@getmagical/cli 0.2.3 → 0.2.5

package/dist/index.js

@@ -2056,13 +2056,13 @@ var require_ast = __commonJS({
         helperExpression: function helperExpression(node) {
           return node.type === "SubExpression" || (node.type === "MustacheStatement" || node.type === "BlockStatement") && !!(node.params && node.params.length || node.hash);
         },
-        scopedId: function scopedId(path7) {
-          return /^\.|this\b/.test(path7.original);
+        scopedId: function scopedId(path8) {
+          return /^\.|this\b/.test(path8.original);
         },
         // an ID is simple if it only has one part, and that part is not
         // `..` or `this`.
-        simpleId: function simpleId(path7) {
-          return path7.parts.length === 1 && !AST.helpers.scopedId(path7) && !path7.depth;
+        simpleId: function simpleId(path8) {
+          return path8.parts.length === 1 && !AST.helpers.scopedId(path8) && !path8.depth;
         }
       }
     };
@@ -3132,12 +3132,12 @@ var require_helpers2 = __commonJS({
         loc
       };
     }
-    function prepareMustache(path7, params, hash, open, strip, locInfo) {
+    function prepareMustache(path8, params, hash, open, strip, locInfo) {
       var escapeFlag = open.charAt(3) || open.charAt(2), escaped = escapeFlag !== "{" && escapeFlag !== "&";
       var decorator = /\*/.test(open);
       return {
         type: decorator ? "Decorator" : "MustacheStatement",
-        path: path7,
+        path: path8,
         params,
         hash,
         escaped,
@@ -3455,9 +3455,9 @@ var require_compiler = __commonJS({
       },
       DecoratorBlock: function DecoratorBlock(decorator) {
         var program2 = decorator.program && this.compileProgram(decorator.program);
-        var params = this.setupFullMustacheParams(decorator, program2, void 0), path7 = decorator.path;
+        var params = this.setupFullMustacheParams(decorator, program2, void 0), path8 = decorator.path;
         this.useDecorators = true;
-        this.opcode("registerDecorator", params.length, path7.original);
+        this.opcode("registerDecorator", params.length, path8.original);
       },
       PartialStatement: function PartialStatement(partial) {
         this.usePartial = true;
@@ -3521,46 +3521,46 @@ var require_compiler = __commonJS({
         }
       },
       ambiguousSexpr: function ambiguousSexpr(sexpr, program2, inverse) {
-        var path7 = sexpr.path, name = path7.parts[0], isBlock = program2 != null || inverse != null;
-        this.opcode("getContext", path7.depth);
+        var path8 = sexpr.path, name = path8.parts[0], isBlock = program2 != null || inverse != null;
+        this.opcode("getContext", path8.depth);
         this.opcode("pushProgram", program2);
         this.opcode("pushProgram", inverse);
-        path7.strict = true;
-        this.accept(path7);
+        path8.strict = true;
+        this.accept(path8);
         this.opcode("invokeAmbiguous", name, isBlock);
       },
       simpleSexpr: function simpleSexpr(sexpr) {
-        var path7 = sexpr.path;
-        path7.strict = true;
-        this.accept(path7);
+        var path8 = sexpr.path;
+        path8.strict = true;
+        this.accept(path8);
         this.opcode("resolvePossibleLambda");
       },
       helperSexpr: function helperSexpr(sexpr, program2, inverse) {
-        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path7 = sexpr.path, name = path7.parts[0];
+        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path8 = sexpr.path, name = path8.parts[0];
         if (this.options.knownHelpers[name]) {
           this.opcode("invokeKnownHelper", params.length, name);
         } else if (this.options.knownHelpersOnly) {
           throw new _exception2["default"]("You specified knownHelpersOnly, but used the unknown helper " + name, sexpr);
         } else {
-          path7.strict = true;
-          path7.falsy = true;
-          this.accept(path7);
-          this.opcode("invokeHelper", params.length, path7.original, _ast2["default"].helpers.simpleId(path7));
+          path8.strict = true;
+          path8.falsy = true;
+          this.accept(path8);
+          this.opcode("invokeHelper", params.length, path8.original, _ast2["default"].helpers.simpleId(path8));
         }
       },
-      PathExpression: function PathExpression(path7) {
-        this.addDepth(path7.depth);
-        this.opcode("getContext", path7.depth);
-        var name = path7.parts[0], scoped = _ast2["default"].helpers.scopedId(path7), blockParamId = !path7.depth && !scoped && this.blockParamIndex(name);
+      PathExpression: function PathExpression(path8) {
+        this.addDepth(path8.depth);
+        this.opcode("getContext", path8.depth);
+        var name = path8.parts[0], scoped = _ast2["default"].helpers.scopedId(path8), blockParamId = !path8.depth && !scoped && this.blockParamIndex(name);
         if (blockParamId) {
-          this.opcode("lookupBlockParam", blockParamId, path7.parts);
+          this.opcode("lookupBlockParam", blockParamId, path8.parts);
         } else if (!name) {
           this.opcode("pushContext");
-        } else if (path7.data) {
+        } else if (path8.data) {
           this.options.data = true;
-          this.opcode("lookupData", path7.depth, path7.parts, path7.strict);
+          this.opcode("lookupData", path8.depth, path8.parts, path8.strict);
         } else {
-          this.opcode("lookupOnContext", path7.parts, path7.falsy, path7.strict, scoped);
+          this.opcode("lookupOnContext", path8.parts, path8.falsy, path8.strict, scoped);
         }
       },
       StringLiteral: function StringLiteral(string) {
@@ -3910,16 +3910,16 @@ var require_util2 = __commonJS({
     }
     exports.urlGenerate = urlGenerate;
     function normalize(aPath) {
-      var path7 = aPath;
+      var path8 = aPath;
       var url = urlParse(aPath);
       if (url) {
         if (!url.path) {
           return aPath;
         }
-        path7 = url.path;
+        path8 = url.path;
       }
-      var isAbsolute = exports.isAbsolute(path7);
-      var parts = path7.split(/\/+/);
+      var isAbsolute = exports.isAbsolute(path8);
+      var parts = path8.split(/\/+/);
       for (var part, up = 0, i = parts.length - 1; i >= 0; i--) {
         part = parts[i];
         if (part === ".") {
@@ -3936,15 +3936,15 @@ var require_util2 = __commonJS({
           }
         }
       }
-      path7 = parts.join("/");
-      if (path7 === "") {
-        path7 = isAbsolute ? "/" : ".";
+      path8 = parts.join("/");
+      if (path8 === "") {
+        path8 = isAbsolute ? "/" : ".";
       }
       if (url) {
-        url.path = path7;
+        url.path = path8;
         return urlGenerate(url);
       }
-      return path7;
+      return path8;
     }
     exports.normalize = normalize;
     function join(aRoot, aPath) {
@@ -6727,8 +6727,8 @@ var require_printer = __commonJS({
       return this.accept(sexpr.path) + " " + params + hash;
     };
     PrintVisitor.prototype.PathExpression = function(id) {
-      var path7 = id.parts.join("/");
-      return (id.data ? "@" : "") + "PATH:" + path7;
+      var path8 = id.parts.join("/");
+      return (id.data ? "@" : "") + "PATH:" + path8;
     };
     PrintVisitor.prototype.StringLiteral = function(string) {
       return '"' + string.value + '"';
@@ -7079,8 +7079,8 @@ function getErrorMessage(error) {
 }
 
 // src/program.ts
-import { readFile as readFile4 } from "node:fs/promises";
-import path6 from "node:path";
+import { readFile as readFile5 } from "node:fs/promises";
+import path7 from "node:path";
 
 // ../common/dist/src/stdlib/json.util.js
 var import_ts_essentials = __toESM(require_dist(), 1);
@@ -7088,6 +7088,56 @@ var import_ts_essentials = __toESM(require_dist(), 1);
 // ../common/dist/src/stdlib/result.util.js
 import { z } from "zod";
 
+// ../common/dist/src/stdlib/error-temporal.js
+function isErrorLike(obj) {
+  return typeof obj === "object" && obj !== null && "name" in obj && "message" in obj && typeof obj.name === "string" && typeof obj.message === "string";
+}
+function isTemporalApplicationFailure(error) {
+  if (!isErrorLike(error)) {
+    return false;
+  }
+  return error.name === "ApplicationFailure" || !!error.stack?.startsWith("ApplicationFailure");
+}
+function isTemporalActivityFailure(error) {
+  if (!isErrorLike(error)) {
+    return false;
+  }
+  return error.name === "ActivityFailure" || error.message === "Activity task failed";
+}
+function isTemporalChildWorkflowFailure(error) {
+  if (!isErrorLike(error)) {
+    return false;
+  }
+  return error.name === "ChildWorkflowFailure" || error.message === "Child Workflow execution failed";
+}
+function isTemporalFailure(error) {
+  if (!isErrorLike(error)) {
+    return false;
+  }
+  return isTemporalApplicationFailure(error) || isTemporalActivityFailure(error) || isTemporalChildWorkflowFailure(error);
+}
+
+// ../common/dist/src/stdlib/error-serialization.js
+function getErrorMessage2(error, maxDepth = 10) {
+  if (error instanceof Error || isErrorLike2(error)) {
+    if (error.cause && maxDepth > 0) {
+      if (isTemporalFailure(error)) {
+        return getErrorMessage2(error.cause, maxDepth - 1);
+      }
+      return `${error.message}
+${getErrorMessage2(error.cause, maxDepth - 1)}`;
+    }
+    return error.message;
+  }
+  if (typeof error === "string" || typeof error === "number" || typeof error === "boolean" || error === void 0) {
+    return String(error);
+  }
+  return JSON.stringify(error);
+}
+function isErrorLike2(obj) {
+  return typeof obj === "object" && obj !== null && "name" in obj && "message" in obj && typeof obj.name === "string" && typeof obj.message === "string";
+}
+
 // ../common/dist/src/stdlib/error-user-facing.js
 var USER_FACING_STATUS_MESSAGES = /* @__PURE__ */ new Map([
   [400, "Bad Request"],
@@ -7691,6 +7741,13 @@ function safeJsonParse(json) {
     return Err({ type: "invalid-json", cause: error, json });
   }
 }
+function safeJsonParseWithoutLogging(json) {
+  try {
+    return Ok(JSON.parse(json));
+  } catch (error) {
+    return Err({ type: "invalid-json", cause: error });
+  }
+}
 
 // ../common/dist/src/constants/tool-declarations.js
 import { z as z12 } from "zod";
@@ -11865,8 +11922,8 @@ var RENDER_TEMPLATE_ERROR_REASON_CATALOG = defineErrorReasonCatalog()([
 ]);
 var storeReferencePathPattern = String.raw`store(?:\.[$A-Z_a-z][\w$]*)*`;
 var storeReferenceMarkdownLinkTemplateRegex = new RegExp(String.raw`(?<open>\{\{\{?)\s*\[(?<path>${storeReferencePathPattern})\]\(\s*<?https?:\/\/\k<path>>?\s*\)\s*(?<close>\}\}\}?)`, "gu");
-function normalizeAutomationStoreTemplateLinkMatch([_match, open, path7]) {
-  return open === "{{{" ? `{{{${path7}}}}` : `{{${path7}}}`;
+function normalizeAutomationStoreTemplateLinkMatch([_match, open, path8]) {
+  return open === "{{{" ? `{{{${path8}}}}` : `{{${path8}}}`;
 }
 function normalizeAutomationStoreTemplateLinks(template) {
   return template.replaceAll(storeReferenceMarkdownLinkTemplateRegex, (...args) => normalizeAutomationStoreTemplateLinkMatch(args));
@@ -12206,6 +12263,16 @@ function replaceHandlebarsTemplates(value) {
   return value.replaceAll(HANDLEBARS_TEMPLATE_GLOBAL_REGEX, URL_TEMPLATE_PLACEHOLDER_VALUE);
 }
 
+// ../common/dist/src/stdlib/unsafe-object-key.util.js
+var UNSAFE_OBJECT_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+function isUnsafeObjectKey(value) {
+  return UNSAFE_OBJECT_KEYS.has(value);
+}
+
 // ../common/dist/src/models/websocket/actions/scroll.js
 import { z as z9 } from "zod";
 var scrollDataSchema = z9.object({
@@ -12424,18 +12491,18 @@ var reportStopDataSchema = z11.object({
 // ../common/dist/src/utils/automation-store-path.util.js
 var AUTOMATION_STORE_ROOT_PATH = "store";
 var relativeStorePathRegex = /^[$A-Z_a-z][\w$]*(?:\.[$A-Z_a-z][\w$]*)*$/u;
-function normalizeStoreMutationPath(path7) {
-  const trimmedPath = path7.trim();
+function normalizeStoreMutationPath(path8) {
+  const trimmedPath = path8.trim();
   const rootPrefix = `${AUTOMATION_STORE_ROOT_PATH}.`;
   const relativePath = trimmedPath.startsWith(rootPrefix) ? trimmedPath.slice(rootPrefix.length) : trimmedPath;
   if (!relativeStorePathRegex.test(relativePath)) {
     return Err({
       type: "invalid-automation-store-path",
-      path: path7,
+      path: path8,
       categories: ["customer_usage"],
       statusCode: 400,
       nonRetryable: true,
-      message: `Automation store path "${path7}" is invalid.`,
+      message: `Automation store path "${path8}" is invalid.`,
       suggestedAction: "Use a dot path relative to the automation store, such as patient.name or provider.clinic."
     });
   }
@@ -12448,16 +12515,16 @@ function findAutomationStorePathOverlap(paths) {
     ...new Set(paths.map(getCanonicalAutomationStoreMutationPath))
   ].toSorted((left, right) => (left === AUTOMATION_STORE_ROOT_PATH ? 0 : left.split(".").length) - (right === AUTOMATION_STORE_ROOT_PATH ? 0 : right.split(".").length));
   for (const [index, ancestorPath] of canonicalPaths.entries()) {
-    const descendantPath = canonicalPaths.slice(index + 1).find((path7) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path7.startsWith(`${ancestorPath}.`));
+    const descendantPath = canonicalPaths.slice(index + 1).find((path8) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path8.startsWith(`${ancestorPath}.`));
     if (descendantPath !== void 0) {
       return { ancestorPath, descendantPath };
     }
   }
   return void 0;
 }
-function getCanonicalAutomationStoreMutationPath(path7) {
-  const normalizedPath = normalizeStoreMutationPath(path7);
-  return normalizedPath._tag === "Ok" ? normalizedPath.value : path7.trim();
+function getCanonicalAutomationStoreMutationPath(path8) {
+  const normalizedPath = normalizeStoreMutationPath(path8);
+  return normalizedPath._tag === "Ok" ? normalizedPath.value : path8.trim();
 }
 
 // ../common/dist/src/constants/tool-declarations.js
@@ -12681,9 +12748,9 @@ var baseToolDeclarations = {
           path: []
         });
       }
-      const canonicalUpdatePaths = updates.map(({ path: path7 }) => getCanonicalAutomationStoreMutationPath(path7));
+      const canonicalUpdatePaths = updates.map(({ path: path8 }) => getCanonicalAutomationStoreMutationPath(path8));
       const canonicalClearPathSet = new Set(clears.map(getCanonicalAutomationStoreMutationPath));
-      const conflictedUpdatePath = canonicalUpdatePaths.find((path7) => canonicalClearPathSet.has(path7));
+      const conflictedUpdatePath = canonicalUpdatePaths.find((path8) => canonicalClearPathSet.has(path8));
       if (conflictedUpdatePath !== void 0) {
         context.addIssue({
           code: "custom",
@@ -13126,7 +13193,7 @@ var SOM_LEGEND_HTML_ATTRIBUTES = [
 ];
 
 // ../common/dist/src/zod-schemas/agent-config.schema.js
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 
 // ../common/dist/src/commands/commands-registry/special.commands.js
 import { z as z13 } from "zod";
@@ -13362,9 +13429,9 @@ var specialCommands = {
 };
 
 // ../common/dist/src/utils/agent-knowledge-base-assets.util.js
-function getIsKnowledgeBaseAssetPathAllowed(path7) {
-  const pathSegments = path7.split("/");
-  if (path7.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
+function getIsKnowledgeBaseAssetPathAllowed(path8) {
+  const pathSegments = path8.split("/");
+  if (path8.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
     return false;
   }
   const isTopLevelAssetPath = pathSegments[0] === "assets";
@@ -13373,32 +13440,99 @@ function getIsKnowledgeBaseAssetPathAllowed(path7) {
   return isTopLevelAssetPath || isAutomationAssetPath || isAutomationAgentAssetPath;
 }
 
-// ../common/dist/src/utils/automation-variable-path.util.js
-var AUTOMATION_VARIABLE_PATH_SEGMENT_PATTERN = String.raw`[A-Za-z_][A-Za-z0-9_-]*`;
-var AUTOMATION_VARIABLE_PATH_PATTERN = String.raw`${AUTOMATION_VARIABLE_PATH_SEGMENT_PATTERN}(?:\.${AUTOMATION_VARIABLE_PATH_SEGMENT_PATTERN})*`;
-var DANGEROUS_AUTOMATION_VARIABLE_OBJECT_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype"
-]);
-var AUTOMATION_VARIABLE_PATH_SEGMENT_REGEX = new RegExp(`^${AUTOMATION_VARIABLE_PATH_SEGMENT_PATTERN}$`, "u");
-function isDangerousAutomationVariableObjectKey(value) {
-  return DANGEROUS_AUTOMATION_VARIABLE_OBJECT_KEYS.has(value);
-}
-
 // ../common/dist/src/utils/ponr-key-field-path.util.js
 var POINT_OF_NO_RETURN_KEY_FIELD_ROOTS = /* @__PURE__ */ new Set(["input", "store"]);
 function parsePointOfNoReturnKeyFieldPath(keyField) {
   const segments = keyField.split(".");
   const [root, ...pathSegments] = segments;
-  if (root === void 0 || !POINT_OF_NO_RETURN_KEY_FIELD_ROOTS.has(root) || pathSegments.length === 0 || pathSegments.some((segment) => segment.length === 0 || isDangerousAutomationVariableObjectKey(segment))) {
+  if (root === void 0 || !POINT_OF_NO_RETURN_KEY_FIELD_ROOTS.has(root) || pathSegments.length === 0 || pathSegments.some((segment) => segment.length === 0 || isUnsafeObjectKey(segment))) {
     return void 0;
   }
   return segments;
 }
 
-// ../common/dist/src/zod-schemas/api-request-body.schema.js
+// ../common/dist/src/zod-schemas/api-agent-file-output.schema.js
 import { z as z14 } from "zod";
+
+// ../common/dist/src/utils/api-file-type-registry.util.js
+var ApiFileContentTypes = ["application/pdf", "image/png"];
+var PDF_CONTENT_TYPE = "application/pdf";
+var PNG_CONTENT_TYPE = "image/png";
+var API_FILE_TYPE_REGISTRY = {
+  [PDF_CONTENT_TYPE]: {
+    extension: "pdf",
+    signature: [37, 80, 68, 70, 45]
+  },
+  [PNG_CONTENT_TYPE]: {
+    extension: "png",
+    signature: [137, 80, 78, 71, 13, 10, 26, 10]
+  }
+};
+
+// ../common/dist/src/zod-schemas/api-agent-file-output.schema.js
+var ApiAgentOutputModes = ["inline", "file"];
+var API_EMBEDDED_FILE_PATH_PATTERN = /^(?:\[\*\]|[A-Za-z_$][\w$-]*)(?:\[\*\]|\.[A-Za-z_$][\w$-]*)*$/u;
+var API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN = /\[\*\]|[A-Za-z_$][\w$-]*/gu;
+function parseApiEmbeddedFilePath(path8) {
+  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path8)) {
+    return void 0;
+  }
+  return [...path8.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
+}
+var apiAgentEmbeddedFileSchema = z14.object({
+  path: z14.string().trim().min(1, "Embedded file path is required.").refine((path8) => parseApiEmbeddedFilePath(path8) !== void 0, {
+    message: "Embedded file path must use object properties and [*] array wildcards."
+  }).describe("Path to a Base64 value relative to the projected API response. Supports object properties and [*] array wildcards."),
+  contentType: z14.enum(ApiFileContentTypes).describe("File type of the decoded Base64 value.")
+}).strict();
+var apiAgentEmbeddedFilesSchema = z14.array(apiAgentEmbeddedFileSchema).superRefine((embeddedFiles, context) => {
+  const paths = /* @__PURE__ */ new Set();
+  for (const [index, { path: path8 }] of embeddedFiles.entries()) {
+    if (paths.has(path8)) {
+      context.addIssue({
+        code: z14.ZodIssueCode.custom,
+        message: `Embedded file path "${path8}" can only be configured once.`,
+        path: [index, "path"]
+      });
+    }
+    paths.add(path8);
+  }
+}).describe("Base64 values to decode, upload as permanent files, and replace with file references in the projected API response.");
+
+// ../common/dist/src/zod-schemas/api-agent-request-file-encoding.schema.js
+import { z as z15 } from "zod";
+var API_REQUEST_FILE_PATH_PATTERN = /^[A-Za-z_$][\w$-]*(?:\.[A-Za-z_$][\w$-]*)*$/u;
+function parseApiRequestFilePath(path8) {
+  if (!API_REQUEST_FILE_PATH_PATTERN.test(path8)) {
+    return void 0;
+  }
+  return path8.split(".");
+}
+var apiAgentRequestFileEncodingSchema = z15.object({
+  sourceInput: z15.string().trim().min(1, "File input is required.").refine((path8) => parseApiRequestFilePath(path8) !== void 0, {
+    message: "File input must use an object property path."
+  }).describe("API Agent input containing the file reference to encode."),
+  destinationPath: z15.string().trim().min(1, "Request field is required.").refine((path8) => parseApiRequestFilePath(path8) !== void 0, {
+    message: "Request field must use an object property path."
+  }).describe("JSON request body path where the encoded value is inserted."),
+  encoding: z15.literal("base64").describe("Encoding applied to the source file before insertion.")
+}).strict();
+var apiAgentRequestFileEncodingsSchema = z15.array(apiAgentRequestFileEncodingSchema).superRefine((requestFileEncodings, context) => {
+  const destinationPaths = /* @__PURE__ */ new Set();
+  for (const [index, { destinationPath }] of requestFileEncodings.entries()) {
+    if (destinationPaths.has(destinationPath)) {
+      context.addIssue({
+        code: z15.ZodIssueCode.custom,
+        message: `Request field "${destinationPath}" can only be configured once.`,
+        path: [index, "destinationPath"]
+      });
+    }
+    destinationPaths.add(destinationPath);
+  }
+}).describe("Files to read from API Agent inputs, encode, and insert into the JSON request body.");
+
+// ../common/dist/src/zod-schemas/api-request-body.schema.js
+import { z as z16 } from "zod";
 var ApiRequestBodyTypes = [
   "json",
   "multipartFormData",
@@ -13407,20 +13541,20 @@ var ApiRequestBodyTypes = [
 var ApiMethodsWithBody = ["POST", "PUT", "PATCH", "DELETE"];
 var ApiMultipartFormDataFieldTypes = ["text", "file"];
 var MULTIPART_PART_CONTENT_TYPE_PATTERN = /^[A-Za-z0-9!#$&^_.+-]+\/[A-Za-z0-9!#$&^_.+-]+(?:\s*;\s*[A-Za-z0-9!#$&^_.+-]+=(?:"[^"]*"|[A-Za-z0-9!#$&^_.+-]+))*$/u;
-var apiMultipartFormDataFieldSchema = z14.object({
-  key: z14.string().describe("Form field name."),
-  contentType: z14.string().trim().min(1).regex(MULTIPART_PART_CONTENT_TYPE_PATTERN, {
+var apiMultipartFormDataFieldSchema = z16.object({
+  key: z16.string().describe("Form field name."),
+  contentType: z16.string().trim().min(1).regex(MULTIPART_PART_CONTENT_TYPE_PATTERN, {
     message: "Content type must be a MIME type like application/json or text/plain; charset=utf-8."
   }).optional().describe("Optional MIME type for this multipart part. Use application/json for text parts that must be sent as JSON."),
-  type: z14.enum(ApiMultipartFormDataFieldTypes).optional().describe("Form field type. Defaults to text when omitted. Use file to upload a file asset selected from available inputs."),
-  value: z14.string().describe("Form field value.")
+  type: z16.enum(ApiMultipartFormDataFieldTypes).optional().describe("Form field type. Defaults to text when omitted. Use file to upload a file asset selected from available inputs."),
+  value: z16.string().describe("Form field value.")
 }).describe("A multipart form-data field. Defaults to a text field when type is omitted. Set contentType when the receiving API requires a MIME type for the individual part.");
-var apiMultipartFormDataBodySchema = z14.array(apiMultipartFormDataFieldSchema).describe("Multipart form-data body represented as an array of typed form-data fields.");
-var apiFormUrlEncodedFieldSchema = z14.object({
-  key: z14.string().describe("Form field name."),
-  value: z14.string().describe("Form field value.")
+var apiMultipartFormDataBodySchema = z16.array(apiMultipartFormDataFieldSchema).describe("Multipart form-data body represented as an array of typed form-data fields.");
+var apiFormUrlEncodedFieldSchema = z16.object({
+  key: z16.string().describe("Form field name."),
+  value: z16.string().describe("Form field value.")
 }).describe("A form URL-encoded field.");
-var apiFormUrlEncodedBodySchema = z14.array(apiFormUrlEncodedFieldSchema).describe("Form URL-encoded body represented as an array of key/value fields.");
+var apiFormUrlEncodedBodySchema = z16.array(apiFormUrlEncodedFieldSchema).describe("Form URL-encoded body represented as an array of key/value fields.");
 function isValidApiMultipartFormDataBody({ bodyType, body }) {
   if (bodyType !== "multipartFormData" || body === void 0) {
     return true;
@@ -13435,11 +13569,11 @@ function isValidApiFormUrlEncodedBody({ bodyType, body }) {
 }
 
