +19664,8 @@ query ListWorkflows {
     operationName: "ListAutomations",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      limit: z31.number().int().positive().optional(),
+    inputSchema: z33.object({
+      limit: z33.number().int().positive().optional(),
       order: jsonObjectSchema.optional(),
       where: jsonObjectSchema.optional()
     }),
@@ -19187,8 +19721,8 @@ query ListAutomations(
     operationName: "GetAutomations",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      ids: z31.array(z31.string().min(1)).min(1)
+    inputSchema: z33.object({
+      ids: z33.array(z33.string().min(1)).min(1)
     }),
     cli: {
       name: "get-automations",
@@ -19241,8 +19775,8 @@ query GetAutomations($ids: [ID!]!) {
     operationName: "ViewAutomationReview",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationId: z31.string().min(1)
+    inputSchema: z33.object({
+      automationId: z33.string().min(1)
     }),
     cli: {
       name: "view-automation-review",
@@ -19277,8 +19811,8 @@ query ViewAutomationReview($automationId: ID!) {
     operationName: "ListAutomationBranches",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationId: z31.uuid("--automation-id must be a UUID.")
+    inputSchema: z33.object({
+      automationId: z33.uuid("--automation-id must be a UUID.")
     }),
     cli: {
       name: "list-automation-branches",
@@ -19313,14 +19847,14 @@ query ListAutomationBranches($automationId: ID!) {
     operationName: "CreateAutomationBranch",
     apiKeyAccess: apiKeyAccessPolicies.automationWrite,
     kind: "mutation",
-    inputSchema: z31.object({
-      automationId: z31.uuid("--automation-id must be a UUID."),
-      name: z31.string().regex(AUTOMATION_BRANCH_NAME_PATTERN, AUTOMATION_BRANCH_NAME_MESSAGE).max(
+    inputSchema: z33.object({
+      automationId: z33.uuid("--automation-id must be a UUID."),
+      name: z33.string().regex(AUTOMATION_BRANCH_NAME_PATTERN, AUTOMATION_BRANCH_NAME_MESSAGE).max(
         AUTOMATION_BRANCH_NAME_MAX_LENGTH,
         AUTOMATION_BRANCH_NAME_MAX_LENGTH_MESSAGE
       ),
-      sourceBranchId: z31.uuid("--source-branch-id must be a UUID.").optional(),
-      sourceVersionId: z31.uuid("--source-version-id must be a UUID.").optional()
+      sourceBranchId: z33.uuid("--source-branch-id must be a UUID.").optional(),
+      sourceVersionId: z33.uuid("--source-version-id must be a UUID.").optional()
     }),
     cli: {
       name: "create-automation-branch",
@@ -19381,9 +19915,9 @@ mutation CreateAutomationBranch(
     operationName: "GetAutomationBranch",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationId: z31.uuid("--automation-id must be a UUID."),
-      branchId: z31.uuid("--branch-id must be a UUID.")
+    inputSchema: z33.object({
+      automationId: z33.uuid("--automation-id must be a UUID."),
+      branchId: z33.uuid("--branch-id must be a UUID.")
     }),
     cli: {
       branchContext: "required",
@@ -19414,9 +19948,9 @@ query GetAutomationBranch($automationId: ID!, $branchId: ID!) {
     operationName: "MergeAutomationBranch",
     apiKeyAccess: apiKeyAccessPolicies.automationWrite,
     kind: "mutation",
-    inputSchema: z31.object({
-      automationId: z31.uuid("--automation-id must be a UUID."),
-      branchId: z31.uuid("--branch-id must be a UUID.")
+    inputSchema: z33.object({
+      automationId: z33.uuid("--automation-id must be a UUID."),
+      branchId: z33.uuid("--branch-id must be a UUID.")
     }),
     cli: {
       branchContext: "required",
@@ -19491,9 +20025,9 @@ mutation MergeAutomationBranch($automationId: ID!, $branchId: ID!) {
     operationName: "PreviewAutomationBranchMerge",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationId: z31.uuid("--automation-id must be a UUID."),
-      branchId: z31.uuid("--branch-id must be a UUID.")
+    inputSchema: z33.object({
+      automationId: z33.uuid("--automation-id must be a UUID."),
+      branchId: z33.uuid("--branch-id must be a UUID.")
     }),
     cli: {
       branchContext: "required",
@@ -19540,11 +20074,11 @@ query PreviewAutomationBranchMerge($automationId: ID!, $branchId: ID!) {
     operationName: "DiscardAutomationBranchChanges",
     apiKeyAccess: apiKeyAccessPolicies.automationWrite,
     kind: "mutation",
-    inputSchema: z31.object({
-      automationId: z31.uuid("--automation-id must be a UUID."),
-      branchId: z31.uuid("--branch-id must be a UUID."),
-      changeIds: z31.array(
-        z31.string().min(1).max(
+    inputSchema: z33.object({
+      automationId: z33.uuid("--automation-id must be a UUID."),
+      branchId: z33.uuid("--branch-id must be a UUID."),
+      changeIds: z33.array(
+        z33.string().min(1).max(
           AUTOMATION_BRANCH_CHANGE_ID_MAX_LENGTH,
           `--change-ids entries must be at most ${AUTOMATION_BRANCH_CHANGE_ID_MAX_LENGTH} characters.`
         )
@@ -19552,8 +20086,8 @@ query PreviewAutomationBranchMerge($automationId: ID!, $branchId: ID!) {
         AUTOMATION_BRANCH_DISCARD_MAX_CHANGE_IDS,
         `--change-ids can name at most ${AUTOMATION_BRANCH_DISCARD_MAX_CHANGE_IDS} preview change ids per run.`
       ),
-      sourceVersionId: z31.uuid("--source-version-id must be a UUID."),
-      targetVersionId: z31.uuid("--target-version-id must be a UUID.")
+      sourceVersionId: z33.uuid("--source-version-id must be a UUID."),
+      targetVersionId: z33.uuid("--target-version-id must be a UUID.")
     }),
     cli: {
       branchContext: "required",
@@ -19708,8 +20242,8 @@ query AnalyzeAutomationStoreMigration(
     operationName: "GetAvailableCommands",
     apiKeyAccess: apiKeyAccessPolicies.baseline,
     kind: "query",
-    inputSchema: z31.object({
-      env: z31.string().min(1)
+    inputSchema: z33.object({
+      env: z33.string().min(1)
     }),
     cli: {
       name: "get-available-commands",
@@ -19743,9 +20277,9 @@ query GetAvailableCommands($env: AvailableCommandsEnv!) {
     operationName: "GetAvailableModels",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      agentId: z31.string().min(1),
-      automationId: z31.string().min(1)
+    inputSchema: z33.object({
+      agentId: z33.string().min(1),
+      automationId: z33.string().min(1)
     }),
     cli: {
       name: "get-available-models",
@@ -19797,9 +20331,9 @@ query GetAvailableModels($agentId: String!, $automationId: String!) {
     operationName: "GetAvailableTools",
     apiKeyAccess: apiKeyAccessPolicies.availableTools,
     kind: "query",
-    inputSchema: z31.object({
-      env: z31.string().min(1),
-      automationId: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      env: z33.string().min(1),
+      automationId: z33.string().min(1).optional()
     }),
     cli: {
       name: "get-available-tools",
@@ -19834,8 +20368,8 @@ query GetAvailableTools($env: AvailableCommandsEnv!, $automationId: String) {
     operationName: "GetFeatureFlagsContext",
     apiKeyAccess: apiKeyAccessPolicies.featureFlagsDenied,
     kind: "query",
-    inputSchema: z31.object({
-      flagKeys: z31.array(z31.string().min(1)).min(1).max(100).optional()
+    inputSchema: z33.object({
+      flagKeys: z33.array(z33.string().min(1)).min(1).max(100).optional()
     }),
     cli: {
       name: "get-feature-flags-context",
@@ -19873,7 +20407,7 @@ query GetFeatureFlagsContext($flagKeys: [String!]) {
     operationName: "GetAutomationWorkbenchCredentials",
     apiKeyAccess: apiKeyAccessPolicies.credentialsRead,
     kind: "query",
-    inputSchema: z31.object({}),
+    inputSchema: z33.object({}),
     cli: {
       name: "get-automation-workbench-credentials",
       path: ["workbench", "credentials"],
@@ -19899,9 +20433,9 @@ query GetAutomationWorkbenchCredentials {
     operationName: "GetAutomationWorkbenchDiagnostics",
     apiKeyAccess: apiKeyAccessPolicies.automationRead,
     kind: "query",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      branchId: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      branchId: z33.string().min(1).optional()
     }),
     cli: {
       branchContext: "optional",
@@ -19970,11 +20504,11 @@ query GetAutomationWorkbenchDiagnostics($draftAutomationId: ID!, $branchId: ID)
     operationName: "GetAutomationWorkbenchRunTrace",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1),
-      agentRunId: z31.string().min(1).optional(),
-      limit: z31.number().int().positive().optional(),
-      reverse: z31.boolean().optional()
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1),
+      agentRunId: z33.string().min(1).optional(),
+      limit: z33.number().int().positive().optional(),
+      reverse: z33.boolean().optional()
     }),
     cli: {
       name: "get-automation-workbench-run-trace",
@@ -20107,13 +20641,13 @@ query GetAutomationWorkbenchRunTrace(
     operationName: "GetAutomationWorkbenchAwaitRunCompletion",
     apiKeyAccess: apiKeyAccessPolicies.runRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1),
-      timeoutMs: z31.number().int().min(1e3).max(6e4).optional(),
-      sinceSequence: z31.number().int().min(0).optional(),
-      agentRunId: z31.string().min(1).optional(),
-      limit: z31.number().int().positive().optional(),
-      reverse: z31.boolean().optional()
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1),
+      timeoutMs: z33.number().int().min(1e3).max(6e4).optional(),
+      sinceSequence: z33.number().int().min(0).optional(),
+      agentRunId: z33.string().min(1).optional(),
+      limit: z33.number().int().positive().optional(),
+      reverse: z33.boolean().optional()
     }),
     cli: {
       name: "await-automation-workbench-run-completion",
@@ -20268,16 +20802,16 @@ query GetAutomationWorkbenchAwaitRunCompletion(
     operationName: "GetAutomationWorkbenchSchemaSuggestions",
     apiKeyAccess: apiKeyAccessPolicies.workbenchSchemaSuggestionsRead,
     kind: "query",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1),
-      draftAutomationId: z31.string().min(1).optional(),
-      branchId: z31.string().min(1).optional(),
-      minConfidence: z31.number().min(0).max(1).optional(),
-      includeSensitive: z31.boolean().optional()
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1),
+      draftAutomationId: z33.string().min(1).optional(),
+      branchId: z33.string().min(1).optional(),
+      minConfidence: z33.number().min(0).max(1).optional(),
+      includeSensitive: z33.boolean().optional()
     }).superRefine((input, ctx) => {
       if (input.branchId && !input.draftAutomationId) {
         ctx.addIssue({
-          code: z31.ZodIssueCode.custom,
+          code: z33.ZodIssueCode.custom,
           message: "--branch-id requires --draft-automation-id."
