@getmagical/cli 0.2.5 → 0.2.6

package/dist/index.js

@@ -2056,13 +2056,13 @@ var require_ast = __commonJS({
         helperExpression: function helperExpression(node) {
           return node.type === "SubExpression" || (node.type === "MustacheStatement" || node.type === "BlockStatement") && !!(node.params && node.params.length || node.hash);
         },
-        scopedId: function scopedId(path8) {
-          return /^\.|this\b/.test(path8.original);
+        scopedId: function scopedId(path9) {
+          return /^\.|this\b/.test(path9.original);
         },
         // an ID is simple if it only has one part, and that part is not
         // `..` or `this`.
-        simpleId: function simpleId(path8) {
-          return path8.parts.length === 1 && !AST.helpers.scopedId(path8) && !path8.depth;
+        simpleId: function simpleId(path9) {
+          return path9.parts.length === 1 && !AST.helpers.scopedId(path9) && !path9.depth;
         }
       }
     };
@@ -3132,12 +3132,12 @@ var require_helpers2 = __commonJS({
         loc
       };
     }
-    function prepareMustache(path8, params, hash, open, strip, locInfo) {
+    function prepareMustache(path9, params, hash, open, strip, locInfo) {
       var escapeFlag = open.charAt(3) || open.charAt(2), escaped = escapeFlag !== "{" && escapeFlag !== "&";
       var decorator = /\*/.test(open);
       return {
         type: decorator ? "Decorator" : "MustacheStatement",
-        path: path8,
+        path: path9,
         params,
         hash,
         escaped,
@@ -3455,9 +3455,9 @@ var require_compiler = __commonJS({
       },
       DecoratorBlock: function DecoratorBlock(decorator) {
         var program2 = decorator.program && this.compileProgram(decorator.program);
-        var params = this.setupFullMustacheParams(decorator, program2, void 0), path8 = decorator.path;
+        var params = this.setupFullMustacheParams(decorator, program2, void 0), path9 = decorator.path;
         this.useDecorators = true;
-        this.opcode("registerDecorator", params.length, path8.original);
+        this.opcode("registerDecorator", params.length, path9.original);
       },
       PartialStatement: function PartialStatement(partial) {
         this.usePartial = true;
@@ -3521,46 +3521,46 @@ var require_compiler = __commonJS({
         }
       },
       ambiguousSexpr: function ambiguousSexpr(sexpr, program2, inverse) {
-        var path8 = sexpr.path, name = path8.parts[0], isBlock = program2 != null || inverse != null;
-        this.opcode("getContext", path8.depth);
+        var path9 = sexpr.path, name = path9.parts[0], isBlock = program2 != null || inverse != null;
+        this.opcode("getContext", path9.depth);
         this.opcode("pushProgram", program2);
         this.opcode("pushProgram", inverse);
-        path8.strict = true;
-        this.accept(path8);
+        path9.strict = true;
+        this.accept(path9);
         this.opcode("invokeAmbiguous", name, isBlock);
       },
       simpleSexpr: function simpleSexpr(sexpr) {
-        var path8 = sexpr.path;
-        path8.strict = true;
-        this.accept(path8);
+        var path9 = sexpr.path;
+        path9.strict = true;
+        this.accept(path9);
         this.opcode("resolvePossibleLambda");
       },
       helperSexpr: function helperSexpr(sexpr, program2, inverse) {
-        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path8 = sexpr.path, name = path8.parts[0];
+        var params = this.setupFullMustacheParams(sexpr, program2, inverse), path9 = sexpr.path, name = path9.parts[0];
         if (this.options.knownHelpers[name]) {
           this.opcode("invokeKnownHelper", params.length, name);
         } else if (this.options.knownHelpersOnly) {
           throw new _exception2["default"]("You specified knownHelpersOnly, but used the unknown helper " + name, sexpr);
         } else {
-          path8.strict = true;
-          path8.falsy = true;
-          this.accept(path8);
-          this.opcode("invokeHelper", params.length, path8.original, _ast2["default"].helpers.simpleId(path8));
+          path9.strict = true;
+          path9.falsy = true;
+          this.accept(path9);
+          this.opcode("invokeHelper", params.length, path9.original, _ast2["default"].helpers.simpleId(path9));
         }
       },
-      PathExpression: function PathExpression(path8) {
-        this.addDepth(path8.depth);
-        this.opcode("getContext", path8.depth);
-        var name = path8.parts[0], scoped = _ast2["default"].helpers.scopedId(path8), blockParamId = !path8.depth && !scoped && this.blockParamIndex(name);
+      PathExpression: function PathExpression(path9) {
+        this.addDepth(path9.depth);
+        this.opcode("getContext", path9.depth);
+        var name = path9.parts[0], scoped = _ast2["default"].helpers.scopedId(path9), blockParamId = !path9.depth && !scoped && this.blockParamIndex(name);
         if (blockParamId) {
-          this.opcode("lookupBlockParam", blockParamId, path8.parts);
+          this.opcode("lookupBlockParam", blockParamId, path9.parts);
         } else if (!name) {
           this.opcode("pushContext");
-        } else if (path8.data) {
+        } else if (path9.data) {
           this.options.data = true;
-          this.opcode("lookupData", path8.depth, path8.parts, path8.strict);
+          this.opcode("lookupData", path9.depth, path9.parts, path9.strict);
         } else {
-          this.opcode("lookupOnContext", path8.parts, path8.falsy, path8.strict, scoped);
+          this.opcode("lookupOnContext", path9.parts, path9.falsy, path9.strict, scoped);
         }
       },
       StringLiteral: function StringLiteral(string) {
@@ -3910,16 +3910,16 @@ var require_util2 = __commonJS({
     }
     exports.urlGenerate = urlGenerate;
     function normalize(aPath) {
-      var path8 = aPath;
+      var path9 = aPath;
       var url = urlParse(aPath);
       if (url) {
         if (!url.path) {
           return aPath;
         }
-        path8 = url.path;
+        path9 = url.path;
       }
-      var isAbsolute = exports.isAbsolute(path8);
-      var parts = path8.split(/\/+/);
+      var isAbsolute = exports.isAbsolute(path9);
+      var parts = path9.split(/\/+/);
       for (var part, up = 0, i = parts.length - 1; i >= 0; i--) {
         part = parts[i];
         if (part === ".") {
@@ -3936,15 +3936,15 @@ var require_util2 = __commonJS({
           }
         }
       }
-      path8 = parts.join("/");
-      if (path8 === "") {
-        path8 = isAbsolute ? "/" : ".";
+      path9 = parts.join("/");
+      if (path9 === "") {
+        path9 = isAbsolute ? "/" : ".";
       }
       if (url) {
-        url.path = path8;
+        url.path = path9;
         return urlGenerate(url);
       }
-      return path8;
+      return path9;
     }
     exports.normalize = normalize;
     function join(aRoot, aPath) {
@@ -6727,8 +6727,8 @@ var require_printer = __commonJS({
       return this.accept(sexpr.path) + " " + params + hash;
     };
     PrintVisitor.prototype.PathExpression = function(id) {
-      var path8 = id.parts.join("/");
-      return (id.data ? "@" : "") + "PATH:" + path8;
+      var path9 = id.parts.join("/");
+      return (id.data ? "@" : "") + "PATH:" + path9;
     };
     PrintVisitor.prototype.StringLiteral = function(string) {
       return '"' + string.value + '"';
@@ -7079,8 +7079,8 @@ function getErrorMessage(error) {
 }
 
 // src/program.ts
-import { readFile as readFile5 } from "node:fs/promises";
-import path7 from "node:path";
+import { readFile as readFile6 } from "node:fs/promises";
+import path8 from "node:path";
 
 // ../common/dist/src/stdlib/json.util.js
 var import_ts_essentials = __toESM(require_dist(), 1);
@@ -11818,6 +11818,7 @@ var fieldMetadataSchema = z7.object({
   description: z7.string().describe("A description of the input parameter.").nullable(),
   typeOverride: z7.string().describe("The override for the input parameter.").nullable(),
   enumLabels: z7.record(z7.string(), z7.string()).describe("Optional map of enum values to their display labels.").optional(),
+  displayDefaultValue: z7.unknown().describe("Optional value to display when input is omitted without changing the parsed value.").optional(),
   label: z7.string().describe("Optional label override for the field.").optional(),
   allowLineBreaks: z7.boolean().describe("Whether the field should allow line breaks when supported by the input component.").optional(),
   hideEmptyInCollapsed: z7.boolean().describe("Whether to hide this field in collapsed view when empty.").optional(),
@@ -11850,6 +11851,7 @@ var clickTypeEnumSchema = z7.enum([
   "DOUBLE",
   "TRIPLE"
 ]);
+var updateModeSchema = z7.enum(["append", "prepend", "replace"]);
 var clickTypeSchema = withMetadata(clickTypeEnumSchema.optional(), {
   description: "The type of click to perform",
   typeOverride: null
@@ -11922,8 +11924,8 @@ var RENDER_TEMPLATE_ERROR_REASON_CATALOG = defineErrorReasonCatalog()([
 ]);
 var storeReferencePathPattern = String.raw`store(?:\.[$A-Z_a-z][\w$]*)*`;
 var storeReferenceMarkdownLinkTemplateRegex = new RegExp(String.raw`(?<open>\{\{\{?)\s*\[(?<path>${storeReferencePathPattern})\]\(\s*<?https?:\/\/\k<path>>?\s*\)\s*(?<close>\}\}\}?)`, "gu");
-function normalizeAutomationStoreTemplateLinkMatch([_match, open, path8]) {
-  return open === "{{{" ? `{{{${path8}}}}` : `{{${path8}}}`;
+function normalizeAutomationStoreTemplateLinkMatch([_match, open, path9]) {
+  return open === "{{{" ? `{{{${path9}}}}` : `{{${path9}}}`;
 }
 function normalizeAutomationStoreTemplateLinks(template) {
   return template.replaceAll(storeReferenceMarkdownLinkTemplateRegex, (...args) => normalizeAutomationStoreTemplateLinkMatch(args));
@@ -12491,18 +12493,18 @@ var reportStopDataSchema = z11.object({
 // ../common/dist/src/utils/automation-store-path.util.js
 var AUTOMATION_STORE_ROOT_PATH = "store";
 var relativeStorePathRegex = /^[$A-Z_a-z][\w$]*(?:\.[$A-Z_a-z][\w$]*)*$/u;
-function normalizeStoreMutationPath(path8) {
-  const trimmedPath = path8.trim();
+function normalizeStoreMutationPath(path9) {
+  const trimmedPath = path9.trim();
   const rootPrefix = `${AUTOMATION_STORE_ROOT_PATH}.`;
   const relativePath = trimmedPath.startsWith(rootPrefix) ? trimmedPath.slice(rootPrefix.length) : trimmedPath;
   if (!relativeStorePathRegex.test(relativePath)) {
     return Err({
       type: "invalid-automation-store-path",
-      path: path8,
+      path: path9,
       categories: ["customer_usage"],
       statusCode: 400,
       nonRetryable: true,
-      message: `Automation store path "${path8}" is invalid.`,
+      message: `Automation store path "${path9}" is invalid.`,
       suggestedAction: "Use a dot path relative to the automation store, such as patient.name or provider.clinic."
     });
   }
@@ -12515,16 +12517,16 @@ function findAutomationStorePathOverlap(paths) {
     ...new Set(paths.map(getCanonicalAutomationStoreMutationPath))
   ].toSorted((left, right) => (left === AUTOMATION_STORE_ROOT_PATH ? 0 : left.split(".").length) - (right === AUTOMATION_STORE_ROOT_PATH ? 0 : right.split(".").length));
   for (const [index, ancestorPath] of canonicalPaths.entries()) {
-    const descendantPath = canonicalPaths.slice(index + 1).find((path8) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path8.startsWith(`${ancestorPath}.`));
+    const descendantPath = canonicalPaths.slice(index + 1).find((path9) => ancestorPath === AUTOMATION_STORE_ROOT_PATH || path9.startsWith(`${ancestorPath}.`));
     if (descendantPath !== void 0) {
       return { ancestorPath, descendantPath };
     }
   }
   return void 0;
 }
-function getCanonicalAutomationStoreMutationPath(path8) {
-  const normalizedPath = normalizeStoreMutationPath(path8);
-  return normalizedPath._tag === "Ok" ? normalizedPath.value : path8.trim();
+function getCanonicalAutomationStoreMutationPath(path9) {
+  const normalizedPath = normalizeStoreMutationPath(path9);
+  return normalizedPath._tag === "Ok" ? normalizedPath.value : path9.trim();
 }
 
 // ../common/dist/src/constants/tool-declarations.js
@@ -12748,9 +12750,9 @@ var baseToolDeclarations = {
           path: []
         });
       }
-      const canonicalUpdatePaths = updates.map(({ path: path8 }) => getCanonicalAutomationStoreMutationPath(path8));
+      const canonicalUpdatePaths = updates.map(({ path: path9 }) => getCanonicalAutomationStoreMutationPath(path9));
       const canonicalClearPathSet = new Set(clears.map(getCanonicalAutomationStoreMutationPath));
-      const conflictedUpdatePath = canonicalUpdatePaths.find((path8) => canonicalClearPathSet.has(path8));
+      const conflictedUpdatePath = canonicalUpdatePaths.find((path9) => canonicalClearPathSet.has(path9));
       if (conflictedUpdatePath !== void 0) {
         context.addIssue({
           code: "custom",
@@ -12826,10 +12828,11 @@ var baseToolDeclarations = {
   },
   type: {
     id: "type",
-    description: "Type in the currently focused element with the given text",
+    description: "Type in the currently focused element. By default, this replaces the complete current value; updateMode can instead append or prepend the text.",
     parameters: z12.object({
       [COMMON_PARAMETERS_KEY]: DEFAULT_COMMON_PARAMETERS,
-      text: z12.string().describe("The text to type")
+      text: z12.string().describe("The text to type"),
+      updateMode: updateModeSchema.optional().describe("How to combine the text with the current value. Defaults to replace.")