 // ../common/dist/src/zod-schemas/api-tool.schema.js
-import { z as z16 } from "zod";
+import { z as z18 } from "zod";
 
 // ../common/dist/src/zod-schemas/output-store-binding.schema.js
-import { z as z15 } from "zod";
-var outputStorePathSchema = z15.string().regex(/^store\.[^\s.]+(?:\.[^\s.]+)*$/u, "Data Store destination must be a fully qualified path such as store.patient.name.");
+import { z as z17 } from "zod";
+var outputStorePathSchema = z17.string().regex(/^store\.[^\s.]+(?:\.[^\s.]+)*$/u, "Data Store destination must be a fully qualified path such as store.patient.name.");
 
 // ../common/dist/src/zod-schemas/api-tool.schema.js
 var methodsWithBody = new Set(ApiMethodsWithBody);
@@ -13456,11 +13590,11 @@ function getStaticHttpsBaseUrl(value) {
   const isStaticHttpsBaseUrl = url.protocol === "https:" && url.username === "" && url.password === "" && url.search === "" && url.hash === "";
   return isStaticHttpsBaseUrl ? url : void 0;
 }
-var nangoBaseUrlOverrideSchema = z16.string().trim().superRefine((value, ctx) => {
+var nangoBaseUrlOverrideSchema = z18.string().trim().superRefine((value, ctx) => {
   const baseUrl = getStaticHttpsBaseUrl(value);
   if (baseUrl === void 0) {
     ctx.addIssue({
-      code: z16.ZodIssueCode.custom,
+      code: z18.ZodIssueCode.custom,
       message: "Base URL override must be a static HTTPS URL without credentials, query parameters, fragments, or template placeholders"
     });
   }
@@ -13471,25 +13605,25 @@ var defaultApiResponseCacheConfig = {
   enabled: false,
   ttl: API_RESPONSE_CACHE_DEFAULT_TTL_SECONDS
 };
-var apiResponseCacheConfigObjectSchema = z16.object({
-  enabled: z16.boolean().default(defaultApiResponseCacheConfig.enabled).describe("Whether API response caching is enabled for this request."),
-  ttl: z16.number().int().positive().default(defaultApiResponseCacheConfig.ttl).describe("Time-to-live for cached successful API responses, measured in seconds.")
+var apiResponseCacheConfigObjectSchema = z18.object({
+  enabled: z18.boolean().default(defaultApiResponseCacheConfig.enabled).describe("Whether API response caching is enabled for this request."),
+  ttl: z18.number().int().positive().default(defaultApiResponseCacheConfig.ttl).describe("Time-to-live for cached successful API responses, measured in seconds.")
 });
 var apiResponseCacheConfigSchema = apiResponseCacheConfigObjectSchema.optional().describe("Response cache configuration. Successful API responses can be reused across runs for identical rendered requests, with TTL measured in seconds.");
 var apiOutputStorePathSchema = outputStorePathSchema.describe("Fully qualified Data Store path that receives the selected value.");
 var apiOutputStoreBindingShape = {
-  jmesPath: z16.string().trim().min(1, "JMESPath is required. Use @ to select the entire response.").describe("JMESPath expression evaluated against the raw API response. Use @ to select the entire response."),
+  jmesPath: z18.string().trim().min(1, "JMESPath is required. Use @ to select the entire response.").describe("JMESPath expression evaluated against the raw API response. Use @ to select the entire response."),
   storePath: apiOutputStorePathSchema,
-  arrayMode: z16.enum(["append", "appendList", "replace"]).optional().describe("Required for newly authored array destinations: append adds exactly one item, appendList adds multiple items, and replace sets the complete list. Omit for scalar and Object destinations; Object values replace the complete object. Legacy omitted array modes still append at runtime.")
+  arrayMode: z18.enum(["append", "appendList", "replace"]).optional().describe("Required for newly authored array destinations: append adds exactly one item, appendList adds multiple items, and replace sets the complete list. Omit for scalar and Object destinations; Object values replace the complete object. Legacy omitted array modes still append at runtime.")
 };
-var apiOutputStoreBindingObjectSchema = z16.object(apiOutputStoreBindingShape);
-var apiOutputStoreBindingAuthoringSchema = z16.object(apiOutputStoreBindingShape).strict();
-var legacyApiOutputStoreBindingObjectSchema = z16.object({
-  sourcePath: z16.literal("$"),
+var apiOutputStoreBindingObjectSchema = z18.object(apiOutputStoreBindingShape);
+var apiOutputStoreBindingAuthoringSchema = z18.object(apiOutputStoreBindingShape).strict();
+var legacyApiOutputStoreBindingObjectSchema = z18.object({
+  sourcePath: z18.literal("$"),
   storePath: apiOutputStorePathSchema,
-  arrayMode: z16.enum(["append", "appendList", "replace"]).optional()
+  arrayMode: z18.enum(["append", "appendList", "replace"]).optional()
 });
-var apiOutputStoreBindingSchema = z16.union([
+var apiOutputStoreBindingSchema = z18.union([
   apiOutputStoreBindingObjectSchema,
   legacyApiOutputStoreBindingObjectSchema
 ]).transform((binding) => "jmesPath" in binding ? binding : {
@@ -13502,7 +13636,7 @@ function validateUniqueApiOutputStoreBindingPaths(bindings, ctx) {
   for (const [index, { storePath }] of bindings.entries()) {
     if (storePaths.has(storePath)) {
       ctx.addIssue({
-        code: z16.ZodIssueCode.custom,
+        code: z18.ZodIssueCode.custom,
         path: [index, "storePath"],
         message: `Data Store destination "${storePath}" can only be written once by this node.`
       });
@@ -13510,32 +13644,44 @@ function validateUniqueApiOutputStoreBindingPaths(bindings, ctx) {
     storePaths.add(storePath);
   }
 }
-var apiOutputStoreBindingsAuthoringSchema = z16.array(apiOutputStoreBindingAuthoringSchema).superRefine(validateUniqueApiOutputStoreBindingPaths).describe("Public authoring mappings from independently selected raw API response values to Data Store destinations.");
-var apiOutputStoreBindingsSchema = z16.array(apiOutputStoreBindingSchema).superRefine(validateUniqueApiOutputStoreBindingPaths).describe("Optional mappings from independently selected raw API response values to Data Store destinations.");
-var apiToolSchema = z16.object({
-  name: z16.string().describe("Unique name for the API tool."),
-  description: z16.string().describe("Description of what the API tool does. Shown to the agent to help it decide when to use this tool."),
-  inputSchema: z16.custom().optional().describe("JSON schema (in serialized Zod format) defining the input parameters for the API call."),
-  authInputs: z16.array(z16.object({
-    key: z16.string().describe("Parameter key where the auth value will be injected."),
-    value: z16.object({
-      authId: z16.string().describe("ID of the authentication credential to use."),
-      factor: z16.enum(IdentifierTypes).optional().describe("Type of authentication factor.")
+var apiOutputStoreBindingsAuthoringSchema = z18.array(apiOutputStoreBindingAuthoringSchema).superRefine(validateUniqueApiOutputStoreBindingPaths).describe("Public authoring mappings from independently selected raw API response values to Data Store destinations.");
+var apiOutputStoreBindingsSchema = z18.array(apiOutputStoreBindingSchema).superRefine(validateUniqueApiOutputStoreBindingPaths).describe("Optional mappings from independently selected raw API response values to Data Store destinations.");
+var apiToolSchema = z18.object({
+  name: z18.string().describe("Unique name for the API tool."),
+  description: z18.string().describe("Description of what the API tool does. Shown to the agent to help it decide when to use this tool."),
+  inputSchema: z18.custom().optional().describe("JSON schema (in serialized Zod format) defining the input parameters for the API call."),
+  authInputs: z18.array(z18.object({
+    key: z18.string().describe("Parameter key where the auth value will be injected."),
+    value: z18.object({
+      authId: z18.string().describe("ID of the authentication credential to use."),
+      factor: z18.enum(IdentifierTypes).optional().describe("Type of authentication factor.")
     })
   })).optional().describe("Authentication inputs to inject into the API call. Maps parameter keys to saved credentials."),
-  type: z16.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]).describe("HTTP method for the API call."),
-  url: z16.string().describe("URL template for the API endpoint. Can include placeholders like {paramName} for dynamic values."),
+  type: z18.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]).describe("HTTP method for the API call."),
+  url: z18.string().describe("URL template for the API endpoint. Can include placeholders like {paramName} for dynamic values."),
   baseUrlOverride: nangoBaseUrlOverrideSchema.optional().describe("Optional static base URL override for Nango-backed requests when the endpoint uses a base URL different from the provider default."),
-  headers: z16.record(z16.string(), z16.string()).optional().describe("HTTP headers to include in the request. Values can include placeholders."),
-  queryParams: z16.record(z16.string(), z16.string()).optional().describe("Query parameters to include in the URL. Values can include placeholders."),
-  body: z16.unknown().optional().describe("Request body template. Can include placeholders for dynamic values."),
-  bodyType: z16.enum(ApiRequestBodyTypes).optional().describe("Request body encoding mode. Defaults to JSON when omitted. Use multipartFormData for typed form-data fields and formUrlEncoded for application/x-www-form-urlencoded payloads."),
-  outputJmesPath: z16.string().optional().describe("JMESPath expression to extract specific data from the API response before returning it to the agent."),
+  headers: z18.record(z18.string(), z18.string()).optional().describe("HTTP headers to include in the request. Values can include placeholders."),
+  queryParams: z18.record(z18.string(), z18.string()).optional().describe("Query parameters to include in the URL. Values can include placeholders."),
+  body: z18.unknown().optional().describe("Request body template. Can include placeholders for dynamic values."),
+  bodyType: z18.enum(ApiRequestBodyTypes).optional().describe("Request body encoding mode. Defaults to JSON when omitted. Use multipartFormData for typed form-data fields and formUrlEncoded for application/x-www-form-urlencoded payloads."),
+  requestFileEncodings: apiAgentRequestFileEncodingsSchema.optional(),
+  outputJmesPath: z18.string().optional().describe("JMESPath expression to extract specific data from the API response before returning it to the agent."),
+  outputMode: z18.enum(ApiAgentOutputModes).optional().describe("How to return the projected API response. File mode stores it as a permanent JSON file."),
+  embeddedFiles: apiAgentEmbeddedFilesSchema.optional(),
   outputStoreBindings: apiOutputStoreBindingsSchema.optional(),
   cacheResponse: apiResponseCacheConfigSchema
 }).refine((data) => !(data.bodyType !== void 0 && !methodsWithBody.has(data.type)), {
   message: "Body type is not supported for this method",
   path: ["bodyType"]
+}).refine((data) => !data.requestFileEncodings?.length || methodsWithBody.has(data.type), {
+  message: "Request file encoding is not supported for this method",
+  path: ["requestFileEncodings"]
+}).refine((data) => !data.requestFileEncodings?.length || (data.bodyType ?? "json") === "json", {
+  message: "Request file encoding is only supported for JSON bodies",
+  path: ["requestFileEncodings"]
+}).refine((data) => !data.requestFileEncodings?.length || data.body !== null && typeof data.body === "object" && !Array.isArray(data.body), {
+  message: "Request file encoding requires a JSON object body",
+  path: ["body"]
 }).refine((data) => isValidApiMultipartFormDataBody({
   bodyType: data.bodyType,
   body: data.body
@@ -13551,48 +13697,48 @@ var apiToolSchema = z16.object({
 }).describe("Custom API tool definition. Allows agents to make HTTP requests to external APIs.");
 
 // ../common/dist/src/zod-schemas/run-limitation.schema.js
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 var MAX_BROWSER_SESSION_DURATION_SECONDS = 6 * 60 * 60;
 var BROWSER_TERMINATION_BUFFER_SECONDS = 60;
 var MAX_AUTOMATION_DURATION_SECONDS = MAX_BROWSER_SESSION_DURATION_SECONDS - BROWSER_TERMINATION_BUFFER_SECONDS;
 var MAX_AUTOMATION_TOOL_CALLS = 500;
 var MAX_AGENT_TOOL_CALLS = 50;
-var maxDurationSecondsSchema = z17.number().min(1).max(MAX_AUTOMATION_DURATION_SECONDS).optional().default(MAX_AUTOMATION_DURATION_SECONDS).describe("Maximum execution duration in seconds. The run will be terminated if it exceeds this limit.");
-var baseRunLimitationSchema = z17.object({
+var maxDurationSecondsSchema = z19.number().min(1).max(MAX_AUTOMATION_DURATION_SECONDS).optional().default(MAX_AUTOMATION_DURATION_SECONDS).describe("Maximum execution duration in seconds. The run will be terminated if it exceeds this limit.");
+var baseRunLimitationSchema = z19.object({
   maxDurationSeconds: maxDurationSecondsSchema,
-  maxToolCalls: z17.number().optional().describe("Maximum number of tool calls allowed. The run will pause with MAX_TOOL_CALLS_REACHED when exceeded."),
-  allowedUrlRegexes: z17.array(z17.string()).optional().describe("Array of regex patterns for URLs the agent is allowed to navigate to. If specified, navigation to non-matching URLs will be blocked.")
+  maxToolCalls: z19.number().optional().describe("Maximum number of tool calls allowed. The run will pause with MAX_TOOL_CALLS_REACHED when exceeded."),
+  allowedUrlRegexes: z19.array(z19.string()).optional().describe("Array of regex patterns for URLs the agent is allowed to navigate to. If specified, navigation to non-matching URLs will be blocked.")
 });
 var automationRunLimitationSchema = baseRunLimitationSchema.extend({
-  maxToolCalls: z17.number().optional().default(MAX_AUTOMATION_TOOL_CALLS).describe("Maximum number of tool calls allowed across all agents in the automation.")
+  maxToolCalls: z19.number().optional().default(MAX_AUTOMATION_TOOL_CALLS).describe("Maximum number of tool calls allowed across all agents in the automation.")
 }).optional().default({
   maxDurationSeconds: MAX_AUTOMATION_DURATION_SECONDS,
   maxToolCalls: MAX_AUTOMATION_TOOL_CALLS
 }).describe("Resource limits for the automation run.");
 var agentRunLimitationSchema = baseRunLimitationSchema.extend({
-  maxToolCalls: z17.number().optional().default(MAX_AGENT_TOOL_CALLS).describe("Maximum number of tool calls allowed for this agent.")
+  maxToolCalls: z19.number().optional().default(MAX_AGENT_TOOL_CALLS).describe("Maximum number of tool calls allowed for this agent.")
 }).optional().default({
   maxDurationSeconds: MAX_AUTOMATION_DURATION_SECONDS,
   maxToolCalls: MAX_AGENT_TOOL_CALLS
 }).describe("Resource limits for the agent run.");
 
 // ../common/dist/src/zod-schemas/voice-provider-options.schema.js
-import { z as z18 } from "zod";
-var voiceParticipantSchema = z18.object({
-  number: z18.string().min(1).optional().describe("Default phone number or endpoint to use for this call participant. Accepts a literal value or a Handlebars template with agent, shared, and context inputs."),
-  name: z18.string().min(1).optional().describe("Display name to associate with this call participant."),
-  countryCode: z18.enum(["US", "CA"]).optional().describe("Country context for local national phone numbers. US and CA numbers can be safely normalized to E.164 for providers that require it.")
+import { z as z20 } from "zod";
+var voiceParticipantSchema = z20.object({
+  number: z20.string().min(1).optional().describe("Default phone number or endpoint to use for this call participant. Accepts a literal value or a Handlebars template with agent, shared, and context inputs."),
+  name: z20.string().min(1).optional().describe("Display name to associate with this call participant."),
+  countryCode: z20.enum(["US", "CA"]).optional().describe("Country context for local national phone numbers. US and CA numbers can be safely normalized to E.164 for providers that require it.")
 }).describe("Default voice call participant settings.");
-var vapiVoiceProviderOptionsSchema = z18.object({
-  assistantId: z18.string().min(1).optional().describe("Existing Vapi assistant ID to start or hand off the call to."),
-  assistant: z18.record(z18.string(), z18.unknown()).optional().describe("Inline Vapi assistant definition used when an explicit assistantId is not provided."),
-  assistantOverrides: z18.record(z18.string(), z18.unknown()).optional().describe("Runtime assistant override payload forwarded to Vapi when starting or handing off a call."),
+var vapiVoiceProviderOptionsSchema = z20.object({
+  assistantId: z20.string().min(1).optional().describe("Existing Vapi assistant ID to start or hand off the call to."),
+  assistant: z20.record(z20.string(), z20.unknown()).optional().describe("Inline Vapi assistant definition used when an explicit assistantId is not provided."),
+  assistantOverrides: z20.record(z20.string(), z20.unknown()).optional().describe("Runtime assistant override payload forwarded to Vapi when starting or handing off a call."),
   caller: voiceParticipantSchema.optional().describe("Default caller settings for outbound calls."),
   callee: voiceParticipantSchema.optional().describe("Default callee settings for outbound calls."),
-  phoneNumberId: z18.string().min(1).optional().describe("Vapi phone number ID used to originate outbound calls."),
-  enableDtmf: z18.boolean().optional().describe("Whether the call should support DTMF input.")
+  phoneNumberId: z20.string().min(1).optional().describe("Vapi phone number ID used to originate outbound calls."),
+  enableDtmf: z20.boolean().optional().describe("Whether the call should support DTMF input.")
 }).describe("Configuration options specific to the Vapi voice provider.");
-var voiceProviderOptionsSchema = z18.object({
+var voiceProviderOptionsSchema = z20.object({
   vapi: vapiVoiceProviderOptionsSchema.optional().describe("Configuration options specific to the Vapi provider.")
 }).describe("Provider-specific voice configuration options. Only the options for the selected voiceProvider are used.");
 