         });
       }
@@ -20354,8 +20888,8 @@ query GetAutomationWorkbenchSchemaSuggestions(
     operationName: "skills_list",
     apiKeyAccess: apiKeyAccessPolicies.skillsRead,
     kind: "query",
-    inputSchema: z31.object({
-      ref: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      ref: z33.string().min(1).optional()
     }),
     cli: {
       name: "list-skills",
@@ -20387,9 +20921,9 @@ query skills_list($ref: String) {
     operationName: "skills_read",
     apiKeyAccess: apiKeyAccessPolicies.skillsRead,
     kind: "query",
-    inputSchema: z31.object({
-      skill: z31.string().min(1),
-      ref: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      skill: z33.string().min(1),
+      ref: z33.string().min(1).optional()
     }),
     cli: {
       name: "read-skill",
@@ -20429,10 +20963,10 @@ query skills_read($skill: String!, $ref: String) {
     operationName: "skills_history",
     apiKeyAccess: apiKeyAccessPolicies.skillsRead,
     kind: "query",
-    inputSchema: z31.object({
-      skill: z31.string().min(1),
-      ref: z31.string().min(1).optional(),
-      limit: z31.number().int().min(1).max(100).optional()
+    inputSchema: z33.object({
+      skill: z33.string().min(1),
+      ref: z33.string().min(1).optional(),
+      limit: z33.number().int().min(1).max(100).optional()
     }),
     cli: {
       name: "get-skill-history",
@@ -20481,11 +21015,11 @@ query skills_history($skill: String!, $ref: String, $limit: Int) {
     operationName: "skills_apply_patch",
     apiKeyAccess: apiKeyAccessPolicies.skillsWrite,
     kind: "mutation",
-    inputSchema: z31.object({
-      patch: z31.string().min(1),
-      message: z31.string().min(1),
-      idempotencyKey: z31.string().min(1).optional(),
-      ref: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      patch: z33.string().min(1),
+      message: z33.string().min(1),
+      idempotencyKey: z33.string().min(1).optional(),
+      ref: z33.string().min(1).optional()
     }),
     cli: {
       name: "apply-skills-patch",
@@ -20545,7 +21079,7 @@ mutation skills_apply_patch(
     operationName: "CreateAutomation",
     apiKeyAccess: apiKeyAccessPolicies.automationWrite,
     kind: "mutation",
-    inputSchema: z31.object({
+    inputSchema: z33.object({
       input: createAutomationInputSchema
     }),
     cli: {
@@ -20585,7 +21119,7 @@ mutation CreateAutomation($input: CreateAutomationInput!) {
     operationName: "GetGraphqlSchema",
     apiKeyAccess: apiKeyAccessPolicies.baseline,
     kind: "query",
-    inputSchema: z31.object({}),
+    inputSchema: z33.object({}),
     cli: {
       name: "get-graphql-schema",
       path: ["graphql", "schema"],
@@ -20607,8 +21141,8 @@ query GetGraphqlSchema {
     operationName: "ApproveAutomationStep",
     apiKeyAccess: apiKeyAccessPolicies.runControl,
     kind: "mutation",
-    inputSchema: z31.object({
-      runId: z31.string().min(1)
+    inputSchema: z33.object({
+      runId: z33.string().min(1)
     }),
     cli: {
       name: "approve-automation-step",
@@ -20634,8 +21168,8 @@ mutation ApproveAutomationStep($runId: ID!) {
     operationName: "RetryAutomationStep",
     apiKeyAccess: apiKeyAccessPolicies.runControl,
     kind: "mutation",
-    inputSchema: z31.object({
-      runId: z31.string().min(1)
+    inputSchema: z33.object({
+      runId: z33.string().min(1)
     }),
     cli: {
       name: "retry-automation-step",
@@ -20661,8 +21195,8 @@ mutation RetryAutomationStep($runId: ID!) {
     operationName: "PauseAutomationRun",
     apiKeyAccess: apiKeyAccessPolicies.runControl,
     kind: "mutation",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1)
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1)
     }),
     cli: {
       name: "pause-automation-run",
@@ -20688,11 +21222,11 @@ mutation PauseAutomationRun($automationRunId: ID!) {
     operationName: "RerunAutomation",
     apiKeyAccess: apiKeyAccessPolicies.rerun,
     kind: "mutation",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1),
-      additionalPrompt: z31.string().min(1).optional(),
-      idempotencyKey: z31.string().min(1),
-      allowPointOfNoReturnOverride: z31.boolean().optional()
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1),
+      additionalPrompt: z33.string().min(1).optional(),
+      idempotencyKey: z33.string().min(1),
+      allowPointOfNoReturnOverride: z33.boolean().optional()
     }),
     cli: {
       name: "rerun-automation",
@@ -20748,9 +21282,9 @@ mutation RerunAutomation(
     operationName: "ResumeAutomationRun",
     apiKeyAccess: apiKeyAccessPolicies.runControl,
     kind: "mutation",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1),
-      message: z31.string().min(1).optional()
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1),
+      message: z33.string().min(1).optional()
     }),
     cli: {
       name: "resume-automation-run",
@@ -20781,16 +21315,16 @@ mutation ResumeAutomationRun($automationRunId: ID!, $message: String) {
     operationName: "RunDraftAutomation",
     apiKeyAccess: apiKeyAccessPolicies.runDraft,
     kind: "mutation",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      branchId: z31.string().min(1).optional(),
-      agentId: z31.string().min(1),
-      idempotencyKey: z31.string().min(1),
-      input: z31.unknown().optional(),
-      initialStore: z31.record(z31.string(), z31.unknown()).optional(),
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      branchId: z33.string().min(1).optional(),
+      agentId: z33.string().min(1),
+      idempotencyKey: z33.string().min(1),
+      input: z33.unknown().optional(),
+      initialStore: z33.record(z33.string(), z33.unknown()).optional(),
       config: runDraftConfigInputSchema.optional(),
-      additionalPrompt: z31.string().min(1).optional(),
-      consistencyCheckCount: z31.number().int().optional()
+      additionalPrompt: z33.string().min(1).optional(),
+      consistencyCheckCount: z33.number().int().optional()
     }),
     cli: {
       branchContext: "optional",
@@ -20882,8 +21416,8 @@ mutation RunDraftAutomation(
     operationName: "PublishDraftAutomation",
     apiKeyAccess: apiKeyAccessPolicies.publishDenied,
     kind: "mutation",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1)
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1)
     }),
     cli: {
       name: "publish-draft-automation",
@@ -20917,8 +21451,8 @@ mutation PublishDraftAutomation($draftAutomationId: ID!) {
     operationName: "StopAutomationRun",
     apiKeyAccess: apiKeyAccessPolicies.runControl,
     kind: "mutation",
-    inputSchema: z31.object({
-      automationRunId: z31.string().min(1)
+    inputSchema: z33.object({
+      automationRunId: z33.string().min(1)
     }),
     cli: {
       name: "stop-automation-run",
@@ -20944,10 +21478,10 @@ mutation StopAutomationRun($automationRunId: ID!) {
     operationName: "PreviewAutomationPatch",
     apiKeyAccess: apiKeyAccessPolicies.workbenchPreviewRead,
     kind: "mutation",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      branchId: z31.string().min(1).optional(),
-      expectedLastSavedAt: z31.string().optional(),
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      branchId: z33.string().min(1).optional(),
+      expectedLastSavedAt: z33.string().optional(),
       operations: automationPatchOperationsSchema
     }),
     cli: {
@@ -21063,15 +21597,15 @@ mutation PreviewAutomationPatch(
     operationName: "ValidateAutomationPatchReadiness",
     apiKeyAccess: apiKeyAccessPolicies.workbenchPreviewRead,
     kind: "mutation",
-    inputSchema: z31.object({
-      targetDraftAutomationId: z31.string().min(1).optional(),
-      newAutomationName: z31.string().min(1).optional(),
-      branchId: z31.string().min(1).optional(),
+    inputSchema: z33.object({
+      targetDraftAutomationId: z33.string().min(1).optional(),
+      newAutomationName: z33.string().min(1).optional(),
+      branchId: z33.string().min(1).optional(),
       operations: automationPatchOperationsSchema
     }).superRefine((input, ctx) => {
       if (input.branchId && !input.targetDraftAutomationId) {
         ctx.addIssue({
-          code: z31.ZodIssueCode.custom,
+          code: z33.ZodIssueCode.custom,
           message: "--branch-id requires --target-draft-automation-id."
         });
       }
@@ -21141,10 +21675,10 @@ mutation ValidateAutomationPatchReadiness(
     operationName: "ApplyAutomationPatch",
     apiKeyAccess: apiKeyAccessPolicies.applyAutomationPatch,
     kind: "mutation",
-    inputSchema: z31.object({
-      draftAutomationId: z31.string().min(1),
-      branchId: z31.string().min(1).optional(),
-      expectedLastSavedAt: z31.string().optional(),
+    inputSchema: z33.object({
+      draftAutomationId: z33.string().min(1),
+      branchId: z33.string().min(1).optional(),
+      expectedLastSavedAt: z33.string().optional(),
       operations: automationPatchOperationsSchema
     }),
     cli: {
@@ -21269,9 +21803,9 @@ mutation ApplyAutomationPatch(
     operationName: "UpdateAutomationById",
     apiKeyAccess: apiKeyAccessPolicies.updateAutomation,
     kind: "mutation",
-    inputSchema: z31.object({
-      id: z31.string().min(1),
-      branchId: z31.string().min(1).optional(),
+    inputSchema: z33.object({
+      id: z33.string().min(1),
+      branchId: z33.string().min(1).optional(),
       input: updateAutomationInputSchema
     }),
     cli: {
@@ -21316,7 +21850,7 @@ mutation UpdateAutomationById($id: ID!, $branchId: ID, $input: UpdateAutomationI
     operationName: "ListRegisteredEvals",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "query",
-    inputSchema: z31.object({}),
+    inputSchema: z33.object({}),
     cli: {
       name: "list-registered-evals",
       path: ["evals", "list"],
@@ -21337,7 +21871,7 @@ ${registeredEvalSelection}
     operationName: "GetRegisteredEval",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "query",
-    inputSchema: z31.object({ slug: z31.string().min(1) }),
+    inputSchema: z33.object({ slug: z33.string().min(1) }),
     cli: {
       name: "get-registered-eval",
       path: ["evals", "get"],
@@ -21365,9 +21899,9 @@ ${registeredEvalSelection}
     operationName: "TestRegisteredEval",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "mutation",
-    inputSchema: z31.object({
+    inputSchema: z33.object({
       input: jsonObjectSchema,
-      slug: z31.string().min(1)
+      slug: z33.string().min(1)
     }),
     cli: {
       name: "test-registered-eval",
@@ -21500,8 +22034,8 @@ query PlanRegisteredEvalRun(
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "mutation",
     inputSchema: registeredEvalRunInputSchema.extend({
-      expectedTrialCount: z31.number().int().positive(),
-      idempotencyKey: z31.string().trim().min(1)
+      expectedTrialCount: z33.number().int().positive(),
+      idempotencyKey: z33.string().trim().min(1)
     }),
     cli: {
       name: "start-registered-eval-run",
@@ -21609,10 +22143,10 @@ mutation StartRegisteredEvalRun(
     operationName: "ListEvalRuns",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "query",
-    inputSchema: z31.object({
-      page: z31.number().int().nonnegative().default(0),
-      pageSize: z31.number().int().min(1).max(100).default(20),
-      slug: z31.string().min(1).optional(),
+    inputSchema: z33.object({
+      page: z33.number().int().nonnegative().default(0),
+      pageSize: z33.number().int().min(1).max(100).default(20),
+      slug: z33.string().min(1).optional(),
       status: evalRunStatusSchema.optional()
     }),
     cli: {
@@ -21666,7 +22200,7 @@ ${evalRunSelection}
     operationName: "GetEvalRun",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "query",
-    inputSchema: z31.object({ id: z31.string().min(1) }),
+    inputSchema: z33.object({ id: z33.string().min(1) }),
     cli: {
       name: "get-eval-run",
       path: ["evals", "runs", "get"],
@@ -21694,9 +22228,9 @@ ${evalRunSelection}
     operationName: "AwaitEvalRun",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "query",
-    inputSchema: z31.object({
-      id: z31.string().min(1),
-      timeoutMs: z31.number().int().min(1e3).max(6e4).default(3e4)
+    inputSchema: z33.object({
+      id: z33.string().min(1),
+      timeoutMs: z33.number().int().min(1e3).max(6e4).default(3e4)
     }),
     cli: {
       name: "await-eval-run",
@@ -21738,10 +22272,10 @@ ${evalRunSelection}
     operationName: "ListEvalRunTrials",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "query",
-    inputSchema: z31.object({
-      cursor: z31.string().min(1).optional(),
-      id: z31.string().min(1),
-      limit: z31.number().int().min(1).max(1e3).default(100)
+    inputSchema: z33.object({
+      cursor: z33.string().min(1).optional(),
+      id: z33.string().min(1),
+      limit: z33.number().int().min(1).max(1e3).default(100)
     }),
     cli: {
       name: "list-eval-run-trials",
@@ -21795,7 +22329,7 @@ query ListEvalRunTrials($id: String!, $limit: Int, $cursor: String) {
     operationName: "CancelEvalRun",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "mutation",
-    inputSchema: z31.object({ id: z31.string().min(1) }),
+    inputSchema: z33.object({ id: z33.string().min(1) }),
     cli: {
       name: "cancel-eval-run",
       path: ["evals", "runs", "cancel"],
@@ -21825,7 +22359,7 @@ mutation CancelEvalRun($id: String!) {
     operationName: "RequestEvalRunExport",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "mutation",
-    inputSchema: z31.object({ id: z31.string().min(1) }),
+    inputSchema: z33.object({ id: z33.string().min(1) }),
     cli: {
       name: "request-eval-run-export",
       path: ["evals", "runs", "export"],
@@ -21872,7 +22406,7 @@ ${evalRunExportSelection}
     operationName: "GetEvalRunExport",
     apiKeyAccess: apiKeyAccessPolicies.evalsDenied,
     kind: "query",
-    inputSchema: z31.object({ exportId: z31.string().min(1) }),
+    inputSchema: z33.object({ exportId: z33.string().min(1) }),
     cli: {
       hidden: true,
       name: "get-eval-run-export",
@@ -21909,7 +22443,7 @@ import { access, link, rename, rm } from "node:fs/promises";
 import nodePath from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { z as z32 } from "zod";
+import { z as z34 } from "zod";
 
 // src/version.ts
 import fs from "node:fs";
@@ -21939,137 +22473,137 @@ var OTTO_AUTHORIZATION_ISSUER = "magical:otto";
 var WORKOS_API_KEY_PREFIX = "sk_";
 var FILE_UPLOAD_TIMEOUT_MS = 10 * 60 * 1e3;
 var NETWORK_RECORDING_METADATA_TIMEOUT_MS = 3e4;
-var workosOrganizationsResponseSchema = z32.object({
-  organizations: z32.array(
-    z32.object({
-      id: z32.string().min(1),
-      name: z32.string().min(1),
-      primaryDomain: z32.string().nullable().optional()
+var workosOrganizationsResponseSchema = z34.object({
+  organizations: z34.array(
+    z34.object({
+      id: z34.string().min(1),
+      name: z34.string().min(1),
+      primaryDomain: z34.string().nullable().optional()
     })
   ),
-  success: z32.boolean()
+  success: z34.boolean()
 });
-var workosUserSchema = z32.object({
-  email: z32.string().nullable(),
-  id: z32.string().min(1)
+var workosUserSchema = z34.object({
+  email: z34.string().nullable(),
+  id: z34.string().min(1)
 });
-var magicalApiKeyPermissionSchema = z32.custom(
+var magicalApiKeyPermissionSchema = z34.custom(
   isMagicalApiKeyPermission,
   "Unknown Magical API key permission."