     })
   },
   getNDCFromMedication: {
@@ -13429,9 +13432,9 @@ var specialCommands = {
 };
 
 // ../common/dist/src/utils/agent-knowledge-base-assets.util.js
-function getIsKnowledgeBaseAssetPathAllowed(path8) {
-  const pathSegments = path8.split("/");
-  if (path8.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
+function getIsKnowledgeBaseAssetPathAllowed(path9) {
+  const pathSegments = path9.split("/");
+  if (path9.length === 0 || pathSegments.some((segment) => segment.length === 0)) {
     return false;
   }
   const isTopLevelAssetPath = pathSegments[0] === "assets";
@@ -13473,46 +13476,46 @@ var API_FILE_TYPE_REGISTRY = {
 var ApiAgentOutputModes = ["inline", "file"];
 var API_EMBEDDED_FILE_PATH_PATTERN = /^(?:\[\*\]|[A-Za-z_$][\w$-]*)(?:\[\*\]|\.[A-Za-z_$][\w$-]*)*$/u;
 var API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN = /\[\*\]|[A-Za-z_$][\w$-]*/gu;
-function parseApiEmbeddedFilePath(path8) {
-  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path8)) {
+function parseApiEmbeddedFilePath(path9) {
+  if (!API_EMBEDDED_FILE_PATH_PATTERN.test(path9)) {
     return void 0;
   }
-  return [...path8.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
+  return [...path9.matchAll(API_EMBEDDED_FILE_PATH_SEGMENT_PATTERN)].map(([segment]) => segment === "[*]" ? { type: "arrayWildcard" } : { key: segment, type: "property" });
 }
 var apiAgentEmbeddedFileSchema = z14.object({
-  path: z14.string().trim().min(1, "Embedded file path is required.").refine((path8) => parseApiEmbeddedFilePath(path8) !== void 0, {
+  path: z14.string().trim().min(1, "Embedded file path is required.").refine((path9) => parseApiEmbeddedFilePath(path9) !== void 0, {
     message: "Embedded file path must use object properties and [*] array wildcards."
   }).describe("Path to a Base64 value relative to the projected API response. Supports object properties and [*] array wildcards."),
   contentType: z14.enum(ApiFileContentTypes).describe("File type of the decoded Base64 value.")
 }).strict();
 var apiAgentEmbeddedFilesSchema = z14.array(apiAgentEmbeddedFileSchema).superRefine((embeddedFiles, context) => {
   const paths = /* @__PURE__ */ new Set();
-  for (const [index, { path: path8 }] of embeddedFiles.entries()) {
-    if (paths.has(path8)) {
+  for (const [index, { path: path9 }] of embeddedFiles.entries()) {
+    if (paths.has(path9)) {
       context.addIssue({
         code: z14.ZodIssueCode.custom,
-        message: `Embedded file path "${path8}" can only be configured once.`,
+        message: `Embedded file path "${path9}" can only be configured once.`,
         path: [index, "path"]
       });
     }
-    paths.add(path8);
+    paths.add(path9);
   }
 }).describe("Base64 values to decode, upload as permanent files, and replace with file references in the projected API response.");
 
 // ../common/dist/src/zod-schemas/api-agent-request-file-encoding.schema.js
 import { z as z15 } from "zod";
 var API_REQUEST_FILE_PATH_PATTERN = /^[A-Za-z_$][\w$-]*(?:\.[A-Za-z_$][\w$-]*)*$/u;
-function parseApiRequestFilePath(path8) {
-  if (!API_REQUEST_FILE_PATH_PATTERN.test(path8)) {
+function parseApiRequestFilePath(path9) {
+  if (!API_REQUEST_FILE_PATH_PATTERN.test(path9)) {
     return void 0;
   }
-  return path8.split(".");
+  return path9.split(".");
 }
 var apiAgentRequestFileEncodingSchema = z15.object({
-  sourceInput: z15.string().trim().min(1, "File input is required.").refine((path8) => parseApiRequestFilePath(path8) !== void 0, {
+  sourceInput: z15.string().trim().min(1, "File input is required.").refine((path9) => parseApiRequestFilePath(path9) !== void 0, {
     message: "File input must use an object property path."
   }).describe("API Agent input containing the file reference to encode."),
-  destinationPath: z15.string().trim().min(1, "Request field is required.").refine((path8) => parseApiRequestFilePath(path8) !== void 0, {
+  destinationPath: z15.string().trim().min(1, "Request field is required.").refine((path9) => parseApiRequestFilePath(path9) !== void 0, {
     message: "Request field must use an object property path."
   }).describe("JSON request body path where the encoded value is inserted."),
   encoding: z15.literal("base64").describe("Encoding applied to the source file before insertion.")
@@ -13863,20 +13866,20 @@ function hasControlCharacter(value) {
   }
   return false;
 }
-function isNormalizedRepoPath(path8) {
-  if (path8 === "/") {
+function isNormalizedRepoPath(path9) {
+  if (path9 === "/") {
     return true;
   }
-  if (path8.length === 0 || path8.startsWith("/") || path8.startsWith("\\") || path8.includes("\\") || hasControlCharacter(path8) || windowsAbsolutePathPattern.test(path8)) {
+  if (path9.length === 0 || path9.startsWith("/") || path9.startsWith("\\") || path9.includes("\\") || hasControlCharacter(path9) || windowsAbsolutePathPattern.test(path9)) {
     return false;
   }
-  return path8.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
+  return path9.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".." && segment !== ".git");
 }
-function normalizeRepoPath(path8) {
-  if (path8 === "/") {
-    return path8;
+function normalizeRepoPath(path9) {
+  if (path9 === "/") {
+    return path9;
   }
-  return path8.replaceAll(/\/+$/gu, "");
+  return path9.replaceAll(/\/+$/gu, "");
 }
 var skillPathPattern = /^(?:skills\/.+|automations\/[^/]+\/skills\/.+|automations\/[^/]+\/agents\/[^/]+\/skills\/.+)$/u;
 var repoPathSchema = z21.string().min(1).transform(normalizeRepoPath).refine(isNormalizedRepoPath, {
@@ -13897,7 +13900,7 @@ var memoryConfigSchema = z21.object({
 }).strict().describe("Configuration for the memory runtime plugin.");
 var skillsConfigSchema = z21.object({
   enabled: z21.boolean().default(false).describe("Explicit rollout switch for the skills runtime plugin."),
-  registeredSkills: z21.array(repoPathSchema.refine((path8) => skillPathPattern.test(path8), {
+  registeredSkills: z21.array(repoPathSchema.refine((path9) => skillPathPattern.test(path9), {
     message: "Skill paths must be under root, automation, or automation-agent skills."
   })).default(() => []).describe("Repository skill root paths available to the skills plugin."),
   canEdit: z21.boolean().default(false).describe("Allows the skills runtime plugin to edit repo skills under the root skills folder.")
@@ -13921,6 +13924,7 @@ var baseAgentConfigFieldsSchema = z21.object({
   environmentOptions: environmentOptionsSchema.optional().default(DEFAULT_ENVIRONMENT_OPTION).describe("Environment configuration for the agent. Default is browser with SOM."),
   runSettings: agentRunSettingsSchema.optional().describe("Run settings persisted on the agent and used when this agent is selected as the settings source for a run while the run-settings rollout is enabled. This is the canonical runtime source for resource pools during the migration. It intentionally mirrors a subset of agent config so settings survive topology changes and can be stored on any agent regardless of that agent's own execution environment. Writers may populate this before the rollout flag is enabled, but runtime snapshotting must keep using legacy fields while the flag is disabled."),
   skipBrowserDebuggerPauses: z21.boolean().optional().describe("Legacy agent-local browser session startup setting. Used only when a run is in legacy config mode; canonical run settings mode reads runSettings.skipBrowserDebuggerPauses instead."),
+  stepFollowingVerification: z21.enum(["default", "enabled", "disabled"]).optional().describe("Controls step-following verification for this agent. Default runs verification unless skills are enabled; enabled forces it on past the skills rule; disabled forces it off. Automation and system feature gates still take precedence."),
   limitations: agentRunLimitationSchema.describe("Resource limits for this agent, including maximum duration and tool call limits."),
   commonParametersSchema: z21.custom().optional().describe("Custom schema defining metadata the agent must provide with every tool call. By default, agents provide reasoning and step information. If specified, this schema replaces the default metadata schema entirely."),
   idempotencySettings: z21.object({
@@ -14327,13 +14331,13 @@ function getMentionedStandardCommand(instructions) {
   const normalizedInstructions = instructions.toLowerCase();
   return STANDARD_COMMAND_NAMES.find((commandName) => normalizedInstructions.includes(commandName.toLowerCase())) ?? null;
 }
-function assertCustomInstructionsCommand({ commands, path: path8 }) {
-  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path8}[${commandIndex.toString()}]` }] : []);
+function assertCustomInstructionsCommand({ commands, path: path9 }) {
+  const customCommands = commands.flatMap((command, commandIndex) => command["commandName"] === "custom" ? [{ command, path: `${path9}[${commandIndex.toString()}]` }] : []);
   if (customCommands.length === 0) {
     return;
   }
   if (customCommands.length > MAX_CUSTOM_COMMAND_COUNT) {
-    throw createInvalidValueError(`${path8} contains ${customCommands.length.toString()} custom commands. Use at most one short custom command per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
+    throw createInvalidValueError(`${path9} contains ${customCommands.length.toString()} custom commands. Use at most one short custom command per agent. Split policy, decision, outreach, and multi-step work into catalog commands or child agents instead.`);
   }
   const [customCommand] = customCommands;
   if (!customCommand) {
@@ -14388,26 +14392,32 @@ function createOperationSpec(spec) {
 
 // ../mcp-registry/src/operation-specs.ts
 function stringOption({
+  clientOnly = false,
   description,
   flagName,
   inputKey,
-  required = false
+  required = false,
+  valueHint
 }) {
   return {
+    ...clientOnly ? { clientOnly: true } : {},
     description,
     flagName,
     inputKey,
     required,
+    ...valueHint ? { valueHint } : {},
     valueType: "string"
   };
 }
 function numberOption({
+  clientOnly = false,
   description,
   flagName,
   inputKey,
   required = false
 }) {
   return {
+    ...clientOnly ? { clientOnly: true } : {},
     description,
     flagName,
     inputKey,
@@ -14416,11 +14426,13 @@ function numberOption({
   };
 }
 function booleanOption({
+  clientOnly = false,
   description,
   flagName,
   inputKey
 }) {
   return {
+    ...clientOnly ? { clientOnly: true } : {},
     description,
     flagName,
     inputKey,
@@ -14458,13 +14470,79 @@ function jsonOption({
   };
 }
 var jsonObjectSchema = z25.record(z25.string(), z25.unknown());
+var evalRunStatusSchema = z25.enum([
+  "QUEUED",
+  "RUNNING",
+  "COMPLETE",
+  "FAILED",
+  "CANCELLED"
+]);
+var evalInputChoicesSchema = z25.record(
+  z25.string(),
+  z25.array(z25.unknown()).min(1)
+);
+var registeredEvalRunInputSchema = z25.object({
+  description: z25.string().min(1).optional(),
+  input: evalInputChoicesSchema,
+  maxConcurrency: z25.number().int().positive().default(1),
+  name: z25.string().min(1).optional(),
+  repeatCount: z25.number().int().positive().default(1),
+  slug: z25.string().min(1),
+  tags: z25.array(z25.string().min(1)).default([])
+});
+var registeredEvalSelection = `    slug
+    name
+    description
+    tags
+    version
+    inputSchema`;
+var evalRunSelection = `    id
+    createdAt
+    updatedAt
+    userId
+    slug
+    evalName
+    evalDescription
+    evalTags
+    evalVersion
+    input
+    name
+    description
+    tags
+    scorerSlugs
+    maxConcurrency
+    repeatCount
+    acknowledgedTrialCount
+    idempotencyKey
+    dashboardUrl
+    workflowId
+    workflowRunId
+    status
+    startedAt
+    finishedAt
+    trialStatusCounts {
+      queued
+      running
+      complete
+      failed
+      cancelled
+    }`;
+var evalRunExportSelection = `    exportId
+    evalRunId
+    status
+    workflowId
+    workflowRunId
+    fileName
+    trialCount
+    downloadUrl
+    error`;
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function validateCustomInstructionsCommands({
   commands,
   ctx,
-  path: path8
+  path: path9
 }) {
   if (!Array.isArray(commands)) {
     return;
@@ -14472,14 +14550,14 @@ function validateCustomInstructionsCommands({
   const validationResult = fromThrowable(() => {
     assertCustomInstructionsCommand({
       commands: commands.map((command) => isRecord3(command) ? command : {}),
-      path: path8.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
+      path: path9.join(".").replaceAll(/\.(?<index>\d+)/gu, "[$<index>]")
     });
   }, "invalid-custom-instructions-command");
   if (isErr(validationResult)) {
     ctx.addIssue({
       code: "custom",