@@ -13604,50 +13750,50 @@ var NangoSupportedMethods = [
   "PATCH",
   "DELETE"
 ];
-var startingUrlSchema = z19.string().refine(isValidUrlOrHandlebarsTemplateString, {
+var startingUrlSchema = z21.string().refine(isValidUrlOrHandlebarsTemplateString, {
   message: "Starting URL must be a valid URL or Handlebars template"
 }).optional();
-var browserSOMEnvironmentOptionsSchema = z19.object({
-  environment: z19.literal("browser").describe("Browser environment using Set of Marks (SOM) for element identification."),
-  maxMediaToIncludeInMemory: z19.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
+var browserSOMEnvironmentOptionsSchema = z21.object({
+  environment: z21.literal("browser").describe("Browser environment using Set of Marks (SOM) for element identification."),
+  maxMediaToIncludeInMemory: z21.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
   somFilter: somFilterConfigSchema.optional().describe("Default SOM overlay filter to apply for each browser iteration until the somFilter tool sets or clears a session filter."),
-  saveAuthCookiesAfterRun: z19.boolean().optional().describe("Whether to save authentication cookies after the run completes for reuse in future runs."),
-  suppressNativePrint: z19.boolean().optional().describe("Suppress native window.print dialogs for the whole browser session while still recording print calls."),
+  saveAuthCookiesAfterRun: z21.boolean().optional().describe("Whether to save authentication cookies after the run completes for reuse in future runs."),
+  suppressNativePrint: z21.boolean().optional().describe("Suppress native window.print dialogs for the whole browser session while still recording print calls."),
   startingUrl: startingUrlSchema.describe("Initial URL to navigate to when the agent starts. Accepts a valid URL or a Handlebars template with agent inputs. If not provided, uses the current URL of the browser; if this is the first agent, it will be a blank page."),
-  browserProvider: z19.nativeEnum(BrowserProviderNames).default(BrowserProviderNames.browserbase).describe("Browser provider to use if this agent is the first in a run to create a browser."),
+  browserProvider: z21.nativeEnum(BrowserProviderNames).default(BrowserProviderNames.browserbase).describe("Browser provider to use if this agent is the first in a run to create a browser."),
   browserProviderOptions: browserProviderOptionsSchema.optional().describe("Provider-specific configuration options for the browser.")
 }).describe("Browser environment configuration using Set of Marks (SOM) for element identification. This is the recommended browser mode for most use cases.");
-var browserCoordinatesEnvironmentOptionsSchema = z19.object({
-  environment: z19.literal("browserCoordinates").describe("Browser environment using coordinate-based interactions instead of SOM."),
-  maxMediaToIncludeInMemory: z19.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
-  saveAuthCookiesAfterRun: z19.boolean().optional().describe("Whether to save authentication cookies after the run completes for reuse in future runs."),
-  suppressNativePrint: z19.boolean().optional().describe("Suppress native window.print dialogs for the whole browser session while still recording print calls."),
+var browserCoordinatesEnvironmentOptionsSchema = z21.object({
+  environment: z21.literal("browserCoordinates").describe("Browser environment using coordinate-based interactions instead of SOM."),
+  maxMediaToIncludeInMemory: z21.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
+  saveAuthCookiesAfterRun: z21.boolean().optional().describe("Whether to save authentication cookies after the run completes for reuse in future runs."),
+  suppressNativePrint: z21.boolean().optional().describe("Suppress native window.print dialogs for the whole browser session while still recording print calls."),
   startingUrl: startingUrlSchema.describe("Initial URL to navigate to when the agent starts. Accepts a valid URL or a Handlebars template with agent inputs. If not provided, uses the current URL of the browser; if this is the first agent, it will be a blank page."),
-  browserProvider: z19.nativeEnum(BrowserProviderNames).default(BrowserProviderNames.browserbase).describe("Browser provider to use if this agent is the first in a run to create a browser."),
+  browserProvider: z21.nativeEnum(BrowserProviderNames).default(BrowserProviderNames.browserbase).describe("Browser provider to use if this agent is the first in a run to create a browser."),
   browserProviderOptions: browserProviderOptionsSchema.optional().describe("Provider-specific configuration options for the browser.")
 }).describe("Browser environment configuration using coordinate-based interactions. Use for scenarios where SOM-based identification is insufficient.");
-var guacamoleEnvironmentOptionsSchema = z19.object({
-  environment: z19.literal("desktop").describe("Desktop environment using Guacamole for remote desktop access."),
-  browserProvider: z19.nativeEnum(BrowserProviderNames).default(BrowserProviderNames.browserbase).describe("Browser provider to use to connect to Guacamole."),
+var guacamoleEnvironmentOptionsSchema = z21.object({
+  environment: z21.literal("desktop").describe("Desktop environment using Guacamole for remote desktop access."),
+  browserProvider: z21.nativeEnum(BrowserProviderNames).default(BrowserProviderNames.browserbase).describe("Browser provider to use to connect to Guacamole."),
   browserProviderOptions: browserProviderOptionsSchema.optional().describe("Provider-specific configuration options."),
-  maxMediaToIncludeInMemory: z19.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
+  maxMediaToIncludeInMemory: z21.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
   startingUrl: startingUrlSchema.describe("Initial URL for the Guacamole connection. Accepts a valid URL or a Handlebars template with agent inputs."),
-  useCopyPasteForTyping: z19.boolean().default(false).optional().describe("Use copy-paste instead of keystroke simulation for text input. Can improve reliability in some desktop applications.")
+  useCopyPasteForTyping: z21.boolean().default(false).optional().describe("Use copy-paste instead of keystroke simulation for text input. Can improve reliability in some desktop applications.")
 }).describe("Desktop environment configuration using Guacamole for remote desktop automation.");
-var desktopAppEnvironmentOptionsSchema = z19.object({
-  environment: z19.literal("desktopApp").describe("Native application environment for mobile or desktop app automation."),
-  maxMediaToIncludeInMemory: z19.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
+var desktopAppEnvironmentOptionsSchema = z21.object({
+  environment: z21.literal("desktopApp").describe("Native application environment for mobile or desktop app automation."),
+  maxMediaToIncludeInMemory: z21.number().min(1).optional().describe("Maximum number of screenshots/media items to keep in the agent memory context."),
   viewport: viewportSizeSchema.optional().describe(`Target viewport dimensions for screenshots and coordinate-based actions. Defaults to ${BROWSER_DEFAULT_VIEWPORT.width}x${BROWSER_DEFAULT_VIEWPORT.height} when omitted.`)
 }).describe("Native application environment configuration for automating mobile or desktop applications.");
-var minimalEnvironmentOptionsSchema = z19.object({
-  environment: z19.literal("minimal").describe("Minimal environment without browser or desktop capabilities. Use for non-UI agents.")
+var minimalEnvironmentOptionsSchema = z21.object({
+  environment: z21.literal("minimal").describe("Minimal environment without browser or desktop capabilities. Use for non-UI agents.")
 }).describe("Minimal environment configuration for agents that do not require browser or desktop access (e.g., API-only agents).");
-var voiceEnvironmentOptionsSchema = z19.object({
-  environment: z19.literal("voice").describe("Hosted voice environment for live phone or audio conversations."),
-  voiceProvider: z19.nativeEnum(VoiceProviderNames).default(VoiceProviderNames.vapi).describe("Voice provider to use if this agent is the first in a run to create or attach to a live call."),
+var voiceEnvironmentOptionsSchema = z21.object({
+  environment: z21.literal("voice").describe("Hosted voice environment for live phone or audio conversations."),
+  voiceProvider: z21.nativeEnum(VoiceProviderNames).default(VoiceProviderNames.vapi).describe("Voice provider to use if this agent is the first in a run to create or attach to a live call."),
   voiceProviderOptions: voiceProviderOptionsSchema.optional().describe("Provider-specific configuration options for voice runtime.")
 }).describe("Voice environment configuration for hosted conversational runtimes such as Vapi.");
-var environmentOptionsSchema = z19.discriminatedUnion("environment", [
+var environmentOptionsSchema = z21.discriminatedUnion("environment", [
   browserSOMEnvironmentOptionsSchema,
   browserCoordinatesEnvironmentOptionsSchema,
   guacamoleEnvironmentOptionsSchema,
@@ -13658,7 +13804,7 @@ var environmentOptionsSchema = z19.discriminatedUnion("environment", [
 var runSettingsBrowserSOMEnvironmentOptionsSchema = browserSOMEnvironmentOptionsSchema.omit({
   somFilter: true
 }).describe("Browser environment configuration using Set of Marks (SOM) for element identification. This is the recommended browser mode for most use cases.");
-var runSettingsEnvironmentOptionsSchema = z19.discriminatedUnion("environment", [
+var runSettingsEnvironmentOptionsSchema = z21.discriminatedUnion("environment", [
   runSettingsBrowserSOMEnvironmentOptionsSchema,
   browserCoordinatesEnvironmentOptionsSchema,
   guacamoleEnvironmentOptionsSchema,
@@ -13674,14 +13820,14 @@ var environmentNames = [
   "voice",
   "minimal"
 ];
-var environmentNamesSchema = z19.enum(environmentNames).describe("Available environment types: browser (SOM-based), browserCoordinates (coordinate-based), desktop (Guacamole), desktopApp, voice, or minimal.");
+var environmentNamesSchema = z21.enum(environmentNames).describe("Available environment types: browser (SOM-based), browserCoordinates (coordinate-based), desktop (Guacamole), desktopApp, voice, or minimal.");
 var DEFAULT_ENVIRONMENT_OPTION = environmentOptionsSchema.parse({
   environment: "browser"
 });
-var passkeyLeaseScopeSchema = z19.enum(["session", "authStep"]).describe("Passkey lock lifetime. session holds the passkey lease for the browser session; authStep starts the lease before WebAuthn is armed for login and releases it after assertion so the passkey can be reused sooner.");
-var resourcePoolReferenceSchema = z19.object({
-  id: z19.string().uuid().describe("Unique identifier of the resource pool."),
-  type: z19.enum([
+var passkeyLeaseScopeSchema = z21.enum(["session", "authStep"]).describe("Passkey lock lifetime. session holds the passkey lease for the browser session; authStep starts the lease before WebAuthn is armed for login and releases it after assertion so the passkey can be reused sooner.");
+var resourcePoolReferenceSchema = z21.object({
+  id: z21.string().uuid().describe("Unique identifier of the resource pool."),
+  type: z21.enum([
     "commandGenerated",
     "proxy",
     "apiAuthentication",
@@ -13691,21 +13837,21 @@ var resourcePoolReferenceSchema = z19.object({
   passkeyLeaseScope: passkeyLeaseScopeSchema.optional()
 });
 var MAX_RESOURCE_POOLS_PER_STARTING_AGENT = 8;
-var resourcePoolsSchema = z19.array(resourcePoolReferenceSchema).max(MAX_RESOURCE_POOLS_PER_STARTING_AGENT, "Only eight resource pools per starting agent are currently supported").optional();
-var agentRunSettingsSchema = z19.object({
+var resourcePoolsSchema = z21.array(resourcePoolReferenceSchema).max(MAX_RESOURCE_POOLS_PER_STARTING_AGENT, "Only eight resource pools per starting agent are currently supported").optional();
+var agentRunSettingsSchema = z21.object({
   environmentOptions: runSettingsEnvironmentOptionsSchema.optional().describe("Canonical run-level browser/session settings used when this agent is selected as the run settings source. Agent-owned fields such as startingUrl and maxMediaToIncludeInMemory are intentionally ignored at runtime even if present here."),
   resourcePools: resourcePoolsSchema.describe("Managed resource pools used when this agent is selected as the run settings source. These may be persisted on any agent even when that agent is not currently a top-level run settings source."),
-  skipBrowserDebuggerPauses: z19.boolean().optional().describe("Run-level browser session startup setting. When run settings mode is active, this value is snapshotted from runSettings and legacy agent-local values are ignored.")
+  skipBrowserDebuggerPauses: z21.boolean().optional().describe("Run-level browser session startup setting. When run settings mode is active, this value is snapshotted from runSettings and legacy agent-local values are ignored.")
 });
-var remoteFileConnectionSchema = z19.object({
-  description: z19.string().describe("Human-readable description of this remote file connection."),
-  host: z19.string().describe("Hostname or IP address of the remote server."),
-  port: z19.number().describe("Port number for the connection (e.g., 22 for SFTP)."),
-  protocol: z19.enum(["sftp"]).describe("Protocol to use for the connection. Currently only SFTP is supported."),
-  opItemId: z19.string().describe("1Password item ID containing the credentials."),
-  opVaultId: z19.string().describe("1Password vault ID containing the item.")
+var remoteFileConnectionSchema = z21.object({
+  description: z21.string().describe("Human-readable description of this remote file connection."),
+  host: z21.string().describe("Hostname or IP address of the remote server."),
+  port: z21.number().describe("Port number for the connection (e.g., 22 for SFTP)."),
+  protocol: z21.enum(["sftp"]).describe("Protocol to use for the connection. Currently only SFTP is supported."),
+  opItemId: z21.string().describe("1Password item ID containing the credentials."),
+  opVaultId: z21.string().describe("1Password vault ID containing the item.")
 }).describe("Remote file connection configuration for SFTP access. Credentials are stored securely in 1Password.");
-var workflowIdReusePolicySchema = z19.enum(["ALLOW_DUPLICATE", "ALLOW_DUPLICATE_FAILED_ONLY"]).describe("Controls Temporal workflow ID reuse. ALLOW_DUPLICATE allows rerunning with the same ID. ALLOW_DUPLICATE_FAILED_ONLY only allows reuse if the previous run failed.");
+var workflowIdReusePolicySchema = z21.enum(["ALLOW_DUPLICATE", "ALLOW_DUPLICATE_FAILED_ONLY"]).describe("Controls Temporal workflow ID reuse. ALLOW_DUPLICATE allows rerunning with the same ID. ALLOW_DUPLICATE_FAILED_ONLY only allows reuse if the previous run failed.");
 var codeLanguages = ["typescript"];
 var windowsAbsolutePathPattern = /^[A-Za-z]:[\\/]/u;
 function hasControlCharacter(value) {
@@ -13717,113 +13863,113 @@ function hasControlCharacter(value) {
   }
   return false;
 }
-function isNormalizedRepoPath(path7) {
-  if (path7 === "/") {
+function isNormalizedRepoPath(path8) {
+  if (path8 === "/") {
     return true;
   }
-  if (path7.length === 0 || path7.startsWith("/") || path7.startsWith("\\") || path7.includes("\\") || hasControlCharacter(path7) || windowsAbsolutePathPattern.test(path7)) {
+  if (path8.length === 0 || path8.startsWith("/") || path8.startsWith("\\") || path8.includes("\\") || hasControlCharacter(path8) || windowsAbsolutePathPattern.test(path8)) {
     return false;
   }
-  return path7.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
+  return path8.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
 }
-function normalizeRepoPath(path7) {
-  if (path7 === "/") {
-    return path7;
+function normalizeRepoPath(path8) {
+  if (path8 === "/") {
+    return path8;
   }
-  return path7.replaceAll(/\/+$/gu, "");
+  return path8.replaceAll(/\/+$/gu, "");
 }
 var skillPathPattern = /^(?:skills\/.+|automations\/[^/]+\/skills\/.+|automations\/[^/]+\/agents\/[^/]+\/skills\/.+)$/u;
-var repoPathSchema = z19.string().min(1).transform(normalizeRepoPath).refine(isNormalizedRepoPath, {
+var repoPathSchema = z21.string().min(1).transform(normalizeRepoPath).refine(isNormalizedRepoPath, {
   message: "Path must be a normalized repository-relative path."
 });
-var knowledgeBasePluginPermissionSchema = z19.object({
+var knowledgeBasePluginPermissionSchema = z21.object({
   path: repoPathSchema.refine(getIsKnowledgeBaseAssetPathAllowed, {
     message: "Knowledge Base paths must be under org, automation, or automation-agent assets."
   }).describe("Repository path the knowledge base plugin can access."),
-  access: z19.enum(["read", "write"]).describe("Access level for the path. Write access also grants reads.")
+  access: z21.enum(["read", "write"]).describe("Access level for the path. Write access also grants reads.")
 }).describe("Path-scoped permission for the knowledge base runtime plugin.");
-var knowledgeBaseConfigSchema = z19.object({
-  enabled: z19.boolean().default(false).describe("Explicit rollout switch for the knowledge base runtime plugin."),
-  permissions: z19.array(knowledgeBasePluginPermissionSchema).min(1).describe("Repository paths the knowledge base plugin can access. Write grants read and write access.")
+var knowledgeBaseConfigSchema = z21.object({
+  enabled: z21.boolean().default(false).describe("Explicit rollout switch for the knowledge base runtime plugin."),
+  permissions: z21.array(knowledgeBasePluginPermissionSchema).min(1).describe("Repository paths the knowledge base plugin can access. Write grants read and write access.")
 }).describe("Configuration for the knowledge base runtime plugin.");
-var memoryConfigSchema = z19.object({
-  enabled: z19.boolean().default(false).describe("Explicit rollout switch for the memory runtime plugin.")
+var memoryConfigSchema = z21.object({
+  enabled: z21.boolean().default(false).describe("Explicit rollout switch for the memory runtime plugin.")
 }).strict().describe("Configuration for the memory runtime plugin.");
-var skillsConfigSchema = z19.object({
-  enabled: z19.boolean().default(false).describe("Explicit rollout switch for the skills runtime plugin."),
-  registeredSkills: z19.array(repoPathSchema.refine((path7) => skillPathPattern.test(path7), {
+var skillsConfigSchema = z21.object({
+  enabled: z21.boolean().default(false).describe("Explicit rollout switch for the skills runtime plugin."),
+  registeredSkills: z21.array(repoPathSchema.refine((path8) => skillPathPattern.test(path8), {
     message: "Skill paths must be under root, automation, or automation-agent skills."
   })).default(() => []).describe("Repository skill root paths available to the skills plugin."),
-  canEdit: z19.boolean().default(false).describe("Allows the skills runtime plugin to edit repo skills under the root skills folder.")
+  canEdit: z21.boolean().default(false).describe("Allows the skills runtime plugin to edit repo skills under the root skills folder.")
 }).describe("Configuration for the skills runtime plugin.");
-var agentPluginsConfigSchema = z19.object({
+var agentPluginsConfigSchema = z21.object({
   knowledgeBase: knowledgeBaseConfigSchema.optional().describe("Enables the knowledge base runtime plugin."),
   memory: memoryConfigSchema.optional().describe("Enables the memory runtime plugin."),
   skills: skillsConfigSchema.optional().describe("Enables the skills runtime plugin.")
 }).optional().describe("Runtime plugins enabled for this agent. Plugin tools are not controlled by the built-in tools allow-list.");
-var baseAgentConfigFieldsSchema = z19.object({
-  apiTools: z19.array(apiToolSchema).optional().describe("Custom API tools available to this agent. Each tool defines an HTTP endpoint the agent can call."),
-  remoteFileConnections: z19.array(remoteFileConnectionSchema).optional().describe("Remote file server connections for SFTP operations. Enables agents to read/write files on remote servers."),
+var baseAgentConfigFieldsSchema = z21.object({
+  apiTools: z21.array(apiToolSchema).optional().describe("Custom API tools available to this agent. Each tool defines an HTTP endpoint the agent can call."),
+  remoteFileConnections: z21.array(remoteFileConnectionSchema).optional().describe("Remote file server connections for SFTP operations. Enables agents to read/write files on remote servers."),
   resourcePools: resourcePoolsSchema.describe("Deprecated compatibility shadow of runSettings.resourcePools. Keep mirrored with runSettings.resourcePools during the migration. New runtime logic should prefer runSettings.resourcePools. Maximum 8 pools per starting agent."),
-  tools: z19.array(z19.enum(baseToolNames)).optional().default(() => []).describe("List of built-in tools enabled for this agent (e.g., click, clickFill, scroll, navigateTo). Note: reportStop is always included by default, callSpecializedAgent is included if the agent has child agents, and queueAgents is included if queueableAgentIds is configured. An empty array will still have these automatically included tools."),
-  knowledgeBase: z19.object({
-    namespace: z19.string().describe("Vector database namespace for knowledge retrieval."),
-    k: z19.number().describe("Number of results to retrieve from the knowledge base per query.")
+  tools: z21.array(z21.enum(baseToolNames)).optional().default(() => []).describe("List of built-in tools enabled for this agent (e.g., click, clickFill, scroll, navigateTo). Note: reportStop is always included by default, callSpecializedAgent is included if the agent has child agents, and queueAgents is included if queueableAgentIds is configured. An empty array will still have these automatically included tools."),
+  knowledgeBase: z21.object({
+    namespace: z21.string().describe("Vector database namespace for knowledge retrieval."),
+    k: z21.number().describe("Number of results to retrieve from the knowledge base per query.")
   }).optional().describe("Knowledge base configuration for RAG (Retrieval-Augmented Generation). Enables the agent to query a vector database."),
   plugins: agentPluginsConfigSchema,
-  maxSessionMessages: z19.number().optional().describe("Maximum number of messages to keep in the agent session memory. Older messages are pruned to stay within this limit."),
+  maxSessionMessages: z21.number().optional().describe("Maximum number of messages to keep in the agent session memory. Older messages are pruned to stay within this limit."),
   environmentOptions: environmentOptionsSchema.optional().default(DEFAULT_ENVIRONMENT_OPTION).describe("Environment configuration for the agent. Default is browser with SOM."),
   runSettings: agentRunSettingsSchema.optional().describe("Run settings persisted on the agent and used when this agent is selected as the settings source for a run while the run-settings rollout is enabled. This is the canonical runtime source for resource pools during the migration. It intentionally mirrors a subset of agent config so settings survive topology changes and can be stored on any agent regardless of that agent's own execution environment. Writers may populate this before the rollout flag is enabled, but runtime snapshotting must keep using legacy fields while the flag is disabled."),
-  skipBrowserDebuggerPauses: z19.boolean().optional().describe("Legacy agent-local browser session startup setting. Used only when a run is in legacy config mode; canonical run settings mode reads runSettings.skipBrowserDebuggerPauses instead."),
+  skipBrowserDebuggerPauses: z21.boolean().optional().describe("Legacy agent-local browser session startup setting. Used only when a run is in legacy config mode; canonical run settings mode reads runSettings.skipBrowserDebuggerPauses instead."),
   limitations: agentRunLimitationSchema.describe("Resource limits for this agent, including maximum duration and tool call limits."),
-  commonParametersSchema: z19.custom().optional().describe("Custom schema defining metadata the agent must provide with every tool call. By default, agents provide reasoning and step information. If specified, this schema replaces the default metadata schema entirely."),
-  idempotencySettings: z19.object({
-    include: z19.array(z19.string()).optional().describe("Input field names to include in the idempotency key. If specified, only these fields are used."),
-    exclude: z19.array(z19.string()).optional().describe("Input field names to exclude from the idempotency key. Ignored if include is specified."),
+  commonParametersSchema: z21.custom().optional().describe("Custom schema defining metadata the agent must provide with every tool call. By default, agents provide reasoning and step information. If specified, this schema replaces the default metadata schema entirely."),
+  idempotencySettings: z21.object({
+    include: z21.array(z21.string()).optional().describe("Input field names to include in the idempotency key. If specified, only these fields are used."),
+    exclude: z21.array(z21.string()).optional().describe("Input field names to exclude from the idempotency key. Ignored if include is specified."),
     workflowIdReusePolicy: workflowIdReusePolicySchema.optional().default("ALLOW_DUPLICATE").describe("Policy for reusing Temporal workflow IDs.")
   }).optional().describe("Idempotency settings for preventing duplicate runs. Controls which input fields contribute to the unique run identifier."),
-  taskQueue: z19.string().optional().describe("Temporal task queue name for this agent. If specified, queued child agents run on this queue instead of the parent queue."),
-  waitUponQueueing: z19.boolean().optional().default(false).describe("If true, wait for queued child agents to complete before proceeding."),
-  queueableAgentIds: z19.array(brandedStringValidator("agentId")).optional().default(() => []).describe("List of agent IDs that this agent can queue using the queueAgents tool. Enables the agent to run a new automation with a different agent as the starting point."),
-  callableAgentIds: z19.array(brandedStringValidator("agentId")).optional().describe("List of external root agent IDs that this agent can call using the callSpecializedAgent tool. Same-automation callable agents continue to be configured by graph connections."),
-  queuedAgentVariables: z19.record(brandedStringValidator("agentId"), z19.record(z19.string(), z19.unknown())).optional().describe("Static automation variable values to pass when this agent queues another automation by target agent ID."),
-  checkpoint: z19.object({
-    name: z19.string().describe("Name for the checkpoint, used for filtering and identification."),
-    screenshot: z19.boolean().optional().default(false).describe("Whether to capture a screenshot when creating the checkpoint.")
+  taskQueue: z21.string().optional().describe("Temporal task queue name for this agent. If specified, queued child agents run on this queue instead of the parent queue."),
+  waitUponQueueing: z21.boolean().optional().default(false).describe("If true, wait for queued child agents to complete before proceeding."),
+  queueableAgentIds: z21.array(brandedStringValidator("agentId")).optional().default(() => []).describe("List of agent IDs that this agent can queue using the queueAgents tool. Enables the agent to run a new automation with a different agent as the starting point."),
+  callableAgentIds: z21.array(brandedStringValidator("agentId")).optional().describe("List of external root agent IDs that this agent can call using the callSpecializedAgent tool. Same-automation callable agents continue to be configured by graph connections."),
+  queuedAgentVariables: z21.record(brandedStringValidator("agentId"), z21.record(z21.string(), z21.unknown())).optional().describe("Static automation variable values to pass when this agent queues another automation by target agent ID."),
+  checkpoint: z21.object({
+    name: z21.string().describe("Name for the checkpoint, used for filtering and identification."),
+    screenshot: z21.boolean().optional().default(false).describe("Whether to capture a screenshot when creating the checkpoint.")
   }).optional().describe("Checkpoint configuration. When set, agent iterations are recorded as checkpoints for auditing and debugging."),
-  systemPrompt: z19.string().optional().describe("Custom system prompt that replaces the default system prompt for this agent. Combined with automation-level and agent-level additionalSystemPrompt values."),
-  additionalSystemPrompt: z19.string().optional().describe("Additional instructions appended to the system prompt for this agent. Combined with automation-level additionalSystemPrompt."),
+  systemPrompt: z21.string().optional().describe("Custom system prompt that replaces the default system prompt for this agent. Combined with automation-level and agent-level additionalSystemPrompt values."),
+  additionalSystemPrompt: z21.string().optional().describe("Additional instructions appended to the system prompt for this agent. Combined with automation-level additionalSystemPrompt."),
   // Backlinking metadata for imported agents
-  importedFrom: z19.object({
+  importedFrom: z21.object({
     automationId: brandedStringValidator("draftAutomationId").describe("ID of the source automation from which this agent was imported."),
     originalAgentId: brandedStringValidator("agentId").describe("Original agent ID in the source automation.")
   }).optional().describe("Metadata for agents imported from another automation. Used for traceability and updates."),
-  ignoreUnstableSessionState: z19.boolean().optional().describe("When true, skips screenshot consistency checks before tool execution. Overrides the automation-level ignoreUnstableSessionState setting."),
-  pointOfNoReturn: z19.object({
-    keyFields: z19.array(z19.string().trim().min(1).refine((keyField) => parsePointOfNoReturnKeyFieldPath(keyField) !== void 0, "PONR key fields must start with input. or store. and use safe path segments")).min(1).describe("Paths resolved against the current node input or automation store into the work-item business key. A path that cannot be resolved fails closed.")
+  ignoreUnstableSessionState: z21.boolean().optional().describe("When true, skips screenshot consistency checks before tool execution. Overrides the automation-level ignoreUnstableSessionState setting."),
+  pointOfNoReturn: z21.object({
+    keyFields: z21.array(z21.string().trim().min(1).refine((keyField) => parsePointOfNoReturnKeyFieldPath(keyField) !== void 0, "PONR key fields must start with input. or store. and use safe path segments")).min(1).describe("Paths resolved against the current node input or automation store into the work-item business key. A path that cannot be resolved fails closed.")
   }).optional().describe("Marks this node as a point of no return. Once the work item identified by keyFields crosses this node, the node and everything downstream never auto-run again; recovery is override-only.")
 }).superRefine((config, ctx) => {
   if (config.resourcePools !== void 0 && config.runSettings?.resourcePools !== void 0 && !isDeepEqualAndSameType(config.resourcePools, config.runSettings.resourcePools)) {
     ctx.addIssue({
-      code: z19.ZodIssueCode.custom,
+      code: z21.ZodIssueCode.custom,
       path: ["runSettings", "resourcePools"],
       message: "runSettings.resourcePools must match resourcePools when both are provided"
     });
   }
 });
 var agenticAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
-  type: z19.literal("agentic").describe("Agentic agent type - autonomous AI agent with tool calling capabilities."),
+  type: z21.literal("agentic").describe("Agentic agent type - autonomous AI agent with tool calling capabilities."),
   model: agentModelConfigSchema.describe("LLM model configuration for this agentic agent.")
 }).describe("Agentic agent configuration. Uses an LLM to autonomously decide which tools to call to accomplish tasks.");
 var codeAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
-  type: z19.literal("code").describe("Code agent type - executes predefined code instead of LLM-driven decisions."),
-  language: z19.enum(codeLanguages).default("typescript").describe("Programming language for the agent code. Currently only TypeScript is supported.")
+  type: z21.literal("code").describe("Code agent type - executes predefined code instead of LLM-driven decisions."),
+  language: z21.enum(codeLanguages).default("typescript").describe("Programming language for the agent code. Currently only TypeScript is supported.")
 }).describe("Code agent configuration. Executes predefined TypeScript code instead of using LLM-driven decision making.");
 var outputStoreSourcePathRegex = /^[$A-Z_a-z][\w$]*(?:\.[$A-Z_a-z][\w$]*)*$/u;
-var outputStoreBindingSchema = z19.object({
-  sourcePath: z19.string().refine((sourcePath) => sourcePath === "$" || outputStoreSourcePathRegex.test(sourcePath), 'Output source path must be "$" or a dot path such as patient.name.').describe("Dot path of the node output value to write."),
+var outputStoreBindingSchema = z21.object({
+  sourcePath: z21.string().refine((sourcePath) => sourcePath === "$" || outputStoreSourcePathRegex.test(sourcePath), 'Output source path must be "$" or a dot path such as patient.name.').describe("Dot path of the node output value to write."),
   storePath: outputStorePathSchema.describe("Fully qualified Data Store path that receives the output."),
-  arrayMode: z19.enum(["append", "appendList", "replace"]).optional().describe("Required for newly authored array destinations: append adds exactly one item, appendList adds multiple items, and replace sets the complete list. Omit for scalar and Object destinations; Object values replace the complete object. Legacy omitted array modes still append at runtime.")
+  arrayMode: z21.enum(["append", "appendList", "replace"]).optional().describe("Required for newly authored array destinations: append adds exactly one item, appendList adds multiple items, and replace sets the complete list. Omit for scalar and Object destinations; Object values replace the complete object. Legacy omitted array modes still append at runtime.")
 }).describe("Maps one node output value to one Data Store destination.");
 function validateUniqueOutputStoreBindings(bindings, ctx) {
   const sourcePaths = /* @__PURE__ */ new Set();
@@ -13831,7 +13977,7 @@ function validateUniqueOutputStoreBindings(bindings, ctx) {
   for (const [index, { sourcePath, storePath }] of bindings.entries()) {
     if (sourcePaths.has(sourcePath)) {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z21.ZodIssueCode.custom,
         path: [index, "sourcePath"],
         message: `Output source path "${sourcePath}" can only have one Data Store destination.`
       });
@@ -13839,7 +13985,7 @@ function validateUniqueOutputStoreBindings(bindings, ctx) {
     sourcePaths.add(sourcePath);
     if (storePaths.has(storePath)) {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z21.ZodIssueCode.custom,
         path: [index, "storePath"],
         message: `Data Store destination "${storePath}" can only be written once by this node.`
       });
@@ -13847,12 +13993,12 @@ function validateUniqueOutputStoreBindings(bindings, ctx) {
     storePaths.add(storePath);
   }
 }
-var extractOutputStoreBindingsSchema = z19.array(outputStoreBindingSchema).superRefine((bindings, ctx) => {
+var extractOutputStoreBindingsSchema = z21.array(outputStoreBindingSchema).superRefine((bindings, ctx) => {
   validateUniqueOutputStoreBindings(bindings, ctx);
   for (const [index, { sourcePath }] of bindings.entries()) {
     if (sourcePath === "$") {
       ctx.addIssue({
-        code: z19.ZodIssueCode.custom,
+        code: z21.ZodIssueCode.custom,
         path: [index, "sourcePath"],
         message: "Extract output bindings must use a declared output path."
       });
@@ -13860,62 +14006,65 @@ var extractOutputStoreBindingsSchema = z19.array(outputStoreBindingSchema).super
   }
 }).describe("Optional mappings from declared Extract output fields to Data Store destinations.");
 var extractAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
-  type: z19.literal("extract").describe("Extract agent type - specialized for structured data extraction."),
+  type: z21.literal("extract").describe("Extract agent type - specialized for structured data extraction."),
   model: agentModelConfigSchema.describe("LLM model configuration for this extract agent."),
   outputStoreBindings: extractOutputStoreBindingsSchema.optional()
 }).describe("Extract agent configuration. Specialized for extracting structured data from files according to a defined output schema.");
-var OutcomePayloadSchema = z19.object({
-  id: z19.string().min(1).describe("Unique identifier for the outcome."),
-  input: z19.record(z19.string(), z19.unknown()).describe("Input data for the outcome. Maps parameter keys to values."),
-  preview: z19.string().describe("Rendered text representation of the outcome.")
+var OutcomePayloadSchema = z21.object({
+  id: z21.string().min(1).describe("Unique identifier for the outcome."),
+  input: z21.record(z21.string(), z21.unknown()).describe("Input data for the outcome. Maps parameter keys to values."),
+  preview: z21.string().describe("Rendered text representation of the outcome.")
 });
 var branchAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
-  type: z19.literal("branch").describe("Decision agent type - makes decisions to route to different agents."),
+  type: z21.literal("branch").describe("Decision agent type - makes decisions to route to different agents."),
   model: agentModelConfigSchema.describe("LLM model configuration for this decision agent."),
-  includeScreenshot: z19.boolean().optional().describe("Whether to include the previous agent's screen state in this decision agent's decision context."),
-  conditionsAndOutcomes: z19.object({
-    if: z19.array(z19.object({
-      caseName: z19.string().describe("Name of the condition case."),
-      condition: z19.string().min(1).describe("Condition to evaluate."),
-      outcome: z19.array(OutcomePayloadSchema).describe("Outcomes to return if the condition is met.")
+  includeScreenshot: z21.boolean().optional().describe("Whether to include the previous agent's screen state in this decision agent's decision context."),
+  conditionsAndOutcomes: z21.object({
+    if: z21.array(z21.object({
+      caseName: z21.string().describe("Name of the condition case."),
+      condition: z21.string().min(1).describe("Condition to evaluate."),
+      outcome: z21.array(OutcomePayloadSchema).describe("Outcomes to return if the condition is met.")
     })).min(1).describe("Conditions and outcomes for the decision agent."),
-    else: z19.array(OutcomePayloadSchema).min(1).describe("Outcomes to return if the condition is not met.")
+    else: z21.array(OutcomePayloadSchema).min(1).describe("Outcomes to return if the condition is not met.")
   }).describe("Conditions and outcomes for the decision agent, including a fallback outcome.")
 }).describe("Decision agent configuration. Makes decisions about which agent to call next based on the current context.");
 var draftBranchAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
-  type: z19.literal("branch").describe("Decision agent draft configuration. Allows incomplete conditions and outcomes while the agent is still being authored."),
+  type: z21.literal("branch").describe("Decision agent draft configuration. Allows incomplete conditions and outcomes while the agent is still being authored."),
   model: agentModelConfigSchema.describe("LLM model configuration for this decision agent."),
-  includeScreenshot: z19.boolean().optional().describe("Whether to include the previous agent's screen state in this decision agent's decision context."),
-  conditionsAndOutcomes: z19.object({
-    if: z19.array(z19.object({
-      caseName: z19.string().describe("Name of the condition case."),
-      condition: z19.string().describe("Condition to evaluate. Draft saves may include an empty placeholder while the user is still editing."),
-      outcome: z19.array(OutcomePayloadSchema).describe("Outcomes to return if the condition is met.")
+  includeScreenshot: z21.boolean().optional().describe("Whether to include the previous agent's screen state in this decision agent's decision context."),
+  conditionsAndOutcomes: z21.object({
+    if: z21.array(z21.object({
+      caseName: z21.string().describe("Name of the condition case."),
+      condition: z21.string().describe("Condition to evaluate. Draft saves may include an empty placeholder while the user is still editing."),
+      outcome: z21.array(OutcomePayloadSchema).describe("Outcomes to return if the condition is met.")
     })).describe("Draft decision conditions and outcomes."),
-    else: z19.array(OutcomePayloadSchema).describe("Draft fallback outcomes for the decision agent. May be empty while the decision agent is still being configured.")
+    else: z21.array(OutcomePayloadSchema).describe("Draft fallback outcomes for the decision agent. May be empty while the decision agent is still being configured.")
   }).describe("Draft conditions and outcomes for the decision agent, including an optional fallback outcome while editing.")
 }).describe("Decision agent draft configuration. More permissive than the authored decision schema so incomplete decision agents can be saved.");
 var METHODS_WITH_BODY = new Set(ApiMethodsWithBody);
 var apiAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
-  type: z19.literal("api").describe("API agent type - makes HTTP requests to external APIs."),
-  method: z19.enum(NangoSupportedMethods).describe("HTTP method for the API request (GET, POST, PUT, PATCH, DELETE)."),
-  url: z19.string().describe("URL for the API endpoint. Can include placeholders like {paramName} for dynamic values from inputs."),
+  type: z21.literal("api").describe("API agent type - makes HTTP requests to external APIs."),
+  method: z21.enum(NangoSupportedMethods).describe("HTTP method for the API request (GET, POST, PUT, PATCH, DELETE)."),
+  url: z21.string().describe("URL for the API endpoint. Can include placeholders like {paramName} for dynamic values from inputs."),
   baseUrlOverride: nangoBaseUrlOverrideSchema.optional().describe("Optional static base URL override for Nango-backed requests. Use when the request endpoint is hosted on a base URL different from the Nango provider default."),
-  headers: z19.array(z19.object({ key: z19.string(), value: z19.string() })).optional().describe("HTTP headers to include in the request. Values can include placeholders."),
-  queryParams: z19.array(z19.object({ key: z19.string(), value: z19.string() })).optional().describe("Query parameters to append to the URL. Values can include placeholders."),
-  body: z19.unknown().optional().describe("Request body for POST/PUT/PATCH requests. Can include placeholders for dynamic values."),
-  bodyType: z19.enum(ApiRequestBodyTypes).optional().describe("Request body encoding mode. Defaults to JSON when omitted. Use multipartFormData for typed form-data fields and formUrlEncoded for application/x-www-form-urlencoded payloads."),
-  outputJmesPath: z19.string().optional().describe("JMESPath expression to extract specific data from the API response before returning it."),
+  headers: z21.array(z21.object({ key: z21.string(), value: z21.string() })).optional().describe("HTTP headers to include in the request. Values can include placeholders."),
+  queryParams: z21.array(z21.object({ key: z21.string(), value: z21.string() })).optional().describe("Query parameters to append to the URL. Values can include placeholders."),
+  body: z21.unknown().optional().describe("Request body for POST/PUT/PATCH requests. Can include placeholders for dynamic values."),
+  bodyType: z21.enum(ApiRequestBodyTypes).optional().describe("Request body encoding mode. Defaults to JSON when omitted. Use multipartFormData for typed form-data fields and formUrlEncoded for application/x-www-form-urlencoded payloads."),
+  requestFileEncodings: apiAgentRequestFileEncodingsSchema.optional(),
+  outputJmesPath: z21.string().optional().describe("JMESPath expression to extract specific data from the API response before returning it."),
+  outputMode: z21.enum(ApiAgentOutputModes).optional().describe("How to return the projected API response. File mode stores it as a permanent JSON file."),
+  embeddedFiles: apiAgentEmbeddedFilesSchema.optional(),
   outputStoreBindings: apiOutputStoreBindingsSchema.optional(),
   cacheResponse: apiResponseCacheConfigSchema.describe("Response cache configuration for this API agent. TTL is measured in seconds."),
-  authentication: z19.discriminatedUnion("type", [
-    z19.object({
-      type: z19.literal("nangoConnection").describe("Authentication via Nango integration."),
-      providerConfigKey: z19.string().describe('The provider config key for the integration (e.g., "github", "slack").'),
+  authentication: z21.discriminatedUnion("type", [
+    z21.object({
+      type: z21.literal("nangoConnection").describe("Authentication via Nango integration."),
+      providerConfigKey: z21.string().describe('The provider config key for the integration (e.g., "github", "slack").'),
       poolId: brandedStringValidator("resourcePoolId").optional().describe("ID of the resource pool containing authentication credentials.")
     }),
-    z19.object({
-      type: z19.literal("customHost").describe("Authentication via 1Password credentials for custom host."),
+    z21.object({
+      type: z21.literal("customHost").describe("Authentication via 1Password credentials for custom host."),
       poolId: brandedStringValidator("resourcePoolId").optional().describe("ID of the resource pool containing 1Password authentication.")
     })
   ]).optional().describe("Authentication configuration for the API request. Uses credentials from a resource pool.")
@@ -13925,6 +14074,15 @@ var apiAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
 }).refine((data) => !(data.bodyType !== void 0 && !METHODS_WITH_BODY.has(data.method)), {
   message: "Body type is not supported for this method",
   path: ["bodyType"]
+}).refine((data) => !data.requestFileEncodings?.length || METHODS_WITH_BODY.has(data.method), {
+  message: "Request file encoding is not supported for this method",
+  path: ["requestFileEncodings"]
+}).refine((data) => !data.requestFileEncodings?.length || (data.bodyType ?? "json") === "json", {
+  message: "Request file encoding is only supported for JSON bodies",
+  path: ["requestFileEncodings"]
+}).refine((data) => !data.requestFileEncodings?.length || data.body !== null && typeof data.body === "object" && !Array.isArray(data.body), {
+  message: "Request file encoding requires a JSON object body",
+  path: ["body"]
 }).refine((data) => isValidApiMultipartFormDataBody({
   bodyType: data.bodyType,
   body: data.body
@@ -13942,10 +14100,10 @@ var apiAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
   path: ["baseUrlOverride"]
 }).describe("API agent configuration. Makes HTTP requests to external APIs without LLM decision making. Supports authentication via Nango connections.");
 var specializedAgentConfigSchema = baseAgentConfigFieldsSchema.safeExtend({
-  type: z19.literal("specialized").describe("Specialized agent type - runs a published specialized automation."),
-  specializedAutomationId: z19.string().min(1).describe("ID of the specialized automation to run.")
+  type: z21.literal("specialized").describe("Specialized agent type - runs a published specialized automation."),
+  specializedAutomationId: z21.string().min(1).describe("ID of the specialized automation to run.")
 }).describe("Specialized agent configuration. Runs a specialized automation shared by another organization and returns its output.");
-var agentConfigSchemaUnion = z19.discriminatedUnion("type", [
+var agentConfigSchemaUnion = z21.discriminatedUnion("type", [
   agenticAgentConfigSchema,
   codeAgentConfigSchema,
   extractAgentConfigSchema,
@@ -13953,13 +14111,13 @@ var agentConfigSchemaUnion = z19.discriminatedUnion("type", [
   apiAgentConfigSchema,
   specializedAgentConfigSchema
 ]).describe("Agent configuration discriminated by type. Types: agentic (LLM-driven), code (predefined code), extract (data extraction), branch (routing decisions), api (HTTP requests), specialized (shared specialized automation).");
-var agentConfigSchema = z19.preprocess((data) => {
+var agentConfigSchema = z21.preprocess((data) => {
   if (typeof data === "object" && data !== null && !("type" in data)) {
     return { ...data, type: "agentic" };
   }
   return data;
 }, agentConfigSchemaUnion).describe("Agent configuration. Defines the agent type, environment, available tools, model settings, and behavior options. If type is omitted, defaults to agentic.");
-var draftAgentConfigSchemaUnion = z19.discriminatedUnion("type", [
+var draftAgentConfigSchemaUnion = z21.discriminatedUnion("type", [
   agenticAgentConfigSchema,
   codeAgentConfigSchema,
   extractAgentConfigSchema,
@@ -13967,7 +14125,7 @@ var draftAgentConfigSchemaUnion = z19.discriminatedUnion("type", [
   apiAgentConfigSchema,
   specializedAgentConfigSchema
 ]).describe("Draft agent configuration discriminated by type. Uses a more permissive decision schema so incomplete decision agents can be saved before publish-time validation.");
-var draftAgentConfigSchema = z19.preprocess((data) => {
+var draftAgentConfigSchema = z21.preprocess((data) => {
   if (typeof data === "object" && data !== null && !("type" in data)) {
     return { ...data, type: "agentic" };
   }
@@ -13976,66 +14134,66 @@ var draftAgentConfigSchema = z19.preprocess((data) => {
 var DEFAULT_AGENT_CONFIG = agentConfigSchema.parse({});
 