 );
-var apiKeyOrganizationSchema = z32.object({
-  id: z32.string().min(1),
-  name: z32.string().min(1)
-});
-var sanitizedUserApiKeySchema = z32.object({
-  createdAt: z32.string().datetime(),
-  expiresAt: z32.string().datetime().nullable(),
-  id: z32.string().min(1),
-  lastUsedAt: z32.string().datetime().nullable(),
-  name: z32.string(),
-  obfuscatedValue: z32.string().min(1),
-  organizationId: z32.string().min(1),
-  ownerUserId: z32.string().min(1),
-  permissions: z32.array(magicalApiKeyPermissionSchema),
-  updatedAt: z32.string().datetime()
-});
-var apiKeyIdentityResponseSchema = z32.object({
+var apiKeyOrganizationSchema = z34.object({
+  id: z34.string().min(1),
+  name: z34.string().min(1)
+});
+var sanitizedUserApiKeySchema = z34.object({
+  createdAt: z34.string().datetime(),
+  expiresAt: z34.string().datetime().nullable(),
+  id: z34.string().min(1),
+  lastUsedAt: z34.string().datetime().nullable(),
+  name: z34.string(),
+  obfuscatedValue: z34.string().min(1),
+  organizationId: z34.string().min(1),
+  ownerUserId: z34.string().min(1),
+  permissions: z34.array(magicalApiKeyPermissionSchema),
+  updatedAt: z34.string().datetime()
+});
+var apiKeyIdentityResponseSchema = z34.object({
   apiKey: sanitizedUserApiKeySchema,
-  effectivePermissions: z32.array(magicalApiKeyPermissionSchema),
+  effectivePermissions: z34.array(magicalApiKeyPermissionSchema),
   organization: apiKeyOrganizationSchema
 });
-var apiKeyOrganizationsResponseSchema = z32.object({
-  organizations: z32.array(apiKeyOrganizationSchema)
+var apiKeyOrganizationsResponseSchema = z34.object({
+  organizations: z34.array(apiKeyOrganizationSchema)
 });
-var apiKeyPreflightResponseSchema = z32.object({
-  targets: z32.array(
-    z32.object({
-      availablePermissions: z32.array(magicalApiKeyPermissionSchema),
+var apiKeyPreflightResponseSchema = z34.object({
+  targets: z34.array(
+    z34.object({
+      availablePermissions: z34.array(magicalApiKeyPermissionSchema),
       organization: apiKeyOrganizationSchema,
-      requestedPermissions: z32.array(magicalApiKeyPermissionSchema)
+      requestedPermissions: z34.array(magicalApiKeyPermissionSchema)
     })
   )
 });
-var createUserApiKeyResponseSchema = z32.object({
-  apiKey: sanitizedUserApiKeySchema.extend({ value: z32.string().min(1) })
+var createUserApiKeyResponseSchema = z34.object({
+  apiKey: sanitizedUserApiKeySchema.extend({ value: z34.string().min(1) })
 });
-var listUserApiKeysResponseSchema = z32.object({
-  apiKeys: z32.array(sanitizedUserApiKeySchema),
+var listUserApiKeysResponseSchema = z34.object({
+  apiKeys: z34.array(sanitizedUserApiKeySchema),
   organization: apiKeyOrganizationSchema
 });
-var revokeUserApiKeyResponseSchema = z32.object({
-  alreadyRevoked: z32.boolean(),
-  revoked: z32.boolean()
-});
-var networkRecordingMetadataSchema = z32.object({
-  archiveType: z32.literal("MITMPROXY"),
-  automationRunId: z32.string().min(1),
-  contentType: z32.literal("application/octet-stream"),
-  downloadPath: z32.string().min(1).nullable(),
-  limits: z32.object({ maxArchiveBytes: z32.number().int().positive() }),
-  organizationId: z32.string().min(1),
-  recordingId: z32.string().min(1).nullable(),
-  sizeBytes: z32.number().int().nonnegative().nullable(),
-  sourceMode: z32.enum(["record", "replay"]).nullable(),
-  status: z32.enum(["NOT_CONFIGURED", "MISSING", "AVAILABLE", "TOO_LARGE"])
-});
-var nangoIntegrationWireSchema = z32.object({
+var revokeUserApiKeyResponseSchema = z34.object({
+  alreadyRevoked: z34.boolean(),
+  revoked: z34.boolean()
+});
+var networkRecordingMetadataSchema = z34.object({
+  archiveType: z34.literal("MITMPROXY"),
+  automationRunId: z34.string().min(1),
+  contentType: z34.literal("application/octet-stream"),
+  downloadPath: z34.string().min(1).nullable(),
+  limits: z34.object({ maxArchiveBytes: z34.number().int().positive() }),
+  organizationId: z34.string().min(1),
+  recordingId: z34.string().min(1).nullable(),
+  sizeBytes: z34.number().int().nonnegative().nullable(),
+  sourceMode: z34.enum(["record", "replay"]).nullable(),
+  status: z34.enum(["NOT_CONFIGURED", "MISSING", "AVAILABLE", "TOO_LARGE"])
+});
+var nangoIntegrationWireSchema = z34.object({
   // eslint-disable-next-line @typescript-eslint/naming-convention -- mirrors Nango REST payload
-  unique_key: z32.string().min(1)
+  unique_key: z34.string().min(1)
 }).passthrough().transform((data) => ({
   ...data,
   uniqueKey: data.unique_key
 }));
-var nangoIntegrationsResponseSchema = z32.array(nangoIntegrationWireSchema);
-var organizationAuthenticationSchema = z32.object({
-  id: z32.string().min(1),
-  type: z32.string().min(1),
-  connectionId: z32.string().nullable().optional(),
-  providerConfigKey: z32.string().nullable().optional(),
-  description: z32.string().nullable().optional(),
-  hostname: z32.string().nullable().optional()
+var nangoIntegrationsResponseSchema = z34.array(nangoIntegrationWireSchema);
+var organizationAuthenticationSchema = z34.object({
+  id: z34.string().min(1),
+  type: z34.string().min(1),
+  connectionId: z34.string().nullable().optional(),
+  providerConfigKey: z34.string().nullable().optional(),
+  description: z34.string().nullable().optional(),
+  hostname: z34.string().nullable().optional()
 }).passthrough();
-var organizationAuthenticationsResponseSchema = z32.object({
-  authentications: z32.array(organizationAuthenticationSchema),
-  success: z32.boolean()
+var organizationAuthenticationsResponseSchema = z34.object({
+  authentications: z34.array(organizationAuthenticationSchema),
+  success: z34.boolean()
 });
-var missingAgentRunPathwaySignatureResponseSchema = z32.object({
-  signature: z32.null(),
-  status: z32.literal("missing")
+var missingAgentRunPathwaySignatureResponseSchema = z34.object({
+  signature: z34.null(),
+  status: z34.literal("missing")
 });
-var agentRunPathwaySignatureStatusSchema = z32.enum([
+var agentRunPathwaySignatureStatusSchema = z34.enum([
   "failed",
   "queued",
   "running",
   "succeeded"
 ]);
-var agentRunPathwaySignatureRecordSchema = z32.object({
-  agentRunId: z32.string().min(1),
-  agentVersionId: z32.string().min(1),
-  automationRunId: z32.string().min(1),
-  contractEdgeIds: z32.array(z32.string()).nullable(),
-  contractHash: z32.string().nullable(),
-  contractId: z32.string().nullable(),
-  contractNodeIds: z32.array(z32.string()).nullable(),
-  contractPathHash: z32.string().nullable(),
-  createdAt: z32.string().min(1),
-  deviationTokens: z32.array(z32.string()).nullable(),
-  finishedAt: z32.string().nullable(),
-  generatorVersion: z32.string().min(1),
-  id: z32.string().min(1),
-  observedPathHash: z32.string().nullable(),
-  organizationId: z32.string().min(1),
-  pathTokens: z32.array(z32.string()).nullable(),
-  schemaVersion: z32.string().min(1),
-  sourceMemoryCount: z32.number().int().nonnegative().nullable(),
-  sourceMemoryFirstSequence: z32.number().int().nonnegative().nullable(),
-  sourceMemoryLastSequence: z32.number().int().nonnegative().nullable(),
+var agentRunPathwaySignatureRecordSchema = z34.object({
+  agentRunId: z34.string().min(1),
+  agentVersionId: z34.string().min(1),
+  automationRunId: z34.string().min(1),
+  contractEdgeIds: z34.array(z34.string()).nullable(),
+  contractHash: z34.string().nullable(),
+  contractId: z34.string().nullable(),
+  contractNodeIds: z34.array(z34.string()).nullable(),
+  contractPathHash: z34.string().nullable(),
+  createdAt: z34.string().min(1),
+  deviationTokens: z34.array(z34.string()).nullable(),
+  finishedAt: z34.string().nullable(),
+  generatorVersion: z34.string().min(1),
+  id: z34.string().min(1),
+  observedPathHash: z34.string().nullable(),
+  organizationId: z34.string().min(1),
+  pathTokens: z34.array(z34.string()).nullable(),
+  schemaVersion: z34.string().min(1),
+  sourceMemoryCount: z34.number().int().nonnegative().nullable(),
+  sourceMemoryFirstSequence: z34.number().int().nonnegative().nullable(),
+  sourceMemoryLastSequence: z34.number().int().nonnegative().nullable(),
   status: agentRunPathwaySignatureStatusSchema,
-  stepCount: z32.number().int().nonnegative().nullable(),
-  steps: z32.array(
-    z32.object({
-      contractNodeId: z32.string().nullable(),
-      contractStatus: z32.enum([
+  stepCount: z34.number().int().nonnegative().nullable(),
+  steps: z34.array(
+    z34.object({
+      contractNodeId: z34.string().nullable(),
+      contractStatus: z34.enum([
         "expected",
         "ambient",
         "observed-only",
@@ -22077,23 +22611,23 @@ var agentRunPathwaySignatureRecordSchema = z32.object({
         "out-of-flow",
         "rule-mismatch"
       ]),
-      sequence: z32.number().int().nonnegative(),
-      token: z32.string().min(1),
-      toolName: z32.string().nullable()
+      sequence: z34.number().int().nonnegative(),
+      token: z34.string().min(1),
+      toolName: z34.string().nullable()
     }).passthrough()
   ).nullable(),
-  updatedAt: z32.string().min(1),
-  workflowId: z32.string().nullable()
+  updatedAt: z34.string().min(1),
+  workflowId: z34.string().nullable()
 });