       message: `${getErrorMessage2(validationResult.error.cause)} Run mgcl catalog commands to find the standard command for this work.`,
-      path: path8
+      path: path9
     });
   }
 }
@@ -14715,6 +14793,7 @@ ${agentLimitationsSelection}
       systemPrompt
       additionalSystemPrompt
       ignoreUnstableSessionState
+      stepFollowingVerification
       resourcePools {
         id
         type
@@ -14784,6 +14863,7 @@ ${agentLimitationsSelection}
       systemPrompt
       additionalSystemPrompt
       ignoreUnstableSessionState
+      stepFollowingVerification
     }
     isCurrent
   }
@@ -16980,140 +17060,770 @@ mutation UpdateAutomationById($id: ID!, $input: UpdateAutomationInput!) {
     lastSavedAt
   }
 }`
-  })
-];
-
-// src/program.ts
-import { Command as Command2, InvalidArgumentError as InvalidArgumentError2, Option as Option2 } from "commander";
-
-// src/api.ts
-import { z as z26 } from "zod";
-
-// src/version.ts
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-var packageManifestPath = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  "../package.json"
-);
-var packageManifestResult = safeJsonParse(
-  fs.readFileSync(packageManifestPath, "utf8")
-);
-if (isErr(packageManifestResult)) {
-  throw new Error(`Failed to parse ${packageManifestPath}.`, {
-    cause: packageManifestResult.error.cause
-  });
-}
-var cliPackageVersion = packageManifestResult.value.version;
-if (typeof cliPackageVersion !== "string" || cliPackageVersion.length === 0) {
-  throw new Error(`Expected a version in ${packageManifestPath}.`);
-}
-var CLI_VERSION = cliPackageVersion;
-
-// src/api.ts
-var OTTO_AUTHORIZATION_HEADER_NAME = "X-Otto-Authorization";
-var OTTO_AUTHORIZATION_ISSUER = "magical:otto";
-var workosOrganizationsResponseSchema = z26.object({
-  organizations: z26.array(
-    z26.object({
-      id: z26.string().min(1),
-      name: z26.string().min(1),
-      primaryDomain: z26.string().nullable().optional()
-    })
-  ),
-  success: z26.boolean()
-});
-var workosUserSchema = z26.object({
-  email: z26.string().nullable(),
-  id: z26.string().min(1)
-});
-var nangoIntegrationWireSchema = z26.object({
-  // eslint-disable-next-line @typescript-eslint/naming-convention -- mirrors Nango REST payload
-  unique_key: z26.string().min(1)
-}).passthrough().transform((data) => ({
-  ...data,
-  uniqueKey: data.unique_key
-}));
-var nangoIntegrationsResponseSchema = z26.array(nangoIntegrationWireSchema);
-var organizationAuthenticationSchema = z26.object({
-  id: z26.string().min(1),
-  type: z26.string().min(1),
-  connectionId: z26.string().nullable().optional(),
-  providerConfigKey: z26.string().nullable().optional(),
-  description: z26.string().nullable().optional(),
-  hostname: z26.string().nullable().optional()
-}).passthrough();
-var organizationAuthenticationsResponseSchema = z26.object({
-  authentications: z26.array(organizationAuthenticationSchema),
-  success: z26.boolean()
-});
-var graphQlResponseSchema = z26.object({
-  data: z26.record(z26.string(), z26.unknown()).optional(),
-  errors: z26.array(
-    z26.object({
-      message: z26.string().min(1)
-    })
-  ).optional()
-});
-var apiErrorResponseSchema = z26.object({
-  errors: z26.array(
-    z26.object({
-      message: z26.string().min(1)
-    })
-  ).optional(),
-  message: z26.string().min(1).optional()
-});
-function getApiErrorDetail(responseBody) {
-  const parsedResponse = apiErrorResponseSchema.safeParse(responseBody);
-  if (!parsedResponse.success) {
-    return null;
-  }
-  if (parsedResponse.data.message) {
-    return parsedResponse.data.message;
+  }),
+  createOperationSpec({
+    operationName: "ListRegisteredEvals",
+    kind: "query",
+    inputSchema: z25.object({}),
+    cli: {
+      name: "list-registered-evals",
+      path: ["evals", "list"],
+      description: "List globally registered eval definitions.",
+      resultKey: "registeredEvals",
+      options: []
+    },
+    mcp: { fileName: "registeredEvals.graphql" },
+    scope: "global",
+    document: `# List globally registered eval definitions available to the authenticated caller
+query ListRegisteredEvals {
+  registeredEvals {
+${registeredEvalSelection}
   }
-  if (!parsedResponse.data.errors || parsedResponse.data.errors.length === 0) {
-    return null;
+}`
+  }),
+  createOperationSpec({
+    operationName: "GetRegisteredEval",
+    kind: "query",
+    inputSchema: z25.object({ slug: z25.string().min(1) }),
+    cli: {
+      name: "get-registered-eval",
+      path: ["evals", "get"],
+      description: "Get one globally registered eval definition.",
+      resultKey: "registeredEval",
+      options: [
+        stringOption({
+          description: "Registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "registeredEval.graphql" },
+    scope: "global",
+    document: `# Get one globally registered eval definition by slug
+query GetRegisteredEval($slug: String!) {
+  registeredEval(slug: $slug) {
+${registeredEvalSelection}
   }
-  return parsedResponse.data.errors.map((error) => error.message).join("\n");
-}
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/u, "");
-}
-function isRecord4(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function decodeJwtPayload(token) {
-  const [, payloadSegment] = token.split(".");
-  if (!payloadSegment) {
-    return null;
+}`
+  }),
+  createOperationSpec({
+    operationName: "TestRegisteredEval",
+    kind: "mutation",
+    inputSchema: z25.object({
+      input: jsonObjectSchema,
+      slug: z25.string().min(1)
+    }),
+    cli: {
+      name: "test-registered-eval",
+      path: ["evals", "test-run"],
+      description: "Execute one registered eval input and its scorers without persistence.",
+      resultKey: "testRegisteredEval",
+      options: [
+        stringOption({
+          description: "Registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug",
+          required: true
+        }),
+        jsonOption({
+          description: "Concrete eval input object.",
+          flagName: "input-json",
+          inputKey: "input"
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Path to a JSON file containing the concrete input.",
+          flagName: "input-file",
+          inputKey: "inputFile"
+        })
+      ]
+    },
+    mcp: { fileName: "testRegisteredEval.graphql" },
+    scope: "global",
+    document: `# Execute exactly one registered eval input and its scorers without persistence or automatic retries
+# COMPLETE and FAILED execution outcomes are returned in the result body
+mutation TestRegisteredEval($slug: String!, $input: JSON!) {
+  testRegisteredEval(input: { slug: $slug, input: $input }) {
+    status
+    input
+    output
+    scores
+    error {
+      type
+      message
+    }
   }
-  const payloadResult = safeJsonParse(
-    Buffer.from(payloadSegment, "base64url").toString("utf8")
-  );
-  if (isErr(payloadResult)) {
-    return null;
+}`
+  }),
+  createOperationSpec({
+    operationName: "PlanRegisteredEvalRun",
+    kind: "query",
+    inputSchema: registeredEvalRunInputSchema,
+    cli: {
+      name: "plan-registered-eval-run",
+      path: ["evals", "plan-run"],
+      description: "Validate a registered eval run and calculate its exact trial count.",
+      resultKey: "planRegisteredEvalRun",
+      options: [
+        stringOption({
+          description: "Registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug",
+          required: true
+        }),
+        jsonOption({
+          description: "Eval input choices keyed by registered input name.",
+          flagName: "input-json",
+          inputKey: "input"
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Path to a JSON file containing eval input choices.",
+          flagName: "input-file",
+          inputKey: "inputFile"
+        }),
+        stringOption({
+          description: "Optional persisted run name.",
+          flagName: "name",
+          inputKey: "name"
+        }),
+        stringOption({
+          description: "Optional persisted run description.",
+          flagName: "description",
+          inputKey: "description"
+        }),
+        stringArrayOption({
+          description: "Persisted run tags.",
+          flagName: "tags",
+          inputKey: "tags"
+        }),
+        numberOption({
+          description: "Maximum simultaneously executing trials.",
+          flagName: "max-concurrency",
+          inputKey: "maxConcurrency"
+        }),
+        numberOption({
+          description: "Number of times to repeat each input combination.",
+          flagName: "repeat-count",
+          inputKey: "repeatCount"
+        })
+      ]
+    },
+    mcp: { fileName: "planRegisteredEvalRun.graphql" },
+    scope: "global",
+    document: `# Validate the complete proposed run and return the exact trial count without persistence
+query PlanRegisteredEvalRun(
+  $slug: String!
+  $input: JSON!
+  $name: String
+  $description: String
+  $tags: [String!]
+  $maxConcurrency: Int
+  $repeatCount: Int
+) {
+  planRegisteredEvalRun(
+    input: {
+      slug: $slug
+      input: $input
+      name: $name
+      description: $description
+      tags: $tags
+      maxConcurrency: $maxConcurrency
+      repeatCount: $repeatCount
+    }
+  ) {
+    combinationCount
+    repeatCount
+    trialCount
   }
-  return isRecord4(payloadResult.value) ? payloadResult.value : null;
-}
-function isOttoAuthorizationToken(token) {
-  return decodeJwtPayload(token)?.["iss"] === OTTO_AUTHORIZATION_ISSUER;
-}
-function applyAuthenticationHeaders({
-  accessToken,
-  allowOttoAuthorization,
-  headers,
-  impersonatedOrganizationId,
-  organizationId
-}) {
-  if (!isOttoAuthorizationToken(accessToken)) {
-    headers.set("authorization", `Bearer ${accessToken}`);
-    if (impersonatedOrganizationId) {
-      headers.set("x-organization-id", impersonatedOrganizationId);
+}`
+  }),
+  createOperationSpec({
+    operationName: "StartRegisteredEvalRun",
+    kind: "mutation",
+    inputSchema: registeredEvalRunInputSchema.extend({
+      expectedTrialCount: z25.number().int().positive(),
+      idempotencyKey: z25.string().trim().min(1)
+    }),
+    cli: {
+      name: "start-registered-eval-run",
+      path: ["evals", "run"],
+      description: "Plan, confirm, and asynchronously start a registered eval run.",
+      resultKey: "startRegisteredEvalRun",
+      options: [
+        stringOption({
+          description: "Registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug",
+          required: true
+        }),
+        jsonOption({
+          description: "Eval input choices keyed by registered input name.",
+          flagName: "input-json",
+          inputKey: "input"
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Path to a JSON file containing eval input choices.",
+          flagName: "input-file",
+          inputKey: "inputFile"
+        }),
+        stringOption({
+          description: "Optional persisted run name.",
+          flagName: "name",
+          inputKey: "name"
+        }),
+        stringOption({
+          description: "Optional persisted run description.",
+          flagName: "description",
+          inputKey: "description"
+        }),
+        stringArrayOption({
+          description: "Persisted run tags.",
+          flagName: "tags",
+          inputKey: "tags"
+        }),
+        numberOption({
+          description: "Maximum simultaneously executing trials.",
+          flagName: "max-concurrency",
+          inputKey: "maxConcurrency"
+        }),
+        numberOption({
+          description: "Number of times to repeat each input combination.",
+          flagName: "repeat-count",
+          inputKey: "repeatCount"
+        }),
+        stringOption({
+          description: "Idempotency key; generated by mgcl when omitted.",
+          flagName: "idempotency-key",
+          inputKey: "idempotencyKey"
+        }),
+        numberOption({
+          clientOnly: true,
+          description: "Explicitly acknowledge the planned trial count.",
+          flagName: "confirm-trials",
+          inputKey: "confirmTrials"
+        }),
+        booleanOption({
+          clientOnly: true,
+          description: "Wait until the persisted run reaches a terminal state.",
+          flagName: "wait",
+          inputKey: "wait"
+        })
+      ]
+    },
+    mcp: { fileName: "startRegisteredEvalRun.graphql" },
+    scope: "global",
+    document: `# Start a registered eval run after PlanRegisteredEvalRun has returned an exact count
+# MCP callers must provide a unique idempotencyKey and the planned expectedTrialCount
+mutation StartRegisteredEvalRun(
+  $slug: String!
+  $input: JSON!