 // ../common/dist/src/zod-schemas/automation-store-migration-analyzer.schema.js
-import { z as z20 } from "zod";
-var automationStoreMigrationMappingSchema = z20.object({
-  sourceAutomationId: z20.string().uuid(),
-  sourceAgentId: z20.string().uuid().optional(),
-  sourceKind: z20.enum(["input", "output", "sharedInput"]),
-  sourceKey: z20.string().min(1),
-  logicalValueId: z20.string().min(1).optional(),
-  outputBindingSourcePath: z20.string().min(1).optional(),
-  handling: z20.enum(["store", "keepLocal", "remove"]),
-  reason: z20.string().min(1),
-  targetStorePath: z20.string().min(1).optional(),
-  population: z20.enum([
+import { z as z23 } from "zod";
+var automationStoreMigrationMappingSchema = z23.object({
+  sourceAutomationId: z23.string().uuid(),
+  sourceAgentId: z23.string().uuid().optional(),
+  sourceKind: z23.enum(["input", "output", "sharedInput"]),
+  sourceKey: z23.string().min(1),
+  logicalValueId: z23.string().min(1).optional(),
+  outputBindingSourcePath: z23.string().min(1).optional(),
+  handling: z23.enum(["store", "keepLocal", "remove"]),
+  reason: z23.string().min(1),
+  targetStorePath: z23.string().min(1).optional(),
+  population: z23.enum([
     "default",
     "initialStore",
     "outputStoreBinding",
     "updateStoreValues"
   ]).optional(),
-  writerAgentId: z20.string().uuid().optional(),
-  isWorkItemIdentity: z20.boolean().optional(),
-  conversion: z20.string().min(1).optional()
+  writerAgentId: z23.string().uuid().optional(),
+  isWorkItemIdentity: z23.boolean().optional(),
+  conversion: z23.string().min(1).optional()
 });
-var automationStoreMigrationWritePolicySchema = z20.object({
-  automationId: z20.string().uuid(),
-  path: z20.string().min(1),
-  writerAgentIds: z20.array(z20.string().uuid()).min(1),
-  coordination: z20.enum([
+var automationStoreMigrationWritePolicySchema = z23.object({
+  automationId: z23.string().uuid(),
+  path: z23.string().min(1),
+  writerAgentIds: z23.array(z23.string().uuid()).min(1),
+  coordination: z23.enum([
     "singleWriter",
     "mutuallyExclusiveBranches",
     "orderedScalarOverwrite",
     "disjointArrayItems"
   ]),
-  arrayRetryStrategy: z20.enum(["notApplicable", "readBeforeAppend"]),
-  rationale: z20.string().min(1)
+  arrayRetryStrategy: z23.enum(["notApplicable", "readBeforeAppend"]),
+  rationale: z23.string().min(1)
 });
-var automationStoreMigrationComparisonVersionSchema = z20.object({
-  automationId: z20.string().uuid(),
-  automationVersionId: z20.string().uuid(),
-  role: z20.enum(["beforeMigration", "afterMigration"]),
-  slotLifecycle: z20.enum(["existing", "introduced"]).default("existing"),
-  slot: z20.string().min(1)
+var automationStoreMigrationComparisonVersionSchema = z23.object({
+  automationId: z23.string().uuid(),
+  automationVersionId: z23.string().uuid(),
+  role: z23.enum(["beforeMigration", "afterMigration"]),
+  slotLifecycle: z23.enum(["existing", "introduced"]).default("existing"),
+  slot: z23.string().min(1)
 });
-var automationStoreMigrationComparisonSchema = z20.object({
-  versions: z20.array(automationStoreMigrationComparisonVersionSchema).min(1).max(40)
+var automationStoreMigrationComparisonSchema = z23.object({
+  versions: z23.array(automationStoreMigrationComparisonVersionSchema).min(1).max(40)
 });
-var automationStoreMigrationAnalyzerInputSchema = z20.object({
-  mode: z20.enum(["audit", "compare", "auditRuntimeEvidence"]).describe("audit reads current drafts; compare reads exact saved versions; auditRuntimeEvidence reads only caller-supplied existing runs and their exact saved versions."),
-  automationIds: z20.array(z20.string().uuid()).max(20).default([]).describe("Starting draft automation IDs for audit. The analyzer follows authored queue targets within a bounded organization-scoped traversal."),
+var automationStoreMigrationAnalyzerInputSchema = z23.object({
+  mode: z23.enum(["audit", "compare", "auditRuntimeEvidence"]).describe("audit reads current drafts; compare reads exact saved versions; auditRuntimeEvidence reads only caller-supplied existing runs and their exact saved versions."),
+  automationIds: z23.array(z23.string().uuid()).max(20).default([]).describe("Starting draft automation IDs for audit. The analyzer follows authored queue targets within a bounded organization-scoped traversal."),
   comparison: automationStoreMigrationComparisonSchema.nullable().default(null).describe("Exact before/after saved-version pairs for compare. Introduced slots require only an afterMigration version."),
-  mappings: z20.array(automationStoreMigrationMappingSchema).default([]),
-  storeWritePolicies: z20.array(automationStoreMigrationWritePolicySchema).max(100).default([]),
-  runIds: z20.array(z20.string().uuid()).max(20).default([]).describe("Existing run IDs to inspect only in auditRuntimeEvidence mode. The analyzer never creates or starts runs."),
-  workItem: z20.string().default("").describe("Optional name for the business work item being migrated.")
+  mappings: z23.array(automationStoreMigrationMappingSchema).default([]),
+  storeWritePolicies: z23.array(automationStoreMigrationWritePolicySchema).max(100).default([]),
+  runIds: z23.array(z23.string().uuid()).max(20).default([]).describe("Existing run IDs to inspect only in auditRuntimeEvidence mode. The analyzer never creates or starts runs."),
+  workItem: z23.string().default("").describe("Optional name for the business work item being migrated.")
 });
 