-var persistedAgentRunPathwaySignatureResponseSchema = z32.object({
+var persistedAgentRunPathwaySignatureResponseSchema = z34.object({
   signature: agentRunPathwaySignatureRecordSchema,
   status: agentRunPathwaySignatureStatusSchema
 });
-var agentRunPathwaySignatureResponseSchema = z32.union([
+var agentRunPathwaySignatureResponseSchema = z34.union([
   missingAgentRunPathwaySignatureResponseSchema,
   persistedAgentRunPathwaySignatureResponseSchema
 ]);
-var regressionTestPathwayStatusSchema = z32.enum([
+var regressionTestPathwayStatusSchema = z34.enum([
   "new_pathway",
   "missing_after_change",
   "historical_path_missing_after_change",
@@ -22105,7 +22639,7 @@ var regressionTestPathwayStatusSchema = z32.enum([
   "inconclusive",
   "errored"
 ]);
-var regressionTestStatusSchema = z32.enum([
+var regressionTestStatusSchema = z34.enum([
   "queued",
   "running",
   "matched",
@@ -22113,98 +22647,98 @@ var regressionTestStatusSchema = z32.enum([
   "inconclusive",
   "errored"
 ]);
-var regressionTestKickoffPathwaySchema = z32.object({
-  baselineContractPathId: z32.string().min(1).nullable(),
-  baselineLabel: z32.string().nullable(),
-  candidateContractPathId: z32.string().min(1).nullable(),
-  candidateLabel: z32.string().nullable(),
-  id: z32.string().min(1),
-  pathwayKey: z32.string().min(1),
+var regressionTestKickoffPathwaySchema = z34.object({
+  baselineContractPathId: z34.string().min(1).nullable(),
+  baselineLabel: z34.string().nullable(),
+  candidateContractPathId: z34.string().min(1).nullable(),
+  candidateLabel: z34.string().nullable(),
+  id: z34.string().min(1),
+  pathwayKey: z34.string().min(1),
   status: regressionTestPathwayStatusSchema
 });
-var regressionTestKickoffResponseSchema = z32.object({
-  pathways: z32.array(regressionTestKickoffPathwaySchema),
-  regressionTestId: z32.string().min(1),
+var regressionTestKickoffResponseSchema = z34.object({
+  pathways: z34.array(regressionTestKickoffPathwaySchema),
+  regressionTestId: z34.string().min(1),
   status: regressionTestStatusSchema
 });
-var regressionTestIterationCountsSchema = z32.object({
-  deviated: z32.number(),
-  errored: z32.number(),
-  matched: z32.number(),
-  total: z32.number()
+var regressionTestIterationCountsSchema = z34.object({
+  deviated: z34.number(),
+  errored: z34.number(),
+  matched: z34.number(),
+  total: z34.number()
 });
-var regressionTestBaselineRunSummarySchema = z32.object({
-  id: z32.string().min(1),
+var regressionTestBaselineRunSummarySchema = z34.object({
+  id: z34.string().min(1),
   iterationCounts: regressionTestIterationCountsSchema
 });
-var regressionTestPathwaySummarySchema = z32.object({
-  baselineLabel: z32.string().nullable(),
-  baselineRuns: z32.array(regressionTestBaselineRunSummarySchema),
-  candidateLabel: z32.string().nullable(),
-  id: z32.string().min(1),
-  pathwayKey: z32.string().min(1),
+var regressionTestPathwaySummarySchema = z34.object({
+  baselineLabel: z34.string().nullable(),
+  baselineRuns: z34.array(regressionTestBaselineRunSummarySchema),
+  candidateLabel: z34.string().nullable(),
+  id: z34.string().min(1),
+  pathwayKey: z34.string().min(1),
   status: regressionTestPathwayStatusSchema
 });
-var regressionTestResultResponseSchema = z32.object({
-  pathways: z32.array(regressionTestPathwaySummarySchema),
-  regressionTest: z32.object({
-    finishedAt: z32.string().nullable(),
-    id: z32.string().min(1),
-    startedAt: z32.string().nullable(),
+var regressionTestResultResponseSchema = z34.object({
+  pathways: z34.array(regressionTestPathwaySummarySchema),
+  regressionTest: z34.object({
+    finishedAt: z34.string().nullable(),
+    id: z34.string().min(1),
+    startedAt: z34.string().nullable(),
     status: regressionTestStatusSchema
   })
 });
-var regressionTestBaselineStepSchema = z32.object({
-  expectedToolCall: z32.unknown().nullable(),
-  id: z32.string().min(1),
-  iterationIndex: z32.number()
+var regressionTestBaselineStepSchema = z34.object({
+  expectedToolCall: z34.unknown().nullable(),
+  id: z34.string().min(1),
+  iterationIndex: z34.number()
 });
-var regressionTestDeviatedToolCallSchema = z32.object({
-  count: z32.number(),
-  observedToolCall: z32.unknown()
+var regressionTestDeviatedToolCallSchema = z34.object({
+  count: z34.number(),
+  observedToolCall: z34.unknown()
 });
-var regressionTestDeviatedIterationSchema = z32.object({
-  baselineIterationId: z32.string().min(1),
-  deviatedToolCalls: z32.array(regressionTestDeviatedToolCallSchema)
+var regressionTestDeviatedIterationSchema = z34.object({
+  baselineIterationId: z34.string().min(1),
+  deviatedToolCalls: z34.array(regressionTestDeviatedToolCallSchema)
 });
-var regressionTestReplayCountsSchema = z32.object({
-  deviated: z32.number(),
-  errored: z32.number(),
-  matched: z32.number()
+var regressionTestReplayCountsSchema = z34.object({
+  deviated: z34.number(),
+  errored: z34.number(),
+  matched: z34.number()
 });
-var regressionTestBaselineRunSchema = z32.object({
-  baselineAgentRunId: z32.string().min(1),
-  baselineIterations: z32.array(regressionTestBaselineStepSchema),
-  deviatedIterations: z32.array(regressionTestDeviatedIterationSchema),
+var regressionTestBaselineRunSchema = z34.object({
+  baselineAgentRunId: z34.string().min(1),
+  baselineIterations: z34.array(regressionTestBaselineStepSchema),
+  deviatedIterations: z34.array(regressionTestDeviatedIterationSchema),
   replayCounts: regressionTestReplayCountsSchema
 });
-var regressionTestPathwayDetailSchema = z32.object({
-  baselineLabel: z32.string().nullable(),
-  baselineRuns: z32.array(regressionTestBaselineRunSchema),
-  candidateLabel: z32.string().nullable(),
-  id: z32.string().min(1),
-  pathwayKey: z32.string().min(1),
+var regressionTestPathwayDetailSchema = z34.object({
+  baselineLabel: z34.string().nullable(),
+  baselineRuns: z34.array(regressionTestBaselineRunSchema),
+  candidateLabel: z34.string().nullable(),
+  id: z34.string().min(1),
+  pathwayKey: z34.string().min(1),
   status: regressionTestPathwayStatusSchema
 });
-var regressionTestPathwayResultResponseSchema = z32.object({
+var regressionTestPathwayResultResponseSchema = z34.object({
   pathway: regressionTestPathwayDetailSchema,
-  regressionTest: z32.object({
-    finishedAt: z32.string().nullable(),
-    id: z32.string().min(1),
-    startedAt: z32.string().nullable(),
+  regressionTest: z34.object({
+    finishedAt: z34.string().nullable(),
+    id: z34.string().min(1),
+    startedAt: z34.string().nullable(),
     status: regressionTestStatusSchema
   })
 });
-var graphQlResponseSchema = z32.object({
-  data: z32.record(z32.string(), z32.unknown()).nullable().optional(),
-  errors: z32.array(
-    z32.object({
-      extensions: z32.object({
-        appErrorType: z32.string().optional(),
-        code: z32.string().min(1).optional(),
-        http: z32.object({ status: z32.number() }).optional()
+var graphQlResponseSchema = z34.object({
+  data: z34.record(z34.string(), z34.unknown()).nullable().optional(),
+  errors: z34.array(
+    z34.object({
+      extensions: z34.object({
+        appErrorType: z34.string().optional(),
+        code: z34.string().min(1).optional(),
+        http: z34.object({ status: z34.number() }).optional()
       }).passthrough().optional(),
-      message: z32.string().min(1)
+      message: z34.string().min(1)
     })
   ).optional()
 });
@@ -22235,14 +22769,14 @@ function getGraphQlErrorStatus(error) {
   }
   return error.extensions?.appErrorType?.includes("not-found") ? 404 : void 0;
 }
-var apiErrorResponseSchema = z32.object({
-  code: z32.string().min(1).optional(),
-  errors: z32.array(
-    z32.object({
-      message: z32.string().min(1)
+var apiErrorResponseSchema = z34.object({
+  code: z34.string().min(1).optional(),
+  errors: z34.array(
+    z34.object({
+      message: z34.string().min(1)
     })
   ).optional(),
-  message: z32.string().min(1).optional()
+  message: z34.string().min(1).optional()
 });
 function getApiErrorDetail(responseBody) {
   const parsedResponse = apiErrorResponseSchema.safeParse(responseBody);
@@ -22465,18 +22999,18 @@ async function downloadAuthenticatedFileFromApi({
   organizationId,
   outputPath,
   overwrite = false,
-  path: path22,
+  path: path23,
   resolveApiBaseUrl,
   timeoutMs
 }) {
-  if (!path22.startsWith("/") || path22.startsWith("//")) {
+  if (!path23.startsWith("/") || path23.startsWith("//")) {
     throw new CliError(
       "Authenticated file download path must be relative to the configured Magical API."
     );
   }
   const normalizedApiBaseUrl = trimTrailingSlash(await resolveApiBaseUrl());
   const apiBaseResult = safeUrlConstructor(`${normalizedApiBaseUrl}/`);
-  const urlResult = safeUrlConstructor(`${normalizedApiBaseUrl}${path22}`);
+  const urlResult = safeUrlConstructor(`${normalizedApiBaseUrl}${path23}`);
   if (isErr(apiBaseResult) || isErr(urlResult) || urlResult.value.origin !== apiBaseResult.value.origin || !urlResult.value.pathname.startsWith(apiBaseResult.value.pathname)) {
     throw new CliError(
       "Authenticated file download path must stay within the configured Magical API."