+  $name: String
+  $description: String
+  $tags: [String!]
+  $maxConcurrency: Int
+  $repeatCount: Int
+  $idempotencyKey: String!
+  $expectedTrialCount: Int!
+) {
+  startRegisteredEvalRun(
+    input: {
+      slug: $slug
+      input: $input
+      name: $name
+      description: $description
+      tags: $tags
+      maxConcurrency: $maxConcurrency
+      repeatCount: $repeatCount
+      idempotencyKey: $idempotencyKey
+      expectedTrialCount: $expectedTrialCount
     }
-    return;
+  ) {
+    idempotencyKey
+    evalRunId
+    workflowId
+    workflowRunId
   }
-  if (!allowOttoAuthorization) {
+}`
+  }),
+  createOperationSpec({
+    operationName: "ListEvalRuns",
+    kind: "query",
+    inputSchema: z25.object({
+      page: z25.number().int().nonnegative().default(0),
+      pageSize: z25.number().int().min(1).max(100).default(20),
+      slug: z25.string().min(1).optional(),
+      status: evalRunStatusSchema.optional()
+    }),
+    cli: {
+      name: "list-eval-runs",
+      path: ["evals", "runs", "list"],
+      description: "List persisted eval runs with optional filters.",
+      resultKey: "evalRuns",
+      options: [
+        stringOption({
+          description: "Filter by registered eval slug.",
+          flagName: "slug",
+          inputKey: "slug"
+        }),
+        stringOption({
+          description: "Filter by eval run status.",
+          flagName: "status",
+          inputKey: "status"
+        }),
+        numberOption({
+          description: "Zero-based page number.",
+          flagName: "page",
+          inputKey: "page"
+        }),
+        numberOption({
+          description: "Page size from 1 to 100.",
+          flagName: "page-size",
+          inputKey: "pageSize"
+        })
+      ]
+    },
+    mcp: { fileName: "evalRuns.graphql" },
+    scope: "global",
+    document: `# List globally persisted eval runs with status counts and offset pagination
+query ListEvalRuns(
+  $slug: String
+  $status: EvalRunStatus
+  $page: Int
+  $pageSize: Int
+) {
+  evalRuns(slug: $slug, status: $status, page: $page, pageSize: $pageSize) {
+    items {
+${evalRunSelection}
+    }
+    total
+    page
+    pageSize
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "GetEvalRun",
+    kind: "query",
+    inputSchema: z25.object({ id: z25.string().min(1) }),
+    cli: {
+      name: "get-eval-run",
+      path: ["evals", "runs", "get"],
+      description: "Get one persisted eval run with current status counts.",
+      resultKey: "evalRun",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "evalRun.graphql" },
+    scope: "global",
+    document: `# Get one globally persisted eval run by ID
+query GetEvalRun($id: String!) {
+  evalRun(id: $id) {
+${evalRunSelection}
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "AwaitEvalRun",
+    kind: "query",
+    inputSchema: z25.object({
+      id: z25.string().min(1),
+      timeoutMs: z25.number().int().min(1e3).max(6e4).default(3e4)
+    }),
+    cli: {
+      name: "await-eval-run",
+      path: ["evals", "runs", "await"],
+      description: "Wait for an eval run by repeating bounded server long-polls.",
+      resultKey: "evalRunAwait",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Overall client wait timeout.",
+          flagName: "timeout",
+          inputKey: "timeout",
+          valueHint: "duration, for example 30s or 5m"
+        })
+      ]
+    },
+    mcp: { fileName: "evalRunAwait.graphql" },
+    scope: "global",
+    document: `# Wait up to 60 seconds for an eval run to reach COMPLETE, FAILED, or CANCELLED
+# Call again when reachedTerminal is false and a longer overall wait is needed
+query AwaitEvalRun($id: String!, $timeoutMs: Int) {
+  evalRunAwait(id: $id, timeoutMs: $timeoutMs) {
+    reachedTerminal
+    pollCount
+    elapsedMs
+    evalRun {
+${evalRunSelection}
+    }
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "ListEvalRunTrials",
+    kind: "query",
+    inputSchema: z25.object({
+      cursor: z25.string().min(1).optional(),
+      id: z25.string().min(1),
+      limit: z25.number().int().min(1).max(1e3).default(100)
+    }),
+    cli: {
+      name: "list-eval-run-trials",
+      path: ["evals", "runs", "trials"],
+      description: "List eval trials in deterministic cursor order.",
+      resultKey: "evalRunTrials",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        }),
+        numberOption({
+          description: "Maximum trials to return, from 1 to 1000.",
+          flagName: "limit",
+          inputKey: "limit"
+        }),
+        stringOption({
+          description: "Opaque cursor returned by the previous page.",
+          flagName: "cursor",
+          inputKey: "cursor"
+        })
+      ]
+    },
+    mcp: { fileName: "evalRunTrials.graphql" },
+    scope: "global",
+    document: `# List eval trials in ascending deterministic order with an opaque continuation cursor
+query ListEvalRunTrials($id: String!, $limit: Int, $cursor: String) {
+  evalRunTrials(id: $id, limit: $limit, cursor: $cursor) {
+    trials {
+      id
+      createdAt
+      updatedAt
+      evalRunId
+      repeatIndex
+      input
+      status
+      startedAt
+      finishedAt
+      scores
+      output
+      workflowId
+      workflowRunId
+    }
+    nextCursor
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "CancelEvalRun",
+    kind: "mutation",
+    inputSchema: z25.object({ id: z25.string().min(1) }),
+    cli: {
+      name: "cancel-eval-run",
+      path: ["evals", "runs", "cancel"],
+      description: "Request cancellation for a queued or running eval run.",
+      resultKey: "cancelEvalRun",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "cancelEvalRun.graphql" },
+    scope: "global",
+    document: `# Request cancellation without claiming the run has already reached CANCELLED
+mutation CancelEvalRun($id: String!) {
+  cancelEvalRun(id: $id) {
+    evalRunId
+    cancellationRequested
+    status
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "RequestEvalRunExport",
+    kind: "mutation",
+    inputSchema: z25.object({ id: z25.string().min(1) }),
+    cli: {
+      name: "request-eval-run-export",
+      path: ["evals", "runs", "export"],
+      description: "Request an asynchronous raw-results export.",
+      resultKey: "requestEvalRunExport",
+      options: [
+        stringOption({
+          description: "Eval run ID.",
+          flagName: "id",
+          inputKey: "id",
+          required: true
+        }),
+        stringOption({
+          clientOnly: true,
+          description: "Destination path for the completed export.",
+          flagName: "output",
+          inputKey: "output",
+          required: true
+        }),
+        booleanOption({
+          clientOnly: true,
+          description: "Wait for export completion and download the file.",
+          flagName: "wait",
+          inputKey: "wait"
+        }),
+        booleanOption({
+          clientOnly: true,
+          description: "Authorize replacement of an existing output file.",
+          flagName: "force",
+          inputKey: "force"
+        })
+      ]
+    },
+    mcp: { fileName: "requestEvalRunExport.graphql" },
+    scope: "global",
+    document: `# Request or reuse an asynchronous raw-results export for a terminal eval run
+mutation RequestEvalRunExport($id: String!) {
+  requestEvalRunExport(id: $id) {
+${evalRunExportSelection}
+  }
+}`
+  }),
+  createOperationSpec({
+    operationName: "GetEvalRunExport",
+    kind: "query",
+    inputSchema: z25.object({ exportId: z25.string().min(1) }),
+    cli: {
+      hidden: true,
+      name: "get-eval-run-export",
+      path: ["evals", "runs", "export-status"],
+      description: "Get asynchronous eval export status by export ID.",
+      resultKey: "evalRunExport",
+      options: [
+        stringOption({
+          description: "Eval export ID.",
+          flagName: "export-id",
+          inputKey: "exportId",
+          required: true
+        })
+      ]
+    },
+    mcp: { fileName: "evalRunExport.graphql" },
+    scope: "global",
+    document: `# Get asynchronous eval export status; downloadUrl is signed and only present when COMPLETE
+query GetEvalRunExport($exportId: String!) {
+  evalRunExport(exportId: $exportId) {
+${evalRunExportSelection}
+  }
+}`
+  })
+];
+
+// src/program.ts
+import { Command as Command2, InvalidArgumentError as InvalidArgumentError2, Option as Option2 } from "commander";
+
+// src/api.ts
+import { randomUUID } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { access, link, rename, rm } from "node:fs/promises";
+import nodePath from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { z as z26 } from "zod";
+
+// src/version.ts
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+var packageManifestPath = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../package.json"
+);
+var packageManifestResult = safeJsonParse(
+  fs.readFileSync(packageManifestPath, "utf8")
+);
+if (isErr(packageManifestResult)) {
+  throw new Error(`Failed to parse ${packageManifestPath}.`, {
+    cause: packageManifestResult.error.cause
+  });
+}
+var cliPackageVersion = packageManifestResult.value.version;
+if (typeof cliPackageVersion !== "string" || cliPackageVersion.length === 0) {
+  throw new Error(`Expected a version in ${packageManifestPath}.`);
+}
+var CLI_VERSION = cliPackageVersion;
+
+// src/api.ts
+var OTTO_AUTHORIZATION_HEADER_NAME = "X-Otto-Authorization";
+var OTTO_AUTHORIZATION_ISSUER = "magical:otto";
+var workosOrganizationsResponseSchema = z26.object({
+  organizations: z26.array(
+    z26.object({
+      id: z26.string().min(1),
+      name: z26.string().min(1),
+      primaryDomain: z26.string().nullable().optional()
+    })
+  ),
+  success: z26.boolean()
+});
+var workosUserSchema = z26.object({
+  email: z26.string().nullable(),
+  id: z26.string().min(1)
+});
+var nangoIntegrationWireSchema = z26.object({
+  // eslint-disable-next-line @typescript-eslint/naming-convention -- mirrors Nango REST payload
+  unique_key: z26.string().min(1)
+}).passthrough().transform((data) => ({
+  ...data,
+  uniqueKey: data.unique_key
+}));
+var nangoIntegrationsResponseSchema = z26.array(nangoIntegrationWireSchema);
+var organizationAuthenticationSchema = z26.object({
+  id: z26.string().min(1),
+  type: z26.string().min(1),
+  connectionId: z26.string().nullable().optional(),
+  providerConfigKey: z26.string().nullable().optional(),
+  description: z26.string().nullable().optional(),
+  hostname: z26.string().nullable().optional()
+}).passthrough();
+var organizationAuthenticationsResponseSchema = z26.object({
+  authentications: z26.array(organizationAuthenticationSchema),
+  success: z26.boolean()
+});
+var graphQlResponseSchema = z26.object({
+  data: z26.record(z26.string(), z26.unknown()).nullable().optional(),
+  errors: z26.array(
+    z26.object({
+      extensions: z26.object({
+        code: z26.string().min(1).optional()
+      }).passthrough().optional(),
+      message: z26.string().min(1)
+    })
+  ).optional()
+});
+var apiErrorResponseSchema = z26.object({
+  errors: z26.array(
+    z26.object({
+      message: z26.string().min(1)
+    })
+  ).optional(),
+  message: z26.string().min(1).optional()
+});
+function getApiErrorDetail(responseBody) {
+  const parsedResponse = apiErrorResponseSchema.safeParse(responseBody);
+  if (!parsedResponse.success) {
+    return null;
+  }
+  if (parsedResponse.data.message) {
+    return parsedResponse.data.message;
+  }
+  if (!parsedResponse.data.errors || parsedResponse.data.errors.length === 0) {
+    return null;
+  }
+  return parsedResponse.data.errors.map((error) => error.message).join("\n");
+}
+var DEFINITIVE_GRAPHQL_APPLICATION_ERROR_CODES = /* @__PURE__ */ new Set([
+  "BAD_REQUEST",
+  "BAD_USER_INPUT",
+  "FORBIDDEN",
+  "GRAPHQL_PARSE_FAILED",
+  "GRAPHQL_VALIDATION_FAILED",
+  "NOT_FOUND",
+  "OPERATION_RESOLUTION_FAILURE",
+  "PERSISTED_QUERY_NOT_FOUND",
+  "PERSISTED_QUERY_NOT_SUPPORTED",
+  "UNAUTHORIZED"
+]);
+var GraphQlResponseError = class extends CliError {
+  graphQlCodes;
+  hasUnclassifiedGraphQlErrors;
+  constructor(message, {
+    graphQlCodes,
+    hasUnclassifiedGraphQlErrors = false
+  }) {
+    super(message);
+    this.name = "GraphQlResponseError";
+    this.graphQlCodes = [...graphQlCodes];
+    this.hasUnclassifiedGraphQlErrors = hasUnclassifiedGraphQlErrors;
+  }
+};
+function isDefinitiveGraphQlApplicationError(error) {
+  return error instanceof GraphQlResponseError && !error.hasUnclassifiedGraphQlErrors && error.graphQlCodes.length > 0 && error.graphQlCodes.every(
+    (code) => DEFINITIVE_GRAPHQL_APPLICATION_ERROR_CODES.has(code)
+  );
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/u, "");
+}
+function isFileAlreadyExistsError(error) {
+  return error instanceof Error && "code" in error && error.code === "EEXIST";
+}
+async function assertOutputDoesNotExist(outputPath) {
+  const outputExists = await access(outputPath).then(() => true).catch((error) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw new CliError(`Failed to inspect export path "${outputPath}".`, {
+      cause: error
+    });
+  });
+  if (outputExists) {
+    throw new CliError(
+      `Refusing to overwrite existing file "${outputPath}". Pass --force to authorize replacement.`
+    );
+  }
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeJwtPayload(token) {
+  const [, payloadSegment] = token.split(".");
+  if (!payloadSegment) {
+    return null;
+  }
+  const payloadResult = safeJsonParse(
+    Buffer.from(payloadSegment, "base64url").toString("utf8")
+  );
+  if (isErr(payloadResult)) {
+    return null;
+  }
+  return isRecord4(payloadResult.value) ? payloadResult.value : null;
+}
+function isOttoAuthorizationToken(token) {
+  return decodeJwtPayload(token)?.["iss"] === OTTO_AUTHORIZATION_ISSUER;
+}
+function applyAuthenticationHeaders({
+  accessToken,
+  allowOttoAuthorization,
+  headers,
+  impersonatedOrganizationId,
+  organizationId
+}) {
+  if (!isOttoAuthorizationToken(accessToken)) {
+    headers.set("authorization", `Bearer ${accessToken}`);
+    if (impersonatedOrganizationId) {
+      headers.set("x-organization-id", impersonatedOrganizationId);
+    }
+    return;
+  }
+  if (!allowOttoAuthorization) {
     throw new CliError(
       "Otto authorization is only supported for GraphQL requests."