 // ../common/dist/src/zod-schemas/automation-run-config.schema.js
-import { z as z21 } from "zod";
-var automationRunResolvedRunSettingsSchema = z21.object({
+import { z as z24 } from "zod";
+var automationRunResolvedRunSettingsSchema = z24.object({
   environmentOptions: runSettingsEnvironmentOptionsSchema.describe("Canonical run-settings-owned environment settings snapshotted onto the automation run when it starts in runSettings mode. Agent-owned fields such as startingUrl and maxMediaToIncludeInMemory are intentionally ignored at runtime."),
   resourcePools: resourcePoolsSchema.describe("Canonical run-settings-owned resource pools snapshotted onto the automation run when it starts in runSettings mode. Slot assignment and queue status use this only when resolvedRunSettingsSource is runSettings."),
-  skipBrowserDebuggerPauses: z21.boolean().optional().describe("Canonical run-settings-owned browser session startup setting snapshotted onto the automation run when it starts in runSettings mode.")
+  skipBrowserDebuggerPauses: z24.boolean().optional().describe("Canonical run-settings-owned browser session startup setting snapshotted onto the automation run when it starts in runSettings mode.")
 });
 var CONSISTENCY_CHECK_COUNT_MAX = 50;
 var NETWORK_TRAFFIC_CAPTURE_RECORD_MODES = [
@@ -14043,18 +14201,18 @@ var NETWORK_TRAFFIC_CAPTURE_RECORD_MODES = [
   "explicit"
 ];
 var DEFAULT_NETWORK_TRAFFIC_CAPTURE_RECORD_MODE = "implicit";
-var networkTrafficCaptureSchema = z21.discriminatedUnion("mode", [
-  z21.object({
-    mode: z21.literal("record"),
-    recordMode: z21.enum(NETWORK_TRAFFIC_CAPTURE_RECORD_MODES).optional().default(DEFAULT_NETWORK_TRAFFIC_CAPTURE_RECORD_MODE).describe("Whether this recording was created implicitly by automation infrastructure or explicitly requested by the user. Explicit recordings are retained longer.")
+var networkTrafficCaptureSchema = z24.discriminatedUnion("mode", [
+  z24.object({
+    mode: z24.literal("record"),
+    recordMode: z24.enum(NETWORK_TRAFFIC_CAPTURE_RECORD_MODES).optional().default(DEFAULT_NETWORK_TRAFFIC_CAPTURE_RECORD_MODE).describe("Whether this recording was created implicitly by automation infrastructure or explicitly requested by the user. Explicit recordings are retained longer.")
   }).describe("Record network traffic for this run. The recording ID is generated from the automation run ID."),
-  z21.object({
-    mode: z21.literal("replay"),
-    recordingId: z21.uuid().describe("Recording ID from a previous record run in the same organization.")
+  z24.object({
+    mode: z24.literal("replay"),
+    recordingId: z24.uuid().describe("Recording ID from a previous record run in the same organization.")
   }).describe("Replay network traffic from a previous recording.")
 ]).describe("Optional network traffic capture mode for this run. Applies to browser provider traffic and supported agent tool HTTP traffic, including API tool calls and provider-authenticated helper requests.");
-var automationRunSlaTypeSchema = z21.enum(["all"]);
-var automationRunSlaTimestampSchema = z21.iso.datetime();
+var automationRunSlaTypeSchema = z24.enum(["all"]);
+var automationRunSlaTimestampSchema = z24.iso.datetime();
 function refineAutomationRunSlaTimestampOrder(sla, ctx) {
   const startedAtMs = Date.parse(sla.startedAt);
   const breachesAtMs = Date.parse(sla.breachesAt);
@@ -14084,31 +14242,31 @@ function refineAutomationRunSlaTimestampOrder(sla, ctx) {
     });
   }
 }
-var automationRunSlaSchema = z21.object({
+var automationRunSlaSchema = z24.object({
   startedAt: automationRunSlaTimestampSchema.describe("ISO timestamp when SLA tracking started for this run."),
   highRiskAt: automationRunSlaTimestampSchema.optional().describe("Optional ISO timestamp when this run should be considered at high risk of breaching its SLA."),
   breachesAt: automationRunSlaTimestampSchema.describe("ISO timestamp when this run breaches its SLA."),
   type: automationRunSlaTypeSchema.optional().default("all").describe("SLA policy type that applies to this automation run.")
 }).superRefine(refineAutomationRunSlaTimestampOrder).describe("Optional service-level timing metadata for queueing and runtime consumers of this automation run.");
-var automationRunConfigBaseSchema = z21.object({
-  approvalMode: z21.enum(["HUMAN_APPROVAL", "OFF"]).default("OFF"),
-  consistencyCheckCount: z21.number().int().nonnegative().max(CONSISTENCY_CHECK_COUNT_MAX).nullable().default(null),
-  settingsSourceAgentId: z21.uuid().nullable().optional().describe("Optional provenance/debug field recording which top-level agent supplied canonical run settings when the run started. Runtime consumers must not use this as a live pointer once resolvedRunSettingsSource has been decided."),
-  startInTakeOverMode: z21.boolean().default(false).describe("When true, create and prepare the remote session, then pause until a human manually starts the agent."),
-  captureActions: z21.boolean().default(false).describe("When true, attach an action recording while a draft run is paused in takeover mode."),
-  runDraftQueuedAgents: z21.boolean().optional().describe("Draft-run-only option. When false, queue-agent actions in the draft run report success without starting downstream queued draft child runs. Omit or true preserves queueing."),
-  allowPointOfNoReturnOverride: z21.boolean().optional().describe("Internal rerun authorization. When true, the rerun and its queued descendants may proceed past a point-of-no-return crossing owned by an earlier run."),
-  pointOfNoReturnGateEnabled: z21.literal(true).optional().describe("Infrastructure-owned rollout marker. PONR is enforced only for run trees created after the gate rollout."),
+var automationRunConfigBaseSchema = z24.object({
+  approvalMode: z24.enum(["HUMAN_APPROVAL", "OFF"]).default("OFF"),
+  consistencyCheckCount: z24.number().int().nonnegative().max(CONSISTENCY_CHECK_COUNT_MAX).nullable().default(null),
+  settingsSourceAgentId: z24.uuid().nullable().optional().describe("Optional provenance/debug field recording which top-level agent supplied canonical run settings when the run started. Runtime consumers must not use this as a live pointer once resolvedRunSettingsSource has been decided."),
+  startInTakeOverMode: z24.boolean().default(false).describe("When true, create and prepare the remote session, then pause until a human manually starts the agent."),
+  captureActions: z24.boolean().default(false).describe("When true, attach an action recording while a draft run is paused in takeover mode."),
+  runDraftQueuedAgents: z24.boolean().optional().describe("Draft-run-only option. When false, queue-agent actions in the draft run report success without starting downstream queued draft child runs. Omit or true preserves queueing."),
+  allowPointOfNoReturnOverride: z24.boolean().optional().describe("Internal rerun authorization. When true, the rerun and its queued descendants may proceed past a point-of-no-return crossing owned by an earlier run."),
+  pointOfNoReturnGateEnabled: z24.literal(true).optional().describe("Infrastructure-owned rollout marker. PONR is enforced only for run trees created after the gate rollout."),
   sla: automationRunSlaSchema.optional(),
   networkTrafficCapture: networkTrafficCaptureSchema.optional(),
-  networkTrafficCaptureExplicitlyDisabled: z21.literal(true).optional().describe("Infrastructure-owned marker indicating that network traffic capture was explicitly disabled for this run. When present, runtime policy resolution must not enable capture."),
-  implicitNetworkTrafficRecordingDecision: z21.object({
-    enabled: z21.boolean()
+  networkTrafficCaptureExplicitlyDisabled: z24.literal(true).optional().describe("Infrastructure-owned marker indicating that network traffic capture was explicitly disabled for this run. When present, runtime policy resolution must not enable capture."),
+  implicitNetworkTrafficRecordingDecision: z24.object({
+    enabled: z24.boolean()
   }).optional().describe("Infrastructure-owned snapshot of the implicit network traffic recording flag decision. Runtime retries use this to avoid re-evaluating LaunchDarkly for the same run."),
   resolvedRunSettings: automationRunResolvedRunSettingsSchema.optional().describe("Canonical run settings snapshotted onto the automation run at creation time. Present only for runSettings mode; legacyConfig mode intentionally resolves runtime settings from each current agent config instead of storing a misleading snapshot."),
   queueResourcePools: resourcePoolsSchema.optional().describe("Canonical deduped resource-pool requirements snapshotted for queue and slot assignment. Present on new runs so assignment does not recompute requirements from mutable agent config."),
   credentialVariableResourcePools: resourcePoolsSchema.optional().describe("Additional resource pools selected through credential-valued automation variables. These are additive queue requirements and do not change whether the run uses runSettings or legacyConfig as its runtime settings source."),
-  resolvedRunSettingsSource: z21.enum(["runSettings", "legacyConfig"]).optional().describe("Runtime mode decided at run creation. runSettings means resolvedRunSettings is canonical for browser/session/resource-pool behaviour; legacyConfig means runtime consumers must use current agent legacy config fields.")
+  resolvedRunSettingsSource: z24.enum(["runSettings", "legacyConfig"]).optional().describe("Runtime mode decided at run creation. runSettings means resolvedRunSettings is canonical for browser/session/resource-pool behaviour; legacyConfig means runtime consumers must use current agent legacy config fields.")
 });
 var automationRunConfigSchema = automationRunConfigBaseSchema.superRefine((config, ctx) => {
   if (config.networkTrafficCaptureExplicitlyDisabled === true && config.networkTrafficCapture !== void 0) {
@@ -14133,8 +14291,69 @@ var automationRunStartConfigSchema = automationRunConfigBaseSchema.omit({
   networkTrafficCapture: networkTrafficCaptureSchema.nullable().optional().describe("Network traffic capture preference for this run. Omit to apply the implicit recording policy, pass null to explicitly disable capture, or pass a record/replay config to explicitly enable capture.")
 });
 
+// ../common/dist/src/utils/custom-instructions-command.util.js
+var MAX_CUSTOM_COMMAND_COUNT = 1;
+var MAX_CUSTOM_INSTRUCTIONS_LENGTH = 280;
+var STANDARD_COMMAND_NAMES = [
+  "callSpecializedAgent",
+  "checkpoint",
+  "click",
+  "clickFill",
+  "ifElse",
+  "loop",
+  "navigateTo",
+  "pressKeys",
+  "queueAgents",
+  "reportStop",
+  "somFilter"
+];
+function createInvalidValueError(message) {
+  const error = new Error(`INVALID_VALUE: ${message}`);
+  error.name = "INVALID_VALUE";
+  return error;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getCustomInstructions(command) {
+  const commandArguments = command["arguments"];
+  if (!isRecord2(commandArguments)) {
+    return "";
+  }
+  const { instructions } = commandArguments;
+  return typeof instructions === "string" ? instructions.trim() : "";
+}
+function getMentionedStandardCommand(instructions) {
+  const normalizedInstructions = instructions.toLowerCase();
+  return STANDARD_COMMAND_NAMES.find((commandName) => normalizedInstructions.includes(commandName.toLowerCase())) ?? null;
+}
+function assertCustomInstructionsCommand({ commands, path: path8 }) {
+  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path8}[${commandIndex.toString()}]` }] : []);
+  if (customCommands.length === 0) {
+    return;
+  }
+  if (customCommands.length > MAX_CUSTOM_COMMAND_COUNT) {
+    throw createInvalidValueError(`${path8} contains ${customCommands.length.toString()} custom commands. Use at most one short custom command per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
+  }
+  const [customCommand] = customCommands;
+  if (!customCommand) {
+    return;
+  }
+  const instructions = getCustomInstructions(customCommand.command);
+  if (instructions.length === 0) {
+    throw createInvalidValueError(`${customCommand.path}.arguments.instructions must be a non-empty string for custom commands.`);
+  }
+  if (instructions.length > MAX_CUSTOM_INSTRUCTIONS_LENGTH) {
+    throw createInvalidValueError(`${customCommand.path}.arguments.instructions is ${instructions.length.toString()} characters. Custom commands must be short single-action instructions (max ${MAX_CUSTOM_INSTRUCTIONS_LENGTH.toString()} chars). Move policy/template/context text into description, inputSchema, or child agents, and express executable work with catalog commands.`);
+  }
+  const mentionedCommand = getMentionedStandardCommand(instructions);
+  if (mentionedCommand !== null) {
+    throw createInvalidValueError(`${customCommand.path}.arguments.instructions mentions "${mentionedCommand}". Use the "${mentionedCommand}" catalog command directly instead of wrapping it in custom prose.`);
+  }
+}
+
 // ../mcp-registry/src/operation-specs.ts
-import { z as z23 } from "zod";
+import { z as z25 } from "zod";
 