@@ -22601,11 +23135,11 @@ function createFetchJson({
     accessToken,
     impersonatedOrganizationId,
     allowOttoAuthorization,
-    path: path22,
+    path: path23,
     init,
     organizationId
   }) {
-    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path22}`;
+    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path23}`;
     const usesWorkOSApiKey = isWorkOSApiKey(accessToken);
     const headers = new Headers(init?.headers);
     applyAuthenticationHeaders({
@@ -22805,7 +23339,7 @@ function createMagicalApiClient({
       organizationId,
       outputPath,
       overwrite = false,
-      path: path22,
+      path: path23,
       timeoutMs
     }) {
       await downloadAuthenticatedFileFromApi({
@@ -22818,7 +23352,7 @@ function createMagicalApiClient({
         ...maxSizeBytes === void 0 ? {} : { maxSizeBytes },
         outputPath,
         overwrite,
-        path: path22,
+        path: path23,
         resolveApiBaseUrl,
         ...timeoutMs === void 0 ? {} : { timeoutMs }
       });
@@ -23096,14 +23630,14 @@ function createMagicalApiClient({
 import { Command, Option } from "commander";
 
 // src/deployment-target.ts
-import { z as z33 } from "zod";
-var deploymentPresetSchema = z33.enum(["us", "uk", "stg"]);
-var resolvedDeploymentTargetSchema = z33.object({
-  apiUrl: z33.url(),
-  platformUrl: z33.url().optional(),
+import { z as z35 } from "zod";
+var deploymentPresetSchema = z35.enum(["us", "uk", "stg"]);
+var resolvedDeploymentTargetSchema = z35.object({
+  apiUrl: z35.url(),
+  platformUrl: z35.url().optional(),
   preset: deploymentPresetSchema.optional(),
-  workosApiUrl: z33.url(),
-  workosClientId: z33.string().min(1)
+  workosApiUrl: z35.url(),
+  workosClientId: z35.string().min(1)
 });
 var WORKOS_API_URL = "https://api.workos.com";
 var DEPLOYMENT_PRESETS = {
@@ -23143,7 +23677,7 @@ function parsePreset(value) {
   return parsed.data;
 }
 function normalizeOrigin(value, label) {
-  const parsed = z33.url().safeParse(value);
+  const parsed = z35.url().safeParse(value);
   if (!parsed.success) {
     throw new CliError(`${label} must be a valid URL.`);
   }
@@ -23919,7 +24453,7 @@ import { createHash, randomUUID as randomUUID2 } from "node:crypto";
 import path2 from "node:path";
 
 // src/api-key-environment.ts
-import { z as z34 } from "zod";
+import { z as z36 } from "zod";
 var DEFAULT_API_KEY_ENVIRONMENT_VARIABLE = "MAGICAL_API_KEY";
 var ORGANIZATION_API_KEY_ENVIRONMENT_VARIABLE_PREFIX = "MAGICAL_API_KEY_ORG_";
 var API_KEY_COMMAND_OPTION_SOURCE = "--api-key";
@@ -23928,7 +24462,7 @@ var ORGANIZATION_API_KEY_ENVIRONMENT_VARIABLE_PATTERN = new RegExp(
   `^${ORGANIZATION_API_KEY_ENVIRONMENT_VARIABLE_PREFIX}(${CANONICAL_ULID_PATTERN})$`,
   "u"
 );
-var canonicalOrganizationIdSchema = z34.string().regex(new RegExp(`^org_${CANONICAL_ULID_PATTERN}$`, "u")).brand();
+var canonicalOrganizationIdSchema = z36.string().regex(new RegExp(`^org_${CANONICAL_ULID_PATTERN}$`, "u")).brand();
 var ParsedApiKeyEnvironmentResult = class {
   #defaultCredential;
   #organizationCredentials;
@@ -25111,48 +25645,48 @@ import {
   unlink
 } from "node:fs/promises";
 import path3 from "node:path";
-import { z as z35 } from "zod";
+import { z as z37 } from "zod";
 var OWNER_ONLY_FILE_MODE = 384;
 var OWNER_ONLY_DIRECTORY_MODE = 448;
 var CHECKPOINT_VERSION2 = 1;
-var permissionSchema = z35.custom(
+var permissionSchema = z37.custom(
   isMagicalApiKeyPermission
 );
-var checkpointAttemptSchema = z35.object({
-  attemptId: z35.string().min(1),
-  failureCode: z35.string().min(1).nullable(),
-  idempotencyKey: z35.string().min(1),
-  keyId: z35.string().min(1).nullable(),
-  keyOrganizationId: z35.string().min(1).nullable().default(null),
-  obfuscatedValue: z35.string().min(1).nullable(),
-  providerName: z35.string().min(1),
-  status: z35.enum(["creating", "exported", "failed", "revoked", "uncertain"])
+var checkpointAttemptSchema = z37.object({
+  attemptId: z37.string().min(1),
+  failureCode: z37.string().min(1).nullable(),
+  idempotencyKey: z37.string().min(1),
+  keyId: z37.string().min(1).nullable(),
+  keyOrganizationId: z37.string().min(1).nullable().default(null),
+  obfuscatedValue: z37.string().min(1).nullable(),
+  providerName: z37.string().min(1),
+  status: z37.enum(["creating", "exported", "failed", "revoked", "uncertain"])
 }).strict();
-var checkpointTargetSchema = z35.object({
-  attempts: z35.array(checkpointAttemptSchema),
-  organizationId: z35.string().min(1),
-  organizationName: z35.string().min(1),
-  outputVariableInitiallyPresent: z35.boolean()
+var checkpointTargetSchema = z37.object({
+  attempts: z37.array(checkpointAttemptSchema),
+  organizationId: z37.string().min(1),
+  organizationName: z37.string().min(1),
+  outputVariableInitiallyPresent: z37.boolean()
 }).strict();
-var cloudSetupCheckpointSchema = z35.object({
-  allowOverwrite: z35.boolean(),
-  apiOrigin: z35.string().url(),
-  checkpointPath: z35.string().min(1),
-  createdAt: z35.string().datetime(),
-  defaultAliasInitiallyPresent: z35.boolean(),
-  defaultOrganizationId: z35.string().min(1).nullable(),
-  environment: z35.string().min(1),
-  expiresAt: z35.string().datetime().nullable(),
-  keyName: z35.string().min(1),
-  outputPath: z35.string().min(1),
-  ownerUserId: z35.string().min(1),
-  permissions: z35.array(permissionSchema).min(1),
-  purpose: z35.string().min(1),
-  setupId: z35.string().min(1),
-  status: z35.enum(["incomplete", "complete"]),
-  targets: z35.array(checkpointTargetSchema).min(1),
-  updatedAt: z35.string().datetime(),
-  version: z35.literal(CHECKPOINT_VERSION2)
+var cloudSetupCheckpointSchema = z37.object({
+  allowOverwrite: z37.boolean(),
+  apiOrigin: z37.string().url(),
+  checkpointPath: z37.string().min(1),
+  createdAt: z37.string().datetime(),
+  defaultAliasInitiallyPresent: z37.boolean(),
+  defaultOrganizationId: z37.string().min(1).nullable(),
+  environment: z37.string().min(1),
+  expiresAt: z37.string().datetime().nullable(),
+  keyName: z37.string().min(1),
+  outputPath: z37.string().min(1),
+  ownerUserId: z37.string().min(1),
+  permissions: z37.array(permissionSchema).min(1),
+  purpose: z37.string().min(1),
+  setupId: z37.string().min(1),
+  status: z37.enum(["incomplete", "complete"]),
+  targets: z37.array(checkpointTargetSchema).min(1),
+  updatedAt: z37.string().datetime(),
+  version: z37.literal(CHECKPOINT_VERSION2)
 }).strict();
 function createCloudSetupFileStorage({
   checkpointPath,
@@ -25556,12 +26090,12 @@ function hasGroupOrWorldWritePermission(mode) {
 import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
 import { mkdir as mkdir2, readFile as readFile2, rename as rename3, writeFile } from "node:fs/promises";
 import path4 from "node:path";
-import { z as z36 } from "zod";
-var normalizedApiOriginSchema = z36.string().refine(isNormalizedApiOrigin);
-var orgPreferencesFileSchema = z36.object({
+import { z as z38 } from "zod";
+var normalizedApiOriginSchema = z38.string().refine(isNormalizedApiOrigin);
+var orgPreferencesFileSchema = z38.object({
   apiOrigin: normalizedApiOriginSchema,
   preferredOrganizationId: canonicalOrganizationIdSchema,
-  version: z36.literal(1)
+  version: z38.literal(1)
 }).strict();
 function normalizeApiOrigin2(apiBaseUrl) {
   const parsedUrl = safeUrlConstructor(apiBaseUrl);
@@ -26847,7 +27381,7 @@ function getRuntimeConfig() {
 }
 
 // src/credential-resolver.ts
-import { z as z37 } from "zod";
+import { z as z39 } from "zod";
 function getRequiredApiKeyPermissions({
   policy,
   variables
@@ -26883,7 +27417,7 @@ function getRequiredApiKeyPermissions({
     }
   }
 }
-var recordingIdSchema = z37.uuid();
+var recordingIdSchema = z39.uuid();
 var draftRunConfigFieldNames = new Set(
   Object.keys(automationRunStartConfigSchema.shape)
 );
@@ -27939,7 +28473,7 @@ function addCaptureCommands({
 }
 
 // src/capture-operations.ts
-import { z as z38 } from "zod";
+import { z as z40 } from "zod";
 var START_CAPTURE_SESSION_DOCUMENT = `
   mutation MgclStartCaptureSession($automationId: ID!, $idempotencyKey: String!) {
     startCaptureSession(automationId: $automationId, idempotencyKey: $idempotencyKey) {
@@ -27987,7 +28521,7 @@ var CAPTURE_RECORDINGS_DOCUMENT = `
     }
   }
 `;
-var captureRecordingStatusSchema = z38.enum([
+var captureRecordingStatusSchema = z40.enum([
   "recording",
   "processing",
   "finished",
@@ -27995,27 +28529,27 @@ var captureRecordingStatusSchema = z38.enum([
   "failed",
   "expired"
 ]);
-var optionalTimestampSchema = z38.string().nullable().optional();
-var captureRecordingMetadataSchema = z38.object({
-  automationId: z38.string().nullable(),
+var optionalTimestampSchema = z40.string().nullable().optional();
+var captureRecordingMetadataSchema = z40.object({
+  automationId: z40.string().nullable(),
   canceledAt: optionalTimestampSchema,
-  createdAt: z38.string().optional(),
-  createdByUserId: z38.string().nullable().optional(),
+  createdAt: z40.string().optional(),
+  createdByUserId: z40.string().nullable().optional(),
   expiresAt: optionalTimestampSchema,
   finishedAt: optionalTimestampSchema,
   processingStartedAt: optionalTimestampSchema,
-  recordingId: z38.string().min(1),
-  startedAt: z38.string().optional(),
+  recordingId: z40.string().min(1),
+  startedAt: z40.string().optional(),
   status: captureRecordingStatusSchema,
   stoppedAt: optionalTimestampSchema,
-  updatedAt: z38.string().optional()
+  updatedAt: z40.string().optional()
 });
-var startCaptureSessionSchema = z38.object({
-  automationId: z38.string().min(1),
-  automationRunId: z38.string().min(1),
-  initialPortalUrl: z38.url(),
-  recordingId: z38.string().min(1),
-  recordingPortalUrl: z38.url()
+var startCaptureSessionSchema = z40.object({
+  automationId: z40.string().min(1),
+  automationRunId: z40.string().min(1),
+  initialPortalUrl: z40.url(),
+  recordingId: z40.string().min(1),
+  recordingPortalUrl: z40.url()
 });
 function parseOrThrow(schema, value, description) {
   const result = schema.safeParse(value);
@@ -28035,7 +28569,7 @@ function parseCaptureRecording(value) {
 }
 function parseCaptureRecordings(value) {
   return parseOrThrow(
-    z38.array(captureRecordingMetadataSchema),
+    z40.array(captureRecordingMetadataSchema),
     value,
     "Capture recordings"
   );
@@ -28151,19 +28685,19 @@ async function pollCaptureRecording({
 // src/classify-command.ts
 import { readFile as readFile3 } from "node:fs/promises";
 import path8 from "node:path";
-import { z as z39 } from "zod";
+import { z as z41 } from "zod";
 var CLASSIFY_PROVIDERS = ["openai", "typesafe"];
-var providerSchema = z39.enum(CLASSIFY_PROVIDERS, {
+var providerSchema = z41.enum(CLASSIFY_PROVIDERS, {
   error: "Provider must be one of openai or typesafe."