     );
@@ -17133,11 +17843,11 @@ function createMagicalApiClient({
     accessToken,
     impersonatedOrganizationId,
     allowOttoAuthorization,
-    path: path8,
+    path: path9,
     init,
     organizationId
   }) {
-    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path8}`;
+    const url = `${trimTrailingSlash(await resolveApiBaseUrl())}${path9}`;
     const headers = new Headers(init?.headers);
     applyAuthenticationHeaders({
       accessToken,
@@ -17182,6 +17892,51 @@ function createMagicalApiClient({
     return responseBody;
   }
   return {
+    async downloadFile({ outputPath, overwrite = false, url }) {
+      if (!overwrite) {
+        await assertOutputDoesNotExist(outputPath);
+      }
+      const temporaryPath = nodePath.join(
+        nodePath.dirname(outputPath),
+        `.${nodePath.basename(outputPath)}.${randomUUID()}.tmp`
+      );
+      await (async () => {
+        const response = await fetchFn(url).catch((error) => {
+          throw new CliError("Failed to download eval export.", {
+            cause: error
+          });
+        });
+        if (!response.ok) {
+          throw new CliError(
+            `Eval export download failed with status ${response.status}.`
+          );
+        }
+        if (!response.body) {
+          throw new CliError("Eval export download returned an empty body.");
+        }
+        await pipeline(
+          Readable.fromWeb(response.body),
+          createWriteStream(temporaryPath, { flags: "wx" })
+        );
+        if (overwrite) {
+          await rename(temporaryPath, outputPath);
+          return;
+        }
+        await link(temporaryPath, outputPath).catch((error) => {
+          if (isFileAlreadyExistsError(error)) {
+            throw new CliError(
+              `Refusing to overwrite existing file "${outputPath}". Pass --force to authorize replacement.`,
+              { cause: error }
+            );
+          }
+          throw error;
+        });
+        await rm(temporaryPath, { force: true });
+      })().catch(async (error) => {
+        await rm(temporaryPath, { force: true });
+        throw error;
+      });
+    },
     async executeGraphQl({
       accessToken,
       impersonatedOrganizationId,
@@ -17213,8 +17968,15 @@ function createMagicalApiClient({
         throw new CliError("GraphQL response payload was invalid.");
       }
       if (parsedResponse.data.errors && parsedResponse.data.errors.length > 0) {
-        throw new CliError(
-          parsedResponse.data.errors.map((error) => error.message).join("\n")
+        const graphQlCodes = parsedResponse.data.errors.flatMap(
+          (error) => error.extensions?.code ? [error.extensions.code] : []
+        );
+        throw new GraphQlResponseError(
+          parsedResponse.data.errors.map((error) => error.message).join("\n"),
+          {
+            graphQlCodes,
+            hasUnclassifiedGraphQlErrors: graphQlCodes.length !== parsedResponse.data.errors.length
+          }
         );
       }
       return parsedResponse.data.data?.[resultKey] ?? null;
@@ -17372,7 +18134,7 @@ function requireWorkosClientId(config) {
 }
 
 // src/settings.ts
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm as rm2, writeFile } from "node:fs/promises";
 import path3 from "node:path";
 import { z as z27 } from "zod";
 var cliSettingsSchema = z27.object({
@@ -17431,7 +18193,7 @@ function createFileSettingsStore(stateFilePath) {
     },
     async save(settings) {
       if (!hasCliSettingsOverrides(settings)) {
-        await rm(settingsFilePath, { force: true });
+        await rm2(settingsFilePath, { force: true });
         return;
       }
       await mkdir(path3.dirname(settingsFilePath), { recursive: true });
@@ -17520,6 +18282,7 @@ var rootOperationalGroupDescriptions = /* @__PURE__ */ new Map([
   ["automations", "Manage automations."],
   ["automation-runs", "Inspect and control automation runs."],
   ["catalog", "Inspect available commands, models, and tools."],
+  ["evals", "Discover registered evals and manage eval runs."],
   ["graphql", "Inspect GraphQL metadata."],
   ["skills", "Inspect and update root-level Workplace skills."]
 ]);
@@ -17549,11 +18312,498 @@ function createOperationHelpExamples(operationSpec) {
   const baseInvocation = [baseCommand, ...requiredOptions].join(" ");
   return [
     baseInvocation,
-    `${baseInvocation} --org <org>`,
+    ...operationSpec.scope === "global" ? [] : [`${baseInvocation} --org <org>`],
     `${baseInvocation} --json`
   ];
 }
 
+// src/eval-commands.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { access as access2, readFile as readFile2 } from "node:fs/promises";
+import path4 from "node:path";
+import { createInterface } from "node:readline/promises";
+import { z as z28 } from "zod";
+var MAX_AWAIT_REQUEST_MS = 6e4;
+var MIN_AWAIT_REQUEST_MS = 1e3;
+var EXPORT_POLL_INTERVAL_MS = 1e3;
+var evalRunStatusSchema2 = z28.enum([
+  "QUEUED",
+  "RUNNING",
+  "COMPLETE",
+  "FAILED",
+  "CANCELLED"
+]);
+var awaitResultSchema = z28.object({
+  elapsedMs: z28.number().nonnegative(),
+  evalRun: z28.object({
+    id: z28.string().min(1),
+    status: evalRunStatusSchema2
+  }).passthrough(),
+  pollCount: z28.number().int().nonnegative(),
+  reachedTerminal: z28.boolean()
+}).passthrough();
+var planResultSchema = z28.object({ trialCount: z28.number().int().nonnegative() }).passthrough();
+var startResultSchema = z28.object({
+  evalRunId: z28.string().min(1),
+  idempotencyKey: z28.string().min(1),
+  workflowId: z28.string().min(1),
+  workflowRunId: z28.string().min(1)
+}).passthrough();
+var exportResultSchema = z28.object({
+  downloadUrl: z28.string().min(1).nullable().optional(),
+  evalRunId: z28.string().min(1),
+  exportId: z28.string().min(1),
+  status: z28.enum(["QUEUED", "RUNNING", "COMPLETE", "FAILED"])
+}).passthrough();
+var inputOptionsSchema = z28.object({
+  inputFile: z28.string().min(1).optional(),
+  inputJson: z28.unknown().optional()
+});
+var commonRunOptionsSchema = inputOptionsSchema.extend({
+  description: z28.string().min(1).optional(),
+  maxConcurrency: z28.number().int().positive().optional(),
+  name: z28.string().min(1).optional(),
+  repeatCount: z28.number().int().positive().optional(),
+  slug: z28.string().min(1),
+  tags: z28.array(z28.string().min(1)).optional()
+});
+function parseApiResult(value, schema, label) {
+  const parsedResult = schema.safeParse(value);
+  if (!parsedResult.success) {
+    throw new CliError(`${label} returned an invalid response.`);
+  }
+  return parsedResult.data;
+}
+async function parseInputFile({
+  inputFile,
+  workingDirectory
+}) {
+  const inputPath = path4.resolve(workingDirectory, inputFile);
+  const contents = await readFile2(inputPath, "utf8").catch(
+    (error) => {
+      throw new CliError(`Failed to read eval input file "${inputPath}".`, {
+        cause: error
+      });
+    }
+  );
+  const parsedJson = safeJsonParseWithoutLogging(contents);
+  if (isErr(parsedJson)) {
+    throw new CliError(
+      `Eval input file "${inputPath}" must contain valid JSON.`,
+      { cause: parsedJson.error }
+    );
+  }
+  return parsedJson.value;
+}
+async function resolveEvalInput({
+  inputFile,
+  inputJson,
+  workingDirectory
+}) {
+  const inputSourceCount = Number(inputFile !== void 0) + Number(inputJson !== void 0);
+  if (inputSourceCount !== 1) {
+    throw new CliError(
+      "Pass exactly one of --input-file or --input-json for eval input."
+    );
+  }
+  const input = inputFile === void 0 ? inputJson : await parseInputFile({ inputFile, workingDirectory });
+  const parsedInput = z28.record(z28.string(), z28.unknown()).safeParse(input);
+  if (!parsedInput.success) {
+    throw new CliError("Eval input must be a JSON object.");
+  }
+  return parsedInput.data;
+}
+async function resolveEvalInputFromOptions({
+  inputFile,
+  inputJson,
+  workingDirectory
+}) {
+  return await resolveEvalInput({
+    ...inputFile === void 0 ? {} : { inputFile },
+    ...inputJson === void 0 ? {} : { inputJson },
+    workingDirectory
+  });
+}
+function buildCommonRunVariables({
+  input,
+  options
+}) {
+  return {
+    input,
+    slug: options.slug,
+    ...options.description === void 0 ? {} : { description: options.description },
+    ...options.maxConcurrency === void 0 ? {} : { maxConcurrency: options.maxConcurrency },
+    ...options.name === void 0 ? {} : { name: options.name },
+    ...options.repeatCount === void 0 ? {} : { repeatCount: options.repeatCount },
+    ...options.tags === void 0 ? {} : { tags: options.tags }
+  };
+}
+function parseDurationMs(value) {
+  const match = /^(?<amount>\d+(?:\.\d+)?)(?<unit>ms|s|m|h)$/iu.exec(
+    value.trim()
+  );
+  const amount = Number(match?.groups?.["amount"]);
+  const multiplierByUnit = { h: 36e5, m: 6e4, ms: 1, s: 1e3 };
+  const parsedUnit = z28.enum(["h", "m", "ms", "s"]).safeParse(match?.groups?.["unit"]?.toLowerCase());
+  const durationMs = parsedUnit.success ? amount * multiplierByUnit[parsedUnit.data] : Number.NaN;
+  if (!Number.isSafeInteger(durationMs) || durationMs < MIN_AWAIT_REQUEST_MS) {
+    throw new CliError(
+      "Expected --timeout to be a duration of at least 1s, such as 30s, 5m, or 1h."