 // ../mcp-registry/src/operation-spec.ts
 function stripLeadingGraphqlComments(document) {
@@ -14238,7 +14457,79 @@ function jsonOption({
     valueType: "json"
   };
 }
-var jsonObjectSchema = z23.record(z23.string(), z23.unknown());
+var jsonObjectSchema = z25.record(z25.string(), z25.unknown());
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateCustomInstructionsCommands({
+  commands,
+  ctx,
+  path: path8
+}) {
+  if (!Array.isArray(commands)) {
+    return;
+  }
+  const validationResult = fromThrowable(() => {
+    assertCustomInstructionsCommand({
+      commands: commands.map((command) => isRecord3(command) ? command : {}),
+      path: path8.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
+    });
+  }, "invalid-custom-instructions-command");
+  if (isErr(validationResult)) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${getErrorMessage2(validationResult.error.cause)} Run mgcl catalog commands to find the standard command for this work.`,
+      path: path8
+    });
+  }
+}
+var automationPatchOperationsSchema = z25.array(z25.unknown()).min(1).superRefine((operations, ctx) => {
+  for (const [operationIndex, operation] of operations.entries()) {
+    if (!isRecord3(operation)) {
+      continue;
+    }
+    const setCommands = operation["setAgentInstructionsCommands"];
+    if (!isRecord3(setCommands)) {
+      continue;
+    }
+    validateCustomInstructionsCommands({
+      commands: setCommands["instructionsCommands"],
+      ctx,
+      path: [
+        "operations",
+        operationIndex,
+        "setAgentInstructionsCommands",
+        "instructionsCommands"
+      ]
+    });
+  }
+});
+function automationInputSchema(agentKeys) {
+  return jsonObjectSchema.superRefine((input, ctx) => {
+    for (const agentKey of agentKeys) {
+      const agents = input[agentKey];
+      if (!Array.isArray(agents)) {
+        continue;
+      }
+      for (const [agentIndex, agent] of agents.entries()) {
+        if (!isRecord3(agent)) {
+          continue;
+        }
+        validateCustomInstructionsCommands({
+          commands: agent["instructionsCommands"],
+          ctx,
+          path: [agentKey, agentIndex, "instructionsCommands"]
+        });
+      }
+    }
+  });
+}
+var createAutomationInputSchema = automationInputSchema(["newAgents"]);
+var updateAutomationInputSchema = automationInputSchema([
+  "newAgents",
+  "updatedAgents"
+]);
+var COMMAND_CATALOG_HELP = "When authoring raw instructionsCommands, run mgcl catalog commands and prefer a standard command.";
 var agentBrowserProviderOptionsSelection = `            browserbase {
               advancedStealth
               contextId
@@ -14331,11 +14622,51 @@ var agentLimitationsSelection = `      limitations {
         allowedUrlRegexes
       }`;
 var operationSpecs = [
+  createOperationSpec({
+    operationName: "GetCaptureContext",
+    kind: "query",
+    inputSchema: z25.object({
+      automationId: z25.string().min(1).optional(),
+      recordingId: z25.string().min(1).optional()
+    }).refine(
+      ({ automationId, recordingId }) => [automationId, recordingId].some((value) => value !== void 0),
+      { message: "Provide --automation-id or --recording-id." }
+    ),
+    cli: {
+      name: "get-capture-context",
+      path: ["capture-context", "get"],
+      description: "Fetch raw browser events and screenshots from a Capture Mode recording.",
+      resultKey: "captureContext",
+      options: [
+        stringOption({
+          inputKey: "automationId",
+          flagName: "automation-id",
+          description: "Automation ID whose newest usable Capture Mode recording to fetch."
+        }),
+        stringOption({
+          inputKey: "recordingId",
+          flagName: "recording-id",
+          description: "Exact Capture Mode recording ID to fetch."
+        })
+      ]
+    },
+    mcp: { fileName: "captureContext.graphql" },
+    document: `# Fetch raw Capture Mode context with inline screenshots
+query GetCaptureContext($automationId: ID, $recordingId: ID) {
+  captureContext(
+    automationId: $automationId
+    recordingId: $recordingId
+  ) {
+    metadata
+    rawEvents
+  }
+}`
+  }),
   createOperationSpec({
     operationName: "GetAgents",
     kind: "query",
-    inputSchema: z23.object({
-      ids: z23.array(z23.string().min(1)).min(1)
+    inputSchema: z25.object({
+      ids: z25.array(z25.string().min(1)).min(1)
     }),
     cli: {
       name: "get-agents",
@@ -14396,9 +14727,9 @@ ${agentLimitationsSelection}
   createOperationSpec({
     operationName: "GetAgentVersion",
     kind: "query",
-    inputSchema: z23.object({
-      agentId: z23.string().min(1),
-      versionId: z23.string().min(1)
+    inputSchema: z25.object({
+      agentId: z25.string().min(1),
+      versionId: z25.string().min(1)
     }),
     cli: {
       name: "get-agent-version",
@@ -14461,8 +14792,8 @@ ${agentLimitationsSelection}
   createOperationSpec({
     operationName: "GetAgentVersions",
     kind: "query",
-    inputSchema: z23.object({
-      agentId: z23.string().min(1)
+    inputSchema: z25.object({
+      agentId: z25.string().min(1)
     }),
     cli: {
       name: "get-agent-versions",
@@ -14496,10 +14827,10 @@ query GetAgentVersions($agentId: ID!) {
   createOperationSpec({
     operationName: "DiffAgentVersion",
     kind: "query",
-    inputSchema: z23.object({
-      agentId: z23.string().min(1),
-      versionId: z23.string().min(1),
-      compareVersionId: z23.string().min(1).optional()
+    inputSchema: z25.object({
+      agentId: z25.string().min(1),
+      versionId: z25.string().min(1),
+      compareVersionId: z25.string().min(1).optional()
     }),
     cli: {
       name: "diff-agent-version",
@@ -14553,8 +14884,8 @@ query DiffAgentVersion(
   createOperationSpec({
     operationName: "GetAgentRun",
     kind: "query",
-    inputSchema: z23.object({
-      id: z23.string().min(1)
+    inputSchema: z25.object({
+      id: z25.string().min(1)
     }),
     cli: {
       name: "get-agent-run",
@@ -14590,8 +14921,8 @@ query GetAgentRun($id: ID!) {
   createOperationSpec({
     operationName: "GetAutomationAgents",
     kind: "query",
-    inputSchema: z23.object({
-      ids: z23.array(z23.string().min(1)).min(1)
+    inputSchema: z25.object({
+      ids: z25.array(z25.string().min(1)).min(1)
     }),
     cli: {
       name: "get-automation-agents",
@@ -14634,8 +14965,8 @@ query GetAutomationAgents($ids: [ID!]!) {
   createOperationSpec({
     operationName: "GetAutomationDiffFromPublished",
     kind: "query",
-    inputSchema: z23.object({
-      automationId: z23.string().min(1)
+    inputSchema: z25.object({
+      automationId: z25.string().min(1)
     }),
     cli: {
       name: "get-automation-diff-from-published",
@@ -14668,9 +14999,9 @@ query GetAutomationDiffFromPublished($automationId: ID!) {
   createOperationSpec({
     operationName: "GetAutomationDiffVersions",
     kind: "query",
-    inputSchema: z23.object({
-      baseVersionId: z23.string().min(1),
-      targetVersionId: z23.string().min(1)
+    inputSchema: z25.object({
+      baseVersionId: z25.string().min(1),
+      targetVersionId: z25.string().min(1)
     }),
     cli: {
       name: "get-automation-diff-versions",
@@ -14711,10 +15042,10 @@ query GetAutomationDiffVersions($baseVersionId: ID!, $targetVersionId: ID!) {
   createOperationSpec({
     operationName: "GetAutomationVersionJson",
     kind: "query",
-    inputSchema: z23.object({
-      versionId: z23.string().min(1),
-      paths: z23.array(z23.string().min(1)).optional(),
-      format: z23.enum(["normalized", "full", "export"]).optional()
+    inputSchema: z25.object({
+      versionId: z25.string().min(1),
+      paths: z25.array(z25.string().min(1)).optional(),
+      format: z25.enum(["normalized", "full", "export"]).optional()
     }),
     cli: {
       name: "get-automation-version-json",
@@ -14749,8 +15080,8 @@ query GetAutomationVersionJson($versionId: ID!, $paths: [String!], $format: Stri
   createOperationSpec({
     operationName: "GetAutomationVersionJsonSkeleton",
     kind: "query",
-    inputSchema: z23.object({
-      versionId: z23.string().min(1)
+    inputSchema: z25.object({
+      versionId: z25.string().min(1)
     }),
     cli: {
       name: "get-automation-version-json-skeleton",
@@ -14775,8 +15106,8 @@ query GetAutomationVersionJsonSkeleton($versionId: ID!) {
   createOperationSpec({
     operationName: "GetAutomationRun",
     kind: "query",
-    inputSchema: z23.object({
-      id: z23.string().min(1)
+    inputSchema: z25.object({
+      id: z25.string().min(1)
     }),
     cli: {
       name: "get-automation-run",
@@ -14816,8 +15147,8 @@ query GetAutomationRun($id: ID!) {
   createOperationSpec({
     operationName: "GetAutomationRunAgentRuns",
     kind: "query",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1)
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1)
     }),
     cli: {
       name: "get-automation-run-agent-runs",
@@ -14853,11 +15184,11 @@ query GetAutomationRunAgentRuns($automationRunId: ID!) {
   createOperationSpec({
     operationName: "GetAutomationRunIterations",
     kind: "query",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1),
-      agentRunId: z23.string().min(1).optional(),
-      limit: z23.number().int().positive().optional(),
-      reverse: z23.boolean().optional()
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1),
+      agentRunId: z25.string().min(1).optional(),
+      limit: z25.number().int().positive().optional(),
+      reverse: z25.boolean().optional()
     }),
     cli: {
       name: "get-automation-run-iterations",
@@ -14921,19 +15252,70 @@ query GetAutomationRunIterations(
       screenshotMimeType
     }
   }
+}`
+  }),
+  createOperationSpec({
+    operationName: "InspectPausedAutomationStep",
+    kind: "query",
+    inputSchema: z25.object({
+      runId: z25.string().min(1)
+    }),
+    cli: {
+      name: "inspect-paused-automation-step",
+      path: ["automation-runs", "inspect-paused-step"],
+      description: "Inspect the latest persisted iteration for a paused manual-mode run.",
+      resultKey: "automationRunIterations",
+      options: [
+        stringOption({
+          inputKey: "runId",
+          flagName: "run-id",
+          description: "Automation run ID.",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "inspectPausedAutomationStep.graphql" },
+    document: `# Inspect the latest persisted iteration for a paused manual-mode run
+query InspectPausedAutomationStep($runId: ID!) {
+  automationRunIterations(
+    automationRunId: $runId
+    limit: 1
+    reverse: true
+  ) {
+    id
+    sequence
+    agentRunId
+    metadata
+    startedAt
+    finishedAt
+    totalDurationMs
+    llmResponseDurationMs
+    iterationContext
+    verificationResults
+    withMarksScreenshotUrl
+    withMarksMimeType
+    memories {
+      id
+      type
+      value
+      sequence
+      screenshotUrl
+      screenshotMimeType
+    }
+  }
 }`
   }),
   createOperationSpec({
     operationName: "GetAutomationRuns",
     kind: "query",
-    inputSchema: z23.object({
-      automationId: z23.string().min(1).optional(),
-      from: z23.string().min(1).optional(),
-      status: z23.array(z23.string().min(1)).optional(),
-      invocationType: z23.array(z23.string().min(1)).optional(),
-      limit: z23.number().int().positive().optional(),
-      page: z23.number().int().nonnegative().optional(),
-      to: z23.string().min(1).optional()
+    inputSchema: z25.object({
+      automationId: z25.string().min(1).optional(),
+      from: z25.string().min(1).optional(),
+      status: z25.array(z25.string().min(1)).optional(),
+      invocationType: z25.array(z25.string().min(1)).optional(),
+      limit: z25.number().int().positive().optional(),
+      page: z25.number().int().nonnegative().optional(),
+      to: z25.string().min(1).optional()
     }),
     cli: {
       name: "get-automation-runs",
@@ -15015,8 +15397,8 @@ query GetAutomationRuns(
   createOperationSpec({
     operationName: "ListAutomations",
     kind: "query",
-    inputSchema: z23.object({
-      limit: z23.number().positive().optional(),
+    inputSchema: z25.object({
+      limit: z25.number().positive().optional(),
       order: jsonObjectSchema.optional(),
       where: jsonObjectSchema.optional()
     }),
@@ -15067,8 +15449,8 @@ query ListAutomations(
   createOperationSpec({
     operationName: "GetAutomations",
     kind: "query",
-    inputSchema: z23.object({
-      ids: z23.array(z23.string().min(1)).min(1)
+    inputSchema: z25.object({
+      ids: z25.array(z25.string().min(1)).min(1)
     }),
     cli: {
       name: "get-automations",
@@ -15186,8 +15568,8 @@ query AnalyzeAutomationStoreMigration(
   createOperationSpec({
     operationName: "GetAvailableCommands",
     kind: "query",
-    inputSchema: z23.object({
-      env: z23.string().min(1)
+    inputSchema: z25.object({
+      env: z25.string().min(1)
     }),
     cli: {
       name: "get-available-commands",
@@ -15208,7 +15590,10 @@ query AnalyzeAutomationStoreMigration(
 query GetAvailableCommands($env: AvailableCommandsEnv!) {
   availableCommands(env: $env) {
     id
+    category
     description
+    template
+    whenToUse
     requiredTool
     inputSchema
   }
@@ -15217,8 +15602,8 @@ query GetAvailableCommands($env: AvailableCommandsEnv!) {
   createOperationSpec({
     operationName: "GetAvailableModels",
     kind: "query",
-    inputSchema: z23.object({
-      agentId: z23.string().min(1)
+    inputSchema: z25.object({
+      agentId: z25.string().min(1)
     }),
     cli: {
       name: "get-available-models",
@@ -15262,9 +15647,9 @@ query GetAvailableModels($agentId: String!) {
   createOperationSpec({
     operationName: "GetAvailableTools",
     kind: "query",
-    inputSchema: z23.object({
-      env: z23.string().min(1),
-      automationId: z23.string().min(1).optional()
+    inputSchema: z25.object({
+      env: z25.string().min(1),
+      automationId: z25.string().min(1).optional()
     }),
     cli: {
       name: "get-available-tools",
@@ -15298,8 +15683,8 @@ query GetAvailableTools($env: AvailableCommandsEnv!, $automationId: String) {
   createOperationSpec({
     operationName: "GetFeatureFlagsContext",
     kind: "query",
-    inputSchema: z23.object({
-      flagKeys: z23.array(z23.string().min(1)).min(1).max(100).optional()
+    inputSchema: z25.object({
+      flagKeys: z25.array(z25.string().min(1)).min(1).max(100).optional()
     }),
     cli: {
       name: "get-feature-flags-context",
@@ -15336,7 +15721,7 @@ query GetFeatureFlagsContext($flagKeys: [String!]) {
   createOperationSpec({
     operationName: "GetAutomationWorkbenchCredentials",
     kind: "query",
-    inputSchema: z23.object({}),
+    inputSchema: z25.object({}),
     cli: {
       name: "get-automation-workbench-credentials",
       path: ["workbench", "credentials"],
@@ -15361,8 +15746,8 @@ query GetAutomationWorkbenchCredentials {
   createOperationSpec({
     operationName: "GetAutomationWorkbenchDiagnostics",
     kind: "query",
-    inputSchema: z23.object({
-      draftAutomationId: z23.string().min(1)
+    inputSchema: z25.object({
+      draftAutomationId: z25.string().min(1)
     }),
     cli: {
       name: "get-automation-workbench-diagnostics",
@@ -15427,11 +15812,11 @@ query GetAutomationWorkbenchDiagnostics($draftAutomationId: ID!) {
   createOperationSpec({
     operationName: "GetAutomationWorkbenchRunTrace",
     kind: "query",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1),
-      agentRunId: z23.string().min(1).optional(),
-      limit: z23.number().int().positive().optional(),
-      reverse: z23.boolean().optional()
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1),
+      agentRunId: z25.string().min(1).optional(),
+      limit: z25.number().int().positive().optional(),
+      reverse: z25.boolean().optional()
     }),
     cli: {
       name: "get-automation-workbench-run-trace",
@@ -15563,13 +15948,13 @@ query GetAutomationWorkbenchRunTrace(
   createOperationSpec({
     operationName: "GetAutomationWorkbenchAwaitRunCompletion",
     kind: "query",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1),
-      timeoutMs: z23.number().int().min(1e3).max(6e4).optional(),
-      sinceSequence: z23.number().int().min(0).optional(),
-      agentRunId: z23.string().min(1).optional(),
-      limit: z23.number().int().positive().optional(),
-      reverse: z23.boolean().optional()
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1),
+      timeoutMs: z25.number().int().min(1e3).max(6e4).optional(),
+      sinceSequence: z25.number().int().min(0).optional(),
+      agentRunId: z25.string().min(1).optional(),
+      limit: z25.number().int().positive().optional(),
+      reverse: z25.boolean().optional()
     }),
     cli: {
       name: "await-automation-workbench-run-completion",
@@ -15723,11 +16108,11 @@ query GetAutomationWorkbenchAwaitRunCompletion(
   createOperationSpec({
     operationName: "GetAutomationWorkbenchSchemaSuggestions",
     kind: "query",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1),
-      draftAutomationId: z23.string().min(1).optional(),
-      minConfidence: z23.number().min(0).max(1).optional(),
-      includeSensitive: z23.boolean().optional()
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1),
+      draftAutomationId: z25.string().min(1).optional(),
+      minConfidence: z25.number().min(0).max(1).optional(),
+      includeSensitive: z25.boolean().optional()
     }),
     cli: {
       name: "get-automation-workbench-schema-suggestions",
@@ -15793,97 +16178,336 @@ query GetAutomationWorkbenchSchemaSuggestions(
 }`
   }),
   createOperationSpec({
-    operationName: "CreateAutomation",
-    kind: "mutation",
-    inputSchema: z23.object({
-      input: jsonObjectSchema
+    operationName: "skills_list",
+    kind: "query",
+    inputSchema: z25.object({
+      ref: z25.string().min(1).optional()
     }),
     cli: {
-      name: "create-automation",
-      path: ["automations", "create"],
-      description: "Create a draft automation.",
-      resultKey: "createAutomation",
+      name: "list-skills",
+      path: ["skills", "list"],
+      description: "List root-level Workplace skill bundles under skills/<skill-name>.",
+      resultKey: "skillsList",
       options: [
-        jsonOption({
-          inputKey: "input",
-          flagName: "input-json",
-          description: "CreateAutomationInput payload.",
-          required: true
+        stringOption({
+          inputKey: "ref",
+          flagName: "ref",
+          description: "Branch, tag, or commit to list. Defaults to HEAD."
         })
       ]
     },
-    mcp: { fileName: "createAutomation.graphql" },
-    document: `# Mutation to create a draft automation with optional initial values
-# Returns flat fields only for MCP tool simplicity
-mutation CreateAutomation($input: CreateAutomationInput!) {
-  createAutomation(input: $input) {
-    id
-    name
-    organizationId
-    createdAt
-    updatedAt
-    environment
-    lastSavedAt
-    publishedVersionId
-    draftVersionId
+    mcp: { fileName: "skillsList.graphql" },
+    document: `# List root-level Workplace skill bundles. Nested automation and agent skill paths are outside the v1 API scope.
+query skills_list($ref: String) {
+  skillsList(ref: $ref) {
+    ref
+    truncated
+    skills {
+      name
+      path
+    }
   }
 }`
   }),
   createOperationSpec({
-    operationName: "GetGraphqlSchema",
+    operationName: "skills_read",
     kind: "query",
-    inputSchema: z23.object({}),
-    cli: {
-      name: "get-graphql-schema",
-      path: ["graphql", "schema"],
-      description: "Fetch GraphQL schema metadata.",
-      resultKey: "graphqlSchema",
-      options: []
-    },
-    mcp: { fileName: "graphqlSchema.graphql" },
-    document: `# Query to fetch full GraphQL schema metadata.
-# Uses the first-class graphqlSchema query field to avoid __schema validation
-# issues in MCP tool-load paths while still returning introspection JSON.
-# Response can be large: call sparingly (typically once per task/session) and
-# reuse cached results.
-query GetGraphqlSchema {
-  graphqlSchema
-}`
-  }),
-  createOperationSpec({
-    operationName: "PauseAutomationRun",
-    kind: "mutation",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1)
+    inputSchema: z25.object({
+      skill: z25.string().min(1),
+      ref: z25.string().min(1).optional()
     }),
     cli: {
-      name: "pause-automation-run",
-      path: ["automation-runs", "pause"],
-      description: "Pause an automation run.",
-      resultKey: "pauseAutomationRun",
+      name: "read-skill",
+      path: ["skills", "read"],
+      description: "Read every file in one root-level Workplace skill bundle.",
+      resultKey: "skillsRead",
       options: [
         stringOption({
-          inputKey: "automationRunId",
-          flagName: "automation-run-id",
-          description: "Automation run ID.",
+          inputKey: "skill",
+          flagName: "skill",
+          description: "Skill directory name or skills/<skill-name> path.",
           required: true
+        }),
+        stringOption({
+          inputKey: "ref",
+          flagName: "ref",
+          description: "Branch, tag, or commit to read. Defaults to HEAD."
         })
       ]
     },
-    mcp: { fileName: "pauseAutomationRun.graphql" },
-    document: `# Mutation to pause an automation run
-mutation PauseAutomationRun($automationRunId: ID!) {
-  pauseAutomationRun(automationRunId: $automationRunId)
+    mcp: { fileName: "skillsRead.graphql" },
+    document: `# Read one complete root-level Workplace skill bundle at a single resolved commit.
+query skills_read($skill: String!, $ref: String) {
+  skillsRead(skill: $skill, ref: $ref) {
+    path
+    ref
+    files {
+      path
+      size
+      encoding
+      content
+    }
+  }
 }`
   }),
   createOperationSpec({
-    operationName: "RerunAutomation",
-    kind: "mutation",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1),
-      additionalPrompt: z23.string().min(1).optional(),
-      idempotencyKey: z23.string().min(1),
-      allowPointOfNoReturnOverride: z23.boolean().optional()
+    operationName: "skills_history",
+    kind: "query",
+    inputSchema: z25.object({
+      skill: z25.string().min(1),
+      ref: z25.string().min(1).optional(),
+      limit: z25.number().int().min(1).max(100).optional()
+    }),
+    cli: {
+      name: "get-skill-history",
+      path: ["skills", "history"],
+      description: "List newest-first commits that changed one root-level skill bundle.",
+      resultKey: "skillsHistory",
+      options: [
+        stringOption({
+          inputKey: "skill",
+          flagName: "skill",
+          description: "Skill directory name or skills/<skill-name> path.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "ref",
+          flagName: "ref",
+          description: "Branch, tag, or commit to inspect. Defaults to HEAD."
+        }),
+        numberOption({
+          inputKey: "limit",
+          flagName: "limit",
+          description: "Number of commits to return, from 1 to 100."
+        })
+      ]
+    },
+    mcp: { fileName: "skillsHistory.graphql" },
+    document: `# List newest-first commits that changed one root-level Workplace skill bundle.
+query skills_history($skill: String!, $ref: String, $limit: Int) {
+  skillsHistory(skill: $skill, ref: $ref, limit: $limit) {
+    path
+    ref
+    truncated
+    commits {
+      commit
+      message
+      committedAt
+      author {
+        name
+        email
+      }
+    }
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "skills_apply_patch",
+    kind: "mutation",
+    inputSchema: z25.object({
+      patch: z25.string().min(1),
+      message: z25.string().min(1),
+      idempotencyKey: z25.string().min(1).optional(),
+      ref: z25.string().min(1).optional()
+    }),
+    cli: {
+      name: "apply-skills-patch",
+      path: ["skills", "apply-patch"],
+      description: "Atomically apply one Git patch limited to root-level skills/** files.",
+      resultKey: "skillsApplyPatch",
+      options: [
+        stringOption({
+          inputKey: "patch",
+          flagName: "patch",
+          description: "Raw Git unified diff changing only skills/** files.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "message",
+          flagName: "message",
+          description: "Commit message for the atomic skill update.",
+          required: true
+        }),
+        stringOption({
+          inputKey: "idempotencyKey",
+          flagName: "idempotency-key",
+          description: "Optional key used to safely retry the same patch."
+        }),
+        stringOption({
+          inputKey: "ref",
+          flagName: "ref",
+          description: "Branch to update. Defaults to HEAD."
+        })
+      ]
+    },
+    mcp: { fileName: "skillsApplyPatch.graphql" },
+    document: `# Atomically apply one Git patch limited to root-level skills/** files.
+mutation skills_apply_patch(
+  $patch: String!
+  $message: String!
+  $idempotencyKey: String
+  $ref: String
+) {
+  skillsApplyPatch(
+    patch: $patch
+    message: $message
+    idempotencyKey: $idempotencyKey
+    ref: $ref
+  ) {
+    ok
+    commit
+    ref
+    changedFiles {
+      path
+      status
+    }
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "CreateAutomation",
+    kind: "mutation",
+    inputSchema: z25.object({
+      input: createAutomationInputSchema
+    }),
+    cli: {
+      name: "create-automation",
+      path: ["automations", "create"],
+      description: "Create a draft automation.",
+      resultKey: "createAutomation",
+      options: [
+        jsonOption({
+          inputKey: "input",
+          flagName: "input-json",
+          description: `CreateAutomationInput payload. ${COMMAND_CATALOG_HELP}`,
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "createAutomation.graphql" },
+    document: `# Mutation to create a draft automation with optional initial values
+# Returns flat fields only for MCP tool simplicity
+mutation CreateAutomation($input: CreateAutomationInput!) {
+  createAutomation(input: $input) {
+    id
+    name
+    organizationId
+    createdAt
+    updatedAt
+    environment
+    lastSavedAt
+    publishedVersionId
+    draftVersionId
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "GetGraphqlSchema",
+    kind: "query",
+    inputSchema: z25.object({}),
+    cli: {
+      name: "get-graphql-schema",
+      path: ["graphql", "schema"],
+      description: "Fetch GraphQL schema metadata.",
+      resultKey: "graphqlSchema",
+      options: []
+    },
+    mcp: { fileName: "graphqlSchema.graphql" },
+    document: `# Query to fetch full GraphQL schema metadata.
+# Uses the first-class graphqlSchema query field to avoid __schema validation
+# issues in MCP tool-load paths while still returning introspection JSON.
+# Response can be large: call sparingly (typically once per task/session) and
+# reuse cached results.
+query GetGraphqlSchema {
+  graphqlSchema
+}`
+  }),
+  createOperationSpec({
+    operationName: "ApproveAutomationStep",
+    kind: "mutation",
+    inputSchema: z25.object({
+      runId: z25.string().min(1)
+    }),
+    cli: {
+      name: "approve-automation-step",
+      path: ["automation-runs", "approve-step"],
+      description: "Approve the proposed step for a paused manual-mode run.",
+      resultKey: "approveAutomationStep",
+      options: [
+        stringOption({
+          inputKey: "runId",
+          flagName: "run-id",
+          description: "Automation run ID.",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "approveAutomationStep.graphql" },
+    document: `# Approve the proposed step for a paused manual-mode run
+mutation ApproveAutomationStep($runId: ID!) {
+  approveAutomationStep(automationRunId: $runId, retry: false)
+}`
+  }),
+  createOperationSpec({
+    operationName: "RetryAutomationStep",
+    kind: "mutation",
+    inputSchema: z25.object({
+      runId: z25.string().min(1)
+    }),
+    cli: {
+      name: "retry-automation-step",
+      path: ["automation-runs", "retry-step"],
+      description: "Retry the proposed step after saving a material change to its agent.",
+      resultKey: "approveAutomationStep",
+      options: [
+        stringOption({
+          inputKey: "runId",
+          flagName: "run-id",
+          description: "Automation run ID.",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "retryAutomationStep.graphql" },
+    document: `# Retry the proposed step after saving a material change to its agent
+mutation RetryAutomationStep($runId: ID!) {
+  approveAutomationStep(automationRunId: $runId, retry: true)
+}`
+  }),
+  createOperationSpec({
+    operationName: "PauseAutomationRun",
+    kind: "mutation",
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1)
+    }),
+    cli: {
+      name: "pause-automation-run",
+      path: ["automation-runs", "pause"],
+      description: "Pause an automation run.",
+      resultKey: "pauseAutomationRun",
+      options: [
+        stringOption({
+          inputKey: "automationRunId",
+          flagName: "automation-run-id",
+          description: "Automation run ID.",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "pauseAutomationRun.graphql" },
+    document: `# Mutation to pause an automation run
+mutation PauseAutomationRun($automationRunId: ID!) {
+  pauseAutomationRun(automationRunId: $automationRunId)
+}`
+  }),
+  createOperationSpec({
+    operationName: "RerunAutomation",
+    kind: "mutation",
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1),
+      additionalPrompt: z25.string().min(1).optional(),
+      idempotencyKey: z25.string().min(1),
+      allowPointOfNoReturnOverride: z25.boolean().optional()
     }),
     cli: {
       name: "rerun-automation",
@@ -15938,9 +16562,9 @@ mutation RerunAutomation(
   createOperationSpec({
     operationName: "ResumeAutomationRun",
     kind: "mutation",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1),
-      message: z23.string().min(1).optional()
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1),
+      message: z25.string().min(1).optional()
     }),
     cli: {
       name: "resume-automation-run",
@@ -15970,15 +16594,15 @@ mutation ResumeAutomationRun($automationRunId: ID!, $message: String) {
   createOperationSpec({
     operationName: "RunDraftAutomation",
     kind: "mutation",
-    inputSchema: z23.object({
-      draftAutomationId: z23.string().min(1),
-      agentId: z23.string().min(1),
-      idempotencyKey: z23.string().min(1),
-      input: z23.unknown().optional(),
-      initialStore: z23.record(z23.string(), z23.unknown()).optional(),
+    inputSchema: z25.object({
+      draftAutomationId: z25.string().min(1),
+      agentId: z25.string().min(1),
+      idempotencyKey: z25.string().min(1),
+      input: z25.unknown().optional(),
+      initialStore: z25.record(z25.string(), z25.unknown()).optional(),
       config: automationRunStartConfigSchema.partial().passthrough().optional(),
-      additionalPrompt: z23.string().min(1).optional(),
-      consistencyCheckCount: z23.number().int().optional()
+      additionalPrompt: z25.string().min(1).optional(),
+      consistencyCheckCount: z25.number().int().optional()
     }),
     cli: {
       name: "run-draft-automation",
@@ -16063,8 +16687,8 @@ mutation RunDraftAutomation(
   createOperationSpec({
     operationName: "StopAutomationRun",
     kind: "mutation",
-    inputSchema: z23.object({
-      automationRunId: z23.string().min(1)
+    inputSchema: z25.object({
+      automationRunId: z25.string().min(1)
     }),
     cli: {
       name: "stop-automation-run",
@@ -16089,10 +16713,10 @@ mutation StopAutomationRun($automationRunId: ID!) {
   createOperationSpec({
     operationName: "PreviewAutomationPatch",
     kind: "mutation",
-    inputSchema: z23.object({
-      draftAutomationId: z23.string().min(1),
-      expectedLastSavedAt: z23.string().optional(),
-      operations: z23.array(z23.unknown()).min(1)
+    inputSchema: z25.object({
+      draftAutomationId: z25.string().min(1),
+      expectedLastSavedAt: z25.string().optional(),
+      operations: automationPatchOperationsSchema
     }),
     cli: {
       name: "preview-automation-patch",
@@ -16109,7 +16733,7 @@ mutation StopAutomationRun($automationRunId: ID!) {
         jsonOption({
           inputKey: "operations",
           flagName: "operations-json",
-          description: "Automation patch operations array using AutomationWorkbenchPatchOperationInput oneOf shape.",
+          description: `Automation patch operations array using AutomationWorkbenchPatchOperationInput oneOf shape. ${COMMAND_CATALOG_HELP}`,
           required: true
         })
       ]
@@ -16201,9 +16825,9 @@ mutation PreviewAutomationPatch(
   createOperationSpec({
     operationName: "ApplyAutomationPatch",
     kind: "mutation",
-    inputSchema: z23.object({
-      draftAutomationId: z23.string().min(1),
-      operations: z23.array(z23.unknown()).min(1)
+    inputSchema: z25.object({
+      draftAutomationId: z25.string().min(1),
+      operations: automationPatchOperationsSchema
     }),
     cli: {
       name: "apply-automation-patch",
@@ -16220,7 +16844,7 @@ mutation PreviewAutomationPatch(
         jsonOption({
           inputKey: "operations",
           flagName: "operations-json",
-          description: "Automation patch operations array using AutomationWorkbenchPatchOperationInput oneOf shape.",
+          description: `Automation patch operations array using AutomationWorkbenchPatchOperationInput oneOf shape. ${COMMAND_CATALOG_HELP}`,
           required: true
         }),
         stringOption({
@@ -16319,9 +16943,9 @@ mutation ApplyAutomationPatch(
   createOperationSpec({
     operationName: "UpdateAutomationById",
     kind: "mutation",
-    inputSchema: z23.object({
-      id: z23.string().min(1),
-      input: jsonObjectSchema
+    inputSchema: z25.object({
+      id: z25.string().min(1),
+      input: updateAutomationInputSchema
     }),
     cli: {
       name: "update-automation-by-id",
@@ -16338,7 +16962,7 @@ mutation ApplyAutomationPatch(
         jsonOption({
           inputKey: "input",
           flagName: "input-json",
-          description: "UpdateAutomationInput payload. Must include baseVersionId from a fresh read. Store schema writes are additive under config.storeSchema; use removeStoreSchemaPaths for explicit deletion or replaceStoreSchema for exact replacement.",
+          description: `UpdateAutomationInput payload. Must include baseVersionId from a fresh read. Store schema writes are additive under config.storeSchema; use removeStoreSchemaPaths for explicit deletion or replaceStoreSchema for exact replacement. ${COMMAND_CATALOG_HELP}`,
           required: true
         })
       ]
@@ -16363,7 +16987,7 @@ mutation UpdateAutomationById($id: ID!, $input: UpdateAutomationInput!) {
 import { Command as Command2, InvalidArgumentError as InvalidArgumentError2, Option as Option2 } from "commander";
 