 });
-var classifyRequestSchema = z39.object({
-  model: z39.string().refine((model) => model.trim().length > 0, "Model must not be empty.").optional(),
+var classifyRequestSchema = z41.object({
+  model: z41.string().refine((model) => model.trim().length > 0, "Model must not be empty.").optional(),
   provider: providerSchema.optional(),
-  questions: z39.record(z39.string(), z39.unknown()).refine(
+  questions: z41.record(z41.string(), z41.unknown()).refine(
     (questions) => Object.keys(questions).length > 0,
     "Questions must contain at least one named question."
   ),
-  context: z39.unknown()
+  context: z41.unknown()
 }).passthrough().refine((input) => Object.hasOwn(input, "context"), {
   message: "Classify input must include context.",
   path: ["context"]
@@ -28323,50 +28857,50 @@ import { randomUUID as randomUUID4 } from "node:crypto";
 import { access as access2, readFile as readFile4 } from "node:fs/promises";
 import path9 from "node:path";
 import { createInterface } from "node:readline/promises";
-import { z as z40 } from "zod";
+import { z as z42 } from "zod";
 var MAX_AWAIT_REQUEST_MS = 6e4;
 var MIN_AWAIT_REQUEST_MS = 1e3;
 var EXPORT_POLL_INTERVAL_MS = 1e3;
-var evalRunStatusSchema2 = z40.enum([
+var evalRunStatusSchema2 = z42.enum([
   "QUEUED",
   "RUNNING",
   "COMPLETE",
   "FAILED",
   "CANCELLED"
 ]);
-var awaitResultSchema = z40.object({
-  elapsedMs: z40.number().nonnegative(),
-  evalRun: z40.object({
-    id: z40.string().min(1),
+var awaitResultSchema = z42.object({
+  elapsedMs: z42.number().nonnegative(),
+  evalRun: z42.object({
+    id: z42.string().min(1),
     status: evalRunStatusSchema2
   }).passthrough(),
-  pollCount: z40.number().int().nonnegative(),
-  reachedTerminal: z40.boolean()
+  pollCount: z42.number().int().nonnegative(),
+  reachedTerminal: z42.boolean()
 }).passthrough();
-var planResultSchema = z40.object({ trialCount: z40.number().int().nonnegative() }).passthrough();
-var startResultSchema = z40.object({
-  evalRunId: z40.string().min(1),
-  idempotencyKey: z40.string().min(1),
-  workflowId: z40.string().min(1),
-  workflowRunId: z40.string().min(1)
+var planResultSchema = z42.object({ trialCount: z42.number().int().nonnegative() }).passthrough();
+var startResultSchema = z42.object({
+  evalRunId: z42.string().min(1),
+  idempotencyKey: z42.string().min(1),
+  workflowId: z42.string().min(1),
+  workflowRunId: z42.string().min(1)
 }).passthrough();
-var exportResultSchema = z40.object({
-  downloadUrl: z40.string().min(1).nullable().optional(),
-  evalRunId: z40.string().min(1),
-  exportId: z40.string().min(1),
-  status: z40.enum(["QUEUED", "RUNNING", "COMPLETE", "FAILED"])
+var exportResultSchema = z42.object({
+  downloadUrl: z42.string().min(1).nullable().optional(),
+  evalRunId: z42.string().min(1),
+  exportId: z42.string().min(1),
+  status: z42.enum(["QUEUED", "RUNNING", "COMPLETE", "FAILED"])
 }).passthrough();
-var inputOptionsSchema = z40.object({
-  inputFile: z40.string().min(1).optional(),
-  inputJson: z40.unknown().optional()
+var inputOptionsSchema = z42.object({
+  inputFile: z42.string().min(1).optional(),
+  inputJson: z42.unknown().optional()
 });
 var commonRunOptionsSchema = inputOptionsSchema.extend({
-  description: z40.string().min(1).optional(),
-  maxConcurrency: z40.number().int().positive().optional(),
-  name: z40.string().min(1).optional(),
-  repeatCount: z40.number().int().positive().optional(),
-  slug: z40.string().min(1),
-  tags: z40.array(z40.string().min(1)).optional()
+  description: z42.string().min(1).optional(),
+  maxConcurrency: z42.number().int().positive().optional(),
+  name: z42.string().min(1).optional(),
+  repeatCount: z42.number().int().positive().optional(),
+  slug: z42.string().min(1),
+  tags: z42.array(z42.string().min(1)).optional()
 });
 function parseApiResult(value, schema, label) {
   const parsedResult = schema.safeParse(value);
@@ -28408,7 +28942,7 @@ async function resolveEvalInput({
     );
   }
   const input = inputFile === void 0 ? inputJson : await parseInputFile({ inputFile, workingDirectory });
-  const parsedInput = z40.record(z40.string(), z40.unknown()).safeParse(input);
+  const parsedInput = z42.record(z42.string(), z42.unknown()).safeParse(input);
   if (!parsedInput.success) {
     throw new CliError("Eval input must be a JSON object.");
   }
@@ -28445,7 +28979,7 @@ function parseDurationMs(value) {
   );
   const amount = Number(match?.groups?.["amount"]);
   const multiplierByUnit = { h: 36e5, m: 6e4, ms: 1, s: 1e3 };
-  const parsedUnit = z40.enum(["h", "m", "ms", "s"]).safeParse(match?.groups?.["unit"]?.toLowerCase());
+  const parsedUnit = z42.enum(["h", "m", "ms", "s"]).safeParse(match?.groups?.["unit"]?.toLowerCase());
   const durationMs = parsedUnit.success ? amount * multiplierByUnit[parsedUnit.data] : Number.NaN;
   if (!Number.isSafeInteger(durationMs) || durationMs < MIN_AWAIT_REQUEST_MS) {
     throw new CliError(
@@ -28654,10 +29188,10 @@ async function executeStartRegisteredEvalRun({
   workingDirectory
 }) {
   const parsedOptions = commonRunOptionsSchema.extend({
-    confirmTrials: z40.number().int().positive().optional(),
-    idempotencyKey: z40.string().trim().min(1).optional(),
-    json: z40.boolean().optional(),
-    wait: z40.boolean().optional()
+    confirmTrials: z42.number().int().positive().optional(),
+    idempotencyKey: z42.string().trim().min(1).optional(),
+    json: z42.boolean().optional(),
+    wait: z42.boolean().optional()
   }).parse(options);
   const input = await resolveEvalInputFromOptions({
     ...parsedOptions,
@@ -28717,7 +29251,7 @@ async function executeAwaitEvalRun({
   options,
   runtime
 }) {
-  const parsedOptions = z40.object({ id: z40.string().min(1), timeout: z40.string().optional() }).parse(options);
+  const parsedOptions = z42.object({ id: z42.string().min(1), timeout: z42.string().optional() }).parse(options);
   return await awaitEvalRun({
     evalRunId: parsedOptions.id,
     executeOperation,
@@ -28736,11 +29270,11 @@ async function executeRequestEvalRunExport({
   runtime,
   workingDirectory
 }) {
-  const parsedOptions = z40.object({
-    force: z40.boolean().optional(),
-    id: z40.string().min(1),
-    output: z40.string().min(1),
-    wait: z40.boolean().optional()
+  const parsedOptions = z42.object({
+    force: z42.boolean().optional(),
+    id: z42.string().min(1),
+    output: z42.string().min(1),
+    wait: z42.boolean().optional()
   }).parse(options);
   const outputPath = path9.resolve(workingDirectory, parsedOptions.output);
   const force = parsedOptions.force === true;
@@ -28810,22 +29344,22 @@ import { createReadStream as createReadStream2 } from "node:fs";
 import { stat as stat2 } from "node:fs/promises";
 import path10 from "node:path";
 import mimeTypes from "mime-types";
-import { z as z41 } from "zod";
-var fileUploadIntentSchema = z41.object({
-  file: z41.object({
-    checksum: z41.object({
-      algorithm: z41.literal("CRC32"),
-      value: z41.string().min(1)
+import { z as z43 } from "zod";
+var fileUploadIntentSchema = z43.object({
+  file: z43.object({
+    checksum: z43.object({
+      algorithm: z43.literal("CRC32"),
+      value: z43.string().min(1)
     }),
-    key: z41.string().startsWith("s3://"),
-    mimeType: z41.string().min(1),
-    name: z41.string().min(1),
-    sizeBytes: z41.number().int().nonnegative()
+    key: z43.string().startsWith("s3://"),
+    mimeType: z43.string().min(1),
+    name: z43.string().min(1),
+    sizeBytes: z43.number().int().nonnegative()
   }),
-  upload: z41.object({
-    headers: z41.record(z41.string(), z41.string()),
-    method: z41.literal("PUT"),
-    url: z41.url()
+  upload: z43.object({
+    headers: z43.record(z43.string(), z43.string()),
+    method: z43.literal("PUT"),
+    url: z43.url()
   })
 });
 async function prepareFileUpload(inputPath, workingDirectory) {
@@ -28915,19 +29449,19 @@ async function handleFileUploadCliOperation(apiClient, intent, prepared) {
 
 // src/iteration-media-commands.ts
 import path13 from "node:path";
-import { z as z44 } from "zod";
+import { z as z46 } from "zod";
 
 // src/file-commands.ts
 import path11 from "node:path";
-import { z as z42 } from "zod";
-var fileAssetAccessSchema = z42.object({
-  status: z42.enum([
+import { z as z44 } from "zod";
+var fileAssetAccessSchema = z44.object({
+  status: z44.enum([
     "AVAILABLE",
     "INVALID_KEY",
     "NOT_FOUND",
     "URL_UNAVAILABLE"
   ]),
-  url: z42.string().url().nullable()
+  url: z44.string().url().nullable()
 }).superRefine((value, ctx) => {
   if (value.status === "AVAILABLE" && value.url === null) {
     ctx.addIssue({
@@ -28937,10 +29471,10 @@ var fileAssetAccessSchema = z42.object({
     });
   }
 });
-var fileCommandOptionsSchema = z42.object({
-  download: z42.string().min(1).optional(),
-  force: z42.boolean().optional(),
-  key: z42.string().min(1)
+var fileCommandOptionsSchema = z44.object({
+  download: z44.string().min(1).optional(),
+  force: z44.boolean().optional(),
+  key: z44.string().min(1)
 });
 function sanitizeDownloadFileName(fileName, fallback = "magical-file.bin") {
   const sanitizedFileName = path11.basename(fileName).replaceAll(/[^\p{L}\p{N}._-]/gu, "_").slice(0, 160);
@@ -29012,18 +29546,18 @@ async function handleFileCliOperation({
 
 // src/repository-file-commands.ts
 import path12 from "node:path";
-import { z as z43 } from "zod";
+import { z as z45 } from "zod";
 var repositoryFileOperationNames = /* @__PURE__ */ new Set(["KnowledgeFile", "MemoryFile"]);
-var repositoryFileOptionsSchema = z43.object({
-  download: z43.string().min(1),
-  force: z43.boolean().optional(),
-  key: z43.string().min(1)
-});
-var repositoryFileAccessSchema = z43.object({
-  commit: z43.string().regex(/^[\da-f]{40}$/u).nullable(),
-  path: z43.string().min(1).nullable(),
-  status: z43.enum(["AVAILABLE", "INVALID_KEY", "NOT_FOUND", "UNAVAILABLE"]),
-  url: z43.url().nullable()
+var repositoryFileOptionsSchema = z45.object({
+  download: z45.string().min(1),
+  force: z45.boolean().optional(),
+  key: z45.string().min(1)
+});
+var repositoryFileAccessSchema = z45.object({
+  commit: z45.string().regex(/^[\da-f]{40}$/u).nullable(),
+  path: z45.string().min(1).nullable(),
+  status: z45.enum(["AVAILABLE", "INVALID_KEY", "NOT_FOUND", "UNAVAILABLE"]),
+  url: z45.url().nullable()
 }).superRefine((value, ctx) => {
   if (value.status === "AVAILABLE" && (value.url === null || value.path === null || value.commit === null)) {
     ctx.addIssue({
@@ -29075,14 +29609,14 @@ async function handleRepositoryFileCliOperation({
 }
 
 // src/iteration-media-commands.ts
-var iterationMediaOptionsSchema = z44.object({
-  download: z44.string().min(1),
-  force: z44.boolean().optional(),
-  iterationId: z44.uuid(),
-  mediaId: z44.uuid()
+var iterationMediaOptionsSchema = z46.object({
+  download: z46.string().min(1),
+  force: z46.boolean().optional(),
+  iterationId: z46.uuid(),
+  mediaId: z46.uuid()
 });
-var iterationMediaAccessSchema = z44.object({
-  downloadPath: z44.string().min(1)
+var iterationMediaAccessSchema = z46.object({