+    );
+  }
+  return durationMs;
+}
+function quotePosixShellArgument(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+async function defaultConfirm(question) {
+  const prompt = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const answer = await prompt.question(`${question} [y/N] `).finally(() => {
+    prompt.close();
+  });
+  return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+}
+function terminalExitError(result) {
+  const { id, status } = result.evalRun;
+  if (status === "FAILED" || status === "CANCELLED") {
+    return new CliError(`Eval run "${id}" finished with status ${status}.`);
+  }
+  return void 0;
+}
+async function awaitEvalRun({
+  evalRunId,
+  executeOperation,
+  now: now2,
+  timeoutMs
+}) {
+  const deadline = timeoutMs === void 0 ? void 0 : now2() + timeoutMs;
+  let previousResult = void 0;
+  for (; ; ) {
+    const remainingMs = deadline === void 0 ? void 0 : deadline - now2();
+    if (remainingMs !== void 0 && remainingMs < MIN_AWAIT_REQUEST_MS) {
+      return {
+        exitError: new CliError(
+          `Timed out waiting for eval run "${evalRunId}".`
+        ),
+        result: previousResult ?? {
+          elapsedMs: timeoutMs ?? 0,
+          evalRun: { id: evalRunId, status: "QUEUED" },
+          pollCount: 0,
+          reachedTerminal: false
+        }
+      };
+    }
+    const requestTimeoutMs = Math.min(
+      MAX_AWAIT_REQUEST_MS,
+      remainingMs ?? MAX_AWAIT_REQUEST_MS
+    );
+    const result = parseApiResult(
+      // eslint-disable-next-line no-await-in-loop -- each long-poll must finish before the next bounded request begins
+      await executeOperation("AwaitEvalRun", {
+        id: evalRunId,
+        timeoutMs: requestTimeoutMs
+      }),
+      awaitResultSchema,
+      "Eval run await"
+    );
+    if (result.reachedTerminal) {
+      const exitError = terminalExitError(result);
+      return { ...exitError ? { exitError } : {}, result };
+    }
+    previousResult = result;
+  }
+}
+async function assertExportOutputAvailable({
+  force,
+  outputPath
+}) {
+  if (force) {
+    return;
+  }
+  const exists = await access2(outputPath).then(() => true).catch((error) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      return false;
+    }
+    throw new CliError(`Failed to inspect export path "${outputPath}".`, {
+      cause: error
+    });
+  });
+  if (exists) {
+    throw new CliError(
+      `Refusing to overwrite existing file "${outputPath}". Pass --force to authorize replacement.`
+    );
+  }
+}
+async function finishExport({
+  downloadFile,
+  exportResult,
+  force,
+  outputPath
+}) {
+  if (exportResult.status === "FAILED") {
+    return {
+      exitError: new CliError(`Eval export "${exportResult.exportId}" failed.`),
+      result: exportResult
+    };
+  }
+  if (exportResult.status !== "COMPLETE") {
+    return { result: exportResult };
+  }
+  if (!exportResult.downloadUrl) {
+    throw new CliError(
+      `Completed eval export "${exportResult.exportId}" did not include a download URL.`
+    );
+  }
+  if (!downloadFile) {
+    throw new CliError("Eval export download is not configured.");
+  }
+  await downloadFile({
+    outputPath,
+    overwrite: force,
+    url: exportResult.downloadUrl
+  });
+  const { downloadUrl: _downloadUrl, ...downloadedExport } = exportResult;
+  return { result: { ...downloadedExport, outputPath } };
+}
+async function pollExport({
+  executeOperation,
+  exportId,
+  sleep
+}) {
+  for (; ; ) {
+    await sleep(EXPORT_POLL_INTERVAL_MS);
+    const result = parseApiResult(
+      // eslint-disable-next-line no-await-in-loop -- do not overlap signed-export status requests
+      await executeOperation("GetEvalRunExport", { exportId }),
+      exportResultSchema,
+      "Eval export status"
+    );
+    if (result.status !== "QUEUED" && result.status !== "RUNNING") {
+      return result;
+    }
+  }
+}
+async function executeTestRegisteredEval({
+  executeOperation,
+  options,
+  workingDirectory
+}) {
+  const parsedOptions = commonRunOptionsSchema.pick({ slug: true }).merge(inputOptionsSchema).parse(options);
+  const input = await resolveEvalInputFromOptions({
+    ...parsedOptions,
+    workingDirectory
+  });
+  return {
+    result: await executeOperation("TestRegisteredEval", {
+      input,
+      slug: parsedOptions.slug
+    })
+  };
+}
+async function executePlanRegisteredEvalRun({
+  executeOperation,
+  options,
+  workingDirectory
+}) {
+  const parsedOptions = commonRunOptionsSchema.parse(options);
+  const input = await resolveEvalInputFromOptions({
+    ...parsedOptions,
+    workingDirectory
+  });
+  return {
+    result: await executeOperation(
+      "PlanRegisteredEvalRun",
+      buildCommonRunVariables({ input, options: parsedOptions })
+    )
+  };
+}
+async function confirmPlannedTrialCount({
+  confirm,
+  confirmedTrialCount,
+  isInteractive,
+  json,
+  trialCount
+}) {
+  if (confirmedTrialCount !== void 0) {
+    if (confirmedTrialCount !== trialCount) {
+      throw new CliError(
+        `Planned ${trialCount} trials, but --confirm-trials was ${confirmedTrialCount}.`
+      );
+    }
+    return;
+  }
+  if (json || !isInteractive) {
+    throw new CliError(
+      `This run will start ${trialCount} trials. Pass --confirm-trials ${trialCount} in non-interactive mode.`
+    );
+  }
+  const confirmed = await confirm(`Start ${trialCount} eval trials?`);
+  if (confirmed) {
+    return;
+  }
+  throw new CliError("Eval run cancelled before starting.");
+}
+async function executeStartRegisteredEvalRun({
+  executeOperation,
+  options,
+  runtime,
+  workingDirectory
+}) {
+  const parsedOptions = commonRunOptionsSchema.extend({
+    confirmTrials: z28.number().int().positive().optional(),
+    idempotencyKey: z28.string().trim().min(1).optional(),
+    json: z28.boolean().optional(),
+    wait: z28.boolean().optional()
+  }).parse(options);
+  const input = await resolveEvalInputFromOptions({
+    ...parsedOptions,
+    workingDirectory
+  });
+  const commonVariables = buildCommonRunVariables({
+    input,
+    options: parsedOptions
+  });
+  const plan = parseApiResult(
+    await executeOperation("PlanRegisteredEvalRun", commonVariables),
+    planResultSchema,
+    "Eval run plan"
+  );
+  await confirmPlannedTrialCount({
+    confirm: runtime.confirm ?? defaultConfirm,
+    ...parsedOptions.confirmTrials === void 0 ? {} : { confirmedTrialCount: parsedOptions.confirmTrials },
+    isInteractive: runtime.isInteractive?.() ?? (process.stdin.isTTY && process.stdout.isTTY),
+    json: parsedOptions.json === true,
+    trialCount: plan.trialCount
+  });
+  const idempotencyKey = parsedOptions.idempotencyKey ?? `mgcl-eval-${(runtime.randomUuid ?? randomUUID2)()}`;
+  const start = await executeOperation("StartRegisteredEvalRun", {
+    ...commonVariables,
+    expectedTrialCount: plan.trialCount,
+    idempotencyKey
+  }).catch((error) => {
+    if (isDefinitiveGraphQlApplicationError(error)) {
+      throw error;
+    }
+    throw new CliError(
+      `${getErrorMessage(error)}
+If execution was accepted, retry with --idempotency-key ${quotePosixShellArgument(idempotencyKey)} to resolve the request safely.`,
+      { cause: error }
+    );
+  });
+  const parsedStart = parseApiResult(
+    start,
+    startResultSchema,
+    "Eval run start"
+  );
+  if (parsedOptions.wait !== true) {
+    return { result: parsedStart };
+  }
+  const awaited = await awaitEvalRun({
+    evalRunId: parsedStart.evalRunId,
+    executeOperation,
+    now: runtime.now ?? Date.now
+  });
+  return {
+    ...awaited.exitError ? { exitError: awaited.exitError } : {},
+    result: { ...parsedStart, await: awaited.result }
+  };
+}
+async function executeAwaitEvalRun({
+  executeOperation,
+  options,
+  runtime
+}) {
+  const parsedOptions = z28.object({ id: z28.string().min(1), timeout: z28.string().optional() }).parse(options);
+  return await awaitEvalRun({
+    evalRunId: parsedOptions.id,
+    executeOperation,
+    now: runtime.now ?? Date.now,
+    ...parsedOptions.timeout ? { timeoutMs: parseDurationMs(parsedOptions.timeout) } : {}
+  });
+}
+async function defaultSleep(milliseconds) {
+  await new Promise((resolve) => {
+    setTimeout(resolve, milliseconds);
+  });
+}
+async function executeRequestEvalRunExport({
+  executeOperation,
+  options,
+  runtime,
+  workingDirectory
+}) {
+  const parsedOptions = z28.object({
+    force: z28.boolean().optional(),
+    id: z28.string().min(1),
+    output: z28.string().min(1),
+    wait: z28.boolean().optional()
+  }).parse(options);
+  const outputPath = path4.resolve(workingDirectory, parsedOptions.output);
+  const force = parsedOptions.force === true;
+  const shouldWait = parsedOptions.wait === true;
+  if (shouldWait) {
+    await assertExportOutputAvailable({ force, outputPath });
+  }
+  const requestedExport = parseApiResult(
+    await executeOperation("RequestEvalRunExport", { id: parsedOptions.id }),
+    exportResultSchema,
+    "Eval export request"
+  );
+  if (!shouldWait) {
+    return { result: requestedExport };
+  }
+  const exportResult = requestedExport.status === "QUEUED" || requestedExport.status === "RUNNING" ? await pollExport({
+    executeOperation,
+    exportId: requestedExport.exportId,
+    sleep: runtime.sleep ?? defaultSleep
+  }) : requestedExport;
+  if (exportResult.status === "QUEUED" || exportResult.status === "RUNNING") {
+    return { result: exportResult };
+  }
+  return await finishExport({
+    ...runtime.downloadFile ? { downloadFile: runtime.downloadFile } : {},
+    exportResult,
+    force,
+    outputPath
+  });
+}
+async function executeEvalCliOperation({
+  executeOperation,
+  operationName,
+  options,
+  runtime = {}
+}) {
+  const handlerInput = {
+    executeOperation,
+    options,
+    runtime,
+    workingDirectory: runtime.workingDirectory ?? process.cwd()
+  };
+  switch (operationName) {
+    case "TestRegisteredEval": {
+      return await executeTestRegisteredEval(handlerInput);
+    }
+    case "PlanRegisteredEvalRun": {
+      return await executePlanRegisteredEvalRun(handlerInput);
+    }
+    case "StartRegisteredEvalRun": {
+      return await executeStartRegisteredEvalRun(handlerInput);
+    }
+    case "AwaitEvalRun": {
+      return await executeAwaitEvalRun(handlerInput);
+    }
+    case "RequestEvalRunExport": {
+      return await executeRequestEvalRunExport(handlerInput);
+    }
+    default: {
+      return null;
+    }
+  }
+}
+
 // src/keychain.ts
 function buildKeychainAccountName(account) {
   return `${account.clientId}:${account.userId}`;
@@ -17620,7 +18870,7 @@ function resolveOpenCommand(url) {
 }
 
 // src/program-session.ts
-import { readFile as readFile2, rm as rm2 } from "node:fs/promises";
+import { readFile as readFile3, rm as rm3 } from "node:fs/promises";
 async function withOrgScopedAccessToken({
   dependencies,
   organizationId,
@@ -17633,6 +18883,35 @@ async function withOrgScopedAccessToken({
   if (directAccessToken) {
     return { accessToken: directAccessToken };
   }
+  return await refreshAccessToken({
+    dependencies,
+    organizationId,
+    state
+  });
+}
+async function withGlobalAccessToken({
+  authenticationOrganizationId,
+  dependencies,
+  state
+}) {
+  const directAccessToken = await loadDirectAccessToken({
+    dependencies,
+    organizationId: authenticationOrganizationId
+  });
+  if (directAccessToken) {
+    return { accessToken: directAccessToken };
+  }
+  return await refreshAccessToken({
+    dependencies,
+    organizationId: authenticationOrganizationId,
+    state
+  });
+}
+async function refreshAccessToken({
+  dependencies,
+  organizationId,
+  state
+}) {
   const refreshToken = await dependencies.refreshTokenStore.load(state.account);
   if (!refreshToken) {
     throw new CliError(
@@ -17664,7 +18943,7 @@ async function clearDirectAccessToken(runtimeConfig) {
   if (!runtimeConfig.accessTokenFilePath) {
     return;
   }
-  await rm2(runtimeConfig.accessTokenFilePath, { force: true });
+  await rm3(runtimeConfig.accessTokenFilePath, { force: true });
 }
 async function loadDirectAccessToken({
   dependencies,
@@ -17674,7 +18953,7 @@ async function loadDirectAccessToken({
   if (!accessTokenFilePath) {
     return null;
   }
-  const accessTokenFileContents = await readFile2(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
+  const accessTokenFileContents = await readFile3(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
     }
@@ -17701,7 +18980,7 @@ async function loadDirectAccessToken({
     }
     return null;
   }
-  if (claims.org_id && claims.org_id !== organizationId) {
+  if (organizationId !== void 0 && claims.org_id && claims.org_id !== organizationId) {
     throw new CliError(