 // src/api.ts
-import { z as z24 } from "zod";
+import { z as z26 } from "zod";
 
 // src/version.ts
 import fs from "node:fs";
@@ -16390,55 +17014,55 @@ var CLI_VERSION = cliPackageVersion;
 // src/api.ts
 var OTTO_AUTHORIZATION_HEADER_NAME = "X-Otto-Authorization";
 var OTTO_AUTHORIZATION_ISSUER = "magical:otto";
-var workosOrganizationsResponseSchema = z24.object({
-  organizations: z24.array(
-    z24.object({
-      id: z24.string().min(1),
-      name: z24.string().min(1),
-      primaryDomain: z24.string().nullable().optional()
+var workosOrganizationsResponseSchema = z26.object({
+  organizations: z26.array(
+    z26.object({
+      id: z26.string().min(1),
+      name: z26.string().min(1),
+      primaryDomain: z26.string().nullable().optional()
     })
   ),
-  success: z24.boolean()
+  success: z26.boolean()
 });
-var workosUserSchema = z24.object({
-  email: z24.string().nullable(),
-  id: z24.string().min(1)
+var workosUserSchema = z26.object({
+  email: z26.string().nullable(),
+  id: z26.string().min(1)
 });
-var nangoIntegrationWireSchema = z24.object({
+var nangoIntegrationWireSchema = z26.object({
   // eslint-disable-next-line @typescript-eslint/naming-convention -- mirrors Nango REST payload
-  unique_key: z24.string().min(1)
+  unique_key: z26.string().min(1)
 }).passthrough().transform((data) => ({
   ...data,
   uniqueKey: data.unique_key
 }));
-var nangoIntegrationsResponseSchema = z24.array(nangoIntegrationWireSchema);
-var organizationAuthenticationSchema = z24.object({
-  id: z24.string().min(1),
-  type: z24.string().min(1),
-  connectionId: z24.string().nullable().optional(),
-  providerConfigKey: z24.string().nullable().optional(),
-  description: z24.string().nullable().optional(),
-  hostname: z24.string().nullable().optional()
+var nangoIntegrationsResponseSchema = z26.array(nangoIntegrationWireSchema);
+var organizationAuthenticationSchema = z26.object({
+  id: z26.string().min(1),
+  type: z26.string().min(1),
+  connectionId: z26.string().nullable().optional(),
+  providerConfigKey: z26.string().nullable().optional(),
+  description: z26.string().nullable().optional(),
+  hostname: z26.string().nullable().optional()
 }).passthrough();
-var organizationAuthenticationsResponseSchema = z24.object({
-  authentications: z24.array(organizationAuthenticationSchema),
-  success: z24.boolean()
+var organizationAuthenticationsResponseSchema = z26.object({
+  authentications: z26.array(organizationAuthenticationSchema),
+  success: z26.boolean()
 });
-var graphQlResponseSchema = z24.object({
-  data: z24.record(z24.string(), z24.unknown()).optional(),
-  errors: z24.array(
-    z24.object({
-      message: z24.string().min(1)
+var graphQlResponseSchema = z26.object({
+  data: z26.record(z26.string(), z26.unknown()).optional(),
+  errors: z26.array(
+    z26.object({
+      message: z26.string().min(1)
     })
   ).optional()
 });
-var apiErrorResponseSchema = z24.object({
-  errors: z24.array(
-    z24.object({
-      message: z24.string().min(1)
+var apiErrorResponseSchema = z26.object({
+  errors: z26.array(
+    z26.object({
+      message: z26.string().min(1)
     })
   ).optional(),
-  message: z24.string().min(1).optional()
+  message: z26.string().min(1).optional()
 });
 function getApiErrorDetail(responseBody) {
   const parsedResponse = apiErrorResponseSchema.safeParse(responseBody);
@@ -16456,7 +17080,7 @@ function getApiErrorDetail(responseBody) {
 function trimTrailingSlash(value) {
   return value.replace(/\/+$/u, "");
 }
-function isRecord2(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeJwtPayload(token) {
@@ -16470,7 +17094,7 @@ function decodeJwtPayload(token) {
   if (isErr(payloadResult)) {
     return null;
   }
-  return isRecord2(payloadResult.value) ? payloadResult.value : null;
+  return isRecord4(payloadResult.value) ? payloadResult.value : null;
 }
 function isOttoAuthorizationToken(token) {
   return decodeJwtPayload(token)?.["iss"] === OTTO_AUTHORIZATION_ISSUER;
@@ -16509,11 +17133,11 @@ function createMagicalApiClient({
     accessToken,
     impersonatedOrganizationId,
     allowOttoAuthorization,
-    path: path7,
+    path: path8,
     init,
     organizationId
   }) {
-    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path7}`;
+    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path8}`;
     const headers = new Headers(init?.headers);
     applyAuthenticationHeaders({
       accessToken,
@@ -16682,6 +17306,29 @@ var CLI_ACCESS_TOKEN_FILE_NAME = "access-token.txt";
 var CLI_STATE_FILE_NAME = "state.json";
 var CLI_SETTINGS_FILE_NAME = "settings.json";
 var CLI_REFRESH_TOKEN_FILE_NAME = "refresh-tokens.json";
+function getIsolatedGitEnvironment() {
+  const environment = {};
+  environment["GIT_CONFIG_GLOBAL"] = os.devNull;
+  environment["GIT_CONFIG_NOSYSTEM"] = "1";
+  environment["GIT_TERMINAL_PROMPT"] = "0";
+  for (const key of [
+    "COMSPEC",
+    "HOME",
+    "PATH",
+    "PATHEXT",
+    "SYSTEMROOT",
+    "TEMP",
+    "TMP",
+    "TMPDIR",
+    "USERPROFILE"
+  ]) {
+    const value = process.env[key];
+    if (value !== void 0) {
+      environment[key] = value;
+    }
+  }
+  return environment;
+}
 function resolvePlatformConfigDirectory() {
   const customConfigDirectory = process.env["MAGICAL_CLI_CONFIG_DIR"];
   if (customConfigDirectory) {
@@ -16727,10 +17374,10 @@ function requireWorkosClientId(config) {
 // src/settings.ts
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import path3 from "node:path";
-import { z as z25 } from "zod";
-var cliSettingsSchema = z25.object({
-  env: z25.object({
-    baseUrl: z25.url().optional()
+import { z as z27 } from "zod";
+var cliSettingsSchema = z27.object({
+  env: z27.object({
+    baseUrl: z27.url().optional()
   }).default({})
 });
 function createEmptyCliSettings() {
@@ -16873,7 +17520,8 @@ var rootOperationalGroupDescriptions = /* @__PURE__ */ new Map([
   ["automations", "Manage automations."],
   ["automation-runs", "Inspect and control automation runs."],
   ["catalog", "Inspect available commands, models, and tools."],
-  ["graphql", "Inspect GraphQL metadata."]
+  ["graphql", "Inspect GraphQL metadata."],
+  ["skills", "Inspect and update root-level Workplace skills."]
 ]);
 function configureCommandPresentation(command) {
   const originalCreateCommand = command.createCommand.bind(command);
@@ -17329,35 +17977,708 @@ ${formatExamples("Examples", [
   return settingsCommand;
 }
 