+  downloadPath: z46.string().min(1)
 });
 async function handleIterationMediaCliOperation({
   accessToken,
@@ -29236,7 +29770,7 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import path14 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { z as z45 } from "zod";
+import { z as z47 } from "zod";
 var NETWORK_RECORDING_ARCHIVE_MAX_BYTES = 256 * 1024 * 1024;
 var NETWORK_RECORDING_MAX_FLOWS = 2e4;
 var NETWORK_RECORDING_MAX_ENCODED_BODY_BYTES = 32 * 1024 * 1024;
@@ -29248,57 +29782,57 @@ var DEFAULT_MAX_EXCHANGES = 100;
 var MAX_EXCHANGES = 1e3;
 var MAX_HELPER_OUTPUT_BYTES = 1024 * 1024;
 var PYTHON_ENVIRONMENT_VARIABLE = "MGCL_MITMPROXY_PYTHON";
-var archiveIdentitySchema = z45.object({
-  sha256: z45.string().regex(/^[0-9a-f]{64}$/u),
-  sizeBytes: z45.number().int().nonnegative()
-});
-var bodyMetadataSchema = z45.object({
-  state: z45.enum(["PRESENT", "EMPTY", "MISSING"]),
-  encodedSizeBytes: z45.number().int().nonnegative().nullable()
-});
-var exchangeSchema = z45.object({
-  exchange: z45.string().regex(/^mitm-v1:[0-9a-f]{64}:[0-9]+$/u),
-  index: z45.number().int().nonnegative(),
-  method: z45.string().min(1),
-  origin: z45.string().min(1),
-  timestamp: z45.string().nullable(),
-  response: z45.object({
-    status: z45.number().int(),
-    contentType: z45.string().nullable(),
+var archiveIdentitySchema = z47.object({
+  sha256: z47.string().regex(/^[0-9a-f]{64}$/u),
+  sizeBytes: z47.number().int().nonnegative()
+});
+var bodyMetadataSchema = z47.object({
+  state: z47.enum(["PRESENT", "EMPTY", "MISSING"]),
+  encodedSizeBytes: z47.number().int().nonnegative().nullable()
+});
+var exchangeSchema = z47.object({
+  exchange: z47.string().regex(/^mitm-v1:[0-9a-f]{64}:[0-9]+$/u),
+  index: z47.number().int().nonnegative(),
+  method: z47.string().min(1),
+  origin: z47.string().min(1),
+  timestamp: z47.string().nullable(),
+  response: z47.object({
+    status: z47.number().int(),
+    contentType: z47.string().nullable(),
     body: bodyMetadataSchema
   }).nullable()
 });
-var inspectionResultSchema = z45.object({
+var inspectionResultSchema = z47.object({
   archive: archiveIdentitySchema,
-  exchanges: z45.array(exchangeSchema),
-  scan: z45.object({
-    scannedFlowCount: z45.number().int().nonnegative(),
-    returnedExchangeCount: z45.number().int().nonnegative(),
-    complete: z45.boolean(),
-    resultLimit: z45.number().int().positive(),
-    flowLimit: z45.number().int().positive(),
-    truncationReason: z45.enum(["RESULT_LIMIT", "FLOW_LIMIT"]).nullable()
+  exchanges: z47.array(exchangeSchema),
+  scan: z47.object({
+    scannedFlowCount: z47.number().int().nonnegative(),
+    returnedExchangeCount: z47.number().int().nonnegative(),
+    complete: z47.boolean(),
+    resultLimit: z47.number().int().positive(),
+    flowLimit: z47.number().int().positive(),
+    truncationReason: z47.enum(["RESULT_LIMIT", "FLOW_LIMIT"]).nullable()
   })
 });
-var extractionResultSchema = z45.object({
+var extractionResultSchema = z47.object({
   archive: archiveIdentitySchema,
-  exchange: z45.string().regex(/^mitm-v1:[0-9a-f]{64}:[0-9]+$/u),
-  index: z45.number().int().nonnegative(),
-  response: z45.object({
-    contentType: z45.string().nullable(),
-    sourceContentEncoding: z45.string().nullable(),
-    representation: z45.literal("decoded-entity-body"),
-    encodedSizeBytes: z45.number().int().nonnegative(),
-    sizeBytes: z45.number().int().nonnegative(),
-    sha256: z45.string().regex(/^[0-9a-f]{64}$/u)
+  exchange: z47.string().regex(/^mitm-v1:[0-9a-f]{64}:[0-9]+$/u),
+  index: z47.number().int().nonnegative(),
+  response: z47.object({
+    contentType: z47.string().nullable(),
+    sourceContentEncoding: z47.string().nullable(),
+    representation: z47.literal("decoded-entity-body"),
+    encodedSizeBytes: z47.number().int().nonnegative(),
+    sizeBytes: z47.number().int().nonnegative(),
+    sha256: z47.string().regex(/^[0-9a-f]{64}$/u)
   }),
-  outputPath: z45.string().min(1)
+  outputPath: z47.string().min(1)
 });
-var helperResponseSchema = z45.union([
-  z45.object({ ok: z45.literal(true), result: z45.unknown() }),
-  z45.object({
-    ok: z45.literal(false),
-    error: z45.object({ code: z45.string().min(1), message: z45.string().min(1) })
+var helperResponseSchema = z47.union([
+  z47.object({ ok: z47.literal(true), result: z47.unknown() }),
+  z47.object({
+    ok: z47.literal(false),
+    error: z47.object({ code: z47.string().min(1), message: z47.string().min(1) })
   })
 ]);
 var NetworkRecordingParserError = class extends CliError {
@@ -30206,29 +30740,29 @@ ${formatExamples("Examples", [
 
 // src/run-evidence-commands.ts
 import { Option as Option5 } from "commander";
-import { z as z46 } from "zod";
+import { z as z48 } from "zod";
 var ITERATION_PAGE_SIZE = 100;
 var MAX_SCANNED_ITERATIONS = 1e4;
-var automationRunSchema = z46.object({
-  id: z46.string().min(1),
-  input: z46.unknown().nullable()
+var automationRunSchema = z48.object({
+  id: z48.string().min(1),
+  input: z48.unknown().nullable()
 }).passthrough();
-var agentRunSchema = z46.object({
-  id: z46.string().min(1),
-  input: z46.unknown().nullable(),
-  parentAgentRunId: z46.string().nullable()
+var agentRunSchema = z48.object({
+  id: z48.string().min(1),
+  input: z48.unknown().nullable(),
+  parentAgentRunId: z48.string().nullable()
 }).passthrough();
-var memorySchema = z46.object({
-  id: z46.string().min(1),
-  sequence: z46.number().int(),
-  type: z46.string(),
-  value: z46.unknown()
+var memorySchema = z48.object({
+  id: z48.string().min(1),
+  sequence: z48.number().int(),
+  type: z48.string(),
+  value: z48.unknown()
 }).passthrough();
-var iterationSchema = z46.object({
-  agentRunId: z46.string().min(1),
-  id: z46.string().min(1),
-  memories: z46.array(memorySchema),
-  sequence: z46.number().int()
+var iterationSchema = z48.object({
+  agentRunId: z48.string().min(1),
+  id: z48.string().min(1),
+  memories: z48.array(memorySchema),
+  sequence: z48.number().int()
 }).passthrough();
 var latestIterationSchema = iterationSchema.nullable();
 var GET_AUTOMATION_RUN_FILE_INPUT_DOCUMENT = `
@@ -30383,21 +30917,21 @@ function collectIterationOccurrences(iteration) {
 function formatRunFiles(result) {
   const parsed = parseOperationResult(
     result,
-    z46.object({
-      automationRunId: z46.string(),
-      files: z46.array(
-        z46.object({
-          agentRunId: z46.string().nullable(),
-          fieldPath: z46.string(),
-          iterationId: z46.string().nullable(),
-          key: z46.string(),
-          role: z46.string(),
-          source: z46.string(),
-          toolName: z46.string().nullable()
+    z48.object({
+      automationRunId: z48.string(),
+      files: z48.array(
+        z48.object({
+          agentRunId: z48.string().nullable(),
+          fieldPath: z48.string(),
+          iterationId: z48.string().nullable(),
+          key: z48.string(),
+          role: z48.string(),
+          source: z48.string(),
+          toolName: z48.string().nullable()
         })
       ),
-      scannedIterationCount: z46.number(),
-      truncated: z46.boolean()
+      scannedIterationCount: z48.number(),
+      truncated: z48.boolean()
     }),
     "Run file inventory"
   );
@@ -30422,9 +30956,9 @@ function formatRunFiles(result) {
 function formatAgentRunOutput(result) {
   const parsed = parseOperationResult(
     result,
-    z46.object({
-      output: z46.unknown(),
-      status: z46.enum(["AVAILABLE", "NOT_FOUND"])
+    z48.object({
+      output: z48.unknown(),
+      status: z48.enum(["AVAILABLE", "NOT_FOUND"])
     }),
     "Agent run output"
   );
@@ -30483,7 +31017,7 @@ async function handleAutomationRunFiles({
   );
   const agentRuns = parseOperationResult(
     agentRunsResult,
-    z46.array(agentRunSchema),
+    z48.array(agentRunSchema),
     "Automation run agent runs"
   );
   const iterations = [];
@@ -30502,7 +31036,7 @@ async function handleAutomationRunFiles({
     });
     const parsedPage = parseOperationResult(
       pageResult,
-      z46.array(iterationSchema),
+      z48.array(iterationSchema),
       "Automation run iterations"
     );
     iterations.push(...parsedPage);
@@ -30523,7 +31057,7 @@ async function handleAutomationRunFiles({
     });
     truncated = parseOperationResult(
       peekResult,
-      z46.array(iterationSchema),
+      z48.array(iterationSchema),
       "Automation run iterations"
     ).length > 0;
   }
@@ -30819,13 +31353,13 @@ async function selfUpdateInstalledCli({
 // src/settings.ts
 import { mkdir as mkdir4, readFile as readFile6, rm as rm4, writeFile as writeFile2 } from "node:fs/promises";
 import path18 from "node:path";
-import { z as z47 } from "zod";
-var cliSettingsSchema = z47.object({
-  env: z47.object({
-    baseUrl: z47.url().optional(),
-    domain: z47.url().optional(),
-    env: z47.enum(["us", "uk", "stg"]).optional(),
-    workosEnv: z47.string().min(1).optional()
+import { z as z49 } from "zod";
+var cliSettingsSchema = z49.object({
+  env: z49.object({
+    baseUrl: z49.url().optional(),
+    domain: z49.url().optional(),
+    env: z49.enum(["us", "uk", "stg"]).optional(),
+    workosEnv: z49.string().min(1).optional()
   }).default({})
 });
 function createEmptyCliSettings() {
@@ -31049,7 +31583,7 @@ import {
 } from "node:fs/promises";
 import os3 from "node:os";
 import path19 from "node:path";
-import { z as z48 } from "zod";
+import { z as z50 } from "zod";
 var SKILLS_ROOT_PATH = "skills";
 var METADATA_DIRECTORY_NAME = "skill-working-copies";
 var MAX_GIT_OUTPUT_BYTES = 10 * 1024 * 1024;
@@ -31058,40 +31592,40 @@ var FULL_COMMIT_SHA_PATTERN = /^[\dA-Fa-f]{40}$/u;
 var UTF8_ENCODER = new TextEncoder();
 var WINDOWS_RESERVED_PATH_CHARACTER_PATTERN = /[<>:"|?*]/u;
 var WINDOWS_RESERVED_PATH_NAME_PATTERN = /^(?:AUX|CON|NUL|PRN|COM[1-9]|LPT[1-9])(?:\..*)?$/iu;
-var skillBundleSchema = z48.object({
-  files: z48.array(
-    z48.object({
-      content: z48.string(),
-      encoding: z48.literal("base64"),
-      path: z48.string().min(1),
-      size: z48.number().int().nonnegative()
+var skillBundleSchema = z50.object({
+  files: z50.array(
+    z50.object({
+      content: z50.string(),
+      encoding: z50.literal("base64"),
+      path: z50.string().min(1),
+      size: z50.number().int().nonnegative()
     })
   ),
-  path: z48.string().min(1),
-  ref: z48.string().regex(FULL_COMMIT_SHA_PATTERN)
+  path: z50.string().min(1),
+  ref: z50.string().regex(FULL_COMMIT_SHA_PATTERN)
 });
-var skillsApplyPatchResultSchema = z48.object({
-  changedFiles: z48.array(
-    z48.object({ path: z48.string().min(1), status: z48.string().min(1) })
+var skillsApplyPatchResultSchema = z50.object({
+  changedFiles: z50.array(
+    z50.object({ path: z50.string().min(1), status: z50.string().min(1) })
   ),
-  commit: z48.string().regex(FULL_COMMIT_SHA_PATTERN),
-  ok: z48.boolean(),
-  ref: z48.string().min(1)
+  commit: z50.string().regex(FULL_COMMIT_SHA_PATTERN),
+  ok: z50.boolean(),
+  ref: z50.string().min(1)
 }).refine((result) => result.ok, {
   message: "Skills patch result was not successful."