       `The current Otto session is authenticated for organization "${claims.org_id}", not "${organizationId}". Start a new Otto session from the desired organization.`
     );
@@ -17718,7 +18997,7 @@ function isExpiredAccessTokenClaims(claims) {
 // src/self-update.ts
 import { spawn as spawn2 } from "node:child_process";
 import fs2 from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var CLI_PACKAGE_NAME = "@getmagical/cli";
 var DEFAULT_CLI_DIST_TAG2 = "latest";
@@ -17729,9 +19008,9 @@ function resolveInstalledPackageRoot({
   packageName
 }) {
   const packagePathSegments = packageName.split("/");
-  let currentPath = path4.dirname(entryFilePath);
+  let currentPath = path5.dirname(entryFilePath);
   for (; ; ) {
-    const currentPathSegments = currentPath.split(path4.sep).filter(Boolean);
+    const currentPathSegments = currentPath.split(path5.sep).filter(Boolean);
     const currentPackageSegments = currentPathSegments.slice(
       -packagePathSegments.length
     );
@@ -17740,7 +19019,7 @@ function resolveInstalledPackageRoot({
     )) {
       return currentPath;
     }
-    const parentPath = path4.dirname(currentPath);
+    const parentPath = path5.dirname(currentPath);
     if (parentPath === currentPath) {
       return null;
     }
@@ -17750,14 +19029,14 @@ function resolveInstalledPackageRoot({
 function resolveInstallPrefixFromPackageRoot(packageRootPath) {
   let currentPath = packageRootPath;
   for (; ; ) {
-    if (path4.basename(currentPath) === "node_modules") {
-      const nodeModulesParentPath = path4.dirname(currentPath);
-      if (path4.basename(nodeModulesParentPath) === "lib") {
-        return path4.dirname(nodeModulesParentPath);
+    if (path5.basename(currentPath) === "node_modules") {
+      const nodeModulesParentPath = path5.dirname(currentPath);
+      if (path5.basename(nodeModulesParentPath) === "lib") {
+        return path5.dirname(nodeModulesParentPath);
       }
       return nodeModulesParentPath;
     }
-    const parentPath = path4.dirname(currentPath);
+    const parentPath = path5.dirname(currentPath);
     if (parentPath === currentPath) {
       return null;
     }
@@ -17774,13 +19053,13 @@ function resolveManagedNpmCommand(installPrefix) {
   if (process.platform === "win32") {
     return null;
   }
-  const managedNodeExecutable = path4.join(
+  const managedNodeExecutable = path5.join(
     installPrefix,
     MANAGED_NODE_SUBPATH,
     "bin",
     "node"
   );
-  const managedNpmCli = path4.join(
+  const managedNpmCli = path5.join(
     installPrefix,
     MANAGED_NODE_SUBPATH,
     "lib",
@@ -17979,20 +19258,20 @@ ${formatExamples("Examples", [
 
 // src/skills-working-copy.ts
 import { execFile } from "node:child_process";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomUUID as randomUUID3 } from "node:crypto";
 import {
   lstat,
   mkdir as mkdir2,
   mkdtemp,
-  readFile as readFile3,
+  readFile as readFile4,
   readdir,
-  rename,
-  rm as rm3,
+  rename as rename2,
+  rm as rm4,
   writeFile as writeFile2
 } from "node:fs/promises";
 import os2 from "node:os";
-import path5 from "node:path";
-import { z as z28 } from "zod";
+import path6 from "node:path";
+import { z as z29 } from "zod";
 var SKILLS_ROOT_PATH = "skills";
 var METADATA_DIRECTORY_NAME = "skill-working-copies";
 var MAX_GIT_OUTPUT_BYTES = 10 * 1024 * 1024;
@@ -18001,40 +19280,40 @@ var FULL_COMMIT_SHA_PATTERN = /^[\dA-Fa-f]{40}$/u;
 var UTF8_ENCODER = new TextEncoder();
 var WINDOWS_RESERVED_PATH_CHARACTER_PATTERN = /[<>:"|?*]/u;
 var WINDOWS_RESERVED_PATH_NAME_PATTERN = /^(?:AUX|CON|NUL|PRN|COM[1-9]|LPT[1-9])(?:\..*)?$/iu;
-var skillBundleSchema = z28.object({
-  files: z28.array(
-    z28.object({
-      content: z28.string(),
-      encoding: z28.literal("base64"),
-      path: z28.string().min(1),
-      size: z28.number().int().nonnegative()
+var skillBundleSchema = z29.object({
+  files: z29.array(
+    z29.object({
+      content: z29.string(),
+      encoding: z29.literal("base64"),
+      path: z29.string().min(1),
+      size: z29.number().int().nonnegative()
     })
   ),
-  path: z28.string().min(1),
-  ref: z28.string().regex(FULL_COMMIT_SHA_PATTERN)
+  path: z29.string().min(1),
+  ref: z29.string().regex(FULL_COMMIT_SHA_PATTERN)
 });
-var skillsApplyPatchResultSchema = z28.object({
-  changedFiles: z28.array(
-    z28.object({ path: z28.string().min(1), status: z28.string().min(1) })
+var skillsApplyPatchResultSchema = z29.object({
+  changedFiles: z29.array(
+    z29.object({ path: z29.string().min(1), status: z29.string().min(1) })
   ),
-  commit: z28.string().regex(FULL_COMMIT_SHA_PATTERN),
-  ok: z28.boolean(),
-  ref: z28.string().min(1)
+  commit: z29.string().regex(FULL_COMMIT_SHA_PATTERN),
+  ok: z29.boolean(),
+  ref: z29.string().min(1)
 }).refine((result) => result.ok, {
   message: "Skills patch result was not successful."
 });
-var workingCopyMetadataSchema = z28.object({
-  version: z28.literal(1),
-  files: z28.array(
-    z28.object({
-      content: z28.string(),
-      path: z28.string().min(1)
+var workingCopyMetadataSchema = z29.object({
+  version: z29.literal(1),
+  files: z29.array(
+    z29.object({
+      content: z29.string(),
+      path: z29.string().min(1)
     })
   ),
-  organizationId: z28.string().min(1),
-  requestedRef: z28.string().min(1).nullable(),
-  skillPath: z28.string().min(1),
-  workingCopyPath: z28.string().min(1)
+  organizationId: z29.string().min(1),
+  requestedRef: z29.string().min(1).nullable(),
+  skillPath: z29.string().min(1),
+  workingCopyPath: z29.string().min(1)
 });
 function hasControlCharacter2(value) {
   return UTF8_ENCODER.encode(value).some((byte) => byte <= 31 || byte === 127);
@@ -18062,12 +19341,12 @@ function normalizeRootSkillPath(skill) {
   return `${SKILLS_ROOT_PATH}/${skillName}`;
 }
 function resolveWorkingCopyPath(workingDirectory, skillPath) {
-  return path5.resolve(workingDirectory, ...skillPath.split("/"));
+  return path6.resolve(workingDirectory, ...skillPath.split("/"));
 }
 function resolveMetadataPath(stateFilePath, workingCopyPath) {
   const key = createHash("sha256").update(workingCopyPath).digest("hex");
-  return path5.join(
-    path5.dirname(stateFilePath),
+  return path6.join(
+    path6.dirname(stateFilePath),
     METADATA_DIRECTORY_NAME,
     `${key}.json`
   );
@@ -18095,7 +19374,7 @@ function metadataFilesToSnapshot(files) {
   );
 }
 async function loadMetadata(metadataPath) {
-  const fileContents = await readFile3(metadataPath, "utf8").catch(
+  const fileContents = await readFile4(metadataPath, "utf8").catch(
     (error) => {
       if (isMissingFileError(error)) {
         return null;
@@ -18119,13 +19398,13 @@ async function loadMetadata(metadataPath) {
   return parsed.data;
 }
 async function saveMetadata(metadataPath, metadata) {
-  await mkdir2(path5.dirname(metadataPath), { recursive: true });
-  const temporaryPath = `${metadataPath}.${randomUUID()}.tmp`;
+  await mkdir2(path6.dirname(metadataPath), { recursive: true });
+  const temporaryPath = `${metadataPath}.${randomUUID3()}.tmp`;
   await writeFile2(temporaryPath, `${JSON.stringify(metadata, null, 2)}
 `, {
     mode: 384
   });
-  await rename(temporaryPath, metadataPath);
+  await rename2(temporaryPath, metadataPath);
 }
 function assertSafeRelativeFilePath(relativePath) {
   const segments = relativePath.split("/");
@@ -18196,7 +19475,7 @@ async function readDirectorySnapshot({
         const nextSegments = [...segments, entry.name];
         const relativePath = nextSegments.join("/");
         assertSafeRelativeFilePath(relativePath);
-        const filePath = path5.join(currentDirectory, entry.name);
+        const filePath = path6.join(currentDirectory, entry.name);
         if (entry.isDirectory()) {
           return await visit(filePath, nextSegments);
         }
@@ -18205,7 +19484,7 @@ async function readDirectorySnapshot({
             `Skill working copy contains unsupported entry "${filePath}". Only regular files and directories are allowed.`
           );
         }
-        return [[`${skillPath}/${relativePath}`, await readFile3(filePath)]];
+        return [[`${skillPath}/${relativePath}`, await readFile4(filePath)]];
       })
     );
     return nestedEntries.flat();
@@ -18231,8 +19510,8 @@ async function writeSnapshotContents(rootPath, snapshot, prefix) {
     [...snapshot.entries()].map(async ([filePath, content]) => {
       const relativePath = prefix === null ? filePath : filePath.slice(`${prefix}/`.length);
       assertSafeRelativeFilePath(relativePath);
-      const targetPath = path5.join(rootPath, ...relativePath.split("/"));
-      await mkdir2(path5.dirname(targetPath), { recursive: true });
+      const targetPath = path6.join(rootPath, ...relativePath.split("/"));
+      await mkdir2(path6.dirname(targetPath), { recursive: true });
       await writeFile2(targetPath, content);
     })
   );
@@ -18242,42 +19521,42 @@ async function replaceWorkingCopy({
   skillPath,
   workingCopyPath
 }) {
-  const parentPath = path5.dirname(workingCopyPath);
+  const parentPath = path6.dirname(workingCopyPath);
   await mkdir2(parentPath, { recursive: true });
-  const temporaryPath = path5.join(
+  const temporaryPath = path6.join(
     parentPath,
-    `.mgcl-${path5.basename(workingCopyPath)}-${randomUUID()}.tmp`
+    `.mgcl-${path6.basename(workingCopyPath)}-${randomUUID3()}.tmp`
   );
-  const backupPath = `${workingCopyPath}.${randomUUID()}.bak`;
+  const backupPath = `${workingCopyPath}.${randomUUID3()}.bak`;
   await mkdir2(temporaryPath);
   const prepareResult = await fromThrowable(async () => {
     await writeSnapshotContents(temporaryPath, snapshot, skillPath);
     const hadExistingWorkingCopy = await pathExists(workingCopyPath);
     if (hadExistingWorkingCopy) {
-      await rename(workingCopyPath, backupPath);
+      await rename2(workingCopyPath, backupPath);
     }
     return hadExistingWorkingCopy;
   }, "skills-working-copy-replace-failed");
   if (isErr(prepareResult)) {
-    await rm3(temporaryPath, { force: true, recursive: true });
+    await rm4(temporaryPath, { force: true, recursive: true });
     throw new CliError("Failed to replace the skill working copy.", {
       cause: prepareResult.error.cause
     });
   }
   const activationResult = await fromThrowable(async () => {
-    await rename(temporaryPath, workingCopyPath);
+    await rename2(temporaryPath, workingCopyPath);
   }, "skills-working-copy-activation-failed");
   if (isErr(activationResult)) {
     if (prepareResult.value) {
-      await rename(backupPath, workingCopyPath);
+      await rename2(backupPath, workingCopyPath);
     }
-    await rm3(temporaryPath, { force: true, recursive: true });
+    await rm4(temporaryPath, { force: true, recursive: true });
     throw new CliError("Failed to activate the new skill working copy.", {
       cause: activationResult.error.cause
     });
   }
   if (prepareResult.value) {
-    await rm3(backupPath, { force: true, recursive: true });
+    await rm4(backupPath, { force: true, recursive: true });
   }
 }
 async function runGit(arguments_, cwd, allowedExitCodes = [0]) {
@@ -18317,7 +19596,7 @@ async function clearDirectoryExceptGit(directoryPath) {
   const entries = await readdir(directoryPath);
   await Promise.all(
     entries.filter((entry) => entry !== ".git").map(async (entry) => {
-      await rm3(path5.join(directoryPath, entry), {
+      await rm4(path6.join(directoryPath, entry), {
         force: true,
         recursive: true
       });
@@ -18329,7 +19608,7 @@ async function createPatch(before, after) {
     return "";
   }
   const repositoryPath = await mkdtemp(
-    path5.join(os2.tmpdir(), "mgcl-skills-diff-")
+    path6.join(os2.tmpdir(), "mgcl-skills-diff-")
   );
   const patchResult = await fromThrowable(async () => {
     await runGit(["init", "--quiet"], repositoryPath);
@@ -18372,7 +19651,7 @@ async function createPatch(before, after) {
     );
     return result.stdout.toString("utf8");
   }, "skills-patch-generation-failed");
-  await rm3(repositoryPath, { force: true, recursive: true });
+  await rm4(repositoryPath, { force: true, recursive: true });
   if (isErr(patchResult)) {
     throw patchResult.error.cause;
   }
@@ -18580,7 +19859,7 @@ async function pushSkillWorkingCopy({
   assertTextPatch(patchContents);
   const applyResult = await fromThrowable(
     async () => await context.api.applyPatch({
-      idempotencyKey: `mgcl-skills-${randomUUID()}`,
+      idempotencyKey: `mgcl-skills-${randomUUID3()}`,
       message: message ?? `Update ${workingCopy.skillPath} via mgcl`,
       patch: patchContents
     }),
@@ -18651,34 +19930,34 @@ async function pushSkillWorkingCopy({
 }
 
 // src/state.ts
-import { mkdir as mkdir3, readFile as readFile4, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
-import path6 from "node:path";