-// src/state.ts
-import { mkdir as mkdir2, readFile as readFile3, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
+// src/skills-working-copy.ts
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import {
+  lstat,
+  mkdir as mkdir2,
+  mkdtemp,
+  readFile as readFile3,
+  readdir,
+  rename,
+  rm as rm3,
+  writeFile as writeFile2
+} from "node:fs/promises";
+import os2 from "node:os";
 import path5 from "node:path";
-import { z as z26 } from "zod";
-var cliAccountSchema = z26.object({
-  clientId: z26.string().min(1),
-  email: z26.string().nullable(),
-  userId: z26.string().min(1)
+import { z as z28 } from "zod";
+var SKILLS_ROOT_PATH = "skills";
+var METADATA_DIRECTORY_NAME = "skill-working-copies";
+var MAX_GIT_OUTPUT_BYTES = 10 * 1024 * 1024;
+var GIT_TIMEOUT_MS = 3e4;
+var FULL_COMMIT_SHA_PATTERN = /^[\dA-Fa-f]{40}$/u;
+var UTF8_ENCODER = new TextEncoder();
+var WINDOWS_RESERVED_PATH_CHARACTER_PATTERN = /[<>:"|?*]/u;
+var WINDOWS_RESERVED_PATH_NAME_PATTERN = /^(?:AUX|CON|NUL|PRN|COM[1-9]|LPT[1-9])(?:\..*)?$/iu;
+var skillBundleSchema = z28.object({
+  files: z28.array(
+    z28.object({
+      content: z28.string(),
+      encoding: z28.literal("base64"),
+      path: z28.string().min(1),
+      size: z28.number().int().nonnegative()
+    })
+  ),
+  path: z28.string().min(1),
+  ref: z28.string().regex(FULL_COMMIT_SHA_PATTERN)
 });
-var cliOrganizationSchema = z26.object({
-  id: z26.string().min(1),
-  name: z26.string().min(1),
-  primaryDomain: z26.string().nullable().default(null)
+var skillsApplyPatchResultSchema = z28.object({
+  changedFiles: z28.array(
+    z28.object({ path: z28.string().min(1), status: z28.string().min(1) })
+  ),
+  commit: z28.string().regex(FULL_COMMIT_SHA_PATTERN),
+  ok: z28.boolean(),
+  ref: z28.string().min(1)
+}).refine((result) => result.ok, {
+  message: "Skills patch result was not successful."
 });
-var cliStateSchema = z26.object({
+var workingCopyMetadataSchema = z28.object({
+  version: z28.literal(1),
+  files: z28.array(
+    z28.object({
+      content: z28.string(),
+      path: z28.string().min(1)
+    })
+  ),
+  organizationId: z28.string().min(1),
+  requestedRef: z28.string().min(1).nullable(),
+  skillPath: z28.string().min(1),
+  workingCopyPath: z28.string().min(1)
+});
+function hasControlCharacter2(value) {
+  return UTF8_ENCODER.encode(value).some((byte) => byte <= 31 || byte === 127);
+}
+function hasWindowsUnsafePathSyntax(value) {
+  return WINDOWS_RESERVED_PATH_CHARACTER_PATTERN.test(value) || WINDOWS_RESERVED_PATH_NAME_PATTERN.test(value) || value.endsWith(".") || value.endsWith(" ");
+}
+function isSafeSkillName(value) {
+  return value.length > 0 && !value.startsWith(".") && !value.includes("\\") && !hasControlCharacter2(value) && !hasWindowsUnsafePathSyntax(value) && value !== "..";
+}
+function normalizeRootSkillPath(skill) {
+  const normalizedInput = skill.trim().replace(/\/+$/u, "");
+  const segments = normalizedInput.split("/");
+  let skillName = void 0;
+  if (segments.length === 1) {
+    [skillName] = segments;
+  } else if (segments.length === 2 && segments[0] === SKILLS_ROOT_PATH) {
+    [, skillName] = segments;
+  }
+  if (!skillName || !isSafeSkillName(skillName)) {
+    throw new CliError(
+      "Skill must be a root-level directory name or a skills/<skill-name> path."
+    );
+  }
+  return `${SKILLS_ROOT_PATH}/${skillName}`;
+}
+function resolveWorkingCopyPath(workingDirectory, skillPath) {
+  return path5.resolve(workingDirectory, ...skillPath.split("/"));
+}
+function resolveMetadataPath(stateFilePath, workingCopyPath) {
+  const key = createHash("sha256").update(workingCopyPath).digest("hex");
+  return path5.join(
+    path5.dirname(stateFilePath),
+    METADATA_DIRECTORY_NAME,
+    `${key}.json`
+  );
+}
+function isMissingFileError(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function pathExists(filePath) {
+  return await lstat(filePath).then(() => true).catch((error) => {
+    if (isMissingFileError(error)) {
+      return false;
+    }
+    throw error;
+  });
+}
+function snapshotToMetadataFiles(snapshot) {
+  return [...snapshot.entries()].toSorted(([leftPath], [rightPath]) => leftPath.localeCompare(rightPath)).map(([filePath, content]) => ({
+    content: content.toString("base64"),
+    path: filePath
+  }));
+}
+function metadataFilesToSnapshot(files) {
+  return new Map(
+    files.map((file) => [file.path, Buffer.from(file.content, "base64")])
+  );
+}
+async function loadMetadata(metadataPath) {
+  const fileContents = await readFile3(metadataPath, "utf8").catch(
+    (error) => {
+      if (isMissingFileError(error)) {
+        return null;
+      }
+      throw new CliError("Failed to read Skills working-copy metadata.", {
+        cause: error
+      });
+    }
+  );
+  if (fileContents === null) {
+    return null;
+  }
+  const jsonResult = safeJsonParseWithoutLogging(fileContents);
+  if (isErr(jsonResult)) {
+    throw new CliError("Stored Skills working-copy metadata is invalid.");
+  }
+  const parsed = workingCopyMetadataSchema.safeParse(jsonResult.value);
+  if (!parsed.success) {
+    throw new CliError("Stored Skills working-copy metadata is invalid.");
+  }
+  return parsed.data;
+}
+async function saveMetadata(metadataPath, metadata) {
+  await mkdir2(path5.dirname(metadataPath), { recursive: true });
+  const temporaryPath = `${metadataPath}.${randomUUID()}.tmp`;
+  await writeFile2(temporaryPath, `${JSON.stringify(metadata, null, 2)}
+`, {
+    mode: 384
+  });
+  await rename(temporaryPath, metadataPath);
+}
+function assertSafeRelativeFilePath(relativePath) {
+  const segments = relativePath.split("/");
+  if (relativePath.length === 0 || relativePath.startsWith("/") || relativePath.includes("\\") || hasControlCharacter2(relativePath) || segments.some(
+    (segment) => segment.length === 0 || segment === "." || segment === ".." || segment === ".git" || hasWindowsUnsafePathSyntax(segment)
+  )) {
+    throw new CliError(
+      `Skill bundle returned unsafe file path "${relativePath}".`
+    );
+  }
+}
+function parseBundle(value, expectedSkillPath) {
+  const parsed = skillBundleSchema.safeParse(value);
+  if (!parsed.success) {
+    throw new CliError("Skills API returned an invalid bundle.");
+  }
+  const bundle = parsed.data;
+  if (bundle.path !== expectedSkillPath) {
+    throw new CliError(
+      `Skills API returned "${bundle.path}" while reading "${expectedSkillPath}".`
+    );
+  }
+  const snapshot = /* @__PURE__ */ new Map();
+  for (const file of bundle.files) {
+    const prefix = `${bundle.path}/`;
+    if (!file.path.startsWith(prefix)) {
+      throw new CliError(
+        `Skill bundle returned file outside "${bundle.path}": "${file.path}".`
+      );
+    }
+    const relativePath = file.path.slice(prefix.length);
+    assertSafeRelativeFilePath(relativePath);
+    if (snapshot.has(file.path)) {
+      throw new CliError(
+        `Skill bundle returned duplicate file "${file.path}".`
+      );
+    }
+    const content = Buffer.from(file.content, "base64");
+    if (content.byteLength !== file.size) {
+      throw new CliError(
+        `Skill bundle returned an invalid size for "${file.path}".`
+      );
+    }
+    snapshot.set(file.path, content);
+  }
+  if (snapshot.size === 0) {
+    throw new CliError(`Skill bundle "${bundle.path}" contains no files.`);
+  }
+  return { bundle, snapshot };
+}
+async function readDirectorySnapshot({
+  directoryPath,
+  skillPath
+}) {
+  if (!await pathExists(directoryPath)) {
+    return /* @__PURE__ */ new Map();
+  }
+  const rootStats = await lstat(directoryPath);
+  if (!rootStats.isDirectory()) {
+    throw new CliError(
+      `Skill working copy "${directoryPath}" is not a directory.`
+    );
+  }
+  async function visit(currentDirectory, segments) {
+    const entries = await readdir(currentDirectory, { withFileTypes: true });
+    const nestedEntries = await Promise.all(
+      entries.toSorted((left, right) => left.name.localeCompare(right.name)).map(async (entry) => {
+        const nextSegments = [...segments, entry.name];
+        const relativePath = nextSegments.join("/");
+        assertSafeRelativeFilePath(relativePath);
+        const filePath = path5.join(currentDirectory, entry.name);
+        if (entry.isDirectory()) {
+          return await visit(filePath, nextSegments);
+        }
+        if (!entry.isFile()) {
+          throw new CliError(
+            `Skill working copy contains unsupported entry "${filePath}". Only regular files and directories are allowed.`
+          );
+        }
+        return [[`${skillPath}/${relativePath}`, await readFile3(filePath)]];
+      })
+    );
+    return nestedEntries.flat();
+  }
+  return new Map(await visit(directoryPath, []));
+}
+function contentEquals(left, right) {
+  if (left === void 0 || right === void 0) {
+    return left === right;
+  }
+  return left.equals(right);
+}
+function snapshotsEqual(left, right) {
+  if (left.size !== right.size) {
+    return false;
+  }
+  return [...left.entries()].every(
+    ([filePath, content]) => contentEquals(content, right.get(filePath))
+  );
+}
+async function writeSnapshotContents(rootPath, snapshot, prefix) {
+  await Promise.all(
+    [...snapshot.entries()].map(async ([filePath, content]) => {
+      const relativePath = prefix === null ? filePath : filePath.slice(`${prefix}/`.length);
+      assertSafeRelativeFilePath(relativePath);
+      const targetPath = path5.join(rootPath, ...relativePath.split("/"));
+      await mkdir2(path5.dirname(targetPath), { recursive: true });
+      await writeFile2(targetPath, content);
+    })
+  );
+}
+async function replaceWorkingCopy({
+  snapshot,
+  skillPath,
+  workingCopyPath
+}) {
+  const parentPath = path5.dirname(workingCopyPath);
+  await mkdir2(parentPath, { recursive: true });
+  const temporaryPath = path5.join(
+    parentPath,
+    `.mgcl-${path5.basename(workingCopyPath)}-${randomUUID()}.tmp`
+  );
+  const backupPath = `${workingCopyPath}.${randomUUID()}.bak`;
+  await mkdir2(temporaryPath);
+  const prepareResult = await fromThrowable(async () => {
+    await writeSnapshotContents(temporaryPath, snapshot, skillPath);
+    const hadExistingWorkingCopy = await pathExists(workingCopyPath);
+    if (hadExistingWorkingCopy) {
+      await rename(workingCopyPath, backupPath);
+    }
+    return hadExistingWorkingCopy;
+  }, "skills-working-copy-replace-failed");
+  if (isErr(prepareResult)) {
+    await rm3(temporaryPath, { force: true, recursive: true });
+    throw new CliError("Failed to replace the skill working copy.", {
+      cause: prepareResult.error.cause
+    });
+  }
+  const activationResult = await fromThrowable(async () => {
+    await rename(temporaryPath, workingCopyPath);
+  }, "skills-working-copy-activation-failed");
+  if (isErr(activationResult)) {
+    if (prepareResult.value) {
+      await rename(backupPath, workingCopyPath);
+    }
+    await rm3(temporaryPath, { force: true, recursive: true });
+    throw new CliError("Failed to activate the new skill working copy.", {
+      cause: activationResult.error.cause
+    });
+  }
+  if (prepareResult.value) {
+    await rm3(backupPath, { force: true, recursive: true });
+  }
+}
+async function runGit(arguments_, cwd, allowedExitCodes = [0]) {
+  const result = await new Promise((resolve, reject) => {
+    execFile(
+      "git",
+      arguments_,
+      {
+        cwd,
+        encoding: "buffer",
+        env: getIsolatedGitEnvironment(),
+        maxBuffer: MAX_GIT_OUTPUT_BYTES,
+        timeout: GIT_TIMEOUT_MS
+      },
+      (error, stdout, stderr) => {
+        let exitCode = 0;
+        if (error !== null) {
+          exitCode = typeof error.code === "number" ? error.code : -1;
+        }
+        const commandResult = { exitCode, stderr, stdout };
+        if (error && !allowedExitCodes.includes(exitCode)) {
+          reject(
+            new CliError(
+              `Git command failed: ${stderr.toString("utf8").trim() || error.message}`,
+              { cause: error }
+            )
+          );
+          return;
+        }
+        resolve(commandResult);
+      }
+    );
+  });
+  return result;
+}
+async function clearDirectoryExceptGit(directoryPath) {
+  const entries = await readdir(directoryPath);
+  await Promise.all(
+    entries.filter((entry) => entry !== ".git").map(async (entry) => {
+      await rm3(path5.join(directoryPath, entry), {
+        force: true,
+        recursive: true
+      });
+    })
+  );
+}
+async function createPatch(before, after) {
+  if (snapshotsEqual(before, after)) {
+    return "";
+  }
+  const repositoryPath = await mkdtemp(
+    path5.join(os2.tmpdir(), "mgcl-skills-diff-")
+  );
+  const patchResult = await fromThrowable(async () => {
+    await runGit(["init", "--quiet"], repositoryPath);
+    await writeSnapshotContents(repositoryPath, before, null);
+    await stageCompleteSnapshot(repositoryPath, before);
+    await runGit(
+      [
+        "-c",
+        "user.name=mgcl",
+        "-c",
+        "user.email=mgcl@getmagical.com",
+        "-c",
+        "commit.gpgsign=false",
+        "commit",
+        "--allow-empty",
+        "--quiet",
+        "-m",
+        "Skills baseline"
+      ],
+      repositoryPath
+    );
+    await clearDirectoryExceptGit(repositoryPath);
+    await writeSnapshotContents(repositoryPath, after, null);
+    await stageCompleteSnapshot(repositoryPath, after);
+    const result = await runGit(
+      [
+        "diff",
+        "--cached",
+        "--no-color",
+        "--no-ext-diff",
+        "--no-renames",
+        "--full-index",
+        "--src-prefix=a/",
+        "--dst-prefix=b/",
+        "HEAD",
+        "--",
+        "."
+      ],
+      repositoryPath
+    );
+    return result.stdout.toString("utf8");
+  }, "skills-patch-generation-failed");
+  await rm3(repositoryPath, { force: true, recursive: true });
+  if (isErr(patchResult)) {
+    throw patchResult.error.cause;
+  }
+  return patchResult.value;
+}
+async function stageCompleteSnapshot(repositoryPath, snapshot) {
+  await runGit(["add", "--all", "--force", "--", "."], repositoryPath);
+  const trackedFilesResult = await runGit(
+    ["ls-files", "--cached", "-z"],
+    repositoryPath
+  );
+  const trackedFiles = trackedFilesResult.stdout.toString("utf8").split("\0").filter((filePath) => filePath.length > 0).toSorted();
+  const expectedFiles = [...snapshot.keys()].toSorted();
+  if (trackedFiles.length !== expectedFiles.length || trackedFiles.some((filePath, index) => filePath !== expectedFiles[index])) {
+    throw new CliError(
+      "Failed to stage the complete skill snapshot for patch generation."
+    );
+  }
+}
+function createMetadata({
+  organizationId,
+  requestedRef,
+  skillPath,
+  snapshot,
+  workingCopyPath
+}) {
+  return {
+    version: 1,
+    files: snapshotToMetadataFiles(snapshot),
+    organizationId,
+    requestedRef,
+    skillPath,
+    workingCopyPath
+  };
+}
+function assertMetadataMatchesContext({
+  metadata,
+  organizationId,
+  skillPath,
+  workingCopyPath
+}) {
+  if (metadata.skillPath !== skillPath || metadata.workingCopyPath !== workingCopyPath) {
+    throw new CliError(
+      "Stored Skills working-copy metadata does not match this folder."
+    );
+  }
+  if (metadata.organizationId !== organizationId) {
+    throw new CliError(
+      `This skill working copy belongs to organization "${metadata.organizationId}". Select that organization or pull with --force to replace it.`
+    );
+  }
+  if (metadata.requestedRef !== null) {
+    throw new CliError(
+      "This skill working copy targets a non-default ref, which is no longer supported. Pull it again with --force to use the repository default branch."
+    );
+  }
+}
+async function requireWorkingCopy({
+  organizationId,
+  skill,
+  stateFilePath,
+  workingDirectory
+}) {
+  const skillPath = normalizeRootSkillPath(skill);
+  const workingCopyPath = resolveWorkingCopyPath(workingDirectory, skillPath);
+  const metadataPath = resolveMetadataPath(stateFilePath, workingCopyPath);
+  const metadata = await loadMetadata(metadataPath);
+  if (!metadata) {
+    throw new CliError(
+      `No pulled working copy exists for "${skillPath}" in this folder. Run "mgcl skills pull ${skillPath}" first.`
+    );
+  }
+  assertMetadataMatchesContext({
+    metadata,
+    organizationId,
+    skillPath,
+    workingCopyPath
+  });
+  return {
+    base: metadataFilesToSnapshot(metadata.files),
+    local: await readDirectorySnapshot({
+      directoryPath: workingCopyPath,
+      skillPath
+    }),
+    metadata,
+    metadataPath,
+    skillPath,
+    workingCopyPath
+  };
+}
+async function readRemoteBundle(api, skillPath, requestedRef) {
+  return parseBundle(
+    await api.read({
+      skill: skillPath,
+      ...requestedRef === null ? {} : { ref: requestedRef }
+    }),
+    skillPath
+  );
+}
+function assertTextPatch(patchContents) {
+  if (/^GIT binary patch$/mu.test(patchContents) || /^Binary files .* differ$/mu.test(patchContents)) {
+    throw new CliError(
+      "Binary skill changes cannot be pushed because repo-browser only accepts text patches."
+    );
+  }
+}
+function isPatchApplyConflict(error) {
+  return error instanceof Error && (/Patch does not apply/iu.test(error.message) || /Branch was updated while applying patch/iu.test(error.message));
+}
+async function pullSkillWorkingCopy({
+  context,
+  force = false,
+  skill
+}) {
+  const skillPath = normalizeRootSkillPath(skill);
+  const workingCopyPath = resolveWorkingCopyPath(
+    context.workingDirectory,
+    skillPath
+  );
+  const metadataPath = resolveMetadataPath(
+    context.stateFilePath,
+    workingCopyPath
+  );
+  if (!force) {
+    const existingMetadata = await loadMetadata(metadataPath);
+    const existingSnapshot = await readDirectorySnapshot({
+      directoryPath: workingCopyPath,
+      skillPath
+    });
+    if (!existingMetadata && existingSnapshot.size > 0) {
+      throw new CliError(
+        `Refusing to overwrite existing files at "${workingCopyPath}". Re-run with --force to replace them.`
+      );
+    }
+    if (existingMetadata) {
+      assertMetadataMatchesContext({
+        metadata: existingMetadata,
+        organizationId: context.organizationId,
+        skillPath,
+        workingCopyPath
+      });
+      const baseline = metadataFilesToSnapshot(existingMetadata.files);
+      if (!snapshotsEqual(existingSnapshot, baseline)) {
+        throw new CliError(
+          `Refusing to overwrite local changes in "${workingCopyPath}". Run "mgcl skills diff ${skillPath}" or re-run pull with --force.`
+        );
+      }
+    }
+  }
+  const { snapshot } = await readRemoteBundle(context.api, skillPath, null);
+  await replaceWorkingCopy({ snapshot, skillPath, workingCopyPath });
+  await saveMetadata(
+    metadataPath,
+    createMetadata({
+      organizationId: context.organizationId,
+      requestedRef: null,
+      skillPath,
+      snapshot,
+      workingCopyPath
+    })
+  );
+  return {
+    fileCount: snapshot.size,
+    path: workingCopyPath,
+    skillPath
+  };
+}
+async function diffSkillWorkingCopy({
+  context,
+  skill
+}) {
+  const workingCopy = await requireWorkingCopy({
+    organizationId: context.organizationId,
+    skill,
+    stateFilePath: context.stateFilePath,
+    workingDirectory: context.workingDirectory
+  });
+  const patchContents = await createPatch(workingCopy.base, workingCopy.local);
+  return {
+    hasLocalChanges: !snapshotsEqual(workingCopy.base, workingCopy.local),
+    patch: patchContents,
+    skillPath: workingCopy.skillPath
+  };
+}
+async function pushSkillWorkingCopy({
+  context,
+  message,
+  skill
+}) {
+  const workingCopy = await requireWorkingCopy({
+    organizationId: context.organizationId,
+    skill,
+    stateFilePath: context.stateFilePath,
+    workingDirectory: context.workingDirectory
+  });
+  const { base, local } = workingCopy;
+  const patchContents = await createPatch(base, local);
+  if (patchContents.length === 0) {
+    return {
+      path: workingCopy.workingCopyPath,
+      pushed: false,
+      skillPath: workingCopy.skillPath
+    };
+  }
+  assertTextPatch(patchContents);
+  const applyResult = await fromThrowable(
+    async () => await context.api.applyPatch({
+      idempotencyKey: `mgcl-skills-${randomUUID()}`,
+      message: message ?? `Update ${workingCopy.skillPath} via mgcl`,
+      patch: patchContents
+    }),
+    "skills-push-request-failed"
+  );
+  if (isErr(applyResult)) {
+    const { cause } = applyResult.error;
+    if (isPatchApplyConflict(cause)) {
+      throw new CliError(
+        `The skill changed remotely and your local patch no longer applies. Save your local edits elsewhere, run "mgcl skills pull ${workingCopy.skillPath} --force", reapply the changes, and push again.`,
+        { cause }
+      );
+    }
+    if (cause instanceof Error) {
+      throw cause;
+    }
+    throw new CliError("Failed to push the skill working copy.", {
+      cause
+    });
+  }
+  const parsedResult = skillsApplyPatchResultSchema.safeParse(
+    applyResult.value
+  );
+  if (!parsedResult.success) {
+    throw new CliError("Skills API returned an invalid patch result.");
+  }
+  const pushResult = {
+    ...parsedResult.data,
+    path: workingCopy.workingCopyPath,
+    pushed: true,
+    skillPath: workingCopy.skillPath
+  };
+  const refreshResult = await fromThrowable(async () => {
+    const authoritative = await readRemoteBundle(
+      context.api,
+      workingCopy.skillPath,
+      parsedResult.data.commit
+    );
+    if (authoritative.bundle.ref !== parsedResult.data.commit) {
+      throw new CliError(
+        `Skills API returned commit "${authoritative.bundle.ref}" while reading pushed commit "${parsedResult.data.commit}".`
+      );
+    }
+    await replaceWorkingCopy({
+      snapshot: authoritative.snapshot,
+      skillPath: workingCopy.skillPath,
+      workingCopyPath: workingCopy.workingCopyPath
+    });
+    await saveMetadata(
+      workingCopy.metadataPath,
+      createMetadata({
+        organizationId: context.organizationId,
+        requestedRef: null,
+        skillPath: workingCopy.skillPath,
+        snapshot: authoritative.snapshot,
+        workingCopyPath: workingCopy.workingCopyPath
+      })
+    );
+  }, "skills-push-refresh-failed");
+  if (isErr(refreshResult)) {
+    return {
+      ...pushResult,
+      warning: `The push succeeded as commit ${parsedResult.data.commit}, but refreshing the local working copy from that commit failed, so this checkout may be out of sync. Run "mgcl skills pull ${workingCopy.skillPath} --force" to sync it with the server.`,
+      workingCopyRefreshed: false
+    };
+  }
+  return { ...pushResult, workingCopyRefreshed: true };
+}
+
+// src/state.ts
+import { mkdir as mkdir3, readFile as readFile4, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
+import path6 from "node:path";
+import { z as z29 } from "zod";
+var cliAccountSchema = z29.object({
+  clientId: z29.string().min(1),
+  email: z29.string().nullable(),
+  userId: z29.string().min(1)
+});
+var cliOrganizationSchema = z29.object({
+  id: z29.string().min(1),
+  name: z29.string().min(1),
+  primaryDomain: z29.string().nullable().default(null)
+});
+var cliStateSchema = z29.object({
   account: cliAccountSchema,
-  defaultOrgId: z26.string().nullable(),
-  lastUsedOrgId: z26.string().nullable(),
-  organizations: z26.array(cliOrganizationSchema)
+  defaultOrgId: z29.string().nullable(),
+  lastUsedOrgId: z29.string().nullable(),
+  organizations: z29.array(cliOrganizationSchema)
 });
-var refreshTokenFileSchema = z26.record(z26.string(), z26.string());
+var refreshTokenFileSchema = z29.record(z29.string(), z29.string());
 function createFileStateStore(stateFilePath) {
   return {
     async clear() {
-      await rm3(stateFilePath, { force: true });
+      await rm4(stateFilePath, { force: true });
     },
     async load() {
       try {
-        const fileContents = await readFile3(stateFilePath, "utf8");
+        const fileContents = await readFile4(stateFilePath, "utf8");
         const parsed = cliStateSchema.safeParse(JSON.parse(fileContents));
         if (!parsed.success) {
           throw new CliError("Stored CLI state is invalid.");
@@ -17374,8 +18695,8 @@ function createFileStateStore(stateFilePath) {
       }
     },
     async save(state) {
-      await mkdir2(path5.dirname(stateFilePath), { recursive: true });
-      await writeFile2(stateFilePath, `${JSON.stringify(state, null, 2)}
+      await mkdir3(path6.dirname(stateFilePath), { recursive: true });
+      await writeFile3(stateFilePath, `${JSON.stringify(state, null, 2)}
 `);
     }
   };
@@ -17383,7 +18704,7 @@ function createFileStateStore(stateFilePath) {
 function createFileRefreshTokenStore(refreshTokenFilePath) {
   async function loadRefreshTokens() {
     try {
-      const fileContents = await readFile3(refreshTokenFilePath, "utf8");
+      const fileContents = await readFile4(refreshTokenFilePath, "utf8");
       const parsed = refreshTokenFileSchema.safeParse(JSON.parse(fileContents));
       if (!parsed.success) {
         throw new CliError("Stored refresh tokens are invalid.");
@@ -17402,8 +18723,8 @@ function createFileRefreshTokenStore(refreshTokenFilePath) {
     }
   }
   async function saveRefreshTokens(refreshTokens) {
-    await mkdir2(path5.dirname(refreshTokenFilePath), { recursive: true });
-    await writeFile2(
+    await mkdir3(path6.dirname(refreshTokenFilePath), { recursive: true });
+    await writeFile3(
       refreshTokenFilePath,
       `${JSON.stringify(refreshTokens, null, 2)}
 `
@@ -17419,7 +18740,7 @@ function createFileRefreshTokenStore(refreshTokenFilePath) {
         )
       );
       if (Object.keys(nextRefreshTokens).length === 0) {
-        await rm3(refreshTokenFilePath, { force: true });
+        await rm4(refreshTokenFilePath, { force: true });
         return;
       }
       await saveRefreshTokens(nextRefreshTokens);
@@ -17440,37 +18761,37 @@ function buildRefreshTokenKey(account) {
 }
 
 // src/workos-auth.ts
-import { z as z27 } from "zod";
+import { z as z30 } from "zod";
 var DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
 function buildFormHeaders() {
   const headers = new Headers();
   headers.set("content-type", "application/x-www-form-urlencoded");
   return headers;
 }
-var deviceAuthorizationSchema = z27.object({
-  device_code: z27.string().min(1),
-  expires_in: z27.number().int().positive().optional(),
-  interval: z27.number().int().positive().optional(),
-  user_code: z27.string().min(1),
-  verification_uri: z27.url(),
-  verification_uri_complete: z27.url().optional()
+var deviceAuthorizationSchema = z30.object({
+  device_code: z30.string().min(1),
+  expires_in: z30.number().int().positive().optional(),
+  interval: z30.number().int().positive().optional(),
+  user_code: z30.string().min(1),
+  verification_uri: z30.url(),
+  verification_uri_complete: z30.url().optional()
 });
-var tokenResponseSchema = z27.object({
-  access_token: z27.string().min(1),
-  expires_in: z27.number().int().positive().optional(),
-  refresh_token: z27.string().min(1),
-  token_type: z27.string().optional()
+var tokenResponseSchema = z30.object({
+  access_token: z30.string().min(1),
+  expires_in: z30.number().int().positive().optional(),
+  refresh_token: z30.string().min(1),
+  token_type: z30.string().optional()
 });
-var tokenErrorSchema = z27.object({
-  error: z27.string().min(1),
-  error_description: z27.string().optional()
+var tokenErrorSchema = z30.object({
+  error: z30.string().min(1),
+  error_description: z30.string().optional()
 });
-var accessTokenClaimsSchema = z27.object({
-  exp: z27.number().int().positive().optional(),
-  iss: z27.string().min(1).optional(),
-  org_id: z27.string().min(1).optional(),
-  sid: z27.string().min(1).optional(),
-  sub: z27.string().min(1)
+var accessTokenClaimsSchema = z30.object({
+  exp: z30.number().int().positive().optional(),
+  iss: z30.string().min(1).optional(),
+  org_id: z30.string().min(1).optional(),
+  sid: z30.string().min(1).optional(),
+  sub: z30.string().min(1)
 });
 function createWorkosAuthClient({
   fetchFn = fetch,
@@ -17669,7 +18990,7 @@ function createCliCommanderOption(optionSpec, helpGroup) {
   }
   return nextOption;
 }
-function isRecord3(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolveOrganizationBySelector({
@@ -17736,7 +19057,7 @@ function collectOperationVariables(operationSpec, options) {
       parsedVariables.error.issues[0]?.message ?? "Invalid command input."
     );
   }
-  if (!isRecord3(parsedVariables.data)) {
+  if (!isRecord5(parsedVariables.data)) {
     throw new CliError("Invalid command input.");
   }
   return parsedVariables.data;
@@ -17832,6 +19153,169 @@ async function handleOperationCommand(dependencies, operationSpec, commandOption
   }
   dependencies.io.info(formatHumanReadableOutput(result));
 }
+function getSkillsOperation(operationName) {
+  const operationSpec = operationSpecs.find(
+    (candidate) => candidate.operationName === operationName
+  );
+  if (!operationSpec) {
+    throw new CliError(
+      `Skills operation "${operationName}" is not registered.`
+    );
+  }
+  return operationSpec;
+}
+async function withSkillsWorkingCopyContext(dependencies, options) {
+  const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
+  const executeOperation = async (operationName, variables) => {
+    const operationSpec = getSkillsOperation(operationName);
+    return await dependencies.apiClient.executeGraphQl({
+      accessToken,
+      ...impersonatedOrganizationId ? { impersonatedOrganizationId } : {},
+      organizationId: organization.id,
+      query: operationSpec.document,
+      resultKey: operationSpec.cli.resultKey,
+      variables
+    });
+  };
+  return {
+    context: {
+      api: {
+        async applyPatch(input) {
+          return await executeOperation("skills_apply_patch", input);
+        },
+        async read(input) {
+          return await executeOperation("skills_read", input);
+        }
+      },
+      organizationId: organization.id,
+      stateFilePath: dependencies.runtimeConfig.stateFilePath,
+      workingDirectory: dependencies.workingDirectory ?? process.cwd()
+    },
+    state
+  };
+}
+async function handleSkillsPullCommand(dependencies, skill, options) {
+  const { context, state } = await withSkillsWorkingCopyContext(
+    dependencies,
+    options
+  );
+  const result = await pullSkillWorkingCopy({
+    context,
+    skill,
+    ...options.force ? { force: true } : {}
+  });
+  await saveLastUsedOrganization({
+    dependencies,
+    organizationId: context.organizationId,
+    state
+  });
+  writeCommandOutput({ dependencies, json: options.json, result });
+}
+async function handleSkillsDiffCommand(dependencies, skill, options) {
+  const { context, state } = await withSkillsWorkingCopyContext(
+    dependencies,
+    options
+  );
+  const result = await diffSkillWorkingCopy({ context, skill });
+  await saveLastUsedOrganization({
+    dependencies,
+    organizationId: context.organizationId,
+    state
+  });
+  if (options.json) {
+    writeJsonOutput3(dependencies.io, result);
+    return;
+  }
+  dependencies.io.info(
+    result.patch.length === 0 ? "No changes." : result.patch
+  );
+}
+async function handleSkillsPushCommand(dependencies, skill, options) {
+  const { context, state } = await withSkillsWorkingCopyContext(
+    dependencies,
+    options
+  );
+  const result = await pushSkillWorkingCopy({
+    context,
+    skill,
+    ...options.message ? { message: options.message } : {}
+  });
+  await saveLastUsedOrganization({
+    dependencies,
+    organizationId: context.organizationId,
+    state
+  });
+  writeCommandOutput({ dependencies, json: options.json, result });
+}
+function addSkillsWorkingCopyCommands({
+  dependencies,
+  skillsCommand
+}) {
+  skillsCommand.command("pull <skill>").description("Download a root-level skill into ./skills/<skill-name>.").addOption(
+    new Option2(
+      "--org <org>",
+      "Organization ID or exact organization name to use."
+    ).helpGroup("Shared options:")
+  ).addOption(
+    new Option2(
+      "--force",
+      "Replace existing files or local edits with the remote bundle."
+    )
+  ).addHelpText(
+    "after",
+    `
+${formatExamples("Examples", [
+      "mgcl skills pull review",
+      "mgcl skills pull skills/review"
+    ])}`
+  ).action(async function(skill) {
+    await handleSkillsPullCommand(
+      dependencies,
+      skill,
+      this.optsWithGlobals()
+    );
+  });
+  skillsCommand.command("diff <skill>").description("Preview local skill changes against the pulled bundle.").addOption(
+    new Option2(
+      "--org <org>",
+      "Organization ID or exact organization name to use."
+    ).helpGroup("Shared options:")
+  ).addHelpText(
+    "after",
+    `
+${formatExamples("Examples", [
+      "mgcl skills diff review",
+      "mgcl skills diff skills/review --json"
+    ])}`
+  ).action(async function(skill) {
+    await handleSkillsDiffCommand(
+      dependencies,
+      skill,
+      this.optsWithGlobals()
+    );
+  });
+  skillsCommand.command("push <skill>").description("Atomically push local changes for one root-level skill.").addOption(
+    new Option2(
+      "--org <org>",
+      "Organization ID or exact organization name to use."
+    ).helpGroup("Shared options:")
+  ).addOption(
+    new Option2("--message <message>", "Commit message for the skill update.")
+  ).addHelpText(
+    "after",
+    `
+${formatExamples("Examples", [
+      "mgcl skills push review",
+      'mgcl skills push skills/review --message "Improve review guidance"'
+    ])}`
+  ).action(async function(skill) {
+    await handleSkillsPushCommand(
+      dependencies,
+      skill,
+      this.optsWithGlobals()
+    );
+  });
+}
 async function withSelectedOrganizationAndAccessToken({
   dependencies,
   options
@@ -17936,7 +19420,7 @@ async function resolveDirectAccessTokenOrganizationId({
   if (!accessTokenFilePath) {
     return null;
   }
-  const accessToken = await readFile4(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
+  const accessToken = await readFile5(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
     }
@@ -18048,12 +19532,12 @@ function createConsoleIo() {
 function createDefaultDependencies() {
   const runtimeConfig = getRuntimeConfig();
   const settingsStore = createFileSettingsStore(runtimeConfig.stateFilePath);
-  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path6.join(
-    path6.dirname(runtimeConfig.stateFilePath),
+  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path7.join(
+    path7.dirname(runtimeConfig.stateFilePath),
     CLI_ACCESS_TOKEN_FILE_NAME
   );
-  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path6.join(
-    path6.dirname(runtimeConfig.stateFilePath),
+  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path7.join(
+    path7.dirname(runtimeConfig.stateFilePath),
     CLI_REFRESH_TOKEN_FILE_NAME
   );
   const selfUpdateOptions = {
@@ -18229,6 +19713,11 @@ ${formatExamples("Examples", ["mgcl update", "mgcl --update"])}`
       operationSpec
     });
   }
+  const skillsCommand = operationalCommandGroups.get("skills");
+  if (!skillsCommand) {
+    throw new CliError("Skills operation group is not registered.");
+  }
+  addSkillsWorkingCopyCommands({ dependencies, skillsCommand });
   return program2;
 }