 });
-var workingCopyMetadataSchema = z48.object({
-  version: z48.literal(1),
-  files: z48.array(
-    z48.object({
-      content: z48.string(),
-      path: z48.string().min(1)
+var workingCopyMetadataSchema = z50.object({
+  version: z50.literal(1),
+  files: z50.array(
+    z50.object({
+      content: z50.string(),
+      path: z50.string().min(1)
     })
   ),
-  organizationId: z48.string().min(1),
-  requestedRef: z48.string().min(1).nullable(),
-  skillPath: z48.string().min(1),
-  workingCopyPath: z48.string().min(1)
+  organizationId: z50.string().min(1),
+  requestedRef: z50.string().min(1).nullable(),
+  skillPath: z50.string().min(1),
+  workingCopyPath: z50.string().min(1)
 });
 function hasControlCharacter2(value) {
   return UTF8_ENCODER.encode(value).some((byte) => byte <= 31 || byte === 127);
@@ -31710,25 +32244,25 @@ async function pushSkillWorkingCopy({
 // src/state.ts
 import { mkdir as mkdir6, readFile as readFile8, rm as rm6, writeFile as writeFile4 } from "node:fs/promises";
 import path20 from "node:path";
-import { z as z49 } from "zod";
-var cliAccountSchema = z49.object({
-  clientId: z49.string().min(1),
-  email: z49.string().nullable(),
-  userId: z49.string().min(1)
-});
-var cliOrganizationSchema = z49.object({
-  id: z49.string().min(1),
-  name: z49.string().min(1),
-  primaryDomain: z49.string().nullable().default(null)
-});
-var cliStateSchema = z49.object({
+import { z as z51 } from "zod";
+var cliAccountSchema = z51.object({
+  clientId: z51.string().min(1),
+  email: z51.string().nullable(),
+  userId: z51.string().min(1)
+});
+var cliOrganizationSchema = z51.object({
+  id: z51.string().min(1),
+  name: z51.string().min(1),
+  primaryDomain: z51.string().nullable().default(null)
+});
+var cliStateSchema = z51.object({
   account: cliAccountSchema,
   deploymentTarget: resolvedDeploymentTargetSchema.optional(),
-  defaultOrgId: z49.string().nullable(),
-  lastUsedOrgId: z49.string().nullable(),
-  organizations: z49.array(cliOrganizationSchema)
+  defaultOrgId: z51.string().nullable(),
+  lastUsedOrgId: z51.string().nullable(),
+  organizations: z51.array(cliOrganizationSchema)
 });
-var refreshTokenFileSchema = z49.record(z49.string(), z49.string());
+var refreshTokenFileSchema = z51.record(z51.string(), z51.string());
 function createFileStateStore(stateFilePath) {
   return {
     async clear() {
@@ -31818,38 +32352,120 @@ function buildRefreshTokenKey(account) {
   return `${account.clientId}:${account.userId}`;
 }
 
+// src/verification-record-commands.ts
+import { readFile as readFile9 } from "node:fs/promises";
+import path21 from "node:path";
+import { z as z52 } from "zod";
+var VERIFICATION_RECORD_UPLOAD_OPERATION_NAME = "VerificationRecordUpload";
+var verificationRecordsSchema = z52.array(z52.record(z52.string(), z52.unknown())).min(1, "Verification record upload must contain at least one record.").max(
+  VERIFICATION_RECORD_UPLOAD_MAX_ITEMS,
+  `Verification record upload must contain at most ${VERIFICATION_RECORD_UPLOAD_MAX_ITEMS} records.`
+);
+async function readStdin2() {
+  process.stdin.setEncoding("utf8");
+  let contents = "";
+  for await (const chunk of process.stdin) {
+    if (typeof chunk !== "string") {
+      throw new CliError("Verification record stdin must be UTF-8 text.");
+    }
+    contents += chunk;
+  }
+  return contents;
+}
+async function readUploadInput({
+  inputFile,
+  runtime
+}) {
+  if (inputFile === "-") {
+    return await (runtime.readStdin ?? readStdin2)().catch(
+      (error) => {
+        throw new CliError("Failed to read verification records from stdin.", {
+          cause: error
+        });
+      }
+    );
+  }
+  const inputPath = path21.resolve(
+    runtime.workingDirectory ?? process.cwd(),
+    inputFile
+  );
+  return await readFile9(inputPath, "utf8").catch((error) => {
+    throw new CliError(
+      `Failed to read verification record input file "${inputPath}".`,
+      { cause: error }
+    );
+  });
+}
+async function resolveVerificationRecordOperationVariables({
+  defaultVariables,
+  operationName,
+  options,
+  runtime = {},
+  workingDirectory
+}) {
+  if (operationName !== VERIFICATION_RECORD_UPLOAD_OPERATION_NAME) {
+    return defaultVariables;
+  }
+  const { inputFile } = options;
+  if (typeof inputFile !== "string" || inputFile.length === 0) {
+    throw new CliError("--input-file must name a JSON file or - for stdin.");
+  }
+  const contents = await readUploadInput({
+    inputFile,
+    runtime: {
+      ...runtime,
+      workingDirectory: runtime.workingDirectory ?? workingDirectory
+    }
+  });
+  const parsedJson = safeJsonParseWithoutLogging(contents);
+  if (isErr(parsedJson)) {
+    const source = inputFile === "-" ? "stdin" : `file "${inputFile}"`;
+    throw new CliError(
+      `Verification record input from ${source} must be valid JSON.`,
+      { cause: parsedJson.error }
+    );
+  }
+  const parsedRecords = verificationRecordsSchema.safeParse(parsedJson.value);
+  if (!parsedRecords.success) {
+    throw new CliError(
+      parsedRecords.error.issues[0]?.message ?? "Verification record input must be a JSON array."
+    );
+  }
+  return { ...defaultVariables, records: parsedRecords.data };
+}
+
 // src/workos-auth.ts
-import { z as z50 } from "zod";
+import { z as z53 } from "zod";
 var DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
 function buildFormHeaders() {
   const headers = new Headers();
   headers.set("content-type", "application/x-www-form-urlencoded");
   return headers;
 }
-var deviceAuthorizationSchema = z50.object({
-  device_code: z50.string().min(1),
-  expires_in: z50.number().int().positive().optional(),
-  interval: z50.number().int().positive().optional(),
-  user_code: z50.string().min(1),
-  verification_uri: z50.url(),
-  verification_uri_complete: z50.url().optional()
-});
-var tokenResponseSchema = z50.object({
-  access_token: z50.string().min(1),
-  expires_in: z50.number().int().positive().optional(),
-  refresh_token: z50.string().min(1),
-  token_type: z50.string().optional()
-});
-var tokenErrorSchema = z50.object({
-  error: z50.string().min(1),
-  error_description: z50.string().optional()
-});
-var accessTokenClaimsSchema = z50.object({
-  exp: z50.number().int().positive().optional(),
-  iss: z50.string().min(1).optional(),
-  org_id: z50.string().min(1).optional(),
-  sid: z50.string().min(1).optional(),
-  sub: z50.string().min(1)
+var deviceAuthorizationSchema = z53.object({
+  device_code: z53.string().min(1),
+  expires_in: z53.number().int().positive().optional(),
+  interval: z53.number().int().positive().optional(),
+  user_code: z53.string().min(1),
+  verification_uri: z53.url(),
+  verification_uri_complete: z53.url().optional()
+});
+var tokenResponseSchema = z53.object({
+  access_token: z53.string().min(1),
+  expires_in: z53.number().int().positive().optional(),
+  refresh_token: z53.string().min(1),
+  token_type: z53.string().optional()
+});
+var tokenErrorSchema = z53.object({
+  error: z53.string().min(1),
+  error_description: z53.string().optional()
+});
+var accessTokenClaimsSchema = z53.object({
+  exp: z53.number().int().positive().optional(),
+  iss: z53.string().min(1).optional(),
+  org_id: z53.string().min(1).optional(),
+  sid: z53.string().min(1).optional(),
+  sub: z53.string().min(1)
 });
 function createWorkosAuthClient({
   fetchFn = fetch,
@@ -32140,7 +32756,7 @@ async function handleOperationCommand(dependencies, operationSpec, commandOption
     commandOptions,
     dependencies.workingDirectory ?? process.cwd()
   );
-  const operationVariables = await resolveClassifyOperationVariables({
+  const classifiedOperationVariables = await resolveClassifyOperationVariables({
     defaultVariables: getFileUploadOperationVariables(
       collectOperationVariableInput(operationSpec, commandOptions),
       preparedUpload
@@ -32150,6 +32766,13 @@ async function handleOperationCommand(dependencies, operationSpec, commandOption
     runtime: dependencies.classifyCommandRuntime,
     workingDirectory: dependencies.workingDirectory ?? process.cwd()
   });
+  const operationVariables = await resolveVerificationRecordOperationVariables({
+    defaultVariables: classifiedOperationVariables,
+    operationName: operationSpec.operationName,
+    options: commandOptions,
+    runtime: dependencies.verificationRecordCommandRuntime,
+    workingDirectory: dependencies.workingDirectory ?? process.cwd()
+  });
   const variables = await resolveOperationVariables({
     operationSpec,
     variables: operationVariables,
@@ -32945,12 +33568,12 @@ function createDefaultDependencies() {
     return resolveDeploymentTarget({ savedEnv: settings.env, selectors });
   };
   const resolveApiBaseUrl = () => deploymentTargetContext.get().apiUrl;
-  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path21.join(
-    path21.dirname(runtimeConfig.stateFilePath),
+  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path22.join(
+    path22.dirname(runtimeConfig.stateFilePath),
     CLI_ACCESS_TOKEN_FILE_NAME
   );
-  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path21.join(
-    path21.dirname(runtimeConfig.stateFilePath),
+  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path22.join(
+    path22.dirname(runtimeConfig.stateFilePath),
     CLI_REFRESH_TOKEN_FILE_NAME
   );
   const selfUpdateOptions = {
@@ -32968,8 +33591,8 @@ function createDefaultDependencies() {
     io: createConsoleIo(),
     openExternalUrl,
     orgPreferencesStore: createFileOrgPreferencesStore(
-      path21.join(
-        path21.dirname(runtimeConfig.stateFilePath),
+      path22.join(
+        path22.dirname(runtimeConfig.stateFilePath),
         "organization-preferences"
       )
     ),