-import { z as z29 } from "zod";
-var cliAccountSchema = z29.object({
-  clientId: z29.string().min(1),
-  email: z29.string().nullable(),
-  userId: z29.string().min(1)
+import { mkdir as mkdir3, readFile as readFile5, rm as rm5, writeFile as writeFile3 } from "node:fs/promises";
+import path7 from "node:path";
+import { z as z30 } from "zod";
+var cliAccountSchema = z30.object({
+  clientId: z30.string().min(1),
+  email: z30.string().nullable(),
+  userId: z30.string().min(1)
 });
-var cliOrganizationSchema = z29.object({
-  id: z29.string().min(1),
-  name: z29.string().min(1),
-  primaryDomain: z29.string().nullable().default(null)
+var cliOrganizationSchema = z30.object({
+  id: z30.string().min(1),
+  name: z30.string().min(1),
+  primaryDomain: z30.string().nullable().default(null)
 });
-var cliStateSchema = z29.object({
+var cliStateSchema = z30.object({
   account: cliAccountSchema,
-  defaultOrgId: z29.string().nullable(),
-  lastUsedOrgId: z29.string().nullable(),
-  organizations: z29.array(cliOrganizationSchema)
+  defaultOrgId: z30.string().nullable(),
+  lastUsedOrgId: z30.string().nullable(),
+  organizations: z30.array(cliOrganizationSchema)
 });
-var refreshTokenFileSchema = z29.record(z29.string(), z29.string());
+var refreshTokenFileSchema = z30.record(z30.string(), z30.string());
 function createFileStateStore(stateFilePath) {
   return {
     async clear() {
-      await rm4(stateFilePath, { force: true });
+      await rm5(stateFilePath, { force: true });
     },
     async load() {
       try {
-        const fileContents = await readFile4(stateFilePath, "utf8");
+        const fileContents = await readFile5(stateFilePath, "utf8");
         const parsed = cliStateSchema.safeParse(JSON.parse(fileContents));
         if (!parsed.success) {
           throw new CliError("Stored CLI state is invalid.");
@@ -18695,7 +19974,7 @@ function createFileStateStore(stateFilePath) {
       }
     },
     async save(state) {
-      await mkdir3(path6.dirname(stateFilePath), { recursive: true });
+      await mkdir3(path7.dirname(stateFilePath), { recursive: true });
       await writeFile3(stateFilePath, `${JSON.stringify(state, null, 2)}
 `);
     }
@@ -18704,7 +19983,7 @@ function createFileStateStore(stateFilePath) {
 function createFileRefreshTokenStore(refreshTokenFilePath) {
   async function loadRefreshTokens() {
     try {
-      const fileContents = await readFile4(refreshTokenFilePath, "utf8");
+      const fileContents = await readFile5(refreshTokenFilePath, "utf8");
       const parsed = refreshTokenFileSchema.safeParse(JSON.parse(fileContents));
       if (!parsed.success) {
         throw new CliError("Stored refresh tokens are invalid.");
@@ -18723,7 +20002,7 @@ function createFileRefreshTokenStore(refreshTokenFilePath) {
     }
   }
   async function saveRefreshTokens(refreshTokens) {
-    await mkdir3(path6.dirname(refreshTokenFilePath), { recursive: true });
+    await mkdir3(path7.dirname(refreshTokenFilePath), { recursive: true });
     await writeFile3(
       refreshTokenFilePath,
       `${JSON.stringify(refreshTokens, null, 2)}
@@ -18740,7 +20019,7 @@ function createFileRefreshTokenStore(refreshTokenFilePath) {
         )
       );
       if (Object.keys(nextRefreshTokens).length === 0) {
-        await rm4(refreshTokenFilePath, { force: true });
+        await rm5(refreshTokenFilePath, { force: true });
         return;
       }
       await saveRefreshTokens(nextRefreshTokens);
@@ -18761,37 +20040,37 @@ function buildRefreshTokenKey(account) {
 }
 
 // src/workos-auth.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
 function buildFormHeaders() {
   const headers = new Headers();
   headers.set("content-type", "application/x-www-form-urlencoded");
   return headers;
 }
-var deviceAuthorizationSchema = z30.object({
-  device_code: z30.string().min(1),
-  expires_in: z30.number().int().positive().optional(),
-  interval: z30.number().int().positive().optional(),
-  user_code: z30.string().min(1),
-  verification_uri: z30.url(),
-  verification_uri_complete: z30.url().optional()
+var deviceAuthorizationSchema = z31.object({
+  device_code: z31.string().min(1),
+  expires_in: z31.number().int().positive().optional(),
+  interval: z31.number().int().positive().optional(),
+  user_code: z31.string().min(1),
+  verification_uri: z31.url(),
+  verification_uri_complete: z31.url().optional()
 });
-var tokenResponseSchema = z30.object({
-  access_token: z30.string().min(1),
-  expires_in: z30.number().int().positive().optional(),
-  refresh_token: z30.string().min(1),
-  token_type: z30.string().optional()
+var tokenResponseSchema = z31.object({
+  access_token: z31.string().min(1),
+  expires_in: z31.number().int().positive().optional(),
+  refresh_token: z31.string().min(1),
+  token_type: z31.string().optional()
 });
-var tokenErrorSchema = z30.object({
-  error: z30.string().min(1),
-  error_description: z30.string().optional()
+var tokenErrorSchema = z31.object({
+  error: z31.string().min(1),
+  error_description: z31.string().optional()
 });
-var accessTokenClaimsSchema = z30.object({
-  exp: z30.number().int().positive().optional(),
-  iss: z30.string().min(1).optional(),
-  org_id: z30.string().min(1).optional(),
-  sid: z30.string().min(1).optional(),
-  sub: z30.string().min(1)
+var accessTokenClaimsSchema = z31.object({
+  exp: z31.number().int().positive().optional(),
+  iss: z31.string().min(1).optional(),
+  org_id: z31.string().min(1).optional(),
+  sid: z31.string().min(1).optional(),
+  sub: z31.string().min(1)
 });
 function createWorkosAuthClient({
   fetchFn = fetch,
@@ -19044,6 +20323,9 @@ function requireApiClientMethod(apiClient, key) {
 function collectOperationVariables(operationSpec, options) {
   const variables = Object.fromEntries(
     operationSpec.cli.options.flatMap((optionSpec) => {
+      if (optionSpec.clientOnly) {
+        return [];
+      }
       const optionValue = options[buildCommandOptionProperty(optionSpec.flagName)];
       if (optionValue === void 0) {
         return [];
@@ -19051,6 +20333,9 @@ function collectOperationVariables(operationSpec, options) {
       return [[optionSpec.inputKey, optionValue]];
     })
   );
+  return parseOperationVariables(operationSpec, variables);
+}
+function parseOperationVariables(operationSpec, variables) {
   const parsedVariables = operationSpec.inputSchema.safeParse(variables);
   if (!parsedVariables.success) {
     throw new CliError(
@@ -19130,6 +20415,14 @@ async function handleSelfUpdate(dependencies, options) {
   );
 }
 async function handleOperationCommand(dependencies, operationSpec, commandOptions) {
+  if (operationSpec.scope === "global") {
+    await handleGlobalOperationCommand(
+      dependencies,
+      operationSpec,
+      commandOptions
+    );
+    return;
+  }
   const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({
     dependencies,
     options: commandOptions
@@ -19153,16 +20446,89 @@ async function handleOperationCommand(dependencies, operationSpec, commandOption
   }
   dependencies.io.info(formatHumanReadableOutput(result));
 }
-function getSkillsOperation(operationName) {
+function getOperation(operationName) {
   const operationSpec = operationSpecs.find(
     (candidate) => candidate.operationName === operationName
   );
   if (!operationSpec) {
+    throw new CliError(`Operation "${operationName}" is not registered.`);
+  }
+  return operationSpec;
+}
+async function withGlobalOperationAccessToken({
+  dependencies
+}) {
+  const state = requireLoggedInState(await dependencies.stateStore.load());
+  const directAccessTokenOrganizationId = await resolveDirectAccessTokenOrganizationId({ dependencies });
+  const authenticationOrganizationId = directAccessTokenOrganizationId ?? state.defaultOrgId ?? state.lastUsedOrgId ?? state.organizations[0]?.id;
+  if (!authenticationOrganizationId) {
     throw new CliError(
-      `Skills operation "${operationName}" is not registered.`
+      'No organization is available for authentication. Run "mgcl auth login" again.'
     );
   }
-  return operationSpec;
+  const { accessToken } = await withGlobalAccessToken({
+    authenticationOrganizationId,
+    dependencies,
+    state
+  });
+  const usesOttoAuthorization = (() => {
+    try {
+      return dependencies.authClient.decodeAccessTokenClaims(accessToken).iss === "magical:otto";
+    } catch {
+      return false;
+    }
+  })();
+  return {
+    accessToken,
+    ...usesOttoAuthorization ? { organizationId: authenticationOrganizationId } : {}
+  };
+}
+async function handleGlobalOperationCommand(dependencies, operationSpec, commandOptions) {
+  const { accessToken, organizationId } = await withGlobalOperationAccessToken({
+    dependencies
+  });
+  const executeOperation = async (operationName, variables) => {
+    const nextOperationSpec = getOperation(operationName);
+    if (nextOperationSpec.scope !== "global") {
+      throw new CliError(
+        `Global operation "${operationName}" cannot execute an organization-scoped operation.`
+      );
+    }
+    return await dependencies.apiClient.executeGraphQl({
+      accessToken,
+      ...organizationId ? { organizationId } : {},
+      query: nextOperationSpec.document,
+      resultKey: nextOperationSpec.cli.resultKey,
+      variables: parseOperationVariables(nextOperationSpec, variables)
+    });
+  };
+  const customResult = await executeEvalCliOperation({
+    executeOperation,
+    operationName: operationSpec.operationName,
+    options: commandOptions,
+    runtime: {
+      ...dependencies.evalCommandRuntime,
+      ...dependencies.apiClient.downloadFile ? { downloadFile: dependencies.apiClient.downloadFile } : {},
+      workingDirectory: dependencies.evalCommandRuntime?.workingDirectory ?? dependencies.workingDirectory ?? process.cwd()
+    }
+  });
+  const commandResult = customResult ?? {
+    result: await executeOperation(
+      operationSpec.operationName,
+      collectOperationVariables(operationSpec, commandOptions)
+    )
+  };
+  writeCommandOutput({
+    dependencies,
+    json: commandOptions.json,
+    result: commandResult.result
+  });
+  if (commandResult.exitError) {
+    throw commandResult.exitError;
+  }
+}
+function getSkillsOperation(operationName) {
+  return getOperation(operationName);
 }
 async function withSkillsWorkingCopyContext(dependencies, options) {
   const { accessToken, impersonatedOrganizationId, organization, state } = await withSelectedOrganizationAndAccessToken({ dependencies, options });
@@ -19420,7 +20786,7 @@ async function resolveDirectAccessTokenOrganizationId({
   if (!accessTokenFilePath) {
     return null;
   }
-  const accessToken = await readFile5(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
+  const accessToken = await readFile6(accessTokenFilePath, "utf8").then((value) => value.trim()).catch((error) => {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return null;
     }
@@ -19452,6 +20818,9 @@ function addRegistryOperationCommand({
   dependencies,
   operationSpec
 }) {
+  if (operationSpec.cli.hidden) {
+    return;
+  }
   const commandPath = [...operationSpec.cli.path];
   const leafCommandName = commandPath.pop();
   if (!leafCommandName) {
@@ -19488,12 +20857,16 @@ function addRegistryOperationCommand({
   configureOperationalCommand(legacyAliasCommand, dependencies, operationSpec);
 }
 function configureOperationalCommand(command, dependencies, operationSpec) {
-  command.description(operationSpec.cli.description).addOption(
-    new Option2(
-      "--org <org>",
-      "Organization ID or exact organization name to use."
-    ).helpGroup("Shared options:")
-  ).addHelpText(
+  command.description(operationSpec.cli.description);
+  if (operationSpec.scope !== "global") {
+    command.addOption(
+      new Option2(
+        "--org <org>",
+        "Organization ID or exact organization name to use."
+      ).helpGroup("Shared options:")
+    );
+  }
+  command.addHelpText(
     "after",
     `
 ${formatExamples(
@@ -19532,12 +20905,12 @@ function createConsoleIo() {
 function createDefaultDependencies() {
   const runtimeConfig = getRuntimeConfig();
   const settingsStore = createFileSettingsStore(runtimeConfig.stateFilePath);
-  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path7.join(
-    path7.dirname(runtimeConfig.stateFilePath),
+  const accessTokenFilePath = runtimeConfig.accessTokenFilePath ?? path8.join(
+    path8.dirname(runtimeConfig.stateFilePath),
     CLI_ACCESS_TOKEN_FILE_NAME
   );
-  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path7.join(
-    path7.dirname(runtimeConfig.stateFilePath),
+  const refreshTokenFilePath = runtimeConfig.refreshTokenFilePath ?? path8.join(
+    path8.dirname(runtimeConfig.stateFilePath),
     CLI_REFRESH_TOKEN_FILE_NAME
   );
   const selfUpdateOptions